Karsten Wenzlaff, Advisor
August 26th, 2025
Retail Payments | March 6, 2025

Image: Freepik/prostooleh
The Bank of Canada has shared two new guides (see below) to help payment service providers (PSPs) prepare for supervision under the Retail Payment Activities Act (RPAA). The new materials explain the key rules PSPs must follow and offer practical tips to make compliance easier.
By September 8, 2025, PSPs must follow new rules for managing risks and protecting customer funds. They should be fully prepared by this date, or at least show that they have identified any gaps and are actively working to fix them. PSPs will also need to start meeting reporting requirements on the same date.
PSPs subject to the RPAA had until November 15, 2024 to apply for registration with the Bank of Canada. Those who have not yet registered must do so immediately—at least 60 days before beginning retail payment activities. Failure to register may lead to enforcement actions.
The two documents on Operational Risk and Incident Response (7 page PDF) and Safeguarding End-User Funds (8 page PDF) provide additional clarity on official guidelines (it doesn't replace them). The two new pieces of guidance should be reviewed by PSPs along with the following regulatory documents:
This document helps PSPs understand how to handle risks and deal with unexpected issues in their payment services. PSPs need a solid plan to keep their operations secure and running smoothly. This means identifying possible risks, taking steps to prevent problems, and having a clear process for fixing issues when they happen. If a major problem affects their business, PSPs must notify the Bank of Canada within 48 hours. They also need to regularly check and update their risk management plans to make sure they remain effective. If PSPs use third-party providers, they must also ensure those providers follow proper risk management practices to stay compliant.
This document explains what PSPs need to do to keep customer funds safe. PSPs must make sure that customer money is kept separate from their own by storing it in a dedicated account only for safeguarding. They can protect these funds by using a trust account, purchasing insurance, or securing a financial guarantee, as required by the RPAA.
PSPs also need to have a clear, written plan outlining how they meet these safeguarding requirements. Regular checks should be done to confirm funds are properly protected, and an independent review must take place at least once every three years. These steps help ensure that customer funds stay secure and available, even if the PSP faces financial challenges.
The Bank of Canada has also updated the Supervisory Framework: Supervision page with the two new documents. To avoid enforcement actions and ensure a smooth transition, PSPs should take proactive steps now to meet their obligations before September 8, 2025.
The National Crowdfunding & Fintech Association of Canada (NCFA Canada) is a cross-Canada non-profit actively engaged with fintech, alternative finance, blockchain, cryptocurrency, crowdfunding and online investing stakeholders globally. NCFA Canada provides education, research, industry stewardship, services, and networking opportunities to thousands of members and subscribers and works closely with industry, government, academia, community and eco-system partners and affiliates to create a strong and vibrant crowdfunding and fintech industry. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
Leave a Reply