Frequently asked questions about retail payments supervision

Publication date: December 12, 2023

Answers to common questions about retail payments supervision.

Registration 

Do I need a licence to operate in Canada?

The Retail Payment Activities Act (RPAA) requires that payment service providers (PSPs) register with the Bank of Canada (the Bank). The RPAA outlines requirements for registration. The Bank will maintain a public registry of registered PSPs but does not provide PSPs with a licence.

Can I operate my business without registering with the Bank of Canada as a payment service provider (PSP)?

If you plan to operate during the transition period (beginning on November 1, 2024 and ending on September 7, 2025), you are required to apply for registration as a PSP within 15 days of the Bank opening the registration application process. Furthermore, if you plan to begin performing retail payment activities during the transition period, you must apply for registration with the Bank and wait 60 days before beginning to perform these activities. Beginning on September 8, 2025, PSPs must be registered with the Bank before they perform retail payment activities as outlined in section 23 of the Retail Payment Activities Act (RPAA). PSPs that do not register with the Bank before performing retail payment activities may be subject to enforcement action in accordance with the RPAA.

Why should I register as a PSP with the Bank of Canada?

Registering as a PSP with the Bank of Canada is a requirement. Here are some advantages:

• The Bank’s new supervisory role will support confidence in PSPs and in the Canadian market.
• Registering with the Bank could create incentives for the entrance of new players and foster competition.
• You may be able to access other core payment systems, such as Real Time Rail, which is under development.

What do I need to do before I establish a business and perform retail payment activities in Canada?

If your business is considered a PSP as defined in the Retail Payment Activities Act (RPAA) and you plan to perform retail payment activities in Canada, you must apply for registration with the Bank of Canada before performing retail payment activities. If you perform or plan to perform retail payment activities for end users in Canada and direct retail payment activities at individuals or entities in Canada before having a place of business in Canada, you must also apply to register as a PSP with the Bank.

The Bank will publish step-by-step guidance before the RPAA comes into force. This guidance will provide details on the information applicants must provide when registering.

Scope of the Retail Payment Activities Act

Am I subject to the Retail Payment Activities Act (RPAA) if I do not generate any revenue from the retail payment activities I perform?

All payment service providers (PSPs) that fall in scope of the RPAA must register with the Bank of Canada, whether or not the business generates revenue. This includes PSPs:

• with a place of business in Canada that performs retail payment activities
• with a place of business outside of Canada that perform retail payment activities for an end user in Canada and directs retail payment activities at individuals or entities in Canada

Do I need to register if I direct retail payment activities only to banks?

If you are a payment service provider (PSP) with a place of business in Canada and perform retail payment activities for banks in Canada, you may need to register with the Bank of Canada if you are not otherwise subject to an exclusion.

If you are a foreign PSP performing retail payment activities for banks in Canada and directing retail payment activities to individuals or entities in Canada, you may need to register with the Bank if you are not otherwise subject to an exclusion.

Do I need to register if I am a foreign payment service provider (PSP) doing business with a PSP that is registered with the Bank of Canada?

Whether or not you are doing business with another registered PSP, you are responsible for registering with the Bank and ensuring compliance with the Retail Payment Activities Act (RPAA) and its regulations. This also applies to PSPs that do not have a place of business in Canada and who direct services at individuals or entities in Canada.

Once I am registered as a payment service provider (PSP), which part of my business will be covered under the RPAA?

Once a PSP is registered, all transactions related to the retail payment activities it performs in relation to an electronic funds transfer (EFT) will be subject to the Retail Payment Activities Act (RPAA). The only exemptions are if the transactions are being performed incidentally to another service or business activity by the PSP or are subject to other exclusions, such as for internal transactions or for carrying out securities transactions for eligible financial contracts.

What is an end user in Canada?

An end user is an individual or entity that uses a payment service as a payer or payee.

The Bank will only consider the actual physical location of the end user to determine whether they are in Canada. An individual temporarily living, attending school, working or vacationing outside of Canada is not considered to be an end user in Canada.

Which cross-border transactions do I need to report?

