Businesses that perform certain retail payment activities in Canada, or provide payment services to customers in Canada, may need to register with the Bank of Canada under the Retail Payment Activities Act (RPAA).

Whether RPAA registration is required depends on the payment functions a business performs, whether those activities involve electronic funds transfers, where the business operates and whether any exclusions apply.

The RPAA applies to a range of payment service providers (PSPs), including businesses involved in payment processing, electronic money transfers, digital wallets and other payment services.

Businesses do not necessarily need to be incorporated or physically located in Canada to fall within the legislation.

The Bank of Canada’s criteria for registering payment service providers set out four key questions businesses can consider when determining whether registration is required.

What Is Canada’s Retail Payment Activities Act (RPAA)?

The Retail Payment Activities Act establishes a regulatory framework for payment service providers operating in the Canadian retail payments market.

The Bank of Canada is responsible for supervising PSPs under the legislation, with the aim of strengthening the safety and reliability of retail payment services.

The framework covers registration, operational risk management, incident response, safeguarding of end-user funds and regulatory reporting.

The RPAA’s registration provisions came into force in November 2024, while requirements relating to operational risk management and safeguarding became effective on September 8, 2025.

Businesses entering the market after that date must obtain registration before beginning activities that fall within the RPAA.

How Do I Know If My Business Needs RPAA Registration?

The Bank of Canada uses four criteria to help determine whether a business needs to register.

A business will generally need to register if all four conditions are met.

1. Does Your Business Perform a Payment Function?

The RPAA identifies five payment functions that may bring a business within its scope:

  1. Providing or maintaining payment accounts: Maintaining an account on behalf of an end user for the purpose of conducting electronic funds transfers.
  2. Holding end-user funds: Holding funds on behalf of customers until they are transferred or withdrawn.
  3. Initiating electronic funds transfers: Initiating payments at the request of an end user.
  4. Authorizing or facilitating payment instructions: Authorizing electronic funds transfers or transmitting, receiving or facilitating related payment instructions.
  5. Providing clearing or settlement services: Providing services that support the clearing or settlement of electronic funds transfers.

A business does not need to perform all five functions to fall within the RPAA.

Performing just one qualifying payment function may be sufficient to trigger registration requirements.

However, the payment function must be performed as a service or business activity rather than merely being incidental to another activity.

For example, a company whose primary business is processing electronic payments for merchants may fall within scope, whereas a business that processes payments solely to support the sale of its own products may be treated differently.

The Bank of Canada’s RPAA registration criteria provide further examples to help businesses assess the payment functions they perform.

2. Does Your Business Perform Retail Payment Activities?

The second consideration is whether the payment functions relate to electronic funds transfers.

An electronic funds transfer generally involves moving money electronically between a payer and a payee.

Examples can include debit and credit card payments, electronic transfers between individuals, direct deposits and other electronic payment transactions.

The RPAA can apply to transactions involving Canadian dollars or foreign currencies.

Businesses processing payments in currencies other than Canadian dollars may therefore still fall within scope. The nature of the payment activity, rather than simply the currency used, is an important consideration.

3. Does Your Business Operate in Canada or Serve Canadian Customers?

The RPAA applies to PSPs that have a place of business in Canada and perform retail payment activities.

Being based outside Canada does not automatically put a business outside the scope of the RPAA.

A foreign PSP may fall within scope where it both:

  • performs retail payment activities for end users located in Canada; and
  • directs its retail payment services at individuals or businesses in Canada.

The Bank of Canada considers a range of factors when determining whether services are directed at the Canadian market.

These can include advertising aimed at Canadian customers, operating a Canadian website, maintaining relationships with Canadian businesses or otherwise actively targeting the Canadian market.

International payment businesses should therefore consider their Canadian activities even if they have no physical presence in the country.

A business’s location alone does not determine whether registration is required.

4. Does an Exclusion Apply to Your Business?

Not every business performing payment-related activities must register under the RPAA.

The legislation includes exclusions for certain types of financial institutions and specific payment activities.

For example, banks, authorized foreign banks and certain provincially regulated financial institutions are excluded.

Certain activities may also fall outside the legislation, including qualifying closed-loop payment arrangements, certain securities-related transactions and some payment functions performed incidentally to another business activity.

It’s important to consider each activity separately, as an exclusion that applies to one service may not apply to others.

Firms should therefore assess their activities individually rather than assuming that an exclusion applies to their entire business.

The exclusions are set out in the Retail Payment Activities Act, alongside further guidance provided by the Bank of Canada.

Which Types of Businesses May Need RPAA Registration?

The RPAA can apply to a broad range of businesses operating within the payments sector.

Depending on the activities performed, these may include payment processors, payment gateways, money transfer businesses, digital wallet providers, merchant payment service providers and businesses offering electronic payment accounts.

Some financial technology businesses providing payment services alongside other products may also fall within scope.

Whether registration is required ultimately depends on the payment activities the business actually performs.

A payment gateway, for example, may need to register depending on the payment functions it actually performs, even if it never directly holds customer funds.

