"Canada RPAA Registration Playbook," Faisal Khan LLC, version 3 July 2026 (document 47209A3). An operational manual for a FINTRAC-registered Canadian MSB seeking registration as a Payment Service Provider under the RPAA, regulated by the Bank of Canada, Retail Payments Supervision, filed through PSP Connect.
The core misconception
An RPAA application is not a FINTRAC application. It is submitted to, reviewed by and decided by the Bank of Canada, not FINTRAC. The Bank does not issue an "RPAA licence" — it makes a registration decision and, if successful, places the entity on the public Registry of Payment Service Providers. A FINTRAC MSB registration does not substitute for Bank registration.
Immediate exposure check
Since 8 September 2025 a new applicant must be registered before it begins or continues performing in-scope retail payment activities.
The four-part scope test
Test 1 — Is the entity a PSP? It performs at least one of five statutory payment functions as a service or business activity not incidental to another: (1) providing or maintaining an account for end users in relation to an electronic funds transfer; (2) holding end-user funds until withdrawn or transferred; (3) initiating an EFT at an end user's request; (4) authorising an EFT, or transmitting, receiving or facilitating payment instructions; (5) providing clearing or settlement services.
"Do not rely on labels such as 'software provider,' 'agent,' 'processor,' 'marketplace,' 'technology company' or 'MSB.' The Bank looks at the actual functions performed."
The most common structural error
Choosing the wrong applicant legal entity. Map every product, contract, account and payment function to the entity that actually performs it, and reconcile against FINTRAC records. Each legal entity independently performing in-scope activity may need its own registration; group membership does not consolidate the obligation.
Preparation before opening the form
The playbook prescribes formal project governance, mandatory controls (one master tracker, one data room, one approved source of quantitative data, one version-controlled funds-flow narrative, a 24-hour regulator-response target, written sign-off from every function before submission). Disclosure is extensive: every direct and indirect 10% holder of voting rights or of profits on dissolution; the board and five most highly compensated senior officers; the five largest creditors; state-owned-enterprise ownership, veto and appointment rights; and any FINTRAC violation in the preceding five years.
Quantitative: twelve months, monthly — EFT count and value for all end users and for Canadian end users separately, average daily closing end-user funds, currency mix, end-user counts, and PSP counterparties for the past and next two years.
Two mandatory frameworks
Operational risk and incident response "A superficial policy is inadequate" and a framework copied from an AML manual is listed as a delay trigger.
Safeguarding, if end-user funds are held. The statutory alternatives are a trust account used for no other purpose, another prescribed method, or a dedicated account plus insurance or a guarantee at least equal to the amount held (with a limited exception for qualifying provincially insured deposits).
The application and the fee
PSP Connect's form runs 18 sections. Control points recur — the operating-status answer must match transaction data, contracts, website and FINTRAC profile (do not mark the applicant "not operating" merely because it is not yet registered if it is in fact processing payments); some contact details are published on the public registry; every "yes" to a payment function must be traceable to a specific system action, contract and process step and never selected "merely because it sounds commercially attractive"; and figures must reconcile to a controlled workbook — "Do not calculate directly inside PSP Connect."
The fee is indexed. The Regulations index the base CAD 2,500 using the September all-items Canadian CPI; on the official September 2024 and 2025 indices the formula yields approximately CAD 2,558.97 for a 2026 submission, Pay the exact amount PSP Connect generates; the fee is one-time and non-refundable.
After submission
Seven stages: receipt and initial assessment (assessment begins after the fee is paid; the applicant may appear on the public list of applicants, which is not registration); additional-information requests with a 30-day statutory response period; a completeness determination, which starts the Bank's prescribed 45-day refusal window and is not approval; FINTRAC information exchange; Department of Finance national-security review — the Minister generally has 60 days to decide whether a review is needed, extendable in further 60-day periods, with a prescribed 180-day review that can itself be extended and can end in a direction to refuse; the Bank's registration decision; and the go-live decision.
Critically: there is no reliable end-to-end approval SLA, and the often-quoted 45 days is not an approval timeline — it is the refusal window after completeness. Do not start or resume in-scope activity because the application was submitted, the company appears on the applicant list, the application was deemed complete, or 45 days have passed. Wait until actually registered and on the Registry.
Refusal grounds and delay triggers
Refusal grounds include failure to provide requested information in time, false or misleading information, relevant AML convictions, certain FINTRAC violations in the preceding five years, failure to maintain FINTRAC registration, cessation of or no genuine plan to perform activities, an RPAA violation, unpaid Bank assessments, a determination that the RPAA does not apply, or a Ministerial direction on national-security grounds.
On refusal: written reasons, generally 30 days to request a prescribed review by the Governor, a decision generally due within 90 days, and a further Federal Court appeal generally within 30 days.
After registration
** A material incident must be reported to the Bank without delay and no later than 48 hours after materiality is determined. Significant changes or new retail payment activities require at least five business days' prior notice. An annual report is generally due by 31 March for the preceding calendar year.
Management position
RPAA registration must not be treated as "a short supplemental filing attached to FINTRAC MSB registration" but as a separate prudential and operational-risk regime.