Canada’s Retail Payment Activities Act: what payment service providers must do since 2025-09-08

For years, many Canadian payment companies operated without a dedicated federal supervisor. That changed with the Retail Payment Activities Act (RPAA). Since 2025-09-08, payment service providers (PSPs) covered by the Act have been supervised by the Bank of Canada. This article summarizes who is covered, what they must do, and what it means for businesses that work with them.

What the RPAA is

The Retail Payment Activities Act is federal legislation that creates a supervisory framework for retail payment activities. The Bank of Canada supervises PSPs under the Act, with a focus on how they manage operational risks, respond to incidents and safeguard end-user funds. The Bank notes that matters such as dispute resolution, fees and privacy complaints fall outside its mandate.

Who is covered

A PSP is an entity that performs one or more payment functions as a service or business activity. The payment functions are, in summary, providing or maintaining a payment account, holding funds on behalf of end users, initiating electronic fund transfers, authorizing or transmitting them, and providing clearing or settlement services. The Act applies to PSPs in Canada and to certain foreign PSPs that serve end users in Canada. There are exclusions, for example for banks and certain other regulated entities, so each organization needs to assess its own position.

The timeline

• 2024-11-01: the Bank of Canada began accepting registration applications. Existing PSPs had until 2024-11-15 to apply.
• 2025-09-08: the remaining provisions came into force. From that date, PSPs must comply with obligations on operational risk management and safeguarding of end-user funds. The Bank also publishes a registry of PSPs.
• Each year by March 31: registered PSPs must submit an annual report to the Bank. The first was due no later than 2026-03-31.

The core obligations

1. Registration

PSPs must be registered with the Bank of Canada to perform retail payment activities. The Bank provides guides for registration applications and notices of significant change. A PSP may also need to apply again before certain changes, such as a change of control.

2. Risk management and incident response framework

PSPs must establish, implement and maintain a risk management and incident response framework to identify and mitigate operational risks. In practice, this touches information security, business continuity, third-party risk, roles and responsibilities, and regular testing and review. The Bank’s supervisory framework explains how it oversees compliance.

3. Incident reporting

When an incident has a significant impact, PSPs must notify affected end users, other PSPs or clearing houses, and report the incident to the Bank of Canada. This requires a clear internal process to detect, assess and escalate incidents quickly.

4. Safeguarding of end-user funds

PSPs that hold funds for end users must protect them, either in a trust account or in a segregated account backed by insurance or a guarantee.

5. Reporting and notices

Beyond the annual report, PSPs must notify the Bank of significant changes and new activities, using the forms and guides the Bank provides.

Enforcement

The Bank of Canada can take enforcement action, including administrative penalties of up to $10 million and revocation of registration. Enforcement decisions are published on the Bank’s website.

How this connects to PCI DSS and privacy

Many PSPs already handle card data and are subject to PCI DSS. Many are also subject to Quebec’s privacy law (Law 25) or the federal privacy law, PIPEDA. These frameworks overlap with the RPAA but do not replace it. A PCI DSS assessment covers the security of card data, while the RPAA asks for a broader operational risk framework that also covers continuity, third parties and the safeguarding of funds. Organizations that map their existing controls to RPAA expectations can avoid duplicating work.

What businesses should do

• If you may be a PSP: confirm whether you perform payment functions, check your registration status, and review your framework against the Bank’s guidance.
• If you rely on PSPs: check that your providers appear on the Bank’s registry and ask how they meet their RPAA obligations.
• In both cases: test your incident response plan and make sure contracts address notification responsibilities.

Our KW Consulting team helps PSPs build and document risk management and incident response frameworks, and the Accel GRC portal supports governance and privacy programmes. See our pages on PCI DSS and Law 25 for related obligations, or contact us to discuss your RPAA readiness.

Sources

• Bank of Canada: Retail payments supervision
• Bank of Canada: Resources for payment service providers
• Bank of Canada: PSP registry
• Bank of Canada: Supervisory framework
• Bank of Canada: How to complete an annual report (step-by-step guide)
• Justice Laws Website: Retail Payment Activities Act
• Norton Rose Fulbright: Bank of Canada now supervises the activities of payment service providers
• Baker McKenzie (Global Compliance News): Deadline approaching for registration under the RPAA