Retail Payment Activities Act (RPAA)

The Retail Payment Activities Act (RPAA) a dedicated framework for regulating retail payments that came into effect on September 8th, 2025. If your business is a Payment Service Provider (PSP), Money Services Business (MSB), Fintech, or Prepaid Card issuer that initiates, holds or authorizes electronic funds transfers (EFTs), you are required to comply (even if you haven’t yet registered with the Bank of Canada). If you are performing the activity, you are obligated and must register as a PSP with the Bank of Canada. Operating without registering can expose your business to enforcement action and potential monetary penalties.

Operating under the RPAA means you must fully implement:

1) Operational risk management frameworks

2) Incident response framework

3) Safeguarding of funds protocols where end-user funds are held

4) Ongoing regulatory reporting (including, annual reporting to the Bank of Canada)

The AML Shop's RPAA team designs and reviews programs for PSPs of every size, helping you translate Bank of Canada supervisory expectations into tailored risk management frameworks, fund safeguarding structures, and reporting workflows and standards so you can operate with confidence.

who does the rpaa apply to?

The RPAA applies to PSPs and any individual or entity that performs one or more of five payment functions as a service or business activity, including:

Providing or maintaining an account held on behalf of an end user
Holding funds on behalf of an end user
Initiating an electronic funds transfer at the request of an end user
Authorizing an electronic funds transfer, or transmitting, receiving, or facilitating a payment instruction
Providing clearing or settlement services

This would include a variety of business types like MSBs, fintechs, payment processors and prepaid card providers performing these functions for end users in Canada, or directing services to end-users in Canada, even without a Canadian office. Banks, authorized foreign banks, and provincially regulated trust companies are generally excluded from the RPAA, since they are already regulated elsewhere.

Many PSPs also need to register separately as a money services business with FINTRAC, under the Proceeds of Crime (Money Laundering) and Terrorist Financing (PCMLTFA) regime. RPAA and FINTRAC obligations are separate regimes with separate regulators — meeting one doesn't satisfy the other and if you are an MSB, you are regulated by both.

what are a pspS OBLIGATIONS UNDER THE RPAA?

REGISTRATION WITH THE BANK OF CANADA

PSPs must register with the Bank of Canada before performing any retail payment activities in or directed at Canada.

OPERATIONAL RISK MANAGEMENT FRAMEWORK

Documented practices for identifying, managing, and testing against operational risks to your payment activities.

SAFEGUARDING OF END-USER FUNDS

A framework ensuring end-user funds are protected, including in the event of insolvency.

incident response and reporting

A plan for responding to and reporting significant incidents affecting your retail payment activities.

APPOINTMENT OF RESPONSIBILITIES

A designated senior officer accountable for oversight of your risk management and safeguarding programs.

ANNUAL REPORT TO THE BANK OF CANADA

A substantive annual filing on your operations, risk management, and compliance status.

Record keeping

Retaining required records for a prescribed period, including supervisory correspondence and compliance documentation.

what OUR RPAA COMPLIANCE SERVICES COVER

RPAA APPLICABILITY ASSESSMENT

Determining whether your business performs a retail payment function, if you are applicable and whether any exclusions apply.

REGISTRATION SUPPORT

Preparing and managing your Bank of Canada PSP application.

RISK MANAGEMENT AND INCIDENT RESPONSE FRAMEWORK DESIGN

Built around your actual business types and risks, payment flows and technology.

SAFEGUARDING OF FUNDS FRAMEWORK

Account structures, reconciliation practices, and documentation aligned with the Bank of Canada expectations.

rpaa training

RPAA Training for your staff and senior officer to ensure team wide compliance.

annual report preparation support

Helping you compile and submit accurate RPAA annual reports.

ongoing advisory

As your business grows, you implement changes to payment functions, take on higher risk clients or expand into new markets.

FAQs

A PSP is any individual or entity that performs one or more of five payment functions such as holding end-user funds or initiating electronic funds transfers, as a service or business activity, for end users in Canada or directed at end users in Canada.
Yes. Any business performing a covered payment function is captured regardless of how it describes itself. This includes fintechs, prepaid card providers, and many MSBs, not only dedicated payment processors.
No. The RPAA is administered by the Bank of Canada, which is a separate regulator from FINTRAC. Many PSPs are subject to both regimes and must meet each one's requirements independently.
No. They're separate registrations under separate legislation. Registering as a PSP with the Bank of Canada doesn't satisfy FINTRAC's MSB registration requirement, and vice versa.
Yes. The RPAA applies to PSPs that direct retail payment activities at end users in Canada, even if the business has no physical presence in the country.
The Retail Payment Activities Regulations classify specific violations by severity, considering factors like actual or potential harm, the PSP's compliance history, and the degree of intention or negligence involved.

KEY CONTACTS

Marcelle Dadoun - Principal, Program Design and Advisory
marcelle@theamlshop.ca
LinkedIn

Marcelle Dadoun, Principal, Program Design and Advisory leads The AML Shop's compliance program design division and provides advisory support to all reporting types, including new and evolving money services businesses, payment service providers and fintech clients looking to navigate local and international regimes for registration, licensing, and regulations. Additionally, she has developed and currently leads the Retail Payment Activities Act (RPAA) program division at The AML Shop. Read more.

Reach out to a RPAA expert today.