Markup Over Interchange

Common pitfalls and official sources

Is your payment processor registered? The RPAA and the Bank of Canada PSP registry

What the Retail Payment Activities Act means for merchants, which providers must register with the Bank of Canada, how to check the PSP registry, and what registration does not cover.

Updated · 4 min read

Is your payment processor registered? The RPAA and the Bank of Canada PSP registry

Under the Retail Payment Activities Act (RPAA), most non-bank payment service providers (PSPs) that perform retail payment functions for people or businesses in Canada must register with the Bank of Canada. Registration provisions took effect on 1 November 2024, and since 8 September 2025 PSPs must have operational risk management and end-user funds safeguarding frameworks in place; PSPs also file an annual report with the Bank. Merchants can search the Bank of Canada's public registry of PSPs, its list of applicants and its list of refused or revoked registrations. Registration is a supervision check, not an endorsement: the Bank does not handle individual disputes or fee concerns.

This guide is part of the pitfalls and official sources section.

Key RPAA dates

DateMilestone (Bank of Canada)
29 June 2021RPAA approved by Parliament
22 November 2023Retail Payment Activities Regulations published in the Canada Gazette, Part II
2024Guidelines finalised; supervisory policies begin
1 November 2024Registration provisions take effect (applications due by 15 November 2024 for existing PSPs)
8 September 2025Risk management and funds safeguarding requirements take effect
June 2026The Bank announced it would begin publishing notices of violation by PSPs

Who must register, and who does not

The RPAA applies to providers that perform retail payment functions: providing or maintaining accounts for payment, holding funds on behalf of end users, initiating payments, authorising and transmitting payments, and clearing or settling. For merchants, that can include payment facilitators, some online payment platforms, POS providers that handle funds, and other non-bank processors.

Not every provider is a PSP under the RPAA. Banks and other financial institutions regulated under other laws (such as credit unions, trust and loan companies and insurers) are excluded (RPAA s. 9), and certain activities are outside the Act (s. 6). A small processor that resells a bank's acquiring service may or may not perform functions itself. If in doubt, ask the provider directly: "Are you registered with the Bank of Canada under the RPAA, or are you exempt, and why?"

How to check a provider

  1. Go to the Bank of Canada website and find the retail payments supervision pages.
  2. Open the registry of PSPs and search for the provider's legal name and any trade name.
  3. If not found, check the list of applicants and the refused or revoked registrations list.
  4. If you still cannot find it, ask the provider whether it is a bank, is exempt, or operates under another provider's registration, and get the answer in writing.
  5. Save a screenshot with the date in your records.

What registration means for your money

Registered PSPs that hold end-user funds must safeguard them under RPAA s. 20: in a trust account used for no other purpose, in a separate account backed by insurance or a guarantee, or in another manner set by regulation. This matters to merchants whose sales sit with a provider before being paid out. Funds safeguarding does not change the provider's right under your agreement to keep reserves for chargebacks and refunds; see settlement holds, reserves and payouts.

What registration does not cover

IssueWho handles it
Fees and pricingYour agreement; the Code of Conduct and FCAC for card network rules
Individual disputes with the providerThe provider's complaints process; then provincial or federal consumer protection bodies, or legal routes
Privacy complaintsThe Office of the Privacy Commissioner, or provincial commissioners
FraudThe Canadian Anti-Fraud Centre and police
Card network rule breachesNetwork complaint processes; FCAC for the Code

The Bank of Canada says it does not handle individual disputes, fee concerns or privacy complaints, and points end users to the PSP first and then to provincial or federal consumer protection agencies.

Composite example

A composite, not a real business: a yoga studio is offered a very low online rate by a provider it has not heard of. The owner checks the Bank of Canada registry and finds no match under the brand name. She asks for the legal name and finds that company listed as registered. She files a screenshot with the agreement, then compares the full quote with two others using the quote comparison checklist. Registration answered one question; whether the provider is the best fit is a separate one.

Other checks before you sign

  • Legal name and address in Canada, and how to reach support.
  • Settlement account: where your funds are held before payout, and when you get paid.
  • Reserves: whether and when the provider can hold funds.
  • Data: where card and customer data are stored and how they are protected; see PCI compliance fees.
  • Code of Conduct: whether the provider processes card payments under the networks' rules and gives the Code's disclosures; see merchant rights under the Code.

FAQ

My bank is my processor. Does the RPAA apply?

Banks are generally excluded from the RPAA because they are regulated under other laws. Your card processing agreement with the bank's acquiring business is still covered by the Code of Conduct.

Does registration mean the Bank of Canada approves the provider's prices?

No. Registration and supervision concern risk management and safeguarding of funds, not pricing or service quality.

What if a provider is on the refused or revoked list?

Ask the provider to explain, and think carefully before entrusting it with your sales. Consider getting advice.

Sources

Related guides