Cross-border transactions in the retail payments space involve the movement of funds between a payer and a payee in separate countries. These transactions can be conducted in a variety of ways, including (but not limited to) bank transfers, credit card payments, mobile payments and e-wallet initiated payments. Both foreign and domestic payment service providers (PSPs) need to report retail payment activities that are performed in relation to an electronic funds transfer (EFT) and are not incidental to another service or business activity, unless otherwise excluded.

The Bank of Canada intends to issue guidance on reportable transactions required under the Retail Payment Activities Act (RPAA).

Does the Retail Payment Activities Act (RPAA) apply to my Interac e-Transfer^® transactions?

Section 7 states that the RPAA does not apply to payment functions that are performed in relation to an electronic funds transfer (EFT) if it uses a system designated under section 4 of the Payment Clearing and Settlement Act (PCSA), such as Interac e-Transfer. This ensures that systems designated under section 4 of the PCSA, and therefore already overseen by the Bank of Canada, are not also covered by the RPAA.

If you use Interac e-Transfer as part of your payment services or to deliver parts of your payment services, payment functions performed on the system would not be covered under the RPAA. However, payment functions relating to the same transaction and performed outside of the designated systems would fall in scope. For example, in most situations involving Interac e-Transfer, at least some of the payment functions are performed outside of the designated system, such as maintaining an account. Initiating an EFT and transmitting some payment instructions in relation to an EFT are likely performed outside of the designated system. These functions are covered by the RPAA. As a result, in most cases PSPs using the Interac e-Transfer system will still need to register with the Bank.

Further, if the operator of a designated system (i.e., a legal entity) performs other retail payment functions on systems that are not designated under section 4 of the PCSA, it would need to register with the Bank.

Are banks or authorized foreign banks covered under the Retail Payment Activities Act (RPAA)?

As indicated in paragraph 9(a), banks are subject to the entity-based exclusion under the RPAA. They are subject to the Bank Act and supervised by the Office of Superintendent of Financial Institutions (OSFI) in Canada. As set out in paragraph 9(b), the RPAA also does not apply to an authorized foreign bank as defined in section 2 of the Bank Act in respect of its business in Canada.

Roles and responsibilities in the transaction chain

Does a foreign payment service provider (PSP) need a local representative?

Under paragraph 29(1)(o) of the Retail Payment Activities Act (RPAA), a PSP that does not have a place of business in Canada must identify the name and address of an agent or mandatary within Canada. Agents and mandataries identified by a PSP are authorized to accept, on behalf of the PSP, notices and orders received under the RPAA.

Will I still be considered a foreign payment service provider (PSP) if I open a branch in Canada?

If you have a place of business in Canada, you will be considered a domestic PSP.

Do agents and mandataries need to register with the Bank of Canada under the Retail Payment Activities Act (RPAA)?

As set out in section 10, the RPAA does not apply to agents or mandataries of a registered PSP if the agents or mandataries are performing retail payment activities in the scope of their authority as agents or mandataries. They must be included on the list of agents or mandataries the PSP provided as part of its application for registration and updated when a change in registration information occurs. Hence, they do not need to register with the Bank of Canada if they are performing retail payment activities in the scope of their authority as agents and mandataries.

Are payment service providers (PSPs) liable for their employees, third-party service providers or agents?

As set out in section 87 of the Retail Payment Activities Act (RPAA), a PSP is liable for a violation that is committed by any of its employees, third-party service providers, or agents or mandataries acting in the course of their employment, their contract or the scope of their authority as agent or mandatary. This applies whether or not the employee, third-party service provider, or agent or mandatary that actually committed the violation is identified.

Timeline for registering

What is the transition period?

The Retail Payment Activities Act (RPAA) includes a transition period for payment service providers (PSPs) to apply to register with the Bank of Canada.

During the transition period (from November 1, 2024 to September 7, 2025), the regulations prescribe a 15-day period within which PSPs must submit their application for registration. PSPs can continue to perform retail payment activities during this transition period only if they have submitted an application to the Bank. Furthermore, if an individual or entity plans to begin performing retail payment activities during the transition period, it must apply for registration with the Bank and wait a prescribed period of 60 days before beginning to perform these activities.

How long will it take to complete and submit my online registration application form?

The time to fill in a registration form will vary depending on the corporate structure and business activities. We recommend you use all the guidance tools at your disposal. To help prepare for registration, the Bank of Canada will publish a step-by-step guide ahead of the registration period.

