RPAA Reporting for Registered PSPs: Bank of Canada Obligations

For MSBs that are also registered as payment service providers (PSPs) with the Bank of Canada, completing the registration process is only the beginning.

The Retail Payment Activities Act (RPAA) creates a separate set of ongoing reporting obligations that operate alongside your FINTRAC reporting responsibilities. And although these two regimes are very different in nature, failure to comply with your RPAA reporting obligations can lead to equally severe consequences.

In June 2026, the Bank of Canada issued a reminder to registered PSPs about these obligations, noting that failure to meet them can result in enforcement action.

It's Not About Reporting Large Transactions

MSBs are accustomed to FINTRAC requirements that can be triggered by certain transactions or suspicious activity. RPAA reporting works differently.

The Bank of Canada is primarily concerned with the safety and reliability of payment services: how PSPs manage operational risks, how they respond to incidents, and how changes to a business may affect its payment activities or customers.

For business owners, this means that certain operational incidents or significant changes to your business can create a reporting obligation, even if they have nothing to do with a large or suspicious transaction.

Material Incidents Need to Be Reported

If an incident has a material impact on an end user, another PSP or an applicable clearing house, the PSP will be required to notify the Bank of Canada.

This could include certain incidents affecting the availability, integrity or confidentiality of systems, data or payment services. The important point is that PSPs need a process for identifying when an incident becomes significant enough to trigger a regulatory notification.

Significant Changes Can Also Trigger Reporting

PSPs also need to think about their reporting obligations before making significant changes to the way they operate.

Under the RPAA, a PSP must notify the Bank before making a significant change to the way it performs a retail payment activity if that change could reasonably be expected to have a material impact on its operational risks or on how end-user funds are safeguarded. The same applies before beginning a new retail payment activity. Notice must generally be provided at least five business days before the change is made.

For a growing business, this is particularly important. Launching a new payment service, changing how funds are handled or introducing a major new third-party provider could have regulatory implications that need to be considered before the change goes live.

Even Ordinary Business Changes May Need to Be Reported

There is another layer that PSPs should not overlook.

Registered PSPs must keep certain information they provided during registration up to date. Changes to areas such as the business's address, structure, third-party relationships, directors, major shareholders and certain data practices can all trigger notification requirements. In most cases, the notice of change should be filed with the Bank of Canada within 30 days of the change.

Annual Reporting

PSPs must also submit an annual report to the Bank of Canada by March 31 each year, covering areas such as risk management, incident response, safeguarding of end-user funds where applicable, and certain financial and payment activity information.

Build RPAA Reporting Into Your Business Decisions

The practical takeaway is that RPAA compliance should not sit separately from the day-to-day management of your business.

If you are planning a major operational change, launching a new service, changing key parts of your business structure or dealing with a significant incident, the question "Do we need to tell the Bank of Canada?" should be part of the conversation from the beginning.

For businesses subject to both FINTRAC and Bank of Canada oversight, understanding which regulator needs to be notified, what needs to be reported and when is becoming an increasingly important part of staying compliant.

If you are unsure about your ongoing obligations under the RPAA, or are planning changes to your business and want to understand whether they need to be reported, contact our team. We can help you assess your reporting requirements and ensure the appropriate notifications are made on time.