TL;DR
For years, Canada's regulatory framework for cross-border payment companies was straightforward. Register as a Money Services Business with FINTRAC, build an AML compliance program, and you were covered. One federal registration, national scope, relatively light-touch compared to the US multi-state licensing grind.
That changed with the Retail Payment Activities Act.
What the RPAA Added
The RPAA created a second layer of federal supervision. Payment service providers performing retail payment activities in Canada must now register with the Bank of Canada, in addition to their FINTRAC MSB registration [1].
The division of responsibility is specific. FINTRAC handles anti-money laundering and counter-terrorist financing: who is moving money, whether transactions are screened against sanctions lists, whether suspicious activity is reported. The Bank of Canada handles operational risk: how the PSP manages end-user funds, how it responds to cybersecurity incidents, whether it has adequate business continuity planning, and whether it reports breakdowns and incidents to the regulator [2].
These are genuinely different regimes. A company can be fully compliant with FINTRAC and still fail the Bank of Canada's RPAA requirements if it lacks a documented operational risk management framework or a fund safeguarding plan. Canada's dual registration is one of five major regulatory shifts happening simultaneously across global payment markets in 2026.
Who Needs to Register
The RPAA applies to any individual or entity that meets all four criteria [3]: performs one or more payment functions not incidental to another service, performs those functions in connection with an electronic funds transfer in Canadian or foreign currencies, has a place of business in Canada regardless of where customers are, or is based outside Canada but directs payment services at Canadian end users.
In practice, this captures fintechs, payment processors, remittance companies, digital wallets, prepaid card programs, merchant acquirers, and most companies facilitating electronic fund transfers. Banks, credit unions, and securities firms are excluded.
For virtual asset businesses, the requirements layer further. You need FINTRAC MSB registration with the virtual currency permission, plus RPAA registration if you perform retail payment activities involving electronic funds transfers [4].
The Timeline That Already Passed
The Bank of Canada opened a 15-day registration window from November 1 to November 15, 2024. PSPs that submitted applications during that window could continue operating while the Bank reviewed applications. On September 8, 2025, the Bank published its PSP registry and began active supervision [5].
As of October 2025, Canada accounts for roughly 84% of all registered or in-review PSP entities, with international applicants from the US, UK, and other jurisdictions making up the rest [6].
PSPs that missed the window or that plan to start operating now must apply at least 60 days before commencing retail payment activities. Operating without registration after September 8, 2025 is a serious violation carrying fines up to $10 million CAD per violation and potential criminal liability for officers [7].
What the RPAA Actually Requires
Beyond registration itself, every PSP must build and maintain three operational frameworks [2]:
Operational Risk Management. A written framework covering identification, assessment, mitigation, and monitoring of operational risks across all business lines, technology systems, and third-party relationships. This includes business continuity planning and periodic testing.
End-User Fund Safeguarding. If your PSP holds end-user funds at rest (not just in transit), you must implement a safeguarding framework. Methods include holding funds in trust, segregated accounts, or covered by a guarantee or insurance. The Bank of Canada expects legal opinions on safeguarding arrangements during periodic assessments [8].
Incident Response and Reporting. Documented procedures for detecting, responding to, and reporting operational incidents and breakdowns. Material changes to your business must be notified to the Bank before they take effect.
The first PSP annual report under the RPAA was due March 31, 2026, covering the previous calendar year [4].
What This Means for Cross-Border Payment Companies
If you operate in Canadian payments in any capacity, assess both regimes. The dual-registered MSB + RPAA entity is now the baseline for fintechs operating in Canada. Planning should account for the full compliance build: $100,000 to $200,000 CAD in Year 1 including legal, consulting, and internal staffing costs [7].
Companies already registered as FINTRAC MSBs should not assume they are covered. RPAA registration is a separate process with separate requirements, and FINTRAC compliance does not satisfy the Bank of Canada's operational risk expectations.
For a broader view of how Canada's dual registration fits into the global licensing landscape across five jurisdictions, including the US, EU, Hong Kong, and Singapore, see our complete licensing guide.
Sources:
[1] Bank of Canada. "About Retail Payments Supervision Mandate." https://www.bankofcanada.ca/core-functions/retail-payments-supervision/about-retail-payments-supervision-mandate/
[2] Bank of Canada. "Supervisory Framework: Registration." https://www.bankofcanada.ca/core-functions/retail-payments-supervision/supervisory-framework-registration/
[3] ComplyFactor. "Retail Payment Activities Act (RPAA) Compliance Guide." January 2026. https://complyfactor.com/retail-payment-activities-act-rpaa-compliance-guide-complete-psp-registration-requirements-canada/
[4] 7Baas. "Canada 2025 MSB & PSP Rules: FINTRAC & RPAA Updates." November 2025. https://7baas.com/canada-2025-msb-psp-fintrac-rpaa-regulations/
[5] NCFA Canada. "Update on Retail Payments Supervision and PSP Registry." August 2025. https://ncfacanada.org/update-on-retail-payments-supervision-and-psp-registry/
[6] NCFA Canada. "Bank of Canada's PSP Registry Goes Live Under RPAA." October 2025. https://ncfacanada.org/bank-of-canadas-psp-registry-goes-live-under-rpaa/
[7] Canada-MSB. "RPAA Canada 2026: Bank of Canada Registration." May 2026. https://canada-msb.com/guide/rpaa/
[8] ComplyFactor. "RPAA Registration Guide." April 2026. https://complyfactor.com/rpaa-registration-guide/
Disclaimer: Stablecoin-related services are provided exclusively by Tazapay Canada Corp, a FINTRAC-registered Money Services Business. Tazapay Pte. Ltd. (Singapore) does not provide Digital Payment Token services under the Payment Services Act 2019.
