Two regulators oversee companies that move or hold business money in Canada, and public registries let you check their registration before you sign.
Updated November 3, 2026
EFT Rails keeps step-by-step payment histories, showing when steps happened and when they were recorded, and closes clients’ end-of-day positions into records that never change.
The Bank of Canada supervises payment service providers (PSPs) that perform retail payment activities. The Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) oversees businesses that remit or transmit funds as money services businesses.
A PSP must register with the Bank of Canada before performing retail payment activities. A money services business must register with FINTRAC before beginning to operate in Canada.
A provider holding end-user funds must use a dedicated trust account, a prescribed account or manner, or a dedicated account backed by insurance or a guarantee covering at least the amount held.
The Bank of Canada publishes registered PSP names and addresses, along with refusals and revocations. FINTRAC maintains a searchable Money Services Business Registry.
Two separate regulators examine different parts of a provider’s work: how it performs payment activities and safeguards users, and how it addresses financial crime obligations.
The Retail Payment Activities Act (RPAA) creates the framework for retail payments. The Bank of Canada oversees PSP compliance with that Act, taking into account payment service efficiency and end users’ interests.1
A business that remits or transmits funds for others over an electronic funds transfer network is a money services business. This includes a business that pays invoices or accepts payment for goods and services on behalf of others, and it must register with FINTRAC before operating in Canada.2
The regimes remain separate. An application to register with the Bank of Canada must state whether the applicant is registered with FINTRAC, so one application asks about the other without combining the two registrations.3
Read the Retail Payment Activities Act guide for the retail payment regime, or the FINTRAC and RPAA guide for how the two sets of obligations relate.
A payment service provider performs payment functions as a service or business activity. The definition covers an individual or an entity, and excludes payment activity incidental to another service or business activity.4
The payment functions cover the work involved in holding money and moving an electronic transfer:
A retail payment activity is any of these payment functions performed for an electronic funds transfer in Canadian currency or another country’s currency.4 The definition describes the activity being performed and its connection to an electronic funds transfer.
The Act applies to a PSP with a place of business in Canada. It also applies to a provider without a Canadian place of business when that provider performs retail payment activities for an end user in Canada and directs those activities at individuals or entities in Canada.5
Several providers and activities fall outside the Act. The exclusions include banks, credit unions and caisses, insurers, and trust and loan companies. They also include payment functions performed using a system designated under the Payment Clearing and Settlement Act, transfers between affiliated entities where an affiliate is the provider and no other PSP performs payment functions, and payment activity incidental to another business.6
For a business reviewing a provider, the practical starting point is the service itself: whether the provider holds an account or funds, initiates or authorizes transfers, handles transfer instructions, or provides clearing or settlement.
The Bank of Canada’s requirements govern registration, operational risk, incident response, safeguarding, reporting and records for PSPs performing retail payment activities.
Before carrying out retail payment activities, a PSP is required to register with the Bank.7 This means registration must come first. The PSP registration guide explains that process.
A PSP is required to put a risk management and incident response framework in place and keep it operating, so it can find and reduce operational risks and deal with incidents. The framework requires a review no less often than annually and ahead of material changes. The PSP also requires a testing approach, and if it uses an internal or external auditor, it must obtain an independent assessment at intervals of no more than three years. That assessment must be done by a person with adequate skills who did not help set up, operate or maintain the framework.8
If an incident materially affects an end user, another PSP or a designated clearing house, the PSP must notify the affected party and the Bank without delay once it becomes aware. The notice sent to the Bank must explain what happened, the material effect and the response measures.9
A PSP that holds end-user funds until withdrawal or transfer has three permitted safeguarding arrangements. It can hold the funds in trust in a trust account used for no other purpose, hold them in a prescribed account or manner, or hold them in an account used for no other purpose with insurance or a guarantee at least equal to the amount in the account.10
The provider must also create, put into practice and keep up a written framework for safeguarding funds. It is intended to ensure end users can reliably access their funds without delay and, after a specified failure event affecting the provider, that end users receive the funds or proceeds from insurance or a guarantee as soon as feasible.11 The safeguarding guide sets out these requirements in detail.
A PSP must submit an annual report for a calendar year to the Bank by March 31 of the following year. It must also notify the Bank at least five business days before making a significant change in how it performs a retail payment activity or beginning a new retail payment activity.12
Its records must be sufficient to demonstrate compliance and must be retained for five years after the current compliance they demonstrate ceases. The PSP must take reasonable measures to prevent their loss, destruction or falsification, detect and correct inaccuracies, and prevent unauthorized access to or use of their information.13
Administrative monetary penalties can reach $1,000,000 for a serious violation and $10,000,000 for a very serious violation.14
FINTRAC’s requirements apply to money services businesses and concern registration, compliance controls, client identification, records and reports.
A business that moves funds between people or entities over an electronic funds transfer network is a money services business. This includes invoice payment services and services that handle payments for goods and services. FINTRAC registration is required before the business starts operating in Canada.2
A money services business must maintain a compliance program, verify client identity for the activities and transactions where verification is required, and carry out other customer due diligence. It must keep prescribed transaction and client-identification records and submit reports to FINTRAC, including suspicious transaction reports and large cash transaction reports.15
The FINTRAC and RPAA guide explains why a provider’s services can bring it within either or both regimes.
These four questions connect a provider’s answers to published records or a specific legal requirement.
Are you registered with the Bank of Canada? The Bank’s public registry lists the names and addresses of registered PSPs. The Bank also publishes a list of applicants refused registration and PSPs whose registrations were revoked, including the reasons for these decisions.16
Are you registered with FINTRAC? The searchable Money Services Business Registry is updated monthly. A registration entry shows that the business satisfied the legal requirements to register. It carries no FINTRAC endorsement or licence.17
How is my money held while you hold it? Ask which permitted arrangement applies: a dedicated trust account, a prescribed account or manner, or a dedicated account supported by insurance or a guarantee at least equal to the funds held.10
How would you tell me about an incident? An incident with a material impact on you requires notice to you and the Bank without delay. The notice to the Bank must describe the incident, its material impact and the response measures taken.9
An individual or entity that provides payment functions as a service or business is a payment service provider, unless the activity is incidental to another service or business.1 The functions include keeping end-user accounts used for electronic funds transfers, holding funds pending withdrawal or transfer, starting or authorizing transfers, processing transfer instructions, and clearing or settlement.1
The Bank of Canada supervises PSPs performing retail payment activities to determine whether they comply with the Act, and must consider payment-service efficiency and end-user interests.2 FINTRAC separately oversees money services businesses, including businesses that remit or transmit funds for others through an electronic funds transfer network.3
A PSP must register with the Bank of Canada before performing any retail payment activity.4 A business whose services make it a money services business must also register with FINTRAC before beginning to operate in Canada.3
A PSP must maintain and test a risk management and incident response framework, review it annually and before material changes, and arrange an independent review at least once within a three-year period if it has an auditor.5 It must notify materially affected parties and the Bank without delay after a qualifying incident, and its Bank notice must describe the incident, impact and response.6 A provider holding end-user funds must use a permitted safeguarding arrangement and maintain a written framework supporting prompt access and payment after a failure.7 It must also file annual reports, give advance notice of significant changes or new activities, and retain protected compliance records for five years.8
The two regimes and registrations are separate. The Bank of Canada application includes a declaration stating whether the applicant is registered with FINTRAC.9
The Bank of Canada publishes registered PSP names and addresses, plus a list of refusals and revocations with reasons.10 FINTRAC’s searchable Money Services Business Registry is updated monthly, and an entry confirms legal registration requirements were met without indicating endorsement or licensing.11