Canada RPAA Registration: Bank of Canada PSP Requirements, Cost and Timeline
Bank of Canada RPAA registration: the five payment functions, the foreign PSP test, safeguarding and incident duties, fees and how it differs to FINTRAC.
Written and reviewed by the Regulatory Counsel team. Last reviewed: 28 August 2026.
The short answer
The Retail Payment Activities Act requires a payment service provider that performs retail payment activities to register with the Bank of Canada before performing them. Registration is administered through the Bank of Canada's PSP Connect portal.
A payment service provider is captured if it performs one or more of five payment functions as a service or business activity: providing or maintaining an account, holding funds on behalf of an end user, initiating an electronic funds transfer, authorising an electronic funds transfer or transmitting a transfer instruction, and providing clearing or settlement services. Foreign providers can be captured where they direct retail payment activities at end users in Canada.
Registered PSPs must establish and maintain an operational risk and incident response framework, notify material incidents without delay, safeguard end-user funds where they hold them, report annually to the Bank of Canada and notify significant changes. A base registration fee applies, set at CAD 2,500 from 1 November 2024 and indexed annually, with the applicable amount published by the Bank of Canada each year. This is a distinct regime from FINTRAC registration and many payment firms require both.
Key facts at a glance
| Regulator | Bank of Canada, under the Retail Payment Activities Act |
|---|---|
| Permission type | Registration as a payment service provider. Supervision of operational risk and end-user fund safeguarding, not a prudential licence |
| Who needs it | PSPs performing one or more of the five payment functions as a service or business activity in relation to electronic funds transfers in Canadian or foreign currency |
| Local entity required? | No. Foreign PSPs directing retail payment activities at end users in Canada can be captured and must register |
| Local management required? | No prescribed Canadian resident management. The Bank of Canada requires contact and governance information and expects the framework to be genuinely implemented |
| Capital or net worth | None. The RPAA imposes safeguarding and operational risk duties rather than capital requirements |
| Government fee | Base registration fee of CAD 2,500 as at 1 November 2024, indexed annually. Confirm the current figure in the Bank of Canada fee publication before budgeting |
| Review periods | The regulations provide for a decision on whether to review an application, an available extension, and a defined period in which any review is conducted |
| Renewal | No fixed-term renewal. Continuing obligations include annual reporting and notification of significant changes |
| Territorial scope | Retail payment activities performed for end users in Canada |
Get Expert Advice
Whether you need licensing support, compliance advice or regulatory strategy, our team is ready to help. Free initial consultation - no obligation.
Get Expert Advice
What is the Canada RPAA Registration (Bank of Canada PSP)?
The Retail Payment Activities Act brought payment service providers in Canada under federal supervision by the Bank of Canada for the first time. The regime is deliberately narrow in purpose: it targets operational reliability and the protection of end-user funds, rather than solvency, conduct or anti-money laundering supervision, which sit elsewhere.
Registration is mandatory before a PSP performs retail payment activities. The Bank of Canada maintains a public register of registered PSPs, and the register is increasingly used by banks, platforms and enterprise counterparties as a due diligence check.
The regime applies to domestic and foreign providers alike. A payment service provider with no Canadian establishment can be captured where it directs retail payment activities at end users in Canada, which mirrors the approach taken in the FINTRAC foreign MSB regime but operates entirely separately from it.
Who Needs Canada RPAA Registration (Bank of Canada PSP)?
Any payment service provider that performs one or more of the five payment functions as a service or business activity in relation to an electronic funds transfer, where the activity is performed for an end user in Canada.
- - Payment processors and payment facilitators serving Canadian merchants
- - Digital wallet and account providers holding balances for Canadian end users
- - Remittance and cross-border payment platforms serving Canadian senders or recipients
- - Payroll, disbursement and marketplace payout providers moving funds for Canadian users
- - Card programme managers and issuing or acquiring intermediaries performing a captured function
- - Foreign PSPs directing retail payment activities at end users in Canada without a Canadian establishment
The most common misconception is that a firm already registered with FINTRAC has satisfied its Canadian obligations. FINTRAC registration is anti-money laundering supervision under separate legislation, administered by a different authority. A firm that transfers funds for Canadian customers and holds end-user funds will frequently require FINTRAC registration and Bank of Canada registration at the same time, with distinct applications, distinct obligations and only one fee. The second misconception is that the absence of a Canadian entity puts a firm outside the Act. The statutory test looks at whether retail payment activities are directed at end users in Canada, not at where the provider is incorporated.
