RPAA Annual Report 2027: What Payment Service Providers Must File With the Bank of Canada by 31 March

Every payment service provider (PSP) registered with the Bank of Canada must file its next Retail Payment Activities Act (RPAA) annual report through PSP Connect by 31 March 2027. The report covers calendar year 2026, except financial figures, which use the PSP's most recent financial year end. It has six sections and asks for dated evidence: when frameworks were approved and reviewed, every safeguarding shortfall, monthly transaction counts and values, and audited or unaudited financial statements. A late report costs C$500 a day for up to 30 days, then C$15,000 to C$1,000,000.

This is the second annual report under the RPAA. The first, covering 2025, was due by 31 March 2026. The form asks for records that are hard to rebuild after the year has ended, so the time to prepare for the 2027 report is before 31 December 2026, not in March.

This guide covers who must file, what each section asks, the evidence the Bank of Canada expects behind each answer, and the gaps that appear most often. It builds on our guide to Bank of Canada RPAA registration and our earlier note on the Bank of Canada's 2026 RPAA guidance.

Who must file the 2027 RPAA annual report?

Every PSP on the Bank of Canada's registry must file, including foreign PSPs that direct retail payment activities at end users in Canada. The duty comes from section 18 of the Retail Payment Activities Regulations, which sets the 31 March deadline. A PSP is a business that performs at least one of five payment functions for end users: holding an account, holding funds, initiating a transfer, authorising or transmitting a transfer instruction, or clearing and settlement.

Registration does not expire, so the report is the main yearly checkpoint. A PSP that stopped performing retail payment activities during 2026 should deal with that through the Bank rather than simply not filing.

What does the Bank of Canada ask in the annual report?

The form starts by asking the PSP to confirm that its registration information is accurate. Any change must be updated and saved before the main sections open. The Bank's step-by-step guide to the annual report sets out six sections.

Some questions appear or disappear depending on earlier answers. A PSP that does not hold end-user funds still answers the safeguarding metrics with zeros and an explanation.

Section 1: operational risk and incident evidence

Operational risk means the risk that systems, people, processes or suppliers fail and payments stop or go wrong. The RPAA requires a written framework to manage that risk and to respond to incidents.

The form asks when the senior officer approved the framework. A senior officer is the person accountable for the framework; the Bank has confirmed this person need not live in Canada. It also asks whether the PSP has classified both its assets (such as servers and data) and its business processes (such as onboarding and settlement) by how critical they are. Classifying only one of the two is treated as not classified.

The form also asks for the number of full-time staff and the share of budget devoted to retail payments and to operational risk, and for the date of the last independent review. The framework must be independently reviewed at least once every three years. If a review is due in 2026, the date must be real by 31 December.

Third parties are a frequent weak point. The Bank has said that a bank that holds accounts or settles payments for a PSP can be a third-party service provider, so it belongs in the third-party risk assessment.

Section 2: safeguarding evidence and shortfalls

Safeguarding means keeping customer money separate so that it can be returned in full if the PSP fails. A PSP that holds end-user funds must use a trust account or a segregated account backed by insurance or a guarantee. Deposit insurance alone does not count, because it covers the failure of the bank, not the failure of the PSP.

The report asks for:

• the institution holding the safeguarding account, and the account type
• the trust deed, or the insurance or guarantee reference number, amount and expiry date
• the date the safeguarding framework was last reviewed; this review must also happen at least every three years
• whether the PSP's ledger meets every requirement; if not, the answer must be No
• a list of secure and liquid assets held, with book values as at 31 December
• every shortfall in the year

There is no materiality threshold for shortfall reporting. A shortfall caused by a timing gap in a payment processor's settlement still counts. A PSP that has not kept a shortfall log since 1 January 2026 should build one now from bank statements and reconciliations.

Where an express trust is used, the Bank will ask for a written legal opinion confirming the trust is valid. Where insurance or a guarantee is used, the PSP must notify the Bank at least 30 days before any cancellation or termination of that cover.

Section 4: the transaction metrics

Section 4 measures how large and how connected each PSP is. The Bank's annual reporting of retail payment activity metrics defines each figure.

A PSP with a place of business in Canada reports twice: once for all end users and once for end users in Canada. Figures for all end users must be equal to or greater than the Canadian figures. A foreign PSP with no Canadian place of business reports only for end users in Canada. Foreign currency converts to Canadian dollars at the Bank's monthly rates or the PSP's own normal rates. Activity by registered agents is included; activity an affiliate performs for the PSP is not.

Common gaps to close before year end

These gaps follow directly from what the form asks. Each is easier to close in 2026 than to explain in March 2027.

The Bank has shown it acts on safeguarding. On 17 February 2026 it ordered XTM Inc. to stop retail payment activities, citing concerns that client funds were not safeguarded. In June 2026 it announced it would publish notices of violation, which are also noted on the PSP's public registry entry.

A filing timetable for the 2027 report

The annual report and FINTRAC obligations often fall on the same team. A PSP that also transfers funds is usually a money services business too, with its own FINTRAC MSB registration and two-year renewal. Our note on revoked or expired FINTRAC registrations covers that side, and our overview of money services businesses in Canada shows how the regimes fit together.

Stablecoins and the next reporting cycles

Bill C-15 received Royal Assent on 26 March 2026 and enacted the Stablecoin Act. The Department of Finance has said that PSPs performing payment functions in a fiat-backed stablecoin will be supervised under the RPAA once that stablecoin is prescribed by regulation, with the framework expected in force in 2027. A PSP that moves stablecoins for end users should expect that activity to appear in later annual reports. Our guide to Canada's Stablecoin Act explains the issuer regime.