Similarly, a business providing a digital wallet service may need to consider whether it maintains payment accounts, holds end-user funds or performs other qualifying payment functions.

The Bank of Canada assesses the activities performed rather than relying solely on how a business describes itself.

What Happens If My Business Needs to Register?

Businesses within scope must apply for registration through the Bank of Canada’s PSP Connect system.

The application requires information about the business, its ownership and management, payment activities, operating arrangements and other relevant matters.

Applicants may also need to provide information about their operational risk management arrangements, safeguarding methods and relationships with agents or third-party service providers.

Registration is not automatic. Applications are assessed by the Bank of Canada, with national security screening coordinated by the Department of Finance.

Registration should not be confused with obtaining a banking licence, nor does it represent an endorsement of the PSP by the Bank of Canada.

What Are the Ongoing Requirements Under the RPAA?

Registration is only one part of a PSP’s regulatory responsibilities.

Businesses within scope must also meet applicable requirements relating to operational risk management, incident response, safeguarding and regulatory reporting.

Operational Risk Management

PSPs must establish and maintain a framework for identifying, managing and responding to operational risks.

This includes appropriate systems, controls, governance and procedures for responding to incidents that could affect payment services.

Safeguarding End-User Funds

PSPs that hold end-user funds must have appropriate safeguarding arrangements designed to protect those funds and ensure customers can access them.

The requirements include maintaining a written safeguarding framework and using an appropriate safeguarding method.

Regulatory Reporting

Registered PSPs are subject to reporting obligations, including annual reporting and notifications relating to certain incidents, significant changes and new activities.

These obligations require firms to maintain appropriate records, oversight and compliance arrangements after registration.

Further information is available through the Bank of Canada’s retail payments supervisory framework.

How Neopay Global Can Help

Working out whether the RPAA applies to your business isn’t always straightforward, particularly if you offer several payment services or operate across different markets.

Neopay Global can help you understand where your business sits within the framework and what you need to do next. We can review the payment activities you provide, help determine whether registration with the Bank of Canada is required, and support you through the application process.

Our support doesn’t end with registration. We can also help you put the right arrangements in place to meet your ongoing RPAA obligations, including operational risk management, safeguarding, regulatory reporting and financial crime compliance.

If you’re unsure how the RPAA applies to your business, speak to our team. We can review your activities with you and help you understand the requirements that apply.

Frequently Asked Questions

Does every payment service provider need to register under the RPAA?

No. Registration depends on the payment functions performed, whether those activities involve electronic funds transfers, the geographic scope of the business and whether any exclusions apply.

Businesses should assess their activities against the Bank of Canada’s registration criteria.

Do foreign payment service providers need RPAA registration?

Yes, in some circumstances.

A PSP located outside Canada may need to register if it performs retail payment activities for end users in Canada and directs those services at the Canadian market.

A physical office or Canadian incorporation is not necessarily required.

Does my business need to register if it does not hold customer funds?

Yes. A business may still need to register even if it does not hold customer funds.

Holding end-user funds is only one of the five payment functions identified under the RPAA.

Businesses performing other qualifying functions, such as initiating electronic funds transfers or facilitating payment instructions, may still need to register.

Are small payment businesses exempt from RPAA registration?

There is no general exemption based solely on a business being small or processing a low volume of transactions.

Registration depends primarily on the activities performed and whether the business falls within the legislation’s scope.

Does a digital wallet provider need RPAA registration?

It can. Digital wallet providers may fall within scope where they perform qualifying payment functions, such as maintaining payment accounts, holding end-user funds or facilitating electronic funds transfers.

The specific activities performed and any applicable exclusions must be considered.

Does RPAA registration replace FINTRAC registration?

No.

The RPAA and Canada’s anti-money laundering and anti-terrorist financing framework are separate regulatory regimes.

A business may need to register with the Bank of Canada under the RPAA and also meet applicable FINTRAC registration and compliance requirements.

How much does RPAA registration cost?

The Bank of Canada’s published registration application fee is CAD $2,500.

The fee is non-refundable and is subject to annual adjustment for inflation, so applicants should confirm the current fee before submitting an application.

There may also be additional costs associated with preparing an application and putting the necessary RPAA compliance arrangements in place.

What happens if a business operates without RPAA registration?

Businesses that are required to register must obtain registration before beginning retail payment activities.

Operating without the required registration can constitute a violation of the RPAA and may result in regulatory enforcement action.

The Bank of Canada’s frequently asked questions about retail payments supervision provide further information on registration and compliance expectations.

How can I check whether my business needs RPAA registration?

Businesses can use the Bank of Canada’s registration criteria and self-assessment questionnaire to help determine whether they fall within scope.

The questionnaire is intended as a guidance tool rather than an official regulatory determination.

Where the position is unclear, businesses should consider obtaining professional advice before deciding whether registration is required.

Useful Bank of Canada Resources

For businesses assessing their obligations under the RPAA, the following official resources may be useful: