Retail Payment Activities Act (RPAA)
Retail Payment Activities Act (RPAA) is the Canadian federal law under which the Bank of Canada registers and supervises payment service providers. It sets duties on operational risk, incidents, safeguarding end-user funds and reporting.
This page explains the rules in general terms and is not legal or regulatory advice. Check the primary source and take advice on how the rules apply to your firm.
Canada: Retail Payment Activities Act, supervised by the Bank of Canada. Risk management, safeguarding and annual reporting duties apply from 8 September 2025.
How it works
The RPAA was passed in 2021 and applies by function. A firm performing any of five payment functions can be covered. Physical presence in Canada is not required; serving Canadian end users, for example through direct marketing, likely brings a firm into scope. Entities overseen by OSFI and provincially supervised credit unions are excluded.
A provider must register with the Bank of Canada before performing retail payment activities. Providers already operating had to apply for registration during a window that ran from 1 to 15 November 2024. From 8 September 2025, providers must have risk management and safeguarding frameworks in place. They must also file an annual report.
Providers holding end-user funds must use a trust account, a prescribed arrangement, or a dedicated account backed by insurance or a guarantee. The bank holding a safeguarding account cannot claim a right of set-off. Providers must notify the Bank before significant changes or new activities. Incidents with a material impact must be reported without delay.
Example
Illustrative example: A UK remittance firm serving Canadian senders holds CAD 6,000,000 of their funds overnight. It can place the CAD 6,000,000 in a dedicated trust account. Under the insurance route, cover would need to be at least CAD 6,000,000. The funds would also sit in an account used for no other purpose.
Frequently asked questions
Does the RPAA apply to foreign payment companies?
It can. The Bank of Canada has said a provider does not need a physical presence in Canada. Offering services to Canadian end users, for example through a Canadian website, likely brings a firm into scope.
Does RPAA registration replace FINTRAC registration?
No. The RPAA is a separate regime run by the Bank of Canada. Remitly, for example, discloses registration with FINTRAC as a money services business alongside a pending Bank of Canada registration.
Related terms
Sources
- Retail payments supervision · Bank of Canada
- Retail Payment Activities Act, sections 17 to 29 · Justice Laws Website, Government of Canada
- Moving money with confidence: Canada's new regime for retail payments supervision · Bank of Canada
- Remitly Global, Inc. Form 10-K for fiscal year 2024 · U.S. Securities and Exchange Commission (EDGAR)
Know where all your money is.
Polynopsis gives cross-border payment teams one live position across every bank, payout partner, exchange and wallet, including money in flight, and warns before a corridor runs dry.