Will my registration as a payment service provider (PSP) ever expire?

Your registration will not expire.

However, your registration can be revoked for a variety of reasons, as set out in the Retail Payment Activities Act (RPAA), including if you cease to perform retail payment activities or have committed or have been deemed to have committed a violation under the RPAA.

How far in advance do I need to register before I can start performing payment services?

As set out in section 104 of the Retail Payment Activities Act (RPAA), payment service providers (PSPs) that perform or plan to perform retail payment activities during the transition period (from November 1, 2024 to September 7, 2025) must register with the Bank by November 15, 2024. If you plan to begin performing retail payment activities during the transition period you must wait 60 days after submitting an application before beginning to provide such services.

Following the transition period, section 23 requires that PSPs must register with the Bank before performing retail payment activities.

Applying for registration

Who within the payment chain is responsible for ensuring that payment service providers (PSPs) register with the Bank of Canada and comply with the requirements in the Retail Payment Activities Act (RPAA) and Retail Payment Activities Regulations (RPAR)?

All PSPs that are subject to the RPAA (no matter where they are in the payment chain) are responsible for ensuring they register with the Bank before performing retail payment activities and ensuring compliance with the RPAA and its associated regulations.

Failure to register with the Bank is a serious violation. This may result in the issuance of a notice of violation along with a substantial administrative monetary penalty.

Do independent sales organization agents and service providers need to ensure the entities they work with are registered?

As part of the registration process, payment service providers (PSPs) must identify their third-party service providers and agents or mandataries within their registration application. However, all PSPs that are subject to the RPAA (no matter where they are in the payment chain) are responsible for ensuring they register with the Bank before performing retail payment activities and ensuring compliance with the RPAA and its associated regulations.

As set out in section 10, the RPAA does not apply to agents or mandataries of a registered PSP if the agents or mandataries are performing retail payment activities in the scope of their authority as agents or mandataries. A PSP must update its list of agents and mandataries when a change in registration information occurs.

Note that, as set out in section 87 of the Retail Payment Activities Act (RPAA), a PSP is liable for a violation that is committed by any of its employees, third-party service providers, or agents or mandataries acting in the course of their employment, their contract or the scope of their authority as agent or mandatary, whether or not the employee, third-party service provider, or agent or mandatary that actually committed the violation is identified.

Can I complete a registration application on behalf of my clients?

An applicant can designate authorized users within their user profiles to perform various functions. These functions include (but are not limited to):

• completing the registration application form
• assisting with the payment for the registration application fee
• communicating with the Bank of Canada for information requests related to the application

Is the $2,500 registration fee refundable if my application is denied?

The $2,500 fee is non-refundable.

You can refer to the criteria for registering payment service providers to determine whether you are subject to the Retail Payment Activities Act (RPAA) and will need to register with the Bank of Canada.

In addition, you can use the Bank’s self-assessment questionnaire to help you determine whether you are subject to the RPAA. This tool is a resource for potential applicants and does not constitute legal or other advice.

The results of this tool do not provide an official decision or opinion from the Bank on application or registration status. Prospective registrants are advised to seek specific legal advice if any questions arise from their use of this questionnaire.

Do all payment service providers (PSPs) pay the same registration fee?

PSPs subject to the Retail Payment Activities Act (RPAA) are required to pay a flat registration application fee of $2,500. This fee is the same for all applicants.

Process for registration

As an international payment service provider (PSP), do I have to register the entire business or just the Canadian subsidiary?

A PSP will be responsible for registering with the Bank of Canada:

• if it has a place of business in Canada and performs retail payment activities
• if it does not have a place of business in Canada but performs any retail payment activity for an end user in Canada and directs retail payment activities at individuals or entities in Canada

During the registration application process, a PSP will be required to identify its third-party service providers, affiliated entities, and agents or mandataries. If an affiliated entity, such as a subsidiary, is performing retail payment activities and is subject to the Retail Payment Activities Act (RPAA), it is also responsible for registering with the Bank.

Is there a streamlined registration process for small payment service providers (PSPs)?

There is no streamlined registration process based on the size of a PSP. The information requested will vary depending on the applicant’s activities and organizational structure.

Do international payment service providers (PSPs) need to individually register all their agents, mandataries and affiliates?

