RPAA registration and the Bank of Canada
The Retail Payment Activities Act brings payment service providers under Bank of Canada supervision. It is a separate regime from FINTRAC's anti-money-laundering registration, it does different work, and a Canadian payments counterparty generally needs both. This page explains what each one covers and how to tell whether a provider actually holds them.
Canada regulates payments through two separate regimes with two separate supervisors, and conflating them is the most common error in assessing a Canadian counterparty.
- The Retail Payment Activities Act — chapter R-7.36 — brings payment service providers under Bank of Canada supervision.
- The Proceeds of Crime (Money Laundering) and Terrorist Financing Act brings money services businesses under FINTRAC supervision.
They are not alternatives. They answer different questions, and a firm can hold one without the other.
What each regime actually does
| RPAA — Bank of Canada | PCMLTFA — FINTRAC | |
|---|---|---|
| Concerned with | How the business is run: operational risk, incident response, and how end-user funds are held | Financial crime: customer due diligence, monitoring, reporting |
| Asks | Are your systems reliable, and is customer money protected if you fail? | Do you know who your customers are, and do you report what you should? |
| Status | Registration, not a licence | Registration, not a licence |
| Public record | Bank of Canada PSP register | FINTRAC MSB Registry |
The practical consequence: a FINTRAC registration tells you nothing about operational resilience, and an RPAA registration tells you nothing about AML posture. If a provider offers you one and you needed assurance about the other, you have not got it.
What RPAA registration requires
Registration is the entry point rather than the substance. What follows it:
- Operational risk management — documented frameworks for the risks that could stop the service working, and controls proportionate to them.
- Incident response — the ability to detect, respond to and report incidents that materially affect end users, rather than discovering them from customer complaints.
- End-user fund protection — where a PSP holds funds, arrangements to keep them separate from the firm’s own money and protected. See the end-user funds page for what that does and does not mean.
- Reporting to the supervisor, and keeping registration details accurate as the business changes.
The misreading that matters: registration is not insurance
This is the one to be careful about, because the wrong version is reassuring and the right version is not.
RPAA end-user fund requirements are about segregation and protection arrangements. They are not deposit insurance. A registered PSP is not a bank, and CDIC deposit insurance does not apply to funds held with one.
That is not a weakness in the regime — it is simply what the regime is. But a provider that lets you believe otherwise, or that uses banking language loosely about a payments registration, has told you how it will describe everything else. Ask specifically: where are funds held, in whose name, separated how, and what happens to them if the firm fails.
Why a serious Canadian counterparty holds both
If you are contracting with a Canadian firm for cross-border payments, foreign exchange or stablecoin settlement, the questions you actually need answered span both regimes:
- Will my payments keep working, and is my money protected if they don’t? → RPAA
- Will this firm’s financial-crime controls survive contact with my own compliance function? → FINTRAC
A firm holding only the FINTRAC registration may run good AML and have no supervised operational framework. A firm holding only RPAA registration may be operationally sound and outside the AML perimeter for what you need. Neither is disqualifying on its own; both gaps are worth knowing about before you sign.
How to verify, in order
- Get the legal entity name, not the trading name. Registers list the legal entity, and a trading name will not find it.
- Search the Bank of Canada PSP register for RPAA status.
- Search the FINTRAC MSB Registry for the AML registration and, critically, the activities it covers.
- Ask which regime they are relying on for what. A provider that cannot separate the two in conversation probably has not separated them internally.
- Watch the wording. Registration or licence? Supervised or authorised? The easy claim is the one you can check, and it is a fair proxy for the ones you cannot.
KwiikPay’s Canadian standing
KwiikPay is a trading name of KWP Finance Limited, which holds both:
- registration with the Bank of Canada as a payment service provider under the Retail Payment Activities Act;
- registration with FINTRAC as a money services business including dealing in virtual currency, number C100000942.
Both are registrations, not licences or authorisations, and we say so on every page rather than rounding up. Neither makes KwiikPay a bank, and neither brings deposit insurance.
Verify both on the public registers rather than taking this page’s word for it. If you want to know whether we can serve your business before you spend time on an application, the eligibility check answers it in four questions, or talk to us.
FAQs
What is the RPAA?
The Retail Payment Activities Act, chapter R-7.36 of Canada's statutes. It brings payment service providers performing retail payment activities under Bank of Canada supervision, with registration, operational-risk and end-user-fund requirements. It is the payments-supervision regime; it is not an anti-money-laundering regime.
How is it different from FINTRAC MSB registration?
They do different jobs and sit with different supervisors. FINTRAC registration is anti-money-laundering: who you are, who your customers are, what you report. RPAA registration with the Bank of Canada is prudential and operational: how your systems are run, how incidents are handled, and how end-user funds are held. Holding one says nothing about the other, which is why a serious Canadian payments counterparty usually holds both.
Does RPAA registration mean my funds are insured?
No, and this is the misreading to avoid. The RPAA's end-user fund requirements are about segregation and protection arrangements, not deposit insurance. A registered PSP is not a bank and CDIC deposit insurance does not apply. Anyone implying otherwise is overstating their status — ask instead exactly how funds are held and what happens on insolvency.
Is the Bank of Canada register public?
Yes. The Bank of Canada publishes a register of payment service providers, so you can confirm a counterparty's status yourself rather than relying on a claim. As with FINTRAC, get the legal entity name — not the trading name — before you search.
Is RPAA registration a licence?
No. Like the FINTRAC regime it is registration-based, and we describe it that way deliberately. A provider calling either of its Canadian registrations a licence is inflating the one claim you can check in two minutes.
Does KwiikPay hold RPAA registration?
Yes. KWP Finance Limited, trading as KwiikPay, is registered with the Bank of Canada as a payment service provider under the RPAA, and separately with FINTRAC as a money services business including dealing in virtual currency (C100000942).