Retail payments supervision: Key milestones

Legislation

The Retail Payment Activities Act (RPAA) establishes the legal framework for us to supervise payment service providers (PSPs), including its scope and powers. It was approved by Parliament on June 29, 2021, and is expected to come into force in stages.

Regulations

Regulations to help clarify the details of the legislation to support the RPAA. Regulations, like legislation, have the force of law.

• Drafting: While the Department of Finance Canada drafted regulations, we engaged with stakeholders and provided technical expertise and advice as required.
• Approving: The Department of Finance Canada submitted the regulations to the Treasury Board—the committee of ministers that oversees the Government of Canada’s spending and operations—for approval.
• Publishing: Proposed regulations were published for public comment in Part I of the Canada Gazette.
• Reviewing and republishing: The Government of Canada reviewed comments on the proposed regulations. A final version of the regulations was published in Part II of the Canada Gazette on November 22, 2023.

Registration pilot

In the first half of 2024, we tested our registration process to identify areas of improvement before provisions of the RPAA came into force.

Consultation

From February 2024, we consulted industry and stakeholders over a 90-day period to receive their feedback on four guidelines related to:

• operational risk and incident response
• safeguarding end-user funds
• significant change reporting
• incident notification

In the second half of 2024 we published final versions of these guidelines.

Supervisory guidelines

These clarify the standards and practices we expect PSPs to incorporate into their business operations to meet requirements on:

• managing operational risks
• safeguarding end-user funds
• notifying the Bank of significant changes and new activities
• reporting on incidents

Supervisory policies

In 2024 we started to issue supervisory policies and guidelines on the legislation and final regulations.

These documents clarify what we will do to carry out our supervisory role, including registration and enforcement activities.

We will continue to issue supervisory policies on specific topics related to the RPAA and the final regulations.

Coming into force

Registration

The registration provisions of the RPAA began on November 1, 2024. Individuals and entities had 15 calendar days from November 1 to November 15, 2024 to apply for registration with us.

Supervision

The requirements to establish risk management and funds safeguarding frameworks came into force on September 8, 2025.