Every PSP must apply for registration for itself, regardless of size. As part of its registration application, the PSP will be required to provide the information outlined in section 29 of the Retail Payment Activities Act (RPAA), which includes identifying its agents, mandataries, affiliated entities and third-party service providers, as well as any prescribed information. It is up to its agents and mandataries to determine whether they should also register with the Bank of Canada in regards to payment activities provided outside of the scope of their authority as agents and mandataries. All affiliates and third-party service providers who individually meet the criteria under the RPAA to be considered a PSP must also apply for registration.

How long will it take to obtain a response from the Bank of Canada about my registration application?

For an application submitted during the transition period, an applicant can expect to receive a response from the Bank beginning September 8, 2025. The Retail Payment Activities Act (RPAA) prohibits the Bank from informing applicants of the outcome of their application during the transition period.

For an application that is submitted after September 8, 2025, an applicant can expect to receive a written notice of registration as soon as feasible in accordance with subsection 25(2).

If applicable, you can expect to receive a written notice of refusal from the Bank:

• 45 days after the day the period of additional information (subsection 29(3) of the RPAA) expires
• 45 days after the day the Bank considers the application to be complete, for a prescribed reason or any reason set out in subsection 48(1)
• 30 days after the day the Bank refuses registration in accordance with subsection 48(2)
• following the issuance of a directive from the Minister of Finance to refuse registration in accordance with section 40

Do I have any obligations under the Retail Payment Activities Act (RPAA) if I am being acquired?

As set out in subsection 24(1) of the RPAA, if an individual or entity plans to acquire control of a registered payment service provider (PSP), the registered PSP must, before the acquisition, submit a new application for registration that takes the planned acquisition into account and be so registered.

Do foreign payment service providers (PSPs) need to submit a new application if they are being acquired or there is a prescribed change?

The Retail Payment Activities Act (RPAA) applies to both domestic and foreign PSPs. Subsection 24(1) requires registered PSPs to submit a new application for registration before the planned acquisition takes place. Subsection 24(2) requires them to submit a new application before a prescribed change takes place.

Which criteria does the Minister of Finance consider when conducting national security reviews?

As part of the registration process, the Department of Finance Canada, on behalf of the Minister, has 60 days to review applications when the Minister is of the opinion it is necessary to do so for reasons of national security. If the Minister decides to review an application, they will inform the Bank of Canada, which will in turn inform the PSP of the Minister’s decision. The Retail Payment Activities Regulations (RPAR) prescribes 180 days for national security reviews, which can be extended for one or more periods equal to the prescribed period, at the discretion of the Minister.

As part of its security review, the Department of Finance Canada reviews specific information the applicant provided during the application process.

Paragraph 29(1)(p) of the Retail Payment Activities Act (RPAA) identifies the information an applicant is required to provide in relation to itself or the retail payment activities it performs. Additionally, paragraphs 24(9)(a)–(p) of the RPAR outline additional (prescribed) information an applicant is required to disclose for the purposes of national security.

The Department of Finance Canada may designate a person or government authority under section 32 of the RPAA to perform national security reviews. Section 2 of the RPAA defines “government authority” as including the Royal Canadian Mounted Police, the Communications Security Establishment and the Canadian Security Intelligence Service.

When the review is complete, the Minister may issue a directive to the Bank to refuse the registration. The Minister may also, by order, require any individual or entity to provide an undertaking, or impose conditions, in relation to an application for registration or in relation to any registered PSP if the Minister is of the opinion that it is necessary to do so for reasons related to national security. In that case, the Department of Finance Canada will inform the Bank, which will then inform the applicant or PSP. The RPAR also sets out 30 days for a PSP to request a review of the Minister’s decision.

How is a payment service provider (PSP) expected to report on the values and volumes of electronic funds transfers as well as other retail payment activity metrics?

The Retail Payment Activities Act (RPAA) and its regulations outline the metrics that a PSP is required to provide to the Bank of Canada. In addition, the Bank intends to issue guidance to further outline expectations for reporting metrics.

Who can I contact to get more information?

If you have questions about retail payments supervision or have any comments on this topic, contact us.

To stay up to date on retail payments supervision and opportunities to engage with us, please subscribe to our newsletter.

How will the Bank of Canada protect my data?

