Start Your RegistrationBank of Canada registration, safeguarding and operational-risk support for payment service providers operating in or serving Canada.
Complium is an independent legal, corporate and compliance services provider. We are not affiliated with FINTRAC, the Bank of Canada or any Canadian government authority.
RPAA Registration is separate from FINTRAC MSB Registration and may apply to both Canadian and foreign payment service providers.
The Retail Payment Activities Act brings eligible payment service providers under Bank of Canada supervision. Whether registration applies depends on the payment functions performed, the geographic scope of the activities and any available exclusions.
Complium coordinates the registration process and helps build the operational-risk, incident-response, safeguarding and reporting framework required for ongoing compliance.
The Bank of Canada supervises registered payment service providers under the Retail Payment Activities Act.
The framework can apply to payment service providers with a Canadian place of business and qualifying foreign providers serving end users in Canada.
Scope can include maintaining payment accounts, holding end-user funds, initiating electronic funds transfers, transmitting or authorising payment instructions, and providing clearing or settlement services.
Registered payment service providers must maintain appropriate operational-risk controls, incident-response processes, safeguarding arrangements and regulatory reporting procedures.
RPAA Registration is separate from FINTRAC MSB Registration. A payment business may require Bank of Canada registration, FINTRAC registration, both registrations or neither, depending on its activities and structure.
The RPAA applies through a structured assessment of the payment provider, regulated functions, geographic scope and applicable exclusions.
The business must perform one or more regulated payment functions as a service or business activity that is not merely incidental to another activity.
Entity-based and activity-based exclusions must also be assessed before the registration scope is confirmed.
Complium determines whether RPAA Registration, FINTRAC Registration or both may apply and identifies the operational-risk, safeguarding and reporting framework required.
Start Your Registration
RPAA Registration may apply where a business performs one or more regulated payment functions in relation to electronic funds transfers.
It may be relevant to the following activities:
Providing or maintaining an account held on behalf of one or more end users.
Holding or safeguarding funds on behalf of an end user in connection with payment services.
Initiating, authorising, transmitting, receiving or facilitating electronic payment instructions.
Providing clearing or settlement services in relation to electronic funds transfers.
Performing a payment function does not automatically mean registration is required. The function must relate to an electronic funds transfer, fall within the RPAA geographic scope and not qualify for an exclusion.
Complium assesses each part of the regulatory test before an application is prepared.
Bank of Canada registration is only one part of ongoing RPAA compliance. A registered payment service provider must maintain operational-risk controls, respond to incidents, safeguard end-user funds where applicable and meet continuing reporting obligations.
Submit the required information and receive registration before beginning regulated retail payment activities.
Establish a risk-management and incident-response framework appropriate to the payment activities, technology and operational dependencies.
Implement the required safeguarding arrangements where the payment service provider holds end-user funds.
Keep registration information accurate and report prescribed changes within the required timeframes.
Maintain the records and processes required for annual reports, incident notifications and other Bank of Canada reporting obligations.
RPAA readiness requires more than completing a Bank of Canada application. Complium connects the scope assessment, registration, operational-risk framework, safeguarding arrangements and ongoing reporting through one coordinated project.
Our international legal and compliance team has supported more than 500 fintech and regulated projects across 46+ countries.
Map the payment chain and determine which legal entities, activities and payment functions fall within the RPAA.
Coordinate the Bank of Canada application and the ongoing compliance framework through one accountable workstream.
Develop governance, controls, testing and incident-response arrangements suited to the payment model and operational dependencies.
Design safeguarding arrangements around how customer funds are held, accessed and protected.
Prepare registration information, change reporting, annual reporting and the supporting records required for ongoing compliance.
Maintain the framework, report prescribed changes and incidents and update the compliance arrangements as the business develops.
One accountable team from RPAA scope assessment through registration and ongoing supervision.
