The Retail Payment Activities Act in Canada
The provider that moves or holds your money must register with the Bank of Canada, keep the money it holds for you apart from its own, and tell you without delay about an incident that affects you.
Updated November 4, 2026
Who the Act covers
A business whose service is moving or holding other people's money is a payment service provider when that service is not incidental to another business activity.1 The Retail Payment Activities Act (RPAA) applies to a provider with a place of business in Canada and to a provider outside Canada that performs retail payment activities for people and businesses in Canada.2
Payment functions include holding money for you, sending a transfer you ask for, passing on payment instructions, and clearing or settling payments.1
The Act does not apply to banks, credit unions and caisses populaires, insurance, trust and loan companies, the Canadian Payments Association or the Bank of Canada, among others.3
What your provider must do
Your provider must manage disruptions, safeguard money it holds for you and report to the Bank of Canada.
| What your provider must do | What it means for you | Source |
|---|---|---|
| Maintain a risk management and incident response framework | Your provider plans for what could disrupt its service and how it responds, and the Bank can check that plan. | 4 |
| Report incidents without delay | If an incident materially affects you, your provider tells you and the Bank without delay. | 5 |
| Keep your money apart | Money it holds for you sits in a trust account used for nothing else, in an account or manner the Regulations prescribe, or in an account used for nothing else with insurance or a guarantee covering at least what it holds. | 6 |
| Submit an annual report | It reports to the Bank once a year, by March 31. | 7 |
| Give advance notice of significant changes | It tells the Bank at least five business days before a change that could affect its risks or how it keeps your money safe. | 8 |
Registration
A provider must register with the Bank before it carries out retail payment activities. The Bank must register an applicant unless the Act provides a reason to refuse.9
The Bank can impose penalties of up to $10,000,000 on a provider for a very serious violation.10
Read how registration with the Bank of Canada works.
Checking a provider
You can look up a provider before you trust it with your money. The Bank keeps a public registry that anyone can check. For a registered provider, it lists the name and address, trade names, registration date, contact details, payment functions and agents.11
Use the registry alongside the wider picture of payments regulation in Canada.
Questions
Who does the Retail Payment Activities Act apply to?
The Act applies to a person or entity that performs payment functions as a service or business activity in its own right.1 It covers providers with a place of business in Canada and providers outside Canada that carry out retail payment activities for people and businesses in Canada.2
Are banks covered by the RPAA?
No. The Act does not apply to banks, credit unions and caisses populaires. It also excludes insurance, trust and loan companies, the Canadian Payments Association and the Bank of Canada, among others.3
What happens to my money if a payment provider holds it?
The provider must hold it in a trust account used for nothing else, or in an account used for nothing else with insurance or a guarantee for at least the amount held. The regulations can also set out other accounts or ways of holding it.4
How do I check that a payment provider is registered?
Look it up in the Bank's public registry. The registry lists the provider's name and address, trade names, registration date, contact details, payment functions and agents.5