RPAA 2026 Update: What Every MSB Owner Needs to Know
The Retail Payment Activities Act is no longer upcoming regulation. It is active law, actively enforced, and it already has its first casualty.
In the span of just a few months — from late 2025 through the first quarter of 2026 — three milestones reshaped the payments compliance landscape in Canada. First, the RPAA transition period ended in January 2026, making it illegal to operate payment functions without Bank of Canada registration. Second, the Bank of Canada issued its first enforcement action in February 2026, ordering XTM Inc. to immediately cease all retail payment activities. Third, the first annual reporting deadline passed on March 31, 2026, requiring registered payment service providers to submit detailed compliance reports covering up to 95 questions.
If you own or are considering purchasing a Canadian Money Services Business, these developments demand your immediate attention. The RPAA creates obligations that are entirely separate from your FINTRAC MSB registration — and failure to comply with either regime now carries serious financial and operational consequences.
Already own an MSB and uncertain about your RPAA obligations? Contact us for a consultation or explore our ready-made MSB + RPAA entities — both registrations active, all six permission categories included, operational from day one.
The RPAA Transition Period Ended January 2026
The timeline that brought us here moved faster than many in the industry expected.
The Bank of Canada officially became the supervisor of retail payment activities on September 8, 2025. From that date, all operational risk management and fund safeguarding requirements under the RPAA came into force. Payment service providers that had applied for registration during the transition window — which ran from November 1, 2024, through September 7, 2025 — were allowed to continue operating while their applications were processed.
That transitional grace period expired in January 2026. The implications are concrete and immediate.
Any payment service provider that did not submit an application during the transition period and is currently performing RPAA payment functions in Canada is now operating illegally. New applicants from January 2026 onward must receive Bank of Canada approval before commencing any retail payment activities — there is no more “apply and operate while waiting” option. PSPs that did apply during the transition window may continue operating pending the Bank’s decision, but they must comply with all RPAA requirements in the meantime.
For MSB owners, the critical question is whether your business activities trigger RPAA registration in addition to your FINTRAC MSB registration. The overlap is more common than most owners realize. If your MSB performs any of the five RPAA payment functions — providing payment accounts, initiating electronic fund transfers, authorizing or transmitting EFTs, holding funds, or clearing and settlement — you likely need to be registered with the Bank of Canada as well.
The penalty framework is substantial: up to $1 million per serious violation and up to $10 million per very serious violation under the RPAA, entirely separate from FINTRAC’s own penalty regime under the PCMLTFA.
Bank of Canada’s First RPAA Enforcement: XTM Ordered to Cease Operations
The Bank of Canada did not ease into its enforcement role. Its first action under the RPAA was a cease-operations order — not a warning, not a fine, but a directive to immediately stop all retail payment activities.
On February 17, 2026, the Bank of Canada issued a temporary compliance order under section 94(4) of the RPAA directing XTM Inc. to immediately cease performing any retail payment activities. The order also applied to XTM’s affiliated entities and prohibited all transactions and withdrawals from accounts associated with XTM’s AnyDay payment platform.
The reason was direct: XTM had “failed to safeguard end-user funds in its possession.” The Bank stated it had identified a “significant shortfall in end-user funds” and believed that allowing XTM to continue operating could be “prejudicial to the public’s interest.”
XTM was given seven days to provide the Bank of Canada with a plan for compliance with its RPAA obligations and, if applicable, a transition plan to move its retail payment activities to another registered PSP. Investment regulators simultaneously halted trading in XTM’s stock.
On February 27, 2026, the Bank issued a revised compliance order. XTM was authorized to resume retail payment activities, but only under the supervision of a Monitor appointed by the Ontario Superior Court of Justice under the Companies’ Creditors Arrangement Act (CCAA). The company was effectively placed under court-supervised insolvency protection while continuing to operate under Bank of Canada oversight.
The XTM case carries three critical lessons for every MSB owner with RPAA obligations.
Fund safeguarding is enforcement priority number one. The Bank of Canada’s inaugural enforcement action targeted the most fundamental RPAA obligation: protecting end-user funds. Segregated accounts, trust arrangements, or insurance — whatever safeguarding mechanism you use, it must be airtight. A shortfall in client funds will not result in a remediation notice. It will result in an order to cease operations.
The Bank of Canada acts decisively. There was no graduated enforcement ladder — no informal warning followed by a formal letter followed by eventual consequences. The Bank went from zero enforcement actions to a full cease-operations order in its first move. Payment service providers should calibrate their compliance expectations accordingly.
RPAA non-compliance can destroy a business. XTM went from an operating payment provider to CCAA protection in a matter of days. The reputational damage alone — stock trading halted, court-appointed monitor, public Bank of Canada notices — extends far beyond the immediate financial penalties.
For a complete overview of RPAA compliance requirements, including safeguarding obligations, see our RPAA registration guide.
