Vendor evaluation checklist
Questions you can ask any payment provider, with the evidence to request. We name no vendors: the point is that you can verify each answer yourself.
Registrations and legal status
In-scope PSPs must be registered; the registry is public. Registration is not a licence or endorsement. Evidence: Registry entry with matching legal name.
Dealing in virtual currency is an MSB activity under FINTRAC guidance. Evidence: FINTRAC MSB registry search result with registration number.
You need to know who you can claim against and where. Evidence: Signed agreement and corporate registry lookup.
The CSA treats some value-referenced crypto assets as potential securities or derivatives. Evidence: Written explanation from the provider; your lawyer’s review.
Custody and funds safeguarding
Custody changes your counterparty risk and the provider’s regulatory obligations. Evidence: Architecture description in the agreement or documentation.
RPAA safeguarding requirements apply to in-scope PSPs since September 8, 2025. Evidence: Safeguarding policy summary.
Customer assets have been frozen in past provider failures. Evidence: Clause in agreement; legal opinion if large balances.
Fees, conversion and settlement
Spreads and withdrawal fees often matter more than the headline rate. Evidence: Written fee schedule you can load into the cost comparison tool.
You need it for CRA fair market value records and to measure spread. Evidence: Rate methodology document; sample settlement report.
Settlement days drive working capital. Evidence: Settlement schedule in the agreement.
Operations, refunds and reconciliation
Reconciliation and audit trails depend on it. Evidence: Sample CSV export.
These edge cases are common in on-chain payments. Evidence: Written policy.
Refunds are new irreversible transactions. Evidence: Refund workflow demo in a test environment.
Lets your developers test without real funds. Evidence: Test credentials issued under a test agreement.
Security and data
Self-attestation is weaker than an independent report. Evidence: Report and bridge letter with dates.
Unsigned webhooks can be forged to mark unpaid orders as paid. Evidence: Developer documentation.
Canadian privacy obligations still apply to payment data. Evidence: Privacy policy and data processing terms.
You need to know quickly when payments are affected. Evidence: Clause in agreement; status page URL.
Support and exit
Payment issues are time-sensitive. Evidence: Service-level terms.
A pilot should be reversible. Evidence: Termination clause.
Yield on payment balances can change the legal character of the product. Evidence: Marketing materials review.
The Bank of Canada says its PSP registry does not license or endorse providers, and FINTRAC registration is not an approval of a business model. Read the RPAA explainer and questions to ask a payment provider.
How to use it
- Work through each section and tick items once you hold the evidence.
- Critical items are marked; a missing critical item is a stop sign.
- Export your progress as CSV or print it for a vendor meeting.
Default values are illustrative planning inputs reviewed October 30, 2026, not market data or any provider’s pricing. Replace them with your own statements. This tool is educational and is not financial, legal or tax advice.
Keep going
Want a second look at your numbers?
Describe your scenario and MITEY will review it with you by email. Free and educational; we do not sell or process payments.
Request a scenario review