RPAA registration for payment service providers

What is RPAA registration?

RPAA registration is how a payment service provider (PSP) gets on the Bank of Canada's registry. The Retail Payment Activities Act is the federal law that brought PSPs under the Bank's supervision.

Supervision began on September 8, 2025, after a transition period from November 1, 2024 to September 7, 2025. Since then, a PSP must be registered before it performs any retail payment activity.

For Canadian rails, see our payments API for fintechs and PSPs, or payments for money service businesses if you're also an MSB.

Who has to register under the RPAA?

The Bank of Canada says you must register if all four of these are true.

1. You're a payment service provider

   You perform payment functions as a service or business activity, and not just as a side part of another business.

2. You perform retail payment activities

   These are payment functions for electronic funds transfers, in Canadian dollars, another currency or a prescribed unit.

3. You're within the Act's geographic scope

   You have a place of business in Canada, or you serve end users here and direct your services at them.

4. You aren't excluded

   Neither your business nor your activities fall under one of the exclusions below.

The five payment functions

You need to perform at least one of these.

• Providing or maintaining an account held on behalf of one or more end users
• Holding funds on behalf of an end user
• Starting an electronic funds transfer at an end user's request
• Authorizing an electronic funds transfer, or sending, receiving or facilitating its instructions
• Providing clearing or settlement services

An end user is any person or business that uses a payment service as a payer or a payee.

Geographic scope

A physical location in Canada counts as a place of business here. So does a Canadian incorporation, or employees, agents or mandataries in Canada. One of them is enough.

A foreign PSP with no place of business here can still be in scope. It is if it serves end users in Canada and directs its activities at Canada. The Bank's examples include marketing aimed at Canada, a .ca domain and a Canadian business directory listing.

Who doesn't have to register?

Some businesses are excluded because of what they are. They include:

• banks and authorized foreign banks;
• federally regulated insurance, trust and loan companies;
• certain provincially regulated deposit-taking institutions, such as credit unions.

Some activities are excluded too. Examples include ATM cash withdrawals, payment functions within designated financial market infrastructures, and internal transfers between affiliated entities.

An agent or mandatary acting for a registered PSP, within its authority, doesn't register for that work. The PSP answers for its agents instead.

Third-party service providers aren't excluded. These are businesses that supply a PSP with a payment-related service under contract, and the PSP must disclose them.

The Bank's policy, Criteria for registering payment service providers, sets out every test with examples.

How to register with the Bank of Canada

1. Create a PSP Connect account

   PSP Connect is the Bank's portal for applications, updates, fees and reports. You can't register without an account.

2. Prepare your information

   Gather everything in the list below before you start. It covers your agents, mandataries and affiliated entities as well as your own business.

3. Pay the application fee

   The fee is $2,500, paid by credit card or electronic funds transfer. It's non-refundable, and the Bank starts its assessment only once it's paid.

4. Complete and submit the application

   Fill in the form in PSP Connect. The Bank then begins reviewing your application.

5. Wait for the national security screening

   The Bank shares each application with the Department of Finance Canada for a national security screening, and with FINTRAC. It may also ask you for more information.

6. Get your decision

   The Bank either registers you or refuses the application. Registered PSPs appear on its public registry.

What does the RPAA application ask for?

The Bank of Canada lists this information for the application.

• Contact details, including for any third parties, agents, mandataries and affiliated entities
• Your business structure, ownership, debtholders and key staff
• The payment functions you perform, including those done by agents, mandataries or affiliates
• Actual or projected values and volumes of end-user funds, inside and outside Canada
• Actual or projected numbers of end users, inside and outside Canada
• How you safeguard end-user funds
• Whether you have, or plan, a risk management and incident response framework
• Any payment registrations with FINTRAC or other federal, provincial or territorial authorities

How long does RPAA registration take?

The Bank doesn't publish a fixed timeline. Its review starts once your fee is paid, and decisions follow the national security screening.

Start early. You can't perform retail payment activities until you're registered. The Bank calls failing to register a very serious violation, which can bring a substantial penalty.

What you must do once you're registered

Manage operational risk

You must set up, run and maintain a framework to manage operational risk and respond to incidents. This rule has applied since September 8, 2025.

Report incidents without delay

Some incidents have a material impact on an end user, another PSP or a clearing house. When that happens, notify them and the Bank without delay.

Safeguard end-user funds

If you hold users' funds until they're withdrawn or transferred, you have two options:

• hold them in trust, in a trust account used for nothing else; or
• hold them in an account used for nothing else, with insurance or a guarantee for those funds.

Tell the Bank before you change

Notify the Bank at least 5 business days before a significant change or a new activity. If someone plans to acquire control of your business, you must file a new application before the acquisition.

Report every year, and pay your fees

Your annual report is due by March 31 for the year before. You must also pay an annual assessment fee, which covers the Bank's supervision costs.

Registration doesn't expire, but the Bank can revoke it. Grounds include no longer performing retail payment activities, a violation of the Act and an unpaid assessment fee.

Do you need FINTRAC registration as well?

You might. RPAA registration and FINTRAC registration are separate, under separate laws. The RPAA looks at operational risk and safeguarding; FINTRAC looks at anti-money laundering.

Under FINTRAC's rules, some payment services count as remitting or transmitting funds. Examples are paying invoices on a payer's behalf, and standing between a buyer and a seller. A PSP that does this also registers with FINTRAC as a money services business.

Our FINTRAC MSB registration guide walks through that process.

Both registrations matter if you want to join Interac e-Transfer directly, because Interac asks PSPs for them. Our guide to Interac e-Transfer access for payment service providers covers who can apply.

Invincible Pay holds both registrations. We're registered with FINTRAC as a money services business (C100000702) and registered with the Bank of Canada as a payment service provider under the Retail Payment Activities Act.

What Bank of Canada registration means

It means you met the legal requirement to register. The Bank of Canada says it doesn't endorse or license registered PSPs. Registered PSPs stay subject to its supervision and enforcement.

So describe it exactly: "registered with the Bank of Canada as a payment service provider under the Retail Payment Activities Act". Words like "licensed" or "approved" overstate it.