RPAA Canada 2026: Bank of Canada Registration Requirements

The Retail Payment Activities Act (RPAA) is Canada’s framework for regulating Payment Service Providers (PSPs). Since November 2024, every business performing retail payment activities in Canada must register with the Bank of Canada. Combined with FINTRAC MSB registration, the dual MSB+RPAA license is the strongest payment authorization available in Canada — and the slowest to build from scratch (8–12 months).

Skip the wait: we always have 10+ FINTRAC-registered MSBs in stock, several of which include active RPAA registration. Browse our MSB+RPAA inventory for immediate ownership transfer.

What is the Retail Payment Activities Act (RPAA)?

The RPAA is federal legislation administered by the Bank of Canada. It came into force in two phases:

November 1, 2024 — Registration window opened for PSPs already operating
September 8, 2025 — Full operational supervision began

The RPAA targets businesses performing one or more retail payment activities: providing or maintaining payment accounts, holding funds for end-users, initiating electronic fund transfers, authorizing transactions, providing clearing/settlement services, or any other activity defined in the Retail Payment Activities Regulations.

Who Needs RPAA Registration?

You need RPAA registration if you operate in Canada and do any of the following:

Hold customer funds in payment accounts (digital wallets, prepaid balances)
Initiate or authorize electronic fund transfers on behalf of users
Provide payment processing or merchant acquiring services
Operate a remittance service that holds funds in transit
Run a fintech app that lets users send/receive money electronically
Serve as an intermediary in payment clearing or settlement

Many businesses that need RPAA also need FINTRAC MSB registration under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA). The two regimes overlap significantly. See our guide on the MSB+RPAA dual compliance.

RPAA Application Process

Step 1 — Pre-Registration Assessment

Determine whether your business activities meet the RPAA definition of “retail payment activities”. Edge cases (B2B-only platforms, technical services without fund control) may be exempt.

Step 2 — Build Your Risk Management & Incident Response Framework

The Bank of Canada requires a documented risk management and incident response framework before you submit. This includes operational, compliance, fraud, and cybersecurity controls.

Step 3 — Build Your End-User Funds Safeguarding Plan

If you hold end-user funds, you must safeguard them through one of: (a) holding in a trust account, (b) holding with a guarantee from a Canadian financial institution, or (c) holding with insurance. The plan must be auditable and tested.

Step 4 — Submit Application via Bank of Canada Portal

The application is submitted online. Bank of Canada review takes 60–90 days for complete applications.

Step 5 — Ongoing Supervision

Once registered, you’re subject to annual reporting, incident notifications within 24 hours, and Bank of Canada examinations.

RPAA Registration Costs

Direct registration fees with the Bank of Canada are modest, but the true cost is the compliance build-out:

Bank of Canada registration assessment fee: ~$2,500 CAD (one-time, refundable if rejected)
Annual assessment fee: tiered by transaction volume, typically $1,500–$15,000 CAD
Risk framework + safeguarding plan (lawyer/consultant): $25,000–$75,000 CAD
Internal staffing (CAMLO, risk officer): $80,000+ CAD/year
Total Year 1 setup: typically $100,000–$200,000 CAD

If you also need FINTRAC MSB registration (which most RPAA registrants do), add 4–8 months and ~$25,000–$50,000 in additional compliance build-out.

RPAA vs FINTRAC MSB — What’s the Difference?

	FINTRAC MSB	Bank of Canada RPAA
Regulator	FINTRAC	Bank of Canada
Statute	PCMLTFA	Retail Payment Activities Act
Focus	AML / counter-terrorism financing	Operational risk + funds safeguarding
Triggered by	FX, money transfer, virtual currency, money orders, crowdfunding, payment services	Holding/moving end-user funds electronically
Registration time	4–8 months	3–6 months (after framework build)
Total time from scratch	4–8 months	8–12 months (combined with MSB)
Key requirement	AML compliance program	Risk + safeguarding frameworks

Most Canadian PSPs need both licenses. The dual-registered MSB+RPAA company is the gold standard for fintechs operating in Canadian payments.

