What is the RPAA?
The Retail Payment Activities Act (RPAA) is Canada's supervisory framework for retail payments, administered by the Bank of Canada — a separate regulator from FINTRAC. Where FINTRAC registration addresses money laundering and terrorist financing, the RPAA addresses the operational soundness of payment providers: can you keep running, and are end-user funds safe if you fail?
Who counts as a payment service provider?
You are in scope if you perform any of the RPAA's payment functions in relation to electronic funds transfers — including holding funds on behalf of end users, initiating transfers, authorising or transmitting payment instructions, or providing clearing and settlement services. Many FINTRAC-registered MSBs — remittance businesses, payment processors, wallets — are also PSPs under the RPAA.
Rule of thumb: if customer money rests with you for any period, or you sit in the payment chain for the public, assume RPAA scope and verify with counsel or a specialist.
RPAA vs FINTRAC MSB registration
| FINTRAC MSB | Bank of Canada RPAA | |
|---|---|---|
| Purpose | AML / CTF | Operational reliability, funds safeguarding |
| Regulator | FINTRAC | Bank of Canada |
| Trigger | MSB activity classes (FX, transfers, virtual currency) | Retail payment functions for end users |
| Core obligations | Compliance programme, KYC, reporting | Risk-management framework, safeguarding of end-user funds, incident reporting |
| Relationship | Complementary — many businesses need both | |
Neither replaces the other. A crypto OTC desk that never holds fiat for clients may be MSB-only; a remittance app holding balances needs both. The FINTRAC side is covered in our Canada MSB overview.
Core RPAA requirements
- Registration with the Bank of Canada before performing retail payment activities.
- Operational risk-management framework — documented, tested, with clear accountability for outages and incidents.
- Safeguarding of end-user funds — segregation in trust or insurance/guarantee arrangements, so user balances survive an insolvency.
- Incident reporting and annual reporting to the Bank of Canada.
Practical sequencing for new operators
- Secure the entity and FINTRAC MSB registration first — fresh, or by acquiring a ready-made MSB when speed matters.
- Map your money flows: if you hold end-user funds or perform payment functions, scope RPAA registration in parallel — don't discover it at bank onboarding.
- Build the safeguarding and operational-risk documentation alongside the AML programme; the two share risk-assessment inputs.
- Register with the Bank of Canada and align go-live with both regulators' requirements.
Lariat handles both frameworks together as part of an MSB acquisition — see the current Canada MSB companies for sale — and provides standalone RPAA registration support.