.svg)
Pay-in products
Services that collect electronic fiat payments from a payer on a client's behalf — the pay-in leg of a payment flow.
Register your Payment Service Provider with the Bank of Canada
Launching a payment company in Canada? You may need to register as a payment service provider (PSP) with the Bank of Canada under the Retail Payment Activities Act (RPAA).
Renno & Co helps Canadian and international fintech companies determine whether RPAA registration is required, prepare and submit their applications, respond to the Bank of Canada, and get ready to operate under Canada's payment regulations.
We are a Canadian law firm with a dedicated fintech practice. Our lawyers and compliance professionals can help with the registration, the operational-risk and safeguarding frameworks, and the practical work of getting banked and going live.
Discuss Your RPAA Registration →RPAA scope, registration and corporate structuring raise legal questions. You'll receive Canadian legal advice from Canadian lawyers, not an offshore consultant or form-filling shop that can't actually advise you on the law.
We know the people who run the Bank of Canada's PSP division — Directors of Registration, Directors of Enforcement, and their Head of IT. Those relationships allow us to nudge a stalled file along, have an informal chat about your application, and get an early read on how the Bank may treat an unusual business model.
Working out whether you're in scope is a legal call. The risk and safeguarding frameworks you then need are compliance work. Most places split that between a lawyer and a separate consultant; we do both in-house, so your frameworks match the scope analysis we actually filed.
We've heard some horror stories from clients getting bad advice from foreign providers who just don't understand Canadian regulations. We are physically located in Canada and are governed by Canadian law societies (Ontario and Québec to be specific)!
Fintech, payment, crypto and other financial-services businesses advised
MSB registrations completed
RPAA registrations completed
Jurisdictions served, including clients from Cyprus, the UK, Brazil, India and the US
The RPAA covers businesses that perform certain payment functions involving electronic funds transfers. Whether your business needs to register depends on what it actually does, where it operates, who its end users are, and whether any statutory exclusion applies.
The following businesses commonly need an RPAA assessment and may require Bank of Canada registration:
Services that collect electronic fiat payments from a payer on a client's behalf — the pay-in leg of a payment flow.
Services that send electronic fiat payments out to a recipient on a client's behalf — the payout leg of a payment flow.
Fiat-to-fiat transfers that move regular money from a sender to a recipient, typically across borders.
Payment services provides that allow one leg of a payment flow (either the pay-in or payout) to be settled by way of crypto (typically stablecoins).
Businesses that use their own merchant account to open sub-merchant accounts for other merchants and process those merchants' card payments for a fee. In scope even when the funds pass straight through and are never held at rest.
Businesses that give merchants a merchant account and then route, authorize, clear and settle their card transactions — in scope even when they advance funds from their own capital instead of holding them.
Wallets that hold end-user funds across several currencies. In scope — and you'll likely need a compliant safeguarding account.
Foreign companies that perform retail payment activities for Canadian end users and direct those activities at people or businesses in Canada.
We can manage the Bank of Canada registration process and help prepare the operational documentation needed to launch a compliant payment business.
Plenty of businesses that look like PSPs are actually out of scope. We review each entity, the payment functions it performs and how money moves, then give you our legal opinion: whether the RPAA applies (and if so, whether you're subject to safeguarding rules), whether an exclusion gets you out, and which entity should file.
We prepare the full application and all the supporting documents — your business model write-up, organizational structure, ownership details and required disclosures — and file it with the Bank of Canada on your behalf.
We act as your authorized representative with the Bank of Canada, and manage requests for information (RFIs) received by the Bank of Canada during the application process.
We can help prepare your written risk management framework, and incident response plan — the frameworks you are required to have as an RPAA-registered PSP. These frameworks cover your policies for IT systems, third-party providers, business continuity, and cybersecurity.
If your business holds end-user funds, we help develop the safeguarding framework and assess what account arrangements and supporting controls are needed.
Being registered doesn't give you the bank accounts and payment rails you need to actually operate. We can help you get banked through bank and account-provider onboarding.
Businesses offering payments in Canada may need two separate federal registrations. They are not interchangeable.
Focuses on anti-money laundering and anti-terrorist-financing obligations for money services businesses. Renno can help with your Canadian MSB registration.
