Canadian Payment Regulations 2026: What Merchants Actually Need to Know

1. RPAA Enforcement: Your PSP Must Be Registered (September 2025)

The Retail Payment Activities Act (RPAA) came into force in September 2025. Under the RPAA, every payment service provider (PSP) operating in Canada must register with the Bank of Canada and maintain ongoing compliance. This isn't a licence — it's a registration — but non-registered PSPs are now operating illegally.

Why does this matter to merchants? Because if you're using a PSP that hasn't registered, you're relying on infrastructure that the Bank of Canada could order shut down. The Act was designed to bring visibility and oversight to payment intermediaries — fintechs, payment facilitators, wallet providers — that previously operated in a regulatory grey zone.

Who Needs to Register

PSPs performing "retail payment activities" in Canada must register. This includes:

• Payment processors and acquirers
• Payment facilitators (Stripe, Square, Shopify Payments, PayPal)
• Wallet providers and stored-value platforms
• Buy-now-pay-later companies

Banks, credit unions, and entities already regulated under the Bank Act are exempt. Visa and Mastercard themselves are exempt. But Stripe, Square, and most third-party processors are not banks — they need to register.

What Merchants Should Do

Ask your PSP: "Are you registered under the RPAA?" The Bank of Canada publishes a public registry. Cross-reference your processor against it. The major players — Stripe, PayPal, Helcim, Moneris, Square — should be registered. Smaller fintechs and payment facilitators may have dragged their feet.

If you're using a smaller or newer PSP and they can't confirm registration, that's a problem. You're not liable, but you may find your payment processing disrupted if the Bank of Canada acts on an unregistered operator. For full background on the Act, see the RPAA guide for Canadian merchants.

2. VAMP Thresholds Tightening (April 1, 2026)

Visa's Anti-Money Laundering and Fraud Monitoring Program (VAMP) — which consolidates earlier fraud and dispute monitoring programs — tightened its thresholds on April 1, 2026. Merchants above the new thresholds face escalating consequences: enhanced monitoring, fines, processing surcharges, and ultimately forced termination.

The new VAMP thresholds (effective April 2026):

• Excessive dispute ratio: 1.5% dispute-to-transaction rate places you in the Merchant Fraud and Dispute Program (MFDP); above 2% triggers surcharges
• Fraud basis points: 9 basis points (0.09%) fraud-to-sales ratio is the new standard threshold; 12+ bps is the excessive tier
• Minimum transaction count: 1,000 Visa transactions/month before monitoring kicks in — low-volume merchants are largely unaffected

Mastercard has similar programs with comparable thresholds. Both networks have been ratcheting these down over the past several years.

Who Is Actually at Risk

Most physical retail merchants don't get close to these thresholds. Card-present fraud rates are low when you're tapping and chipping. The merchants who hit VAMP thresholds tend to be:

• High-volume e-commerce stores with significant card-not-present transactions
• Subscription businesses with high failed payment and involuntary churn rates
• Digital goods or downloadable content (high fraud-target categories)
• Travel, ticketing, and marketplace merchants with elevated dispute exposure

If you're above 0.5% dispute rate, start investigating root causes now — before you cross the monitoring threshold. See the Canadian chargeback guide for the tactical stuff on dispute management.

What VAMP Means for High-Volume Merchants

If you're processing $500,000+/month online and have any fraud exposure, get your processor to show you your current dispute and fraud BPS numbers. They track this on your behalf; you're entitled to see it. If you're approaching the thresholds, you have options: 3DS authentication, address verification, velocity limits, better fraud tooling. Waiting until you're in a monitoring program is the expensive option.

3. NSF Fee Cap: $10 Maximum (March 12, 2026)

The federal government capped non-sufficient funds (NSF) fees at $10 per occurrence on personal bank accounts, effective March 12, 2026. Previously, the Big 6 banks charged $45–$50 per NSF — the cap is a significant reduction.

Two important caveats that merchants often miss:

• Personal accounts only: Business account NSF fees are not capped. If you're debiting a customer's business account via PAD and it bounces, the customer's bank can still charge them the old rates
• Your return fee: The cap applies to what banks charge their customers — it doesn't cap what your acquirer or PAD provider charges you for a returned item. Expect $5–$25 return fees from your processor regardless

Impact on PAD Collection Strategy

Pre-authorized debit merchants should think through their retry logic. Under the old system, a consumer hitting $45–$50 in NSF fees had strong motivation to fix their account immediately. With the cap at $10, the financial penalty for a failed PAD is lower — which may slightly increase casual non-payment behaviour, though this is speculative at this stage.

