RPAA compliance now means evidence, not just registration. Canada's Retail Payment Activities Act (RPAA) has moved firmly from registration into ongoing supervision by the Bank of Canada, and the Bank's August 2026 guidance shows what registered payment service providers (PSPs) must be able to prove.
On 14 August 2026, the Bank of Canada published new answers to frequently asked questions about retail payments supervision. For payment service providers subject to the RPAA, the guidance provides important practical detail on safeguarding end-user funds, annual reporting, senior officers and third-party service providers.
One requirement deserves particular attention. Where a PSP relies on an express trust to safeguard customer funds, the Bank says that as part of its supervisory assessment it will request a written legal opinion explaining how a valid trust arrangement has been established.
For payment businesses that have focused primarily on obtaining registration, the message is clear: RPAA compliance does not end when the business appears on the Bank of Canada's register. Our guide to Bank of Canada RPAA registration covers the registration stage.
| Topic | What the Bank of Canada says | What the PSP should hold |
|---|---|---|
| Express trust | The Bank will request a written legal opinion during its assessment | A legal opinion under common law or the Civil Code of Quebec, with risks and fixes |
| Deposit insurance | Not sufficient on its own | A trust, or a segregated account with insurance or a guarantee |
| Trust account use | Use only for safeguarding; settle from a separate account | Documented fund flows that match the trust terms |
| Annual report | Due by 31 March each year, covering the previous calendar year | Mapped data for incidents, safeguarding, operations and finances |
| Senior officer | Need not live in Canada or be a direct employee | Evidence of seniority, authority and reporting line |
| Banks as third parties | A bank can be a third-party service provider | A completed third-party risk assessment that includes banks |
What has changed under the RPAA in 2026?
The RPAA establishes a federal supervisory regime for payment service providers performing specified retail payment activities in Canada.
The latest Bank of Canada guidance does not replace the legislation or create an entirely new regime. Instead, it clarifies how important parts of that regime will work in practice.
The guidance addresses questions including:
- who can act as a PSP's senior officer
- when the annual report must be submitted
- what the annual report will cover
- when banks and other financial institutions are third-party service providers
- whether deposit insurance is sufficient for safeguarding
- what the Bank expects where funds are safeguarded through an express trust
- how trust accounts should be operated
- how insurance and guarantees can be used for safeguarding
These points should now form part of the compliance planning of registered Canadian PSPs and overseas payment businesses operating within the Canadian perimeter.
When is the first RPAA annual report due?
A registered PSP's annual report is due by 31 March each year. The first reports, covering calendar year 2025, were due by 31 March 2026. PSPs registered between 9 and 30 March 2026 had until 28 April 2026. The next report, covering 2026, is due by 31 March 2027.
Each report generally covers the previous calendar year. Financial metrics are based on the PSP's most recent financial year end.
The reporting form is posted in PSP Connect, the Bank's online portal, before each deadline.
The annual report will cover matters including operational risk and incident response, safeguarding of end-user funds where applicable, and information and metrics concerning the PSP's retail payment activities.
This means firms should not wait until March 2027 to check whether the underlying records exist. The reporting requirement should be mapped to operational, financial, safeguarding and incident-management data now so that the information can be produced accurately and consistently.
Does an RPAA PSP using a trust need a legal opinion?
This is one of the most significant practical points in the Bank's latest guidance.
Where a PSP safeguards end-user funds using an express trust, the Bank states that during its supervisory assessment it will request a written legal opinion describing how a valid express trust arrangement has been established under common law or the Civil Code of Quebec.
The Bank also expects the opinion to describe and assess risks or challenges relating to the validity of the trust or compliance with the RPAA safeguarding requirements, together with how those risks have been or will be addressed.
For PSPs using the trust route, this should therefore be treated as a substantive supervisory requirement rather than a documentation exercise to address only if the Bank raises questions.
A PSP should ensure that its contractual arrangements, account structure, trust documentation and actual operational practices support the conclusions contained in the legal opinion.
Is holding customer money at an insured Canadian bank enough?
No.
The Bank has expressly clarified that federal or provincial deposit insurance by itself does not satisfy the RPAA safeguarding requirement.
Deposit insurance is designed principally to address the insolvency of the financial institution holding the account. The RPAA safeguarding regime is concerned with protecting end users if the PSP itself becomes insolvent.
A PSP cannot therefore assume that placing customer funds with a CDIC member institution automatically satisfies its RPAA safeguarding obligations.
Businesses holding end-user funds need a safeguarding structure that meets the specific requirements of the RPAA and Retail Payment Activities Regulations. The Bank has shown it will act on this. In February 2026 it issued a temporary compliance order to a registered PSP, citing failure to safeguard end-user funds.
Can a PSP use its trust account for settlement?
