Remittance companies
Crypto OTC desks
Bitcoin ATM operators
ATM operators
Small businesses
On this page
- What does the RPAA say about safeguarding funds?
- Which accounts and insurers does the law allow?
- What happens to your money if a payment provider fails?
- What happened with XTM and the Bank of Canada?
- Is safeguarding the same as deposit insurance?
- Questions to ask any payment provider about where your money sits
- How Invincible Pay safeguards your funds
- Frequently asked questions
RPAA safeguarding: what happens to your money if your payment provider fails?
RPAA safeguarding is the rule that makes a payment provider keep your funds apart from its own money, so they can come back to you if the provider fails. The safeguarding requirements in the Retail Payment Activities Act came into force on September 8, 2025, when the Bank of Canada began supervising payment service providers. If a provider becomes insolvent, the money set aside for you must be paid to you as soon as feasible.
If you're still working out whether your own business has to register, start with our guide to RPAA registration. This post covers the other side: what the law makes a provider do with your money once it holds it.
What does the RPAA say about safeguarding funds?
Section 20 of the Act applies to any payment service provider that holds your funds until you withdraw them or send them on. As of October 2026, the provider must use one of these methods:
A trust account. The funds are held in trust, in an account used for nothing else.
A dedicated account plus insurance. The funds sit in an account used for nothing else, and the provider holds insurance or a guarantee for at least the amount in that account.
A method set by regulation. The Act lets the government prescribe another type of account, along with the measures that must come with it.
Section 20 also blocks set-off. In plain words, the financial institution that holds the account can't take your money to cover a debt the provider owes it.
Which accounts and insurers does the law allow?
The details sit in the Retail Payment Activities Regulations, sections 13 to 17, under the heading "safeguarding of funds".
Section 13 says the account must be with a financial institution listed in the Act, or with a foreign one held to comparable standards. A provider can't park your funds just anywhere.
Section 14 sets the rules for the insurance option. The insurer must not be affiliated with the provider. The payout can't become part of the provider's estate, and it must still pay out after a bankruptcy or restructuring. The provider also has to tell the Bank of Canada at least 30 days before the policy is cancelled or ends.
What happens to your money if a payment provider fails?
The regulations spell out when the protection kicks in. It starts when the provider files for insolvency, when it agrees to an insolvency proceeding, or 30 days after someone else starts one that isn't dismissed. From that point, the safeguarded funds or the insurance payout must go to users as soon as feasible.
To make that possible, section 15 requires every provider to keep a written safeguarding framework. It must include:
A daily record of each user's name, contact details and end-of-day balance.
A plan to hold funds in secure and liquid assets.
A way for a trustee or insurer to reach the records, contact users and fix errors or shortfalls.
A senior officer must approve the framework every year. Section 17 adds an independent review at least every 3 years.
The law sets no fixed number of days for repayment. It also can't help much if a provider never set the money aside in the first place. Rules work only when they're followed, and that's why the Bank of Canada now checks.
What happened with XTM and the Bank of Canada?
On February 17, 2026, the Bank of Canada ordered XTM Inc. to stop all retail payment activities, under section 94(4) of the Act. The Bank said it had "serious concerns that XTM failed to safeguard client funds in its possession."
On February 27, 2026, the Bank revised the order so XTM could restart its payment activities under the supervision of a court-appointed monitor. The case put safeguarding in the news for business owners across Canada.
The lesson for you is simple. A provider's promise is worth checking.
Is safeguarding the same as deposit insurance?
No. Deposit insurance covers eligible deposits at member banks and some other deposit-taking institutions, up to set limits. A balance in a payment wallet is a different thing, and the RPAA protects it a different way.
Safeguarding keeps your funds separate and sets out a path to return them if the provider fails. How well it works depends on the method the provider picked and how carefully it keeps its records.
Questions to ask any payment provider about where your money sits
Your bank won't ask these for you. Before you move your business's money, ask:
Which of the 3 safeguarding methods in section 20 do you use?
Which financial institution holds the account, and is that account used for anything else?
If you use insurance, who provides it? Is the insurer separate from your company, and does it cover the full amount?
Are you registered with the Bank of Canada as a payment service provider?
If you hold my funds, how quickly can I withdraw them on a normal business day?
A good provider answers all 5 in writing without fuss. If a provider dodges question 1, treat that as your answer.
How Invincible Pay safeguards your funds
Invincible Pay is a payment wallet registered with the Bank of Canada as a payment service provider under the Retail Payment Activities Act. We're also registered with FINTRAC as a money services business, registration no. C100000702.
Your funds are safeguarded under the Retail Payment Activities Act: kept separate from our own money, in a dedicated account covered by insurance, as the Act requires.
You can read more on our security page. If you run a money services business, see how Interac e-Transfer, EFT, same-day wires and our API with webhooks fit together in one wallet on our MSB page.
Next step: write down the 5 questions above and ask your current provider. Then book a 15-minute call with our team and we'll answer the same 5 for Invincible Pay.
Frequently asked questions
What is RPAA safeguarding?
It's the duty in section 20 of the Retail Payment Activities Act for a payment provider to keep users' funds apart from its own. The provider must use a trust account, a dedicated account with insurance or a guarantee, or another method the regulations allow. The goal is to get funds back to users quickly if the provider fails.
When did the RPAA safeguarding rules start?
They came into force on September 8, 2025. That's the day the Bank of Canada began supervising payment service providers under the Retail Payment Activities Act. Providers had to have a written safeguarding framework in place from that date.
Is money in a payment wallet covered by deposit insurance?
No. A payment wallet balance isn't a deposit. The RPAA protects it through safeguarding instead: the provider keeps your funds separate and must return them as soon as feasible if it becomes insolvent.
Can a payment provider use my funds to run its business?
No. Under the RPAA, safeguarded funds must sit in an account used for nothing else. The institution holding that account also can't use your money to cover a debt the provider owes it.
How much does Invincible Pay cost?
Our price is $1.95 + 0.20% per transaction. Money services businesses also pay a $500 one-time setup fee and a $500 monthly minimum that counts toward transaction fees. From November 1 to January 7, MSBs onboarded by January 7 get the setup fee and monthly minimum waived. Wires and the crypto ramp: reach out for pricing. See our pricing page.