Skip the 8–12 Month RPAA + MSB Process

RPAA & Cryptocurrency Businesses

Yes, crypto businesses operating in Canada generally need both FINTRAC MSB registration (with virtual currency permission) and RPAA registration if they hold customer fiat funds. Pure custodial crypto exchanges, fiat on/off-ramps, and crypto-payment platforms are all in scope. See our Canada crypto license guide for the full picture.

Frequently Asked Questions

Who needs RPAA registration in Canada?

Any Payment Service Provider performing retail payment activities in Canada — holding payment accounts, initiating electronic fund transfers, authorizing payments, providing clearing/settlement, or maintaining end-user funds — must register with the Bank of Canada under the RPAA. This includes fintechs, remittance services, digital wallets, prepaid card programs, and most crypto fiat-on-ramps.

How long does RPAA registration take?

The Bank of Canada review itself takes 60–90 days for complete applications. However, building the required risk management framework and end-user funds safeguarding plan typically takes 3–6 months of preparation. Total time from scratch: 6–12 months. By contrast, acquiring a pre-registered MSB+RPAA company through us takes 5–8 hours.

What does RPAA registration cost?

Direct fees are modest: ~$2,500 CAD initial assessment + $1,500–$15,000 CAD annual based on transaction volume. The real cost is compliance build-out: legal/consulting fees of $25,000–$75,000 plus internal staffing. Total Year 1 typically runs $100,000–$200,000 CAD.

Can I outsource the RPAA application?

Yes. Specialized compliance consultancies prepare the entire registration package — risk framework, safeguarding plan, governance documents, and Bank of Canada submission. We offer RPAA application service for clients who prefer to register fresh, or you can buy a pre-registered MSB+RPAA company instead.

What’s the difference between MSB and RPAA?

FINTRAC MSB registration covers anti-money-laundering compliance under PCMLTFA. RPAA registration with the Bank of Canada covers operational risk and end-user funds safeguarding under the Retail Payment Activities Act. Most Canadian PSPs need both. The two regimes are independent but overlap heavily for businesses moving customer money.

Can I buy a company that’s already RPAA-registered?

Yes. We maintain a live inventory of pre-registered Canadian companies, including several that are dual-registered with FINTRAC MSB and Bank of Canada RPAA. Ownership transfer takes 5–8 hours. The company keeps its registrations and operating history. View available MSB+RPAA companies.

What happens if I miss the RPAA deadline?

The initial registration window closed in November 2024 for businesses already operating. New entrants must register before commencing retail payment activities. Operating without registration after September 8, 2025 carries fines up to $10,000,000 CAD per violation and potential criminal liability for officers.

Does RPAA cover cryptocurrency businesses?

Yes, in most cases. Crypto exchanges, custodial wallets, fiat-crypto on/off-ramps, and crypto-payment platforms holding Canadian end-user fiat funds need RPAA registration. They typically also need FINTRAC MSB registration with the virtual currency permission. See virtual currency permissions.

Can foreigners apply for RPAA?

Yes — RPAA registration does not require Canadian citizenship or residency. However, the registered entity must be a Canadian corporation with at least one Canadian-resident director (or comply with provincial corporate law equivalents). Many foreign-owned PSPs incorporate in BC or NB (no Canadian-director requirement) and then apply.

What documents does RPAA require?

The Bank of Canada submission requires: corporate documents, business plan, risk management framework, end-user funds safeguarding plan, governance and conflict-of-interest policies, AML/CTF program (if also FINTRAC-registered), incident reporting procedures, and proof of insurance/safeguarding mechanism. Total documentation typically runs 200+ pages.

Next Steps

If you need a Canadian payment license today, the fastest path is acquiring a pre-registered MSB+RPAA company. We always have 10+ Canadian MSBs in stock and several MSB+RPAA dual-registered companies available at any time.

Related Resources

Canadian MSB Glossary — All Terms Explained