A PSP can safeguard end-user funds through a qualifying trust arrangement, but the integrity of that trust needs to be maintained.
The Bank's guidance states that, as best practice, a PSP should not use the trust account to pay expenses other than trust expenses. It should also settle obligations to payment networks or financial institutions from a separate account.
This is operationally important. A legally well-drafted trust structure can still create regulatory problems if day-to-day treasury and settlement practices are inconsistent with the intended safeguarding arrangement.
PSPs should therefore review not only their trust documentation but also how funds actually enter, move through and leave the relevant accounts.
Who can be the senior officer of a Canadian PSP?
The Bank's guidance also clarifies the senior officer requirement.
The definition can cover specified senior management positions, including a chief executive officer, chief operating officer, president, chief risk officer, chief financial officer and other persons performing similar functions.
Importantly for international groups, the Bank confirms that the senior officer does not have to reside in Canada.
The individual also does not necessarily have to be directly employed by the PSP. For example, a person employed by a parent company could potentially qualify where that person performs the relevant senior role for the PSP. The Bank's guidance ties this to the reporting line: a person who is not a direct employee can qualify where they report directly to the board, the chief executive officer or the chief operating officer.
The appointment should nevertheless reflect the person's actual responsibilities. Firms should be able to demonstrate why the selected individual falls within the statutory definition and how the individual exercises appropriate oversight.
Can a bank be an RPAA third-party service provider?
Yes.
A bank or other regulated financial institution may itself constitute a third-party service provider where it provides a service related to the PSP's payment functions.
Examples can include providing accounts, safeguarding end-user funds, facilitating settlement or providing operational or technological support relevant to the payment activity.
The fact that the provider is itself a regulated financial institution does not remove the PSP's responsibilities.
The PSP remains accountable for managing the risks arising from the arrangement and must conduct the required assessment of its third-party service providers.
This is particularly relevant to PSPs whose operating models depend heavily on sponsor banks, safeguarding banks, payment processors, technology providers or other infrastructure partners.
What should Canadian PSPs do now?
Registered PSPs should use the Bank's latest guidance as a prompt for a focused RPAA compliance review.
In practice, firms should examine whether their safeguarding arrangements operate as intended, whether any required trust legal opinion is ready or can be produced, and whether customer money flows are consistent with the safeguarding structure.
They should also map the information required for the annual report, confirm that the appointed senior officer meets the regulatory definition and update their third-party risk assessment to include relevant banks and financial institutions where appropriate.
The important point is that these requirements are interconnected. A safeguarding arrangement that looks compliant on paper may still fail if account operation, third-party arrangements, governance or record keeping do not support it.
RPAA registration and ongoing compliance are different exercises
Obtaining registration under the RPAA is only the beginning of the Canadian federal payments compliance lifecycle.
The Bank of Canada's latest guidance shows what supervision is likely to look like in practice: evidence of effective risk management, defensible safeguarding arrangements, accurate reporting, appropriate governance and documentation capable of supporting the PSP's regulatory position.
For payment businesses, the sensible approach is to test these arrangements before the Bank does.
Regulatory Counsel advises payment service providers on Canadian regulatory requirements, including RPAA readiness, safeguarding structures, regulatory documentation and ongoing compliance support. Many RPAA firms also need Canada MSB registration with FINTRAC, which is a separate anti-money laundering registration. Ask us for a written proposal. We respond to every enquiry the same business day with a written proposal.
Frequently asked questions
The Retail Payment Activities Act is Canada's federal framework for supervising payment service providers performing specified retail payment activities. The Bank of Canada is responsible for supervising PSPs within the regime.
The annual report is due by 31 March each year and covers the previous calendar year. The first reports, covering 2025, were due by 31 March 2026. The report covering 2026 is due by 31 March 2027.
Where a PSP safeguards end-user funds using an express trust, the Bank of Canada says that during its supervisory assessment it will request a written legal opinion addressing the validity of the trust arrangement and relevant safeguarding risks.
No. The Bank has confirmed that simply holding funds with an institution covered by federal or provincial deposit insurance is not sufficient because the RPAA safeguarding requirements are intended to protect end users if the PSP itself becomes insolvent.
No. The Bank of Canada's guidance confirms that the senior officer does not need to reside in Canada. Depending on the circumstances, the individual may also be employed by another group entity provided they perform a role falling within the regulatory definition.
No. RPAA registration with the Bank of Canada and money services business registration with FINTRAC are separate regimes. Many PSPs need both.
The Bank of Canada can issue compliance orders. In February 2026 it issued a temporary order to a registered PSP requiring it to stop retail payment activities, citing failure to safeguard end-user funds.
Operational risk and incident management, safeguarding of end-user funds, significant change and incident reporting, financial information and record keeping, together with metrics on the PSP's retail payment activities.
Definitive guides on this topic
The permanent reference pages this article relates to.