As of September 8, 2025, every payment service provider operating in Canada — Stripe, Square, PayPal, Helcim, Lightspeed, and dozens of others — must be registered with the Bank of Canada under the Retail Payment Activities Act. Most merchants have never heard of this law.
You don't have to do anything. But you should understand what changed, because it directly affects how well-protected your payout funds are if your processor gets into financial trouble.
The Retail Payment Activities Act (SC 2021, c.23) is federal legislation that brought non-bank payment service providers under Bank of Canada supervision for the first time