The RPAA explained: what the Retail Payment Activities Act means for platforms and merchants

Canada now has a federal rulebook for the companies that move money for merchants. The Retail Payment Activities Act, the RPAA, put payment service providers under Bank of Canada supervision, and the last of its requirements came into force on September 8, 2025. If you build software for Canadian merchants, or you are one, the Act changes what you can expect from whoever processes your payments. This is a plain-language guide to what it covers and what to ask. It is not legal advice.

Who the Act is for

The RPAA applies to payment service providers, which the Act defines by function rather than by label. If a company performs a retail payment activity for end users in Canada, such as initiating a transfer, authorizing or transmitting a payment instruction, holding funds on an end user's behalf, or providing clearing and settlement services, it is a PSP. That catches processors, acquirers, payment facilitators, wallets and many fintechs. It also applies to foreign providers that direct those services at Canadian end users, not only companies with a Canadian office. Banks, credit unions and other prudentially regulated institutions are carved out because they already answer to other regulators.

A software platform that embeds payments is usually not the PSP. Its payments partner is. The distinction matters, because the obligations below sit with the registered entity, and the platform's job is to know whether its partner carries them.

What a registered PSP has to do

The Act sets up four kinds of obligation.

Register and stay registered. PSPs had to apply to the Bank of Canada during a fifteen-day window in November 2024, and new entrants must apply at least sixty days before they start operating. The Bank publishes a registry of registered PSPs, so anyone can check whether a provider is on it.

Safeguard end-user funds. When a PSP holds money on behalf of an end user, even briefly, it has to keep those funds separate from its own and place them in a trust or safeguarding account, or cover them with insurance or a guarantee. The point is that if the PSP fails, the money moving through it still reaches the merchant.

Manage operational risk. Every PSP needs a written framework for identifying and managing the risks that could disrupt its payment activities, covering systems, people, third parties and incident response. Material incidents have to be reported to the Bank and to affected end users.

Report and notify. PSPs file annual reports with the Bank and have to notify it before significant changes to their operations, such as new payment activities or a change in how end-user funds are held.

The Bank of Canada has enforcement tools behind all of this, including penalties and the ability to refuse or revoke registration.

What it means for a software platform

For most platforms the Act is good news with a homework assignment attached. The good news is that the provider carrying your merchants' money is now supervised, has to keep that money separate, and has to tell you when something goes wrong. The homework is checking that the provider you chose actually does those things.

Three questions settle most of it. Is your payments partner on the Bank of Canada registry, under the name on your contract? When your merchants' funds sit with the partner between a sale and a payout, where are they held and under what protection? And if there is an incident, who tells your merchants, and how fast?

If your platform has grown into holding or moving funds itself, through a wallet, a stored-balance feature or a payout service of your own, you may be a PSP in your own right. That is the point to talk to counsel, because the obligations above would be yours.

What it means for a merchant

A merchant rarely deals with the RPAA directly. The effect shows up in the fine print and in a bad week. The provider on your statement should be registered, your settlement funds should be segregated while they are in transit, and you should hear about an outage or a breach from the provider rather than from a customer. Those are now reasonable things to ask for, and a provider that cannot answer is telling you something.

How ValPay thinks about it

ValPay is based in Montreal and processes for Canadian merchants, so the RPAA is our operating environment rather than a compliance project. We think the Act does something useful for the whole market: it makes "who holds the money, and what happens if they fail" a question with a public answer. Platforms comparing partners should ask it of everyone, including us.

The short version

The RPAA registers and supervises the companies that move money for Canadian merchants, makes them protect funds in transit, and makes them report when things break. Platforms should confirm their partner is registered and how funds are safeguarded. Merchants should expect the same. Nobody should treat this guide as legal advice; the Bank of Canada publishes the registry and the guidance, and counsel can tell you where your own business sits.