At a glance
- Canada’s Retail Payment Activities Act (RPAA) took effect Sept. 8, 2025, requiring payment service providers (PSPs) to maintain effective governance, controls, documentation, and operational resilience.
- Organizations performing certain retail payment functions may be subject to the RPAA and required to register as PSPs.
- The RPAA represents a significant regulatory change, shifting the focus from registration to demonstrating ongoing compliance.
- PSPs can strengthen compliance by focusing on key areas such as operational risk management, fund safeguarding, and ongoing monitoring.
- As supervisory expectations evolve, PSPs should be prepared to show how their compliance frameworks operate effectively in practice.
Canada's Retail Payment Activities Act (RPAA) has fundamentally changed the regulatory landscape for payment service providers. With the operational requirements now in force, organizations must demonstrate ongoing compliance through effective governance, operational risk management, safeguarding of end-user funds, and regulatory reporting.
This article explores the key requirements of the RPAA, identifies which organizations may be in scope, and outlines practical considerations for building a sustainable compliance program.
What is the RPAA?
The Retail Payment Activities Act, or RPAA, is Canada’s first comprehensive federal supervisory framework for payment service providers (PSPs), established in response to the rapid evolution of the country’s payments landscape. With the growth of fintechs, digital wallets, payment processors, and embedded payment solutions, the RPAA introduces a regulatory regime designed to address the increasing importance of these services.
Administered by the Bank of Canada, the RPAA is designed to strengthen the safety, reliability, and resilience of retail payment services by introducing consistent requirements for non-bank payment service providers in four key areas:
- Operational risk management
- Incident response
- Safeguarding end-user funds
- Regulatory reporting
The framework aims to improve ongoing operational resilience, reduce systemic risk, and strengthen consumer protection while supporting continued innovation and confidence within Canada's digital payments ecosystem.
Today, many organizations are moving beyond understanding the legislation to demonstrating that their governance, controls, and compliance programs meet the Bank of Canada's supervisory expectations.
Why does the RPPA matter?
The RPAA represents one of the most significant regulatory developments affecting Canada's payments industry in recent years.
For PSPs, compliance is no longer viewed as a one-time registration exercise. Organizations must now demonstrate that appropriate controls are designed, implemented, and operating effectively on an ongoing basis. This includes maintaining evidence of compliance, responding to regulatory inquiries and adapting governance and risk management practices as business models evolve.
Organizations that take a proactive approach to compliance are better positioned to meet regulatory expectations, build customer trust, and support future growth within Canada's increasingly regulated payments system.
One of the strategic benefits of RPAA registration is that eligible PSPs may apply to become members of Payments Canada, providing a pathway to direct participation in Canada's evolving payment infrastructure, including the forthcoming Real-Time Rail (RTR) payment network. Direct participation has the potential to enhance payment speed, operational efficiency, and innovation, although organizations must also meet Payments Canada's membership and participation requirements.
Where RPAA compliance stands today
The RPAA implementation has largely transitioned from planning to ongoing compliance. The RPAA's operational requirements came into force on Sept. 8, 2025, marking the beginning of the Bank of Canada's supervisory oversight of registered PSPs.
Organizations that are subject to the RPAA are now expected to maintain compliant operational risk management and incident response frameworks, safeguard end-user funds, meet reporting obligations, and retain appropriate compliance documentation on an ongoing basis.
Who must register as a PSP?
Section 2 of the RPAA defines a PSP as an individual or entity that performs at least one of the following functions:
Exclusions apply to certain transaction types and regulated entities that are subject to separate requirements under applicable legislative and regulatory frameworks.
How to build an RPAA compliance program: 5 steps
The RPAA establishes a principles-based supervisory framework that requires PSPs to implement a robust risk management program aimed at reducing operational and financial risks.
To meet these obligations, PSPs should focus on five key compliance pillars.
Registration with the Bank of Canada
A PSP must be registered with the Bank of Canada before it performs any retail payment activities. PSPs will be required to remit a registration fee and an annual assessment fee.
Implementation of a risk management and incident response framework
PSPs are required to establish, implement, and maintain an operational risk management and incident response framework designed to ensure the confidentiality, integrity, and availability of retail payment activities and the systems, data, and information that support them.
