Legal Guide to RPAA Registration, Compliance, and Payment Service Provider Obligations in Canada
The Retail Payment Activities Act (RPAA) is Canada’s federal framework for supervising payment service providers (PSPs). It is administered by the Bank of Canada and applies to businesses that perform regulated retail payment activities in Canada or direct retail payment services at persons or entities in Canada.
The RPAA is especially important for fintech companies, payment processors, digital wallets, marketplaces, embedded finance platforms, foreign PSPs serving Canadian users, and businesses that facilitate electronic funds transfers.
This guide explains what the RPAA is, who may need to register, what obligations apply, and why payment businesses should take RPAA compliance seriously.
What Is the Retail Payment Activities Act?
The RPAA is a federal statute that gives the Bank of Canada supervisory authority over certain payment service providers.
The Bank of Canada states that it supervises PSPs subject to the RPAA and Retail Payment Activities Regulations, including assessing whether PSPs manage operational risks, respond effectively to incidents, safeguard end-user funds, and meet mandatory reporting requirements: Bank of Canada Retail Payments.
The RPAA does not replace other regulatory frameworks. A business may also need to consider FINTRAC registration, anti-money laundering compliance, provincial consumer protection laws, privacy laws, contractual obligations, and other regulatory regimes depending on its business model.
Who Needs to Register Under the RPAA?
A person or entity may be required to register with the Bank of Canada if it is a payment service provider that performs regulated retail payment activities.
The Bank of Canada explains that entities generally need to assess whether they perform one or more payment functions, meet geographic scope requirements, perform retail payment activities, and are not excluded from the RPAA framework: Bank of Canada Supervisory Framework.
Businesses that may need RPAA analysis include:
- payment processors
- digital wallets
- merchant payment facilitators
- marketplace payment platforms
- payment gateways
- embedded finance platforms
- bill payment providers
- cross-border payment businesses
- foreign payment companies serving Canadian users
Whether a business is in scope depends on the specific facts and payment flow.
What Are Retail Payment Activities?
Retail payment activities generally involve payment functions performed in relation to electronic funds transfers.
Regulated payment functions may include:
- providing or maintaining an account held on behalf of an end user
- holding funds on behalf of an end user
- initiating electronic funds transfers
- authorizing electronic funds transfers
- transmitting, receiving, or facilitating instructions in relation to electronic funds transfers
- providing clearing or settlement services
A business does not need to call itself a payment processor or fintech company to fall within the RPAA. The analysis depends on what the business actually does.
RPAA Registration With the Bank of Canada
Entities subject to the RPAA must register with the Bank of Canada.
The Bank maintains a public registry of payment service providers. The Bank explains that registered PSPs have satisfied legal registration requirements, including being in scope of the RPAA, paying required fees, and clearing national security screening coordinated by the Department of Finance: Bank of Canada Registry of Payment Service Providers.
The Bank also provides PSP Connect, its online portal for retail payments supervision and registration: Bank of Canada PSP Connect Portal.
Operational Risk Management Obligations
The RPAA requires PSPs to maintain appropriate risk management and incident response frameworks.
Operational risk obligations may involve:
- identifying operational risks
- maintaining controls and safeguards
- managing third-party risks
- developing incident response procedures
- testing systems and controls
- maintaining business continuity plans
- documenting compliance processes
The objective is to reduce risks that could disrupt payment services or harm end users.
Safeguarding End-User Funds
Safeguarding is one of the most important RPAA obligations.
If a PSP holds funds on behalf of end users until they are withdrawn or transferred, it may need to safeguard those funds in accordance with the RPAA.
The Bank of Canada has published guidance on safeguarding end-user funds, including expectations for PSPs with safeguarding obligations: Bank of Canada Safeguarding End-User Funds Guideline.
Safeguarding may involve:
- segregated accounts
- trust arrangements
- insurance or guarantees
- accurate ledgers
- reconciliation procedures
- written safeguarding frameworks
The exact requirements depend on how the PSP holds and manages end-user funds.
Holding Funds Under the RPAA
Many businesses struggle to determine whether they are “holding funds” under the RPAA.
The Bank of Canada has published case scenarios to help PSPs understand when holding funds may occur: Bank of Canada Case Scenarios About Holding Funds.
This analysis is particularly important for:
- wallet providers
- platforms that temporarily retain user funds
- marketplaces
- payment facilitators
- remittance platforms
- settlement intermediaries
Even short periods of control over funds may require careful legal review.
Annual Reporting and Ongoing Compliance
RPAA compliance does not end after registration.
Registered PSPs and certain applicants may need to meet ongoing obligations, including annual reporting. The Bank of Canada has published a supervisory policy on annual reporting requirements: Bank of Canada Annual Reporting Policy.