Information obtained by the Bank under the Retail Payment Activities Act (RPAA), and any information derived from it, is confidential and will be treated accordingly. In practice, this means the Bank will be using a secure API to exchange data and store them on its servers.

Please note that in accordance with the RPAA, certain information may be disclosed:

• to the public through the registry of registered PSPs and the list of refused or revoked PSPs, or when a notice of violation is issued
• to the Minister or to any government authority or regulatory body, provided it agrees to treat the information as confidential

Can I submit multiple applications under one account?

The email address used to create an account can be associated with only one application.

I am a third-party consultant helping payment service provider (PSP) clients register with the Bank of Canada. Can I use my account to submit the applications?

Only one entity can be associated with one account and email address. PSPs should create their own account and may enter third-party consultant information in the Delegate Profiles section to allow third parties to assist with the registration process.

Registration decisions

How will I know when a decision is made for my application?

The Bank of Canada reviews and assesses an individual or entity’s registration application. Application information is also transmitted to the Financial Transactions and Reports Analysis Centre of Canada and the Minister of Finance, which each have a role in reviewing registration applications, as set out in the Retail Payment Activities Act (RPAA). Once this work is complete, you will receive a notice from the Bank indicating the decision either to register you as a PSP or to refuse your application.

The Bank will inform applicants about the outcome of their application only after the transition period.

What is the public registry?

As set out in section 26 of the Retail Payment Activities Act (RPAA), the Bank of Canada must maintain a public registry of registered PSPs. The registry will include:

• the name (legal and trade names) of each registered PSP
• the PSP’s civic (or head office, if applicable) and mailing addresses
• the date on which the PSP was registered
• the PSP’s telephone number, email address and website address (if applicable)
• any payment functions the PSP performs
• the names of all agents and mandataries that perform functions on behalf of the PSP

How long will information remain on the public registry?

The Bank will regularly update the registry and the list of revoked and refused entities published on its website to reflect any change of status. The registry will remain public indefinitely.

If I am refused registration, how can I appeal the decision?

If the Bank of Canada refuses registration, the applicant will receive a written notice of the Bank’s decision to refuse, in accordance with the Retail Payment Activities Act (RPAA). The notice will include the reason for the refusal and information about how to make a request to the Governor for a review of the refusal to register.

Once the review process is complete, an applicant may appeal the Governor’s decision to the Federal Court.

Interplay with other regimes

Do I still need to register with the Bank of Canada as a payment service provider (PSP) if I am already regulated by a provincial regulator?

The Retail Payment Activities Act (RPAA) is intended to avoid duplication of supervision. Section 9 of the RPAA outlines several exclusions for provincially regulated financial institutions, including credit unions, caisses populaires, insurance companies, trust companies and loan companies that accept deposits transferable by order. The RPAA does not apply to a PSP listed in section 9.

Do I still need to register as a payment service provider (PSP) if I am registered with another Canadian federal regulator?

Individuals or entities registered with another federal regulator in Canada must also register with the Bank of Canada unless they are subject to an exclusion outlined in section 9 of the Retail Payment Activities Act (RPAA). The RPAA is intended to avoid duplication of supervision. It does not apply to a PSP listed in section 9.

Do I still need to register if I am supervised in another jurisdiction? Are risk management requirements considered to be satisfied if I am already supervised by another regulator?

Payment service providers (PSPs) supervised in another jurisdiction will need to register with the Bank of Canada if they perform retail payment activities for end users in Canada and direct retail payment activities at individuals or entities in Canada, as set out in the Retail Payment Activities Act (RPAA). This does not apply if they are subject to exclusions outlined in sections 6 to 10 of the RPAA.

Individuals and entities subject to the RPAA will need to comply with operational risk management, incident response, safeguarding of end user funds and reporting requirements even if they are supervised in another jurisdiction.

Will the Bank of Canada share payment service provider (PSP) information with other regulators?

The Retail Payment Activities Act (RPAA) requires the Bank to share certain information with both the Department of Finance Canada and the Financial Transactions and Reports Analysis Centre of Canada. To exercise its powers or perform its duties and functions under the RPAA, the Bank may enter into an agreement or arrangement with any government authority or regulatory body if the government authority or regulatory body agrees to treat the information as confidential.