Although some PSPs may already be registered as MSBs with FINTRAC, RPAA compliance is a distinct requirement and demands its own operational, technological, and governance safeguards.

What Is the Retail Payment Activities Act (RPAA)?

The RPAA is federal legislation enacted in 2021 to improve oversight of payment services offered to individuals and businesses in Canada. Administered by the Bank of Canada, the RPAA creates a registration and supervisory framework for businesses that:

• Transfer or hold client funds

• Execute or initiate payment instructions

• Transmit payment messages related to retail transactions

This applies to a wide range of entities, including:

• Digital wallet providers

• Cross-border remittance companies

• Crypto platforms offering payment-like services
  
  

• FinTech startups providing embedded payment rails

• Foreign PSPs targeting the Canadian market

For more information on MSB registration under FINTRAC, visit MSB Registration.

Why RPAA Compliance Matters

The goal of the RPAA is to ensure that PSPs handle payment data and client funds responsibly. The Act addresses growing concerns around:

• Operational risk in digital payment systems

• Safeguarding of user funds in case of provider insolvency

• Regulatory visibility into payment flows and participants

Failure to comply can result in:

• Administrative monetary penalties

• Revocation of registration

• Regulatory investigations

• Reputational damage with partners, banks, and regulators

To assess your business's current state of readiness, consider a full Effectiveness Review.

Who Must Register Under the RPAA?

Any business that performs a retail payment activity for an end user located in Canada must register with the Bank of Canada under the RPAA, even if the business is based outside the country.

Covered activities include:

• Holding funds in user accounts or wallets

• Initiating or executing payment instructions

• Transmitting payment messages or clearing instructions

Entities already regulated under other federal frameworks—such as banks, credit unions, and trust companies—are exempt from RPAA registration. However, most FinTechs, crypto exchanges, and non-bank payment startups are not exempt and must register if they perform covered retail payment activities for users in Canada.

If you're currently non-compliant and need help, Regulatory Remediation services can help you avoid costly missteps.

Key RPAA Compliance Requirements

Once registered, PSPs must meet ongoing compliance obligations in the following areas.

1. Operational Risk Management

You must implement an internal framework that includes:

• Cybersecurity protocols and incident response plans

• Business continuity and disaster recovery procedures

• Vendor and third-party risk management controls
  
  

2. Safeguarding End-User Funds

Any funds held on behalf of users must be:

• Segregated from operational capital

• Held in eligible financial institutions or protected via trust or insurance

• Accurately reconciled through real-time or periodic controls

3. Recordkeeping and Audits

Maintain comprehensive records for at least five years, covering:

• User transactions

• Operational risk reviews

• System logs

• Internal control updates
  
  

4. Reporting and Notifications

PSPs must report:

• Significant operational incidents

• Changes to business structure or beneficial ownership

• Annual compliance attestations and metrics

Key RPAA Implementation Timeline

As of 2025, the RPAA rollout is underway with these key milestones:

PSPs are advised not to wait. Early preparation ensures smoother onboarding, avoids rejected applications, and demonstrates good faith with regulators.

How RPAA Interacts with MSB Obligations

If you're already registered as a Money Services Business (MSB) with FINTRAC, that does not exempt you from RPAA compliance. In fact, many businesses will require dual registration.

Examples:

• A remittance company that stores user funds before transfer

• A digital wallet with virtual currency support

• A payment gateway offering merchant settlement services
  
  

In such cases, you’ll need to align your AML compliance program with your operational risk controls under RPAA. To support this, explore CAMLO/MLRO Services.

Also see our blog on Navigating Compliance Challenges in FinTech for insight on working across overlapping regimes.

Solutions to Help You Comply with RPAA

Preparing for RPAA compliance requires expertise in:

• Operational risk and systems audits

• Legal registration and documentation

• Reporting and supervisory readiness

AML Incubator offers tailored support to PSPs through:

• CAMLO/MLRO Services

• MSB & RPAA Registration

• Regulatory Remediation

• EDD Services

• Token Due Diligence

We also provide guidance on international compliance strategies, such as those discussed in our blog on Challenges Facing European VASPs & MSBs.

Final Takeaways for Canadian PSPs

The Retail Payment Activities Act represents a significant evolution in Canadian financial regulation. It brings transparency and accountability to the digital payments ecosystem and creates a level playing field across traditional and modern payment players.

If you are a payment service provider—whether startup or enterprise—this is the time to review your service model, assess your operational risks, and prepare for regulatory oversight.

For trusted support and practical solutions, AML Incubator remains your partner in navigating RPAA compliance.

Your Trusted Partner in Regulatory Excellence.