The five payment functions
The Act defines a payment service provider by reference to the performance of payment functions. Performing any one of them as a service or business activity, in relation to an electronic funds transfer, brings the provider within scope unless an exclusion applies.
- - Providing or maintaining an account that is held on behalf of one or more end users
- - Holding funds on behalf of an end user until they are withdrawn by the end user or transferred to another individual or entity
- - Initiating an electronic funds transfer at the request of an end user
- - Authorising an electronic funds transfer or transmitting, receiving or facilitating an instruction in relation to an electronic funds transfer
- - Providing clearing or settlement services
The foreign PSP test
A provider outside Canada is captured where it performs retail payment activities and directs those activities at individuals or entities in Canada. The assessment is practical rather than formal: Canadian marketing, Canadian dollar functionality, Canadian customer onboarding and a Canadian customer base all support a finding that activities are directed at Canada.
Firms that already run a Canadian go-to-market strategy should assume they are in scope and structure the registration accordingly, rather than relying on the absence of an office.
Exclusions from the regime
The Act and regulations exclude certain activities and entities, including activities already supervised under other federal frameworks and certain internal or incidental functions. Exclusions are specific and should be assessed against the actual flow of funds and contractual arrangements rather than assumed from a business description.
Where a firm relies on an exclusion, that analysis should be documented at the time. Bank of Canada supervision is evidence-driven, and an undocumented perimeter conclusion is difficult to defend later.
RPAA is not FINTRAC
FINTRAC registration under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act addresses money laundering and terrorist financing risk. RPAA registration with the Bank of Canada addresses operational risk and the safeguarding of end-user funds.
The two regimes use different definitions, different triggers, different portals and different reporting cycles. A money transferring business will normally be an MSB for FINTRAC purposes and a PSP for RPAA purposes, and neither registration substitutes for the other.
Operational risk and incident management
- - A documented risk management and incident response framework that identifies operational risks and the controls that mitigate them
- - Objectives and controls addressing the reliability, availability and integrity of retail payment activities
- - Testing of the framework and independent review at the intervals required by the regulations
- - Notification to the Bank of Canada, and to affected end users and connected providers, of an incident that has a material impact, without delay
- - Records evidencing the framework, the testing performed and the incidents managed
Safeguarding end-user funds
A PSP that holds end-user funds must safeguard them. The regulations require the funds to be held in a manner that protects them from the PSP's other obligations and ensures they are available to end users without delay, including where the PSP becomes insolvent.
This is supported by a safeguarding framework covering the accounts used, the reconciliation performed, the arrangements with the account provider or insurer, and independent review. Firms familiar with the UK safeguarding regime will recognise the architecture, though the Canadian requirements must be met on their own terms.
The registration process
- - Confirm the perimeter analysis: which payment functions are performed, for which end users, and whether any exclusion applies
- - Build the operational risk and incident response framework and, where funds are held, the safeguarding framework, before applying
- - Create a PSP Connect account and prepare the required information about the business, its activities, its ownership and its arrangements with third parties
- - Submit the application and pay the applicable registration fee
- - Respond to Bank of Canada questions, including any review of the application, within the periods provided by the regulations
- - On registration, appear on the public register and begin the annual reporting and significant change notification cycle
Ongoing obligations after registration
- - Maintain, test and review the risk management and incident response framework
- - Maintain safeguarding arrangements and the associated reconciliation and review where end-user funds are held
- - Notify the Bank of Canada of incidents with a material impact without delay
- - File the annual report required by the regulations within the prescribed period each year
- - Notify significant changes to the business, its activities, its ownership or its arrangements within the prescribed period
- - Pay the annual assessment charged by the Bank of Canada
Bank of Canada RPAA registration vs FINTRAC MSB registration
Two federal regimes, two registers, two sets of obligations. Most payment firms serving Canadian end users need to assess both.
| Point of difference | Bank of Canada RPAA PSP | FINTRAC MSB / FMSB |
|---|---|---|
| Supervisory purpose | Operational risk and end-user fund safeguarding | Money laundering and terrorist financing |
| Legislation | Retail Payment Activities Act | Proceeds of Crime (Money Laundering) and Terrorist Financing Act |
| Trigger | Performing one of five payment functions in a retail payment activity | Offering listed MSB services such as money transferring or dealing in virtual currency |
| Fee | Base registration fee, indexed annually, plus an annual assessment | None |
| Key duties | Risk framework, incident notification, safeguarding, annual report | Compliance programme, reporting, record keeping, client identification |
| Foreign providers | Captured where retail payment activities are directed at end users in Canada | Foreign MSB registration where services are directed at Canada |
| Public register | Yes, the Bank of Canada publishes registered PSPs | Yes, FINTRAC publishes registered MSBs |
Key Requirements
Perimeter and payment functions
Identify which of the five payment functions the business performs, for which end users, and whether any statutory exclusion applies. The analysis should be documented and reviewed when the product changes.
Operational risk framework
A documented risk management and incident response framework covering identification of operational risks, mitigating controls, objectives for reliability and integrity, testing and review, and material incident notification to the Bank of Canada without delay.
Safeguarding of end-user funds
Where end-user funds are held, arrangements that protect those funds from the provider's other obligations, make them available to end users without delay including on insolvency, and are supported by reconciliation, documented arrangements with the account provider or insurer and independent review.
Registration information
Detailed information about the provider, its retail payment activities, ownership and control, third-party arrangements, and the contact points required by the regulations, submitted through PSP Connect.
Reporting
An annual report to the Bank of Canada within the prescribed period, notification of significant changes, and incident notifications. Registered PSPs appear on a public register.
Fees
A base registration fee, set at CAD 2,500 as at 1 November 2024 and indexed annually, plus the annual assessment charged to registered PSPs. The applicable figures are published by the Bank of Canada each year and should be confirmed at the point of application.
What does RPAA registration cost?
- - Registration fee: a base fee of CAD 2,500 applied from 1 November 2024. The fee is indexed annually and the Bank of Canada publishes the applicable amount, so the current figure should be confirmed before the application rather than assumed
- - Annual assessment: registered PSPs are charged an annual assessment by the Bank of Canada to fund supervision
- - Capital: none. The RPAA does not impose capital or net worth requirements
- - Framework build: the operational risk and incident response framework, safeguarding arrangements, reconciliation process and independent review are the substantive cost of the regime
- - Third-party costs: safeguarding account or insurance arrangements, independent review of the frameworks, and resilience and incident tooling
- - Professional fees: quoted as a fixed fee following scoping. Scope depends on which payment functions are performed, whether end-user funds are held, and whether parallel FINTRAC registration is required
The Application Process
Perimeter and structuring analysis
Regulatory Counsel maps the flow of funds against the five payment functions, tests whether activities are directed at end users in Canada, assesses exclusions, and confirms whether parallel FINTRAC registration is required.
Framework build
We prepare the operational risk and incident response framework and, where end-user funds are held, the safeguarding framework, reconciliation process and account arrangements. This precedes the application because the Bank of Canada expects the framework to exist.
PSP Connect preparation and submission
We assemble the registration information, prepare the submission through PSP Connect and manage the fee payment.
Review and response
We manage Bank of Canada correspondence, including any review of the application, within the periods provided by the regulations.
Registration and go-live
On registration, we implement the annual reporting cycle, significant change notification process and incident escalation path, and align them with the firm's FINTRAC obligations where both apply.
Framework build typically drives the critical path. The regulations set out a period in which the Bank of Canada decides whether to review an application, an available extension to that period, and a defined period in which any review is conducted, so a registration subject to review takes materially longer than one that is not.
How long does RPAA registration take?
Registration must be in place before the provider performs retail payment activities, so timing is a gating item for Canadian launch rather than a parallel workstream.
The Retail Payment Activities Regulations set out the framework: the Bank of Canada has a defined period in which to decide whether to review an application, that period can be extended once by a further defined period, and where a review is conducted it must be completed within the longer review period prescribed by the regulations. A straightforward application that is not selected for review completes considerably faster than one that is.
In planning terms, the controllable element is the framework. Applications supported by a genuine, documented operational risk framework and, where relevant, an implemented safeguarding arrangement, present far fewer questions than those where the framework is drafted in response to the Bank of Canada's enquiries.
Why Applications Fail - and How We Prevent It
Perimeter misjudged
A firm concludes it performs no payment function because it does not touch funds, while it authorises or transmits transfer instructions on behalf of end users. The correct analysis is function by function against the flow of funds.
Framework drafted retrospectively
Where the operational risk or safeguarding framework is produced only after the Bank of Canada asks, the application takes longer and the supervisory relationship begins badly.
Safeguarding without reconciliation
Holding end-user funds in a separate account, without documented reconciliation, account arrangements and review, does not meet the safeguarding requirement.
Dual registration overlooked
Firms register with the Bank of Canada and continue to transfer funds for Canadian customers without FINTRAC registration, or the reverse.
Annual reporting missed
The annual report and significant change notifications are continuing statutory duties, not administrative courtesies, and missing them is a supervisory issue.
Practitioner observations on RPAA registration
- - Assuming FINTRAC registration is enough. The two regimes are separate and a firm can be fully compliant with one while unregistered under the other
- - Applying before the framework exists. The Bank of Canada expects the operational risk framework to be real, and an application ahead of the framework invites review
- - Under-scoping the payment functions. Firms describe themselves as a technology provider while authorising or transmitting transfer instructions, which is a captured function
- - Treating safeguarding as a bank account. The requirement is that funds are protected from the provider's other obligations and available to end users without delay, which needs reconciliation and evidence
- - Missing the incident notification duty. Material incidents must be notified without delay, which requires an escalation path defined before an incident occurs
- - Budgeting a fixed fee from an old bulletin. The registration fee is indexed annually and the current figure should be taken from the Bank of Canada publication in force at the time of application
How Regulatory Counsel Can Help
Perimeter and structuring
We map the flow of funds against the five payment functions, test the foreign PSP position and confirm whether FINTRAC registration is required in parallel.
Framework and application
We build the operational risk, incident response and safeguarding frameworks, then prepare and submit the PSP Connect registration.
Ongoing supervision
We implement annual reporting, significant change notification, incident escalation and independent review so the registration remains in good standing.
Canadian payments market entry usually involves two regulators rather than one. We run the Bank of Canada registration and the FINTRAC registration as a single project, so the perimeter analysis, the compliance framework and the safeguarding arrangements are consistent across both, and neither obligation is discovered late.
Related Licences
Canada MSB Registration
FINTRAC registration for money transferring, foreign exchange and virtual currency services.
UK Authorised Payment Institution
The UK equivalent permission for firms operating on both sides of the Atlantic.
US Money Transmitter Licence
State-by-state licensing for firms extending into the United States.
Frequently Asked Questions
A payment service provider that performs one or more of the five payment functions as a service or business activity in relation to an electronic funds transfer for an end user in Canada. The functions are providing or maintaining an account, holding funds, initiating a transfer, authorising or transmitting a transfer instruction, and providing clearing or settlement services.
Yes, where they perform retail payment activities and direct those activities at individuals or entities in Canada. A Canadian entity or office is not required, and incorporation outside Canada does not remove the obligation.
No. They are separate regimes under separate legislation with separate regulators, definitions and reporting cycles. Firms that transfer funds for Canadian customers and hold end-user funds commonly require both registrations at the same time.
A base registration fee of CAD 2,500 applied from 1 November 2024, indexed annually, with the applicable amount published by the Bank of Canada. Registered PSPs are also charged an annual assessment. Confirm the current figures in the Bank of Canada fee publication before budgeting.
No. Registration is required before performing retail payment activities, so the registration timetable is a gating item for Canadian launch.
A PSP holding end-user funds must hold them so that they are protected from the provider's other obligations and available to end users without delay, including on insolvency. The arrangement must be supported by reconciliation, documented account or insurance arrangements and independent review.
Incidents with a material impact on end users, other PSPs or clearing and settlement systems must be notified without delay, alongside notification to affected parties. This requires a defined escalation path and materiality assessment established before an incident occurs.
The regulations provide a period for the Bank of Canada to decide whether to review an application, an available extension, and a longer period in which any review is conducted. Applications supported by a completed operational risk framework and, where relevant, implemented safeguarding, move faster than those that are not.
An annual report to the Bank of Canada within the prescribed period, notification of significant changes to the business or its arrangements, incident notifications, and payment of the annual assessment.
No. Registration reflects that the provider is subject to the regime and has met the registration requirements. It is not a prudential licence, an endorsement of the business model or a substitute for provincial or anti-money laundering obligations.
Primary sources
The requirements, fees and timeframes on this page are taken from the following primary regulatory and legislative sources. Rules change, and firms should confirm the current position before relying on any figure.
- Retail Payment Activities Act
- Retail Payment Activities Regulations
- Bank of Canada: retail payments supervision, registration
- Bank of Canada: registration fees for payment service providers
- FINTRAC: money services businesses registration requirements
Last reviewed by the Regulatory Counsel team on 28 August 2026.