Retail Payment Activities Act (RPAA)

The Retail Payment Activities Act (RPAA) is the Canadian federal law that created a supervisory framework for payment service providers (PSPs) that are not banks or otherwise prudentially regulated. It requires in-scope PSPs to register with the Bank of Canada, which supervises them, and to meet requirements on operational risk management, incident response, and the safeguarding of funds held for end users. Registration under the RPAA is separate from, and additional to, registration with FINTRAC as a money services business for anti-money laundering purposes.

The act received Royal Assent in June 2021 as part of the Budget Implementation Act, 2021, No. 1. Its accompanying Retail Payment Activities Regulations were finalized in 2023, the registration window opened in November 2024, and the operational risk and fund-safeguarding requirements took effect in September 2025.

Before the RPAA, Canada had no general federal regime for non-bank payment companies. Banks and credit unions were supervised for safety and soundness, and the Payment Clearing and Settlement Act gave the Bank of Canada oversight of systemically important payment systems, but payment apps, processors, digital wallets and money transfer firms faced only anti-money laundering rules under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act and, in Quebec, provincial money services legislation. The federal government's review of the payments system concluded that a growing share of payments flowed through firms that were not supervised for operational resilience or the protection of customer money. The RPAA was also seen as a step toward giving qualifying PSPs access to Canada's modernized payment systems, including the planned Real-Time Rail.

The RPAA applies to an individual or entity that performs one or more payment functions as a service or business activity, if it has a place of business in Canada, or if it is located outside Canada but performs retail payment activities for end users in Canada. The five payment functions are:

• Providing or maintaining an account held on behalf of end users.
• Holding funds on behalf of an end user.
• Initiating an electronic funds transfer at the request of an end user.
• Authorizing or transmitting an electronic funds transfer.
• Providing clearing or settlement services.

Exclusions include banks, credit unions and other prudentially regulated institutions, payment functions performed incidentally to another service, transactions within a designated payment system, and certain activities between affiliated entities. Agents and mandataries of PSPs may also be excluded where the principal PSP is responsible for them, an approach similar to the principal MSB model in the United States.

Registration

PSPs must apply to the Bank of Canada for registration. The Minister of Finance can review applications on national security grounds and refuse or impose conditions. Registered PSPs appear on a public registry and must notify the Bank of significant changes, such as a new activity or a change of control.

Operational risk and incident response

PSPs must establish, implement and maintain a risk management and incident response framework covering the integrity, confidentiality and availability of their systems and data, including oversight of third-party service providers. They must report incidents with a material impact to the Bank of Canada and to affected end users.

Safeguarding end-user funds

A PSP that holds end-user funds after the end of the business day must protect them from the claims of its other creditors, either by keeping them in a trust account at a regulated financial institution, separate from the PSP's own money, or by holding them in a dedicated account backed by insurance or a guarantee. The aim matches safeguarding in the UK and EU, where the equivalent pool is known as relevant funds. Firms must also keep records and reconcile the funds.

Reporting and supervision

PSPs must file annual reports and pay assessment fees. The Bank of Canada can conduct examinations, issue compliance agreements and impose administrative monetary penalties.

The two regimes address different risks. FINTRAC registration under the PCMLTFA concerns money laundering and terrorist financing: customer identification, record keeping, reporting of large and suspicious transactions, and compliance programs. RPAA registration concerns operational resilience and the safety of customer money. Many firms, including money transmitters and foreign money services businesses serving Canadians, must register with both, and failure to hold one registration is not cured by holding the other.

The RPAA brought Canada closer to the regimes for payment institutions in Europe and the UK, although it does not create a license with passporting rights or capital requirements of the kind set by PSD2. Consumer protection for PSP customers remains partly a matter for provincial law and, for banks, the Financial Consumer Agency of Canada.

• Bank of Canada