First RPAA Annual Reports — What Was Required by March 31, 2026
The first annual reporting cycle under the RPAA concluded on March 31, 2026. For many registered payment service providers, this was their first direct experience with the Bank of Canada’s ongoing supervisory apparatus — and the scope of what was required surprised many.
The annual report form was made available on the PSP Connect portal beginning February 2, 2026, covering the 2025 calendar year. All PSPs registered before March 9, 2026, were required to file by the March 31 deadline. PSPs that were registered between March 9 and March 30, 2026, received an extension to April 28, 2026. Entities with applications still pending as of March 31 were not required to file for the 2025 period.
The report itself is substantial. Depending on the scope of a PSP’s retail payment activities, it contains between 50 and 95 questions. Content areas span compliance with operational risk management frameworks, detailed transaction volume metrics broken down by currency, the number of end users served, total funds held on behalf of end users, fund safeguarding arrangements and their effectiveness, significant business changes during the reporting year, and incident reporting for any operational disruptions.
This is not a checkbox exercise. The Bank of Canada is using these reports to build a data-driven supervisory model. The transaction volumes, risk metrics, and safeguarding details disclosed in the first annual reports will inform the Bank’s risk-based supervision priorities for the rest of 2026 and beyond.
Failure to file a complete annual report by the deadline, or submitting false or misleading information, constitutes a violation of the RPAA — triggering the same administrative monetary penalty framework that applies to all other RPAA violations. PSPs that missed the March 31 deadline should contact the Bank of Canada immediately.
Looking ahead, the next annual report will cover the full 2026 calendar year and will be due March 31, 2027. PSPs should begin building internal processes for data collection and reporting now, rather than scrambling in February each year.
32 Applications Refused or Revoked — And What the PSP Registry Looks Like Now
The Bank of Canada’s PSP registry launched in October 2025 with 259 registered payment service providers. As of March 23, 2026, the Bank has published a list of 32 businesses whose applications were either refused or whose registrations were revoked.
The refusal and revocation patterns reveal important information about how the Bank of Canada interprets the RPAA’s scope.
The largest category of refusals involves businesses that ceased performing retail payment activities before their registration was completed, or that the Bank determined were not performing activities falling within the RPAA’s scope in the first place. These include businesses whose payment activities were deemed incidental to their primary non-payment business operations.
Eight of the 32 refused or revoked applications involved crypto or digital asset businesses. The Bank of Canada determined that these entities’ activities were incidental to cryptocurrency issuance or exchange — activities that fall outside the RPAA’s scope. The RPAA specifically applies to electronic fund transfers in Canadian or foreign fiat currencies. Digital currencies are expressly excluded from the legislation’s definition of payment functions.
Two applicants were refused on the basis that they are wholly owned subsidiaries of Canadian banks, which are already subject to prudential oversight under the Bank Act and are therefore exempt under section 9(a) of the RPAA.
The initial registry composition tells its own story: 80.9% of registered PSPs are headquartered in Canada, 13.4% are based in the United States, and 2.8% are in the United Kingdom. The remainder are distributed across other jurisdictions.
The key insight for crypto MSB owners: if your primary activity is virtual currency dealing, you may not need RPAA registration — but you still need FINTRAC MSB registration. The two regimes have different scopes. However, if your crypto business also facilitates electronic fiat currency transfers alongside crypto transactions, the fiat component of your activities may still trigger RPAA registration requirements. The distinction is subtle and fact-specific.
Your RPAA Action Checklist for 2026
Regardless of where your MSB currently stands, here is what you should do now.
Step 1: Determine if the RPAA applies to your MSB activities. Review the five RPAA payment functions against your actual business model. The overlap between MSB activities and RPAA payment functions is more common than most owners expect — particularly for MSBs involved in money transferring, payment services, or foreign exchange dealing that involves electronic fund transfers.
Step 2: If you have not applied yet, do it immediately. Since January 2026, you cannot perform RPAA payment functions without registration or a pending application from the transition period. The application fee is $2,500, submitted through the PSP Connect portal. There is no shortcut, and there is no further grace period.
Step 3: If you are registered, confirm your annual report was filed. The March 31, 2026, deadline has passed. If you missed it, contact the Bank of Canada without delay — non-filing is an RPAA violation that can trigger administrative monetary penalties. If you were registered between March 9 and March 30, you have until April 28 to file.
Step 4: Review your fund safeguarding arrangements. The XTM case established that fund safeguarding failures are enforcement priority number one. Ensure your segregated accounts, trust arrangements, or insurance coverage are in place and fully funded. A shortfall — of any size — is an existential risk to your business.
Step 5: Budget for ongoing compliance. Annual reporting, operational risk management framework maintenance, incident reporting, and potential Bank of Canada examinations are recurring obligations. Build these into your operating costs and internal processes now.