An effective framework should address risks including:
Operational resilience under the RPAA extends beyond traditional IT security. PSPs should establish governance and controls that address cyber threats, third-party dependencies, business continuity, incident response, and technology resilience.
Organizations should also establish documented processes to detect, respond to, and recover from operational incidents, including incidents involving third-party service providers. Incident response plans should be regularly tested and supported by clearly defined roles, escalation procedures, and communication protocols.
Roles, responsibilities, and training for managing risks and incident response must be clearly defined.
Establishment of a fund safeguarding framework
Where a PSP holds end-user funds, it must implement a safeguarding framework that protects those funds and ensures users have timely access to them in the event of insolvency.
A safeguarding framework typically includes:
- Segregation of customer funds from operational funds
- Appropriate trust or safeguarding arrangements
- Liquidity monitoring
- Oversight of custodians or financial institutions
- Governance over fund protection arrangements
Regulatory reporting and record keeping
The RPAA establishes ongoing reporting obligations designed to provide the Bank of Canada with visibility into the operational resilience of registered PSPs.
Organizations should maintain processes to support:
- Annual reporting
- Significant change or new activity reporting
- Incident reporting
- Regulatory inquiries and information requests
- Record retention
PSPs should be able to demonstrate not only that required frameworks exist, but also that controls are operating as intended and are supported by appropriate evidence.
Continuous monitoring and compliance
Organizations should establish ongoing monitoring activities to assess the effectiveness of their governance, operational risk management, and safeguarding frameworks. This may include:
- Annual reviews
- Periodic risk assessments
- Control testing
- Internal audits or independent reviews
- Management reporting
- Policy reviews
- Staff training
- Regulatory horizon scanning
Supervisory expectations: Demonstrating RPAA compliance
The RPAA establishes minimum legislative requirements. However, the Bank of Canada's supervisory guidance provides greater insight into how it expects PSPs to design, implement, and maintain their compliance frameworks. The guidance emphasizes that compliance is not a one-time exercise or simply a matter of documenting policies. Rather, PSPs are expected to demonstrate that their governance, risk management, and control frameworks are operating effectively and are proportionate to the nature, size, and complexity of their retail payment activities.
In practice, this means PSPs should be prepared to demonstrate their ability to:
- Maintain effective governance and oversight.
- Adopt a risk-based and proportionate approach.
- Regularly assess and test controls to confirm they remain effective as the organization evolves.
- Maintain comprehensive documentation and evidence to demonstrate compliance with the RPAA.
- Monitor third-party service providers and conduct appropriate due diligence and ongoing oversight.
- Continuously improve their compliance programs, incorporating lessons learned from incidents, control testing, internal reviews, and changes to business operations or the regulatory environment.
As the Bank of Canada continues to mature its supervisory program, organizations should expect ongoing regulatory engagement through annual reporting, incident notifications, requests for information, and reviews of their governance and control frameworks.
The Bank of Canada has begun exercising its enforcement powers under the RPAA and has indicated that it will publicly disclose Notices of Violation issued to PSPs, including any associated administrative monetary penalties. PSPs that maintain well-documented, regularly tested, and continuously improved compliance programs will be better positioned to demonstrate regulatory compliance and operational resilience.
Key takeaways on RPAA compliance
- With the RPAA in effect since Sept. 8, 2025, regulated PSPs should be focused on ongoing compliance.
- Registration is only the first step. Organizations must maintain effective governance and operational risk management frameworks.
- The Bank of Canada expects PSPs to demonstrate that controls are operating effectively.
- Compliance requires ongoing monitoring, reporting, and evidence of operational resilience.
RPAA compliance support tailored to your organization
BDO's Risk Advisory Services professionals work with payment service providers, fintechs, and other financial services organizations to help assess regulatory obligations, strengthen governance, and implement practical compliance solutions that are aligned with the Bank of Canada's supervisory expectations.
Whether your organization is assessing its regulatory obligations for the first time or enhancing an existing compliance program, BDO can provide tailored support throughout the compliance life cycle.
Here’s how BDO can support your RPAA compliance efforts:
- Assessing RPAA applicability and compliance readiness
- Designing and implementing governance frameworks
- Conducting independent compliance reviews
- Evaluating cybersecurity risks and controls
- Strengthening business resilience and ongoing compliance monitoring capabilities