Canada's Retail Payment Activities Act has moved firmly from registration into ongoing supervision.
On 14 August 2026, the Bank of Canada published new answers to frequently asked questions about retail payments supervision. For payment service providers subject to the RPAA, the guidance provides important practical detail on safeguarding end-user funds, annual reporting, senior officers and third-party service providers.
One requirement deserves particular attention. Where a PSP relies on an express trust to safeguard customer funds, the Bank says that as part of its supervisory assessment it will request a written legal opinion explaining how a valid trust arrangement has been established.
For payment businesses that have focused primarily on obtaining registration, the message is clear: RPAA compliance does not end when the business appears on the Bank of Canada's register.
What has changed under the RPAA in 2026?
The RPAA establishes a federal supervisory regime for payment service providers performing specified retail payment activities in Canada.
The latest Bank of Canada guidance does not replace the legislation or create an entirely new regime. Instead, it clarifies how important parts of that regime will work in practice.
The guidance addresses questions including:
- who can act as a PSP's senior officer
- when the annual report must be submitted
- what the annual report will cover
- when banks and other financial institutions are third-party service providers
- whether deposit insurance is sufficient for safeguarding
- what the Bank expects where funds are safeguarded through an express trust
- how trust accounts should be operated
- how insurance and guarantees can be used for safeguarding
These points should now form part of the compliance planning of registered Canadian PSPs and overseas payment businesses operating within the Canadian perimeter.
When is the first RPAA annual report due?
A registered PSP's annual report is due by 31 March each year.
The Bank has confirmed that the first annual report will generally contain information relating to the previous calendar year, meaning 2025 for the first reporting cycle. Financial metrics are based on the PSP's most recent information according to its financial year end.
The reporting form will be made available through PSP Connect.
The annual report will cover matters including operational risk and incident response, safeguarding of end-user funds where applicable, and information and metrics concerning the PSP's retail payment activities.
This means firms should not wait until March to determine whether the underlying records exist. The reporting requirement should be mapped to operational, financial, safeguarding and incident-management data now so that the information can be produced accurately and consistently.
Does an RPAA PSP using a trust need a legal opinion?
This is one of the most significant practical points in the Bank's latest guidance.
Where a PSP safeguards end-user funds using an express trust, the Bank states that during its supervisory assessment it will request a written legal opinion describing how a valid express trust arrangement has been established under common law or the Civil Code of Quebec.
The Bank also expects the opinion to describe and assess risks or challenges relating to the validity of the trust or compliance with the RPAA safeguarding requirements, together with how those risks have been or will be addressed.
For PSPs using the trust route, this should therefore be treated as a substantive supervisory requirement rather than a documentation exercise to address only if the Bank raises questions.
A PSP should ensure that its contractual arrangements, account structure, trust documentation and actual operational practices support the conclusions contained in the legal opinion.
Is holding customer money at an insured Canadian bank enough?
No.
The Bank has expressly clarified that federal or provincial deposit insurance by itself does not satisfy the RPAA safeguarding requirement.
Deposit insurance is designed principally to address the insolvency of the financial institution holding the account. The RPAA safeguarding regime is concerned with protecting end users if the PSP itself becomes insolvent.
A PSP cannot therefore assume that placing customer funds with a CDIC member institution automatically satisfies its RPAA safeguarding obligations.
Businesses holding end-user funds need a safeguarding structure that meets the specific requirements of the RPAA and Retail Payment Activities Regulations.
Can a PSP use its trust account for settlement?
A PSP can safeguard end-user funds through a qualifying trust arrangement, but the integrity of that trust needs to be maintained.
The Bank's guidance states that, as best practice, a PSP should not use the trust account to pay expenses other than trust expenses. It should also settle obligations to payment networks or financial institutions from a separate account.
This is operationally important. A legally well-drafted trust structure can still create regulatory problems if day-to-day treasury and settlement practices are inconsistent with the intended safeguarding arrangement.
PSPs should therefore review not only their trust documentation but also how funds actually enter, move through and leave the relevant accounts.
Who can be the senior officer of a Canadian PSP?
The Bank's guidance also clarifies the senior officer requirement.
The definition can cover specified senior management positions, including a chief executive officer, chief operating officer, president, chief risk officer, chief financial officer and other persons performing similar functions.
Importantly for international groups, the Bank confirms that the senior officer does not have to reside in Canada.
The individual also does not necessarily have to be directly employed by the PSP. For example, a person employed by a parent company could potentially qualify where that person performs the relevant senior role for the PSP.
The appointment should nevertheless reflect the person's actual responsibilities. Firms should be able to demonstrate why the selected individual falls within the statutory definition and how the individual exercises appropriate oversight.
Can a bank be an RPAA third-party service provider?
Yes.
A bank or other regulated financial institution may itself constitute a third-party service provider where it provides a service related to the PSP's payment functions.
Examples can include providing accounts, safeguarding end-user funds, facilitating settlement or providing operational or technological support relevant to the payment activity.
The fact that the provider is itself a regulated financial institution does not remove the PSP's responsibilities.
The PSP remains accountable for managing the risks arising from the arrangement and must conduct the required assessment of its third-party service providers.
This is particularly relevant to PSPs whose operating models depend heavily on sponsor banks, safeguarding banks, payment processors, technology providers or other infrastructure partners.
What should Canadian PSPs do now?
Registered PSPs should use the Bank's latest guidance as a prompt for a focused RPAA compliance review.
In practice, firms should examine whether their safeguarding arrangements operate as intended, whether any required trust legal opinion is ready or can be produced, and whether customer money flows are consistent with the safeguarding structure.
They should also map the information required for the annual report, confirm that the appointed senior officer meets the regulatory definition and update their third-party risk assessment to include relevant banks and financial institutions where appropriate.
The important point is that these requirements are interconnected. A safeguarding arrangement that looks compliant on paper may still fail if account operation, third-party arrangements, governance or record keeping do not support it.
RPAA registration and ongoing compliance are different exercises
Obtaining registration under the RPAA is only the beginning of the Canadian federal payments compliance lifecycle.
The Bank of Canada's latest guidance shows what supervision is likely to look like in practice: evidence of effective risk management, defensible safeguarding arrangements, accurate reporting, appropriate governance and documentation capable of supporting the PSP's regulatory position.
For payment businesses, the sensible approach is to test these arrangements before the Bank does.
Regulatory Counsel advises payment service providers on Canadian regulatory requirements, including RPAA readiness, safeguarding structures, regulatory documentation and ongoing compliance support.
Frequently Asked Questions
The Retail Payment Activities Act is Canada's federal framework for supervising payment service providers performing specified retail payment activities. The Bank of Canada is responsible for supervising PSPs within the regime.
The annual report is due by 31 March each year. The Bank of Canada has confirmed that the first annual report generally covers information from calendar year 2025, with financial metrics based on the PSP's most recent financial year-end information.
Where a PSP safeguards end-user funds using an express trust, the Bank of Canada says that during its supervisory assessment it will request a written legal opinion addressing the validity of the trust arrangement and relevant safeguarding risks.
No. The Bank has confirmed that simply holding funds with an institution covered by federal or provincial deposit insurance is not sufficient because the RPAA safeguarding requirements are intended to protect end users if the PSP itself becomes insolvent.
No. The Bank of Canada's guidance confirms that the senior officer does not need to reside in Canada. Depending on the circumstances, the individual may also be employed by another group entity provided they perform a role falling within the regulatory definition.