RPAA and FINTRAC Registration address different regulatory areas. RPAA focuses on retail payment functions and operational resilience, while Canadian and Foreign MSB Registration focus primarily on prescribed money services and AML compliance.
| Key consideration | CURRENT ROUTERPAA RegistrationBank of Canada / RPAA | Canadian MSBFINTRAC / PCMLTFA | Foreign MSBFINTRAC / PCMLTFA |
|---|---|---|---|
| Regulatory framework | Bank of Canada / RPAA | FINTRAC / PCMLTFA | FINTRAC / PCMLTFA |
| Regulatory focus | Retail payment functions and operational resilience | Prescribed money services and AML compliance | Prescribed money services and AML compliance |
| Primary trigger | Performing regulated payment functions relating to electronic funds transfers | Providing prescribed money services through a Canadian place of business | Directing and providing prescribed money services to Canadian clients without a Canadian place of business |
| Regulator | Bank of Canada | FINTRAC | FINTRAC |
| Geographic scope | Canadian PSPs and qualifying foreign PSPs serving end users in Canada | Business has a place of business in Canada | Business has no place of business in Canada |
| Core obligations | Operational risk, incidents, end-user funds safeguarding and annual reporting | AML program, client identification, records and FINTRAC reporting | AML program, client identification, records and FINTRAC reporting |
| Relationship between routes | May apply in addition to either MSB route | Alternative FINTRAC classification to Foreign MSB | Alternative FINTRAC classification to Canadian MSB |
| Registration type | Bank of Canada registration | FINTRAC registration | FINTRAC registration |
This comparison provides a high-level overview only. The correct scope depends on the legal entities, payment functions, money services, end users, geographic reach and applicable exclusions. Registration is not a licence, government endorsement or guarantee of banking or commercial onboarding.
Complium supports Canadian and international payment service providers through Bank of Canada registration and implementation.
We coordinate the application, operational-risk controls, safeguarding arrangements and ongoing regulatory reporting around the payment model.
Bank of Canada registration does not replace FINTRAC, securities, banking or other regulatory requirements. Complium assesses the complete payment model and coordinates the relevant regulatory workstreams.
Complium has delivered legal and compliance expertise since 2008, supporting more than 500 fintech and regulated projects across 46+ countries.
Share details about your payment functions, legal entities, end users, fund flows and Canadian activity. Our legal and compliance team will review the model and contact you to discuss the appropriate next steps.
Practical answers for payment service providers assessing Bank of Canada registration, operational-risk requirements and end-user funds safeguarding.
RPAA Registration is the registration framework administered by the Bank of Canada for payment service providers subject to the Retail Payment Activities Act.
Registered payment service providers must also meet continuing requirements relating to operational risk, incidents, end-user funds safeguarding and regulatory reporting.
Registration may be required where an individual or entity is a payment service provider, performs regulated retail payment activities within the RPAA geographic scope and is not covered by an entity-based or activity-based exclusion.
The five functions are:
Yes. A foreign payment service provider may fall within scope where it performs retail payment activities for end users in Canada and directs those activities at individuals or entities in Canada.
Yes. The RPAA contains entity-based and activity-based exclusions, including exclusions relevant to certain regulated financial institutions, incidental activities, securities-related transactions and some internal or closed-loop arrangements.
The exclusion analysis should be completed against the specific business model.
No. The Bank of Canada maintains a registry of payment service providers but does not issue a licence or endorse registered providers.
Yes. RPAA and FINTRAC regulate different aspects of the business.
A payment provider that also performs prescribed money services may require both Bank of Canada registration and Canadian or Foreign MSB Registration.
Safeguarding requirements are relevant where a payment service provider holds end-user funds.
The required framework depends on how the funds are held, accessed and protected and must be considered alongside the provider’s operational arrangements.
Registered payment service providers must maintain their operational-risk and incident-response framework, safeguard end-user funds where applicable, report significant incidents, keep registration information current and submit required annual reports.
A payment service provider that is subject to the RPAA must receive a registration decision before beginning regulated retail payment activities, subject to any applicable transitional provisions.
Couldn’t find your answer? Ask a question
