Questions to ask a payment provider
If a provider will receive, hold, convert or move funds for your business, you are trusting it with your revenue. These questions help you compare providers on the things that matter when something goes wrong, not just on the headline rate. They apply to any provider; this site does not review or recommend specific ones.
Key points
- Check registration yourself on the regulator's website rather than relying on a provider's claim.
- Registration is a legal requirement, not an endorsement or a guarantee.
- Ask who controls the keys and what happens to your funds if the provider fails.
- Get every fee in writing, including conversion spreads, network fees and withdrawal fees.
Regulatory status
Start here, because the answers shape every other risk. The facts below are as of October 30, 2026.
Under the Retail Payment Activities Act, registration provisions began on November 1, 2024, and risk-management and funds-safeguarding requirements came into force on September 8, 2025. In-scope payment service providers must register with the Bank of Canada before performing retail payment activities. The Bank keeps a public PSP registry, and it does not license or endorse registered providers. See the Retail Payment Activities Act.
Dealing in virtual currency is a money services business activity, and MSBs must register with FINTRAC before offering MSB services. FINTRAC's July 21, 2022 notice treats payment service providers for goods and services as remitting or transmitting funds or dealing in virtual currency. See FINTRAC MSB registration.
- Are you registered with the Bank of Canada as a PSP, and under what legal name? (Check the PSP registry yourself.)
- Are you registered with FINTRAC as an MSB, and under what name and registration number? (Verify on FINTRAC's website.)
- If you hold crypto-assets for clients or let them trade, which provincial securities regulators have you registered or pre-registered with?
- Which stablecoins do you support, and how do you describe their status, given that the Stablecoin Act is not expected to be in force until 2027?
Custody and control of funds
The most important question is who can move the money. In a custodial model the provider controls the private keys; in a self-hosted model you do. Custody models explained sets out the trade-offs.
- Who holds the private keys for funds received on my behalf, and for how long?
- Are my funds held separately from your own, and how are they safeguarded?
- What happens to my funds if you become insolvent or stop operating?
- Are there withdrawal limits, holds or reserves on new accounts?
- Can I withdraw to my own wallet or bank account at any time, and how quickly?
Conversion and settlement
- Do you convert to CAD automatically at receipt, on a schedule or on request?
- Which exchange rate do you apply, from what reference and at what moment?
- What spread do you add to that reference rate, and is it shown on each conversion record?
- How many business days until CAD reaches my bank account, and what happens on weekends and holidays?
- How do you handle under-payments, over-payments, late payments and payments sent on the wrong network?
Spreads hide inside the exchange rate, so they are easy to miss when comparing quotes. Ask for a sample conversion record and compare its rate with a reference rate taken at the same time.
Fees, in full
Small differences in percentage costs add up. Suppose a business takes $50,000 a month across about 417 payments, with 15% cross-border customers, through a USD-referenced stablecoin. Under the site's default assumptions (illustrative, not market data), a 1% conversion spread gives a monthly cost of about $770.83. If the spread is 1.5% instead, the cost rises to about $1,020.83, an extra $250 a month. Put each provider's quoted figures into the payment cost comparison instead of relying on the defaults.
| Fee type | Question to ask |
|---|---|
| Processing fee | What percentage and fixed fee apply per payment, and do they vary by asset or volume? |
| Network fees | Who pays network fees on receipts, consolidation, conversion and refunds? |
| Conversion | What spread is added to the reference rate? |
| Withdrawal or payout | What does it cost to move CAD to my bank, and is there a minimum? |
| Account fees | Are there monthly, set-up, inactivity or termination fees? |
| Refunds | What does a refund cost, and who pays the network fee? |
Security and assurance
There is no PCI DSS equivalent for accepting crypto-assets, so the security picture depends on how the provider manages keys and systems. Wallet security for businesses covers the controls on your side.
- Do you have an independent security attestation, such as a SOC 2 report, and can I review it under a confidentiality agreement?
- How are private keys generated, stored and backed up, and how many people are needed to move funds?
- How often do you commission independent security testing, and do you fix findings within set timelines?
- What account controls do you support: multi-factor authentication, role-based access, approval rules and address allow-lists?
Data, privacy and residency
- Where is my data and my customers' personal information stored and processed, and which subcontractors have access?
- How do you handle travel rule information for virtual currency transfers, which FINTRAC has required since June 1, 2021? See the travel rule.
- How long do you keep records, and can I export them? FINTRAC records must generally be kept for at least five years.
- Can I export transaction data, including hashes, fair market values and fees, in a format my accounting system can import?
Incidents, refunds and exit
The vendor evaluation checklist turns these questions into a scorecard you can fill in for each provider.
- How and how quickly will you notify me of a security incident, an outage or a change in your registration status?
- Is there a public status page and a named contact for urgent issues?
- How do refunds work, given that on-chain payments are generally irreversible? See refunds on-chain.
- What notice must either side give to end the agreement, and how are remaining funds and data returned?
Questions people ask
Does Bank of Canada registration mean a provider is trustworthy?
No. The Bank of Canada keeps a public registry of PSPs but does not license or endorse them. Registration is one check among several.
How do I check a provider's FINTRAC registration?
Ask for the legal name and registration details, then verify them on FINTRAC's website rather than relying on a screenshot or certificate the provider sends.
What is the single most important question?
Who controls the private keys and what happens to your funds if the provider fails. Everything else is easier to fix than that.
Should I ask for a sample contract before deciding?
It helps. Terms on custody, fees, liability and termination are easier to compare side by side, and a lawyer can review them before you sign.
Sources
- Bank of Canada — PSP registry
- Bank of Canada — Retail payments supervision key milestones
- FINTRAC — MSB registration questions
- FINTRAC — Payment service providers notice
- FINTRAC — Travel rule for electronic funds and virtual currency transfers
Reviewed October 30, 2026. Educational information only; not financial, legal, tax or investment advice. This site does not process payments or hold funds.