Bank of Canada RPAA Registration for Payment Service Providers

A separate regulator, a separate regime, and obligations that have nothing to do with FINTRAC. We determine whether the RPAA captures you, and build what it requires.

05
🏦 RPAA Registration Register as a PSP

The Retail Payment Activities Act requires payment service providers to register with the Bank of Canada. A PSP is a business that performs one or more retail payment functions: providing or holding an end-user account, holding end-user funds, initiating an electronic funds transfer, authorising a transfer or transmitting a payment instruction, or providing clearing and settlement services.

The RPAA regime is entirely separate from FINTRAC MSB registration. It is supervised by a different regulator and its obligations are about operational resilience and the safety of end-user funds, not money laundering. Many payment businesses trigger both regimes and must satisfy both. Businesses that assume their FINTRAC registration covers them are the ones caught out.

C&G advises on RPAA applicability, prepares and manages the registration, and builds the two frameworks the Act requires you to have in place: a risk management and incident response framework, and a safeguarding-of-funds framework. These are documented, testable frameworks that the Bank of Canada expects to see, not policy statements.

What the engagement includes

  • RPAA applicability analysis, determining whether your business performs a retail payment function
  • Exclusion and exemption analysis, including the internal and agent-related carve-outs
  • Bank of Canada registration portal submission and application management
  • Risk management and incident response framework development
  • End-user funds safeguarding framework, including account structures and reconciliation
  • Incident reporting and notification procedures
  • Annual reporting and change-of-information obligations setup
  • Parallel FINTRAC MSB registration where both regimes are triggered
  • Ongoing RPAA regulatory advisory and monitoring of Bank of Canada guidance
How it works

How the engagement runs

STEP 01

Applicability analysis

We assess your payment flows against the five retail payment functions and the statutory exclusions, and give you a documented determination you can show a partner or regulator.

STEP 02

Registration preparation

Corporate, ownership, and operational detail is assembled to the Bank of Canada standard, including the description of payment activities, which is where most applications get pushed back.

STEP 03

Framework development

The risk management and incident response framework and the safeguarding-of-funds framework are drafted against the Act and current Bank of Canada guidance.

STEP 04

Submission and follow-through

We file and manage the application, including responses to any request for further information.

STEP 05

Ongoing obligations setup

Annual reporting, significant change notifications, and incident reporting triggers are set up with owners and deadlines so nothing is missed after approval.

Who this is for

Businesses we deliver this for

Official sources Bank of Canada — PSP registry → The public register of payment service providers registered under the Retail Payment Activities Act. Bank of Canada — list of applicants → Businesses that have applied for RPAA registration and are awaiting a decision.
FAQ

Bank of Canada (RPAA) Registration: common questions

Payment service providers performing at least one of five retail payment functions: providing or holding an end-user account, holding end-user funds, initiating an electronic funds transfer, authorising an electronic funds transfer or transmitting a payment instruction, and providing clearing or settlement services. If a payment passes through you or funds sit with you, the Act is likely in scope.
No. They are separate regimes, separate regulators, and separate obligations. FINTRAC registration addresses money laundering and terrorist financing under the PCMLTFA. RPAA registration addresses operational risk and end-user fund safeguarding under the Bank of Canada. A payment business can easily be required to hold both.
If you hold end-user funds, you must hold them so they are protected and available to the end user, typically in a trust account or an account backed by insurance or a guarantee, with documented reconciliation, clear account structures, and a framework describing how the arrangement works and how it is tested.
A documented framework identifying the operational risks to your payment activities, the controls and safeguards you apply to each, and how you detect, respond to, escalate, and report incidents. The Bank of Canada expects it to be reviewed on a defined cycle and after material incidents.
Quite possibly. FINTRAC registration says nothing about your RPAA status. The right first step is an applicability analysis against the retail payment functions. We deliver that as a documented determination, which is also what your sponsor bank will want to see.
Annual reporting to the Bank of Canada, notification of significant changes to your payment activities or safeguarding arrangements, incident reporting when an incident has a material impact, and keeping both frameworks current and reviewed. We set these up with owners and dates at registration.
Confirm through an applicability analysis that you perform a retail payment function and that no exclusion applies; assemble the corporate, ownership, and operational information the Bank requires; document your risk management and incident response framework and, if you hold end-user funds, your safeguarding arrangements; submit the application through the Bank’s portal; and respond to any follow-up. You must be registered before performing retail payment activities, so start early.
Corporate and ownership details, the individuals who direct the business, a clear description of the retail payment activities you perform and how funds move, transaction volumes and values, the jurisdictions involved, third parties and agents you rely on, and details of your safeguarding arrangements where you hold end-user funds. The description of payment activities is where applications most often get pushed back, because it must match how your flows actually work.
Yes. Registration can be refused, including on national security grounds or where required information is not provided or is inaccurate. Registered PSPs appear on a public registry, which means your status is visible to banks, partners, and customers. Both facts argue for treating the application as a substantive submission rather than a form.
Yes, and they matter. The Act excludes certain activities and entities, and there are carve-outs for activities performed internally within a group and for certain agent and service-provider arrangements, among others. Whether an exclusion applies turns on the specific structure of your flows, not on how you describe your business. That is exactly why we deliver the applicability analysis as a documented determination you can hand to a partner or a regulator.
It exposes the business to enforcement under the Act and, in practice, to the loss of banking and processing relationships once the gap is noticed, which is usually the more immediate commercial problem. If you have been operating unregistered, the sensible sequence is an applicability analysis, then a prompt application with the required frameworks in place, rather than waiting to be asked.
Keep reading

Related services

Service 04

FINTRAC / MSB Registration

 Service 02

Compliance Program Development

 Service 01

AML Independent Review

Insights on this topic

Insight

Money Services Businesses & AML Regulations

 Insight

FINTRAC Expands Oversight to Private ABM Acquirer Services

 Insight

New AML Requirements for Leasing and Financing Entities

Does the RPAA capture your business?

Send us your payment flows. We will give you a documented applicability determination.

Register as a PSP Book a Call