Canada · Registration
Bank of Canada PSP Registration under the RPAA
Registration with the Bank of Canada under the Retail Payment Activities Act — a separate regime from FINTRAC, focused on operational risk and safeguarding, not AML.
At a glance
Do you need to register?
Three tests. All three must be true.
The RPAA catches far more businesses than most founders expect, because the test is functional rather than commercial — and there is no size threshold to hide behind.
You perform a payment function
Any one of the five defined in the Act: providing or maintaining an end-user account, holding end-user funds, initiating an electronic funds transfer, authorising a transfer or transmitting a payment instruction, or providing clearing or settlement. One is enough.
You reach Canadian end-users
Either you have a place of business in Canada, or you direct retail payment activities at Canadian end-users from abroad. Foreign PSPs register directly — no Canadian incorporation needed — but must name a Canadian agent or mandatary to receive notices.
You are not an excluded entity
Banks, insurers, trust and loan companies and credit unions are excluded by category, as are closed-loop instruments, securities transactions and ATM withdrawals. The list is narrow, and there is no de minimis volume exemption — a single-transaction fintech still registers.
Being an affiliate of an exempt bank does not itself exempt you — only entities inside OSFI's consolidated supervision escape registration. This is one of the most commonly misread parts of the regime, and worth confirming before you assume you are out of scope.
This is not FINTRAC, and one does not cover the other
The RPAA governs operational risk and the safeguarding of end-user funds. FINTRAC's MSB regime governs anti-money laundering. They are different regulators under different statutes, and most payment businesses need both — the Bank can refuse an RPAA application where the applicant lacks required AML registration or carries a poor FINTRAC compliance record. See the FINTRAC MSB registration
Overview
Canada's newest payments regime — and a genuinely different one.
The RPAA's registration requirement took effect in phases: applications opened November 1, 2024, mandatory registration followed from November 16, and its substantive obligations — safeguarding, risk management, the public PSP registry — came fully into force on September 8, 2025, the day the Bank of Canada's own supervisory mandate began. It's not a rebadged version of FINTRAC's MSB regime: the RPAA governs operational risk and the safeguarding of end-user funds for retail payment activities, while FINTRAC governs AML/CFT — a business can need both registrations, or just one, depending on what it actually does. Annual reporting, due every March 31, is now a standing obligation.
The distinguishing feature of this regime is who gets screened, and how far that screening reaches.
Requirements in detail
What you actually need.
Incorporation
No Canadian incorporation is required. A foreign payment service provider can register directly if it has a place of business in Canada or directs retail payment activities at Canadian end-users from abroad — you'll need to name a Canadian agent or mandatary to receive notices on your behalf, a separate appointment from FINTRAC's Representative requirement even if the same person can sometimes fill both roles. If you also have agents or mandataries actually performing payment functions on your behalf, that's a separate, broader disclosure of its own.
Capital
None. Like FINTRAC's MSB regime, the Bank of Canada doesn't set a minimum capital requirement for RPAA registration — its focus is operational risk and safeguarding end-user funds, not prudential capital adequacy. There is a one-time $2,500 CAD registration fee, though — non-refundable, paid through the Bank's PSP Connect portal.
Directors
No RPAA-specific minimum — the same position as FINTRAC's MSB regime, governed by whichever corporate law you're incorporated under. Once registered, you'll need risk-management and end-user fund safeguarding frameworks in place, plus annual reporting to the Bank of Canada — obligations that start immediately, not after a probation period.
Governance & people
The distinctive requirement here is national security screening, coordinated by the Department of Finance, not the Bank itself — and it reaches a precisely defined list, not a vague standard: anyone holding 10%+ of the votes to elect directors (or an equivalent profit/asset interest for non-corporate entities), every director, your five most highly-compensated senior officers, your five largest creditors by amount owed, and any state-owned enterprise with an ownership stake or board-appointment power. Once the Bank considers your application complete, it has its own 45-day window to decide on ordinary grounds; separately, the Minister has up to 60 days to decide whether a full national-security review is warranted, and if one is triggered, up to 180 more days to conclude.
Ongoing obligations
Annual reporting to the Bank of Canada is due every March 31. A change of control — crossing the one-third voting threshold — triggers a fresh registration application, and you have just 5 business days to notify the Bank once such a deal closes. The Bank hasn't yet finalised its annual assessment/supervisory fee formula, so budget for it as a known future cost rather than a fixed number today. Non-compliance carries real teeth: administrative monetary penalties up to $1,000,000 per serious violation, or up to $10,000,000 for a very serious one.
Not sure this is the right permission?
A scoping call maps your regulatory perimeter and confirms which regime actually applies — before any documentation work starts.
Time & cost
What actually drives both.
Two clocks run here, and they run in parallel rather than in sequence — which is why the headline numbers are easy to misread.
The Bank's own decision window is 45 days
Once your application is deemed complete, the Bank of Canada has 45 days to decide on ordinary, non-security grounds. This is the fast track, and it is entirely gated on completeness.
National security screening runs separately
The Minister of Finance has up to 60 days to decide whether a full national security review is warranted, and if one is triggered it has up to 180 further days to conclude — extendable. Budget for the possibility, not just the base case.
The screening reaches further than the company
Disclosure covers anyone holding 10% or more of the votes to elect directors, every director, your five most highly-compensated senior officers, your five largest creditors by amount owed, and any state-owned enterprise with an ownership stake or board-appointment power. Assembling this accurately takes longer than firms expect.
