Canada — Bank of Canada PSP Registration (Retail Payment Activities Act)

The four-step scope test

The Bank of Canada's guidance sets a four-part test for determining whether an entity must register. All four must be true.

1. 1
   You are a payment service provider: You perform one or more of the five statutory payment functions as a service or business activity that is not incidental to another service or business activity.
2. 2
   You perform retail payment activities: A payment function performed in relation to an electronic funds transfer made in Canadian currency, foreign currency, or a prescribed unit.
3. 3
   You fall within the geographic scope: Either you have a place of business in Canada, or you both perform retail payment activities for end users in Canada and direct those activities at persons in Canada.
4. 4
   Neither you nor your activities are excluded: The RPAA contains both entity-based and activity-based exclusions, each of which must be checked against your specific circumstances.

The Bank publishes a self-assessment tool for this determination, together with a large library of case scenarios covering acquirers, card program managers, marketplaces, payroll services, remittance providers, point-of-sale terminals, lending, e-commerce gateways, and providers of services backed by cryptocurrencies.

The five payment functions

Precision matters here. Each function is defined narrowly in the legislation and the Bank's guidance, and paraphrasing them introduces error.

The incidental test

This is the hardest judgement in the regime and where most self-assessments go wrong. If your only business activity is performing payment functions, you are a PSP. Where you perform both payment and non-payment activities, the question is whether the payment functions exist only to directly support the non-payment activity.

The Bank applies three indicators:

• •Revenue or commercial advantage — a payment function is likely not incidental if it directly generates revenue or a commercial advantage. The Bank reads this broadly: it includes less tangible benefits, such as generating data that may be monetised later.
• •End-user expectations — if a substantial number of end users reasonably expect to be receiving a payment service, the function is likely not incidental.
• •Marketing and advertising — advertising payment features, using payment-related branding or trade names, or allocating budget to promoting payment services all indicate a distinct service.

The Bank's own worked example: a company processing payments for merchants and producing promotional material for those merchants cannot treat the payment business as incidental, because the payment function does not support the promotional business — even where the two are packaged and sold together.

Foreign PSPs: registration without a Canadian entity

Foreign PSPs subject to the RPAA must register with the Bank of Canada even if they are not incorporated in Canada and not registered with FINTRAC as a foreign money services business. Once registered, they are supervised and treated in the same manner as domestic PSPs, and are subject to the same enforcement actions.

You have a place of business in Canada if any one of the following is true:

• •A physical location in Canada, including a home office.
• •Incorporation under federal or provincial legislation.
• •Employees, agents, or mandataries in Canada.

Without a place of business in Canada, you must still register if you both perform retail payment activities for an end user in Canada and direct those activities at persons in Canada. You are considered to be directing activities at Canada if any one of these applies:

• •Marketing or advertising directed at persons in Canada.
• •Operating a .ca domain.
• •Listing in a Canadian business directory.
• •Having a retail-payments agreement, working relationship, representative, agent, or mandatary in Canada.

The Bank may also consider: describing your activities as offered in Canada, offering them in Canadian dollars, providing end-user support to persons in Canada, seeking feedback from Canadian users, having Canadian staff or third parties promoting your activities, having a high proportion of Canadian end users, or operating in multiple countries and being well known in Canada.

Exclusions

Entity-based exclusions: banks and authorized foreign banks under Schedules I, II and III of the Bank Act; insurance companies and fraternal benefit societies; trust and loan companies; provincially regulated deposit-taking institutions including credit unions and caisses populaires; the Bank of Canada; the Canadian Payments Association; the Provincial Crown and its agents accepting deposits transferable by order; and the SWIFT messaging network.

Activity-based exclusions: merchant instruments and group-of-merchants instruments; eligible financial contracts under the CDIC Act; prescribed securities transactions where the entity is regulated or exempt under Canadian securities legislation; cash withdrawals at ATMs including white-label machines; payment functions performed using a designated financial market infrastructure; and internal transactions between affiliated entities where no other PSP performs payment functions.

