Retail Payment Activities Act

 

On November 1, 2024, the Retail Payment Activities Act (RPAA) launched, introducing a bold new era in payments regulation in Canada. Administered and enforced by the Bank of Canada, the legislation is the first specifically geared toward retail payment activities and is designed to protect Canadian consumers, businesses and the financial system from certain risks.

The RPAA requires  payment service providers (PSPs) that engage in retail payment activities to register with the Bank of Canada. Registered PSPs must also comply with a slate of new regulations related to managing operational risks, safeguarding end-user funds, and reporting.

Who does the RPAA apply to?

The legislation applies to a broad range of entities involved in retail payment activities. The RPAA defines PSPs as individuals or entities that perform one or more of the five payment functions outlined in the RPAA, meet other qualifications and that are not otherwise excluded. The in-scope payment functions are as follows:

  • Provision or maintenance of an account that is held on behalf of one end user or more
  • Holding funds on behalf of an end user
  • Initiation of an electronic funds transfer at the request of an end user
  • Authorization of an electronic funds transfer or transmission, reception or facilitation of an instruction in relation to an electronic funds transfer
  • Provision of clearing or settlement services

Despite referring to “retail payment activities” not all RPAA payment functions must be performed a the request of or on behalf of an end user. Notably, the RPAA also applies to PSPs that do not have a place of business in Canada, but both direct services at, and perform services for, individuals or entities in Canada.

There are several notable exclusions, however. Certain entities that are already closely regulated—like banks, authorized foreign banks and provincially regulated trust companies—are excluded from the PSP regulatory regime. Certain kinds of transactions like foreign PSP activities directed at end-users outside of Canada also fall beyond the scope of the legislation, for example.

What's next?

PSPs currently operating in Canada were required to submit registration applications to the Bank of Canada in early November 2024. In December 2024, the Bank of Canada published the list of companies that have applied to be registered under the RPAA, and on September 8, 2025, the Bank will publish the full list of successful and refused applications.

Also on September 8, 2025, additional requirements with respect to risk management, incident response and funds safeguarding frameworks are scheduled to take effect.

Get ready

The RPAA introduces significant changes to the regulatory landscape, adding another layer of regulation to Canada's payments ecosystem. Accordingly, it is crucial for PSPs to carefully review their forthcoming compliance obligations and become familiar with the Bank of Canada’s supervisory guidelines, including those below:

We strongly advise PSPs to conduct a thorough audit of their existing policies and protocols. Identifying gaps in current practices will allow companies to be proactive as they work to align with the new requirements.

If you have any questions or require guidance during this process, we encourage you to connect with a member of our FSxT team. Our experienced financial services regulatory lawyers are well-versed in the intricacies of the RPAA and can provide tailored advice to ensure your compliance efforts are comprehensive and effective.

Stay informed