More practically: the Payments Canada PAD rules still govern how many times you can retry a failed debit and within what window. Those haven't changed. Three retry attempts within 30 days is the standard; check your PAD agreement for specifics. The NSF cap doesn't give you new retry rights — it just changes what the consumer pays their bank.

For a full breakdown of PAD mechanics, see the pre-authorized debit guide for Canadian merchants.

4. Real-Time Rail: Late 2026 Target

Payments Canada's Real-Time Rail (RTR) infrastructure has been in development for years — the timeline has slipped repeatedly — but the current target is late 2026 for initial launch. RTR is a new interbank settlement network that processes payments in seconds, 24/7, with immediate finality. No overnight batching, no settlement windows.

What RTR means for merchants in practice:

• Interac e-Transfer will migrate to RTR: Business e-Transfer already settles quickly during business hours; RTR will extend this to 24/7 with guaranteed finality
• PAD and EFT will coexist: RTR isn't replacing pre-authorized debit for routine billing — PAD is cheaper for batch collection. RTR is for real-time, request-response payment flows
• New payment products will emerge: RTR enables real-time merchant-initiated debits and request-to-pay flows that don't exist today. These will take 12–24 months after RTR launch to reach merchants through their PSPs

The honest assessment: RTR matters more to PSPs and banks than to most merchants in 2026. Unless your business is built around payment speed (same-day lending disbursements, real-time settlement for gig workers), the practical impact is incremental. The interesting merchant use cases will appear 12–24 months post-launch.

For context on how RTR fits into business payment options, see the business e-Transfer guide.

5. Open Banking Phase 1: Expanding Consumer Data Rights

Canada's open banking framework is rolling out in phases. Phase 1 focuses on read access — consumers can authorize fintechs to read their bank account data (balances, transactions, account details) directly from their bank, without screen scraping. Phase 2 will extend to write access, which is where payment initiation becomes interesting.

Right now, open banking enables better bank account verification and income analysis for merchants who need to qualify customers or verify payment method identity. Fintechs like Flinks and Plaid use this to connect bank accounts for payment processing onboarding. If you're asking customers to provide a void cheque or a bank statement, this is the technology replacing that workflow.

The payment initiation implications come later. When Phase 2 expands write access, it will enable "pay from bank" flows that don't rely on Interac's infrastructure — direct account-to-account transfers initiated by merchants at the point of sale. Think of it as the European open banking payment model arriving in Canada. That's not 2026; it's more likely 2027–2028 for meaningful merchant adoption.

Practical Checklist by Merchant Type

All Merchants

• ✅ Verify your PSP is registered with the Bank of Canada under the RPAA (check the public registry)
• ✅ Review your processor agreement for termination provisions related to fraud/dispute thresholds
• ✅ Know your current dispute rate — ask your processor if you don't have dashboard access to this number

High-Volume E-commerce (>$100K/month)

• ✅ Get your current VAMP metrics from your acquirer
• ✅ If dispute rate is above 0.5%, implement 3DS authentication on high-risk transactions
• ✅ Review fraud tooling — rule-based blocking, velocity limits, device fingerprinting
• ✅ Ensure your chargeback response process is documented and executable within 7 days

PAD / Subscription Billing Merchants

• ✅ Review PAD retry logic in light of the NSF cap (lower consumer penalty may affect behaviour)
• ✅ Confirm your PAD authorization language is compliant with current Payments Canada rules
• ✅ Build a dunning process for failed payments — email + retry schedule, not just silent fail

Businesses Using Alternative PSPs / Fintechs

• ✅ Confirm RPAA registration status for every payment provider you use
• ✅ If using a buy-now-pay-later provider, confirm their registration and what happens to outstanding customer balances if they shut down
• ✅ Have a backup payment method for business continuity — don't rely on a single unregistered PSP

What's Not Changing in 2026

PCI-DSS compliance requirements are not changing in 2026 — PCI-DSS v4.0 requirements are already in force. Card surcharging rules haven't changed: you can still surcharge credit cards up to 2.4% under the 2023 class action settlement rules, but not debit cards. Interchange rates haven't been cut further; the 2023 rate reductions for small businesses remain in place but there's no new round of cuts.

The interchange reduction from 2023 is worth noting: it reduced average credit card interchange for small Canadian merchants from ~1.4% to ~0.95% on qualifying Visa and Mastercard transactions. If you're still paying 2.5–3% all-in, your processor is keeping the difference — not just because interchange is high. See interchange-plus pricing for Canadian merchants for how to evaluate whether you're getting a fair markup.

Timeline Summary