The frameworks must exist before you file
Risk-management and end-user fund safeguarding frameworks have been required since 8 September 2025, and the Bank expects them to be operating rather than drafted. Choosing a safeguarding method — trust account, insurance, guarantee or a provincial deposit-insurance scheme — is a structural decision with its own lead time.
Registration fee
$2,500 CADOne-time, non-refundable, paid by card through the Bank's PSP Connect portal on submission. Adjusted annually by CPI and published each December in a fee bulletin.
Capital
NoneThe RPAA sets no minimum capital requirement. Its focus is operational resilience and the safeguarding of end-user funds, not prudential capital adequacy.
Annual supervisory fee
Not yet setThe Bank has not finalised its cost-recovery formula, so this remains a known future cost rather than a fixed number. Worth provisioning for even though it cannot yet be quantified.
Our fee
Scoped and fixed once we have confirmed which of the five payment functions you perform, whether you are also caught by FINTRAC, and which safeguarding method fits your model. No hourly drift.
Process & timeline
From scoping to registration.
Registration since Nov 2024 · fully in force Sept 2025
Scoping & framework design
Confirm you're performing one of the RPAA's defined retail payment functions, then design the risk-management and end-user fund safeguarding frameworks the Bank of Canada requires to be in place.
Documentation & screening prep
Prepare the frameworks, governance documentation, and the ownership/control information the national security screening will assess — covering owners, senior officers, directors and anyone with significant influence.
Registration & screening
Submit through the Bank of Canada's registration system. Once your application is complete, the Minister has up to 60 days to decide whether a full national security review is warranted; if triggered, that review has up to 180 days to conclude.
Live & ongoing
Once registered, your risk-management and safeguarding frameworks need to actually be operating, not just on paper, and annual reporting to the Bank of Canada is a standing obligation from the outset.
What we prepare
The compliance programme.
20 documents, mapped directly to the Bank of Canada's own registration application — a newer, still-maturing regime, but no longer a vague one.
Business, Ownership & Screening Disclosure
The information the Bank's national security screening actually assesses — a precisely defined list, not a vague standard.
+ supporting corporate records
Payment Functions & Operations
How your business fits the RPAA's five statutory payment functions, and how it actually operates.
+ supporting diagrams
Risk & Safeguarding Frameworks
Choose from four safeguarding methods — trust account, insurance, guarantee, or a provincial deposit-insurance scheme — under the Bank's own supervisory guidelines.
Bank of Canada: Safeguarding of End-User Funds guideline
Registration & Ongoing Reporting
What the Bank needs to register you through PSP Connect, and what stays live afterward.
+ supporting registers
We build this pack, not a template of it.
Every document is written against your actual services, customers and jurisdictions — which is what makes it survive a regulator’s review and a bank’s due diligence alike.
Who does the work
Senior people, start to finish.
Every registration is scoped, built and submitted by senior team members who understand fintech and this specific regime — never delegated to a junior bench.
FAQ
Questions worth asking up front.
They cover different things entirely. FINTRAC's MSB regime is about AML/CFT for money services activity — money transfer, forex, virtual currency exchange. The RPAA is about operational risk and safeguarding end-user funds for retail payment activities. A business doing both types of activity typically needs both registrations, not one or the other — and the Bank can refuse an RPAA application where the applicant lacks required AML registration or has a poor FINTRAC compliance record, so most PSPs need both in place together.
A precisely defined list, not a vague standard: anyone holding 10% or more of the votes to elect directors (or an equivalent profit/asset interest for non-corporate entities), every director, your five most highly-compensated senior officers, your five largest creditors by amount owed, and any state-owned enterprise with an ownership stake or the power to appoint your CEO or board. This is coordinated by the Department of Finance, not the Bank of Canada itself.
Two clocks run in parallel. The Bank of Canada itself has 45 days from a complete application to decide on ordinary, non-security grounds. Separately, the Minister of Finance has up to 60 days to decide whether a full national-security review is warranted — and if one is triggered, that review has up to 180 more days to conclude. Budget for the longer combined timeline, not just the fastest track.
No. A foreign PSP can register directly if it has a Canadian place of business or directs retail payment activities at Canadian end-users from abroad. You'll need a Canadian agent or mandatary to receive notices on your behalf.
Risk-management and end-user fund safeguarding frameworks have to be genuinely operating, not just documented, and annual reporting to the Bank of Canada — due every March 31 — is a standing obligation from day one. This is a live supervisory relationship, not a one-time registration event.
A defined list, but no minimum-size exemption. Banks, insurers, trust and loan companies, credit unions, and a handful of other regulated entities are excluded by category — but there's no de minimis volume threshold. Even a single-transaction fintech performing one of the five statutory payment functions has to register. Closed-loop instruments, securities transactions, ATM withdrawals and a few other specific activity types are excluded, but the exemption list is narrow — worth checking precisely rather than assuming your model qualifies.
Real financial exposure on an escalating ladder: a warning letter, then a compliance agreement, then a formal notice of violation carrying an administrative monetary penalty — up to $1,000,000 for a serious violation, up to $10,000,000 for a very serious one — then a compliance order and potential court enforcement. The Bank also runs a public registry of registered PSPs and publishes enforcement outcomes once concluded, so non-compliance isn't a quiet risk.
Other regimes
Not the right fit? See the others.
Secure your Canada PSP,
secure your future.
Book a scoping call and we’ll map your fastest, most defensible path to registration.