The Retail Payment Activities Act and how to check a provider
Status as of October 30, 2026. The Retail Payment Activities Act (RPAA) is the federal law under which the Bank of Canada supervises payment service providers (PSPs). Registration provisions began on November 1, 2024, and risk-management and funds-safeguarding requirements came into force on September 8, 2025. This page is general information, not legal advice; for questions about scope, ask the Bank of Canada or a lawyer.
Key points
- Registration provisions began on November 1, 2024.
- Risk-management and funds-safeguarding requirements came into force on September 8, 2025.
- In-scope PSPs must register before performing retail payment activities.
- The Bank of Canada's public PSP registry does not license or endorse the PSPs on it.
Key dates
The RPAA came into effect in stages. The Bank of Canada publishes a page of key milestones for retail payments supervision; check it for anything announced after September 8, 2025.
The sequence matters when you read older material. Anything written before September 8, 2025 may describe the risk-management and safeguarding requirements as upcoming rather than in force, and anything written before November 1, 2024 predates registration altogether.
| Date | Milestone |
|---|---|
| November 1, 2024 | Registration provisions begin; in-scope PSPs must register before performing retail payment activities |
| September 8, 2025 | Risk-management and funds-safeguarding requirements come into force |
What the RPAA is for
The RPAA brings payment service providers under federal supervision by the Bank of Canada. Beyond registration, it sets risk-management requirements and requirements to safeguard funds.
Whether a particular business is in scope depends on what it does and how. The definitions and exclusions are in the Act and the Bank's guidance, and this page does not attempt to restate them. If you are unsure whether your business is in scope, start with the Bank of Canada's retail payments supervision pages or ask a lawyer.
BlockchainPayments.ca is not a PSP. It does not process payments, hold funds or perform retail payment activities, and it is not on the registry.
Registered is not the same as endorsed
This distinction is easy to blur in marketing. A provider that says it is registered with the Bank of Canada may be accurate, but that statement does not mean the Bank has reviewed or approved its service for your needs. It also says nothing about fees, settlement speed or customer support, which you still have to assess yourself.
The reverse also holds. A provider that does not appear on the registry may be outside the RPAA's scope rather than out of compliance, so ask it to explain its position in writing instead of drawing a conclusion either way.
The Bank of Canada keeps a public PSP registry, but it does not license or endorse the PSPs on it. Treat a registry entry as one fact about a provider, not as a quality rating or a guarantee.
How to check a provider
Checking the registry takes a few minutes and is worth repeating when anything about the relationship changes. The vendor evaluation checklist and questions to ask a payment provider turn these steps into a reusable list.
- Get the provider's full legal name, not just its brand or app name.
- Search the Bank of Canada's PSP registry for that legal name.
- Compare what you find with the legal entity named in your agreement.
- Ask whether any part of the service, such as holding funds, is carried out by another company, and check that company too.
- Ask whether the provider is also registered with FINTRAC as a money services business, and how you can confirm it.
- Keep a dated note or screenshot of what you checked.
- Recheck at renewal, or when the provider's terms or corporate structure change.
How the RPAA sits next to FINTRAC
A crypto payment provider can fall under both regimes, or only one, depending on its model. They are separate obligations administered by different bodies, and registration with one does not stand in for the other. See FINTRAC MSB registration for the anti-money-laundering side.
| RPAA | FINTRAC | |
|---|---|---|
| Administered by | Bank of Canada | FINTRAC |
| Main focus | Registration, risk management and safeguarding of funds for in-scope PSPs | Anti-money-laundering obligations, including MSB registration, records and reports |
| Key dates | Registration from November 1, 2024; risk management and safeguarding from September 8, 2025 | Virtual currency travel rule and LVCTR guidance in effect since June 1, 2021 |
| Payment service providers | Must register before performing retail payment activities, if in scope | July 21, 2022 notice treats PSPs for invoices, goods and services as MSB activity |
| Public status check | PSP registry (not a licence or endorsement) | Ask the provider how to confirm its MSB registration |
Questions about safeguarding and risk
Since September 8, 2025, in-scope PSPs have had to meet risk-management and funds-safeguarding requirements. You do not need to audit a provider to benefit from that; asking plain questions and keeping the answers is enough to make an informed comparison. Reasonable questions include:
Write the answers down with the date. If a provider will not answer, or the answers change without explanation, that is useful information in itself.
- Are you registered on the Bank of Canada's PSP registry, under which legal name?
- How do you safeguard funds you hold for me before they are paid out?
- How long do my funds typically sit with you between a customer payment and settlement to my account?
- What happens to funds you hold for me if your business stops operating?
- Which parts of the service do other companies perform, and are they registered too?
- For crypto-asset payments, who controls the private keys at each step?
What it means for a merchant
The requirements described here fall on in-scope PSPs. For a merchant that uses a PSP, the practical value is in due diligence: knowing whether your provider is registered, and asking how it safeguards funds it holds for you before they reach your account.
If funds sit with a provider for days before settlement, how they are safeguarded is a fair question. The settlement cash-flow simulator shows how much value can be in transit at once under illustrative assumptions you can change.
For crypto-asset payments, also ask who holds the private keys, and what happens to your balance if the provider stops operating. Custody models explained sets out the options and the trade-offs between holding keys yourself and relying on a provider.
Questions people ask
Does the Bank of Canada license payment providers?
No. It keeps a public PSP registry under the RPAA, but it does not license or endorse registered PSPs.
When did the RPAA take effect?
Registration provisions began on November 1, 2024, and risk-management and funds-safeguarding requirements came into force on September 8, 2025.
Does the RPAA apply to crypto payment providers?
It depends on the provider's activities. Check the Bank of Canada's guidance, and ask the provider directly about its status under the RPAA and with FINTRAC.
Is BlockchainPayments.ca on the PSP registry?
No. This site is an independent educational resource. It does not process payments, hold funds or perform retail payment activities.
Sources
- Bank of Canada — Retail payments supervision
- Bank of Canada — Retail payments supervision key milestones
- Bank of Canada — PSP registry
- FINTRAC — Notice on crowdfunding platforms and certain payment service providers (July 21, 2022)
Reviewed October 30, 2026. Educational information only; not financial, legal, tax or investment advice. This site does not process payments or hold funds.