Applies to PSPs performing in-scope retail payment activities. The regime focuses on operational risk, incident response and, where end-user funds are held, safeguarding those funds.
We send you our RPAA questionnaire — refined over many RPAA filings so you just answer plain questions while our process does the heavy lifting. We then check everything against our checklist and come back with follow-up questions until the file is submission-ready.
We prepare your business model document — the write-up that answers the application's flow-of-funds and business-legal-analysis questions. We may also prepare your sample contract describing the payment activities you perform or intend to perform (which is necessary to include with your application).
We build out your application in the Bank of Canada's PSP Connect portal — entering your business details, payment functions and supporting information in the form the portal requires — and submit it on your behalf.
We act as your point of contact during the Bank of Canada's review and handle any requests for information (RFIs) it raises. Once you're approved, we hand over your PSP Connect portal so you become the main point of contact.
Generally speaking, if you are helping clients make electronic fund transfers (EFTs) to third parties, or helping clients receive EFTs from third parties, you may be required to register as a PSP with the Bank of Canada under the RPAA. Business models that may trigger RPAA registration include: pay-in products, payout products, crypto-based pay-in or payout (where at least one leg of the transaction involves electronic fiat money), remittance companies handling fiat-to-fiat cross-border transfers, custodial crypto trading platforms that hold client balances, and single- or multi-currency e-wallets (which also need a compliant safeguarding account).
See our RPAA registration guide for a deeper dive into what may trigger a requirement to get RPAA registered.
No. FINTRAC's MSB regime is focused on protecting the public against the risk of money laundering and terrorist financing. I.e. FINTRAC MSB registration subjects you to AML/CTF regulations. The Bank of Canada’s RPAA regime is focused on protecting end users from payment service providers. I.e. Bank of Canada RPAA registration subjects you to risk management regulations (e.g. intended to protect your clients’ funds and sensitive data, have robust cybersecurity systems, have processes for doing vendor due diligence, etc.
Read our MSB vs. RPAA guide for more information on how these two registration regimes differ.
Recent straightforward applications have often taken roughly two months in our experience, but this is only a planning estimate, not a guaranteed or statutory turnaround time. Timing depends on the completeness of the application, and regulatory delays. For more detail, see our MSB and RPAA registration timeline guide.
You cannot provide payment services (or any services that trigger RPAA registration) before your RPAA registration is approved. You can however provide other services while you wait for your RPAA registration to be approved — services that do not trigger RPAA registration.
Technically, no. The Bank of Canada registers payment service providers under the RPAA; it does not issue a licence or endorse registered businesses. The registration may nonetheless be a legal prerequisite for your payment services.
Yes. A foreign company can be subject to RPAA registration if it performs retail payment activities for end users in Canada and directs those activities at people or businesses in Canada. Additionally, a company incorporated in Canada that is PSP registered under the RPAA with the Bank of Canada can service non-Canadian clients.
All PSP registered under the RPAA with the Bank of Canada need an operational risk management framework and incident response plan — it is a regulatory requirement (and something banks and account providers may ask for). These are written documents that set out how you keep your payment services running safely — the risk framework covers your policies for IT systems, third-party vendors, business continuity and cybersecurity, while the incident response plan sets out how you detect, handle and report disruptions or security breaches.
Yes, if you intend to hold end-user funds at rest (although you can in theory also get your funds insured as an alternative). Holding funds "at rest" generally means keeping an end user's funds when you have no instruction to move them immediately — they sit with you, available for a future withdrawal or transfer.
The kind of account you'd need is essentially a trust account — similar to a "for benefit of" (FBO) account in the US, or a safeguarding account in Europe.
A safeguarding account is not automatically required for every PSP, and not all bank accounts satisfy safeguarding requirements. We can help assess your model and implement the necessary framework and account setup.
Yes. Where both are required, the FINTRAC and Bank of Canada applications can generally proceed in parallel. We coordinate the descriptions of your products, legal entities and payment flows so the two submissions are consistent. Learn more about our MSB registration services.
Speak with our Canadian fintech legal and compliance team about your business model, application, regulatory documentation and launch requirements.
Contact Renno & Co →