The fastest path to dual compliance: buy a ready-made MSB with RPAA registration already active. Both registrations in place. All six MSB permission categories included. Compliance documentation ready. Operational from day one — no months of waiting for application approvals from either FINTRAC or the Bank of Canada.
Ready to discuss your RPAA obligations or explore a ready-made MSB + RPAA entity? Contact us via WhatsApp, Telegram, email, or phone, or book a consultation to review your specific situation.
What to Expect from the RPAA in Late 2026 and Beyond
The Bank of Canada’s supervisory posture will only intensify from here.
With the first annual reporting cycle complete, the Bank now possesses detailed operational data on every registered PSP in Canada — transaction volumes, fund safeguarding positions, risk management frameworks, and incident histories. This data will power risk-based supervision priorities for the remainder of 2026 and into 2027. Expect targeted examinations of PSPs whose reports reveal elevated risk indicators.
The enforcement precedent is set. The XTM compliance order established that the Bank of Canada will use its strongest tools early and without hesitation. Additional compliance orders for fund safeguarding deficiencies should be expected. As the Bank builds institutional experience, the range of enforcement targets will likely expand beyond safeguarding to include operational risk management failures and reporting violations.
The intersection of the RPAA with FINTRAC’s strengthened penalty regime under Bill C-12 creates a tightening dual regulatory environment. MSBs now face more rigorous oversight from two separate federal regulators simultaneously. Operating without proper compliance infrastructure for both is increasingly untenable.
There is also the question of scope. Digital currencies are currently excluded from the RPAA. However, given the global trend toward regulating crypto payment activities — and Canada’s own enforcement activity against crypto MSBs through FINTRAC — future legislative amendments could bring crypto transactions within the RPAA’s scope. MSB owners in the virtual currency space should monitor this closely.
Annual reporting will become routine. The March 31 deadline will recur every year. PSPs that build data collection and reporting workflows now will save significant time and reduce compliance risk in future cycles.
Stay ahead of both FINTRAC and Bank of Canada requirements. Our compliance consulting services and ongoing AML support cover both MSB and RPAA obligations — so you can focus on running your business while we handle both regulatory frameworks.
Frequently Asked Questions — RPAA 2026 Update
Is the RPAA transition period over?
Yes. The RPAA transition period ended in January 2026. Any payment service provider performing RPAA payment functions in Canada without registration — or without a pending application submitted during the transition period — is operating illegally and subject to administrative monetary penalties of up to $1 million per serious violation and $10 million per very serious violation.
Does my MSB need RPAA registration?
It depends on your MSB activities. If your business performs any of the five RPAA payment functions — providing payment accounts, initiating electronic fund transfers, authorizing or transmitting EFTs, holding funds, or clearing and settlement — you likely need RPAA registration in addition to your FINTRAC MSB registration. Our MSB + RPAA dual registration guide provides a detailed breakdown by MSB activity type.
Do crypto and virtual currency MSBs need RPAA registration?
Not necessarily. The RPAA specifically excludes digital currencies from its scope. Eight of the 32 refused or revoked applications as of March 2026 involved crypto businesses whose activities the Bank of Canada determined were incidental to cryptocurrency issuance or exchange. However, if your crypto MSB also facilitates electronic fiat currency transfers alongside crypto transactions, the fiat portion of your activities may still trigger RPAA registration. See our virtual currency MSB permissions page and crypto exchange license guide for more detail.
What happens if I missed the March 31 annual report deadline?
Failure to file a complete annual report by the deadline is a violation of the RPAA and may lead to administrative monetary penalties. Contact the Bank of Canada immediately. PSPs registered between March 9 and March 30, 2026, received an automatic extension to April 28, 2026. PSPs with applications still pending as of March 31 were not required to file for the 2025 reporting year.
What penalties does the RPAA impose?
The RPAA allows administrative monetary penalties of up to $1 million per serious violation and up to $10 million per very serious violation. The Bank of Canada can also issue compliance orders — as demonstrated in the XTM case — that direct PSPs to immediately cease all retail payment activities. Registrations can be revoked, and matters can be referred for criminal prosecution. These penalties are entirely separate from FINTRAC’s penalty regime under the PCMLTFA.
Can I buy an MSB that already has RPAA registration?
Yes. We sell ready-made MSBs with active RPAA registration — one of the only combined offerings in the Canadian market. Both FINTRAC MSB registration and Bank of Canada RPAA registration are active, all six MSB permission categories are included, and compliance documentation is in place. This eliminates months of application processing time with both regulators and lets you operate from the day of purchase.
Disclaimer: This article is for informational purposes only and does not constitute legal or regulatory advice. Regulatory requirements are subject to change. Consult qualified legal counsel for advice specific to your situation. All regulatory facts cited in this article were verified against official sources including the Bank of Canada and FINTRAC as of April 2026.
Last updated: April 2026