Ongoing compliance may involve:
- annual reports
- incident reporting
- significant change reporting
- framework updates
- documentation maintenance
- regulator communications
- supervisory assessments
Businesses should treat RPAA compliance as an ongoing governance obligation.
RPAA and FINTRAC Compliance
RPAA registration is not the same as FINTRAC registration.
Some PSPs may also be money services businesses (MSBs) or foreign money services businesses (FMSBs) under anti-money laundering laws.
A business may need to assess:
- RPAA registration
- FINTRAC MSB registration
- anti-money laundering compliance
- sanctions screening
- suspicious transaction reporting
- know-your-client obligations
Complying with one framework does not automatically satisfy the other.
RPAA and Marketplaces
Marketplaces may be affected by the RPAA where they facilitate payments between buyers and sellers.
Important questions include:
- Does the marketplace initiate or facilitate electronic funds transfers?
- Does it hold seller or buyer funds?
- Does it maintain accounts for end users?
- Does it rely on a third-party payment processor?
- Are payment functions incidental to another business activity?
Marketplace payment flows should be reviewed carefully because business structure can materially affect RPAA obligations.
RPAA and Foreign Payment Service Providers
Foreign companies may be subject to the RPAA if they perform retail payment activities for end users in Canada and direct those services at persons or entities in Canada.
Foreign PSPs should not assume they are outside Canadian regulation merely because they are incorporated or headquartered outside Canada.
The geographic scope analysis is often important for:
- international payment processors
- foreign digital wallets
- global marketplaces
- cross-border remittance providers
- SaaS platforms with payment features
Enforcement and Non-Compliance Risks
Failure to comply with the RPAA may result in regulatory consequences.
Potential issues may include:
- registration refusal
- compliance orders
- monetary penalties
- supervisory action
- reputational harm
- business disruption
- issues with banking or payment partners
The Bank of Canada’s key milestones page explains the implementation of the RPAA framework and its supervisory role, including registration and enforcement activities: Bank of Canada RPAA Key Milestones.
Why RPAA Legal Advice Matters
RPAA analysis is often highly fact-specific.
Small differences in payment flows, contract structure, custody arrangements, user relationships, and platform design can change the legal analysis.
Legal advice may assist with:
- determining whether the RPAA applies
- preparing registration applications
- reviewing payment flows
- drafting safeguarding frameworks
- assessing operational risk requirements
- responding to Bank of Canada inquiries
- reviewing contracts with payment partners
- coordinating RPAA, FINTRAC, and privacy compliance
Work With an RPAA Lawyer in Canada
If your business provides payment services, facilitates electronic funds transfers, holds end-user funds, or operates a marketplace, wallet, fintech, or embedded payments platform, RPAA compliance should be assessed carefully.
Substance Law assists businesses with RPAA registration, compliance frameworks, safeguarding obligations, payment regulatory analysis, and Bank of Canada communications.
Contact Substance Law to discuss your RPAA compliance requirements.
Frequently Asked Questions About the Retail Payment Activities Act
What is the Retail Payment Activities Act?
The Retail Payment Activities Act is Canada's federal framework for supervising payment service providers that perform regulated retail payment activities. It is administered by the Bank of Canada.
Who regulates payment service providers under the RPAA?
The Bank of Canada supervises payment service providers subject to the RPAA and Retail Payment Activities Regulations.
Who needs to register under the RPAA?
Businesses that perform regulated retail payment activities and meet the RPAA scope criteria may need to register with the Bank of Canada.
Does the RPAA apply to foreign payment companies?
Yes. Foreign payment companies may be subject to the RPAA if they perform retail payment activities for end users in Canada and direct services at persons or entities in Canada.
Is RPAA registration the same as FINTRAC registration?
No. RPAA registration and FINTRAC registration are separate regulatory requirements. Some businesses may need to comply with both.
What does safeguarding end-user funds mean?
Safeguarding end-user funds means protecting funds held on behalf of end users, including through appropriate segregation, reconciliation, and safeguarding arrangements.
Do marketplaces need to comply with the RPAA?
Some marketplaces may need to comply with the RPAA if they perform payment functions, hold funds, maintain accounts, or facilitate electronic funds transfers.
What happens if a PSP does not comply with the RPAA?
Non-compliance may result in Bank of Canada supervisory action, registration refusal, monetary penalties, compliance orders, reputational harm, or business disruption.
Can a lawyer help with RPAA registration?
Yes. A lawyer can assist with RPAA applicability analysis, registration applications, safeguarding frameworks, operational risk obligations, and communications with the Bank of Canada.