The registration process

1. 1
   Scope assessment: The four-step test, the incidental analysis, and identification of the specific payment functions performed. This is Zitadelle AG's starting point on every engagement.
2. 2
   PSP Connect account: Registration is impossible without one. PSP Connect is the Bank's registration and communication portal.
3. 3
   Application preparation: Required content includes contact details for the applicant and any third parties, agents, mandataries and affiliated entities; business structure, ownership, debtholders and key staff; the retail payment functions performed or planned, including those performed by agents or affiliates; actual or projected values and volumes of end-user funds held inside and outside Canada; actual or projected end-user numbers inside and outside Canada; the methods used to safeguard end-user funds; whether a risk management and incident response framework is in place or planned; and any existing registrations with FINTRAC or under other federal, provincial or territorial legislation.
4. 4
   Pay the registration application fee: One-time and non-refundable, payable by credit card or EFT. Assessment does not begin until the fee is paid in full. Amount: {{Amount TO VERIFY}}.
5. 5
   Review: Applicants may need to respond to requests for information. The Bank shares qualifying applications with the Department of Finance Canada for national security screening, and with FINTRAC.
6. 6
   Decision and publication: Registration decisions are published as national security screenings complete. Foreign PSPs must identify any Canadian agents or mandataries, who will receive notices and orders on their behalf.
7. 7
   Ongoing: Comply with the RPAA, pay the annual assessment fee, and keep registration information current.

Ongoing obligations

Operational risk and incident response framework. Identify operational risks, assets and business processes; protect activities and assets from those risks; detect, respond to and recover from incidents; assign roles and responsibilities; maintain adequate resources; review and test the framework; and manage risks arising from third-party service providers, agents and mandataries. The framework must be proportionate to the nature of the business, the services offered, and the organisational structure.

Safeguarding end-user funds. PSPs holding end-user funds must either hold them in trust in a trust account, or hold them in a segregated account with insurance or a guarantee. A written framework is required, setting out how end users retain reliable and timely access to their funds and how funds are paid out on insolvency.

Requests for information. Typically 15 days to respond, but 24 hours in specific circumstances. PSP Connect is the primary communication channel, and entities on the applicant list — not only registered PSPs — must respond.

Assessment methods. The Bank uses desk assessments, on-site assessments, and special audits with a scope the Bank defines.

Change of control. A registered PSP must submit a new registration application where a person plans to acquire control, or where a state-owned enterprise plans to acquire the right to appoint the CEO or senior management, elect board members, or acquire an ownership interest. The new registration must be approved before the change takes place.

Enforcement is live and public

• •12 June 2026 — the Bank announced it would begin publishing Notices of Violation issued to payment service providers.
• •27 February 2026 — the Bank issued a revised compliance order to XTM Inc.
• •Registration may be refused or revoked for failing to meet the registration criteria, failing to provide requested information, providing false or misleading information, ceasing to perform retail payment activities, committing a violation, or failing to pay the annual assessment fee. The Bank may also act on information provided by FINTRAC, and must refuse or revoke under a directive from the Minister of Finance on national security grounds.
• •Operating without having submitted an application may violate section 104 of the RPAA. The Bank describes this as a serious violation that could carry a notice of violation with a substantial administrative monetary penalty. Maximum AMP amounts: {{Maximum AMP amounts TO VERIFY}}.

Enforcement tools escalate in the following order: warning letter, compliance agreement, notice of violation with an administrative monetary penalty, compliance order, and application to a superior court.

Reviews and appeals. A refused or revoked registration, a notice of violation, or a notice of default may be reviewed on request within 30 days of receipt. The Governor's delegate must decide within 90 days, and decisions may be appealed to the Federal Court. Separately, where the Minister of Finance issued the directive, review is by the Minister and is also appealable to the Federal Court.

RPAA registration vs FINTRAC MSB registration

Who needs to look at this

The Bank has published case scenarios covering most of these categories, which is the most reliable starting point for a business-model-specific read.

How Zitadelle AG assists

• •Scope assessment against the four-step test and the incidental analysis.
• •Payment function mapping across your transaction flows.
• •PSP Connect application preparation.
• •Safeguarding framework design, including trust versus segregated-account structuring.
• •Operational risk and incident response framework development.
• •Annual report, significant change notice, and incident notice processes.
• •Responses to requests for information within the applicable deadlines.
• •Coordination with parallel FINTRAC MSB registration where both regimes apply.
• •Ongoing compliance support and reassessment when the business model changes.

Related services: Compliance & Advisory, Legal, and Company Formation. For a European footprint see the EU EMI License, and for an offshore payment intermediary structure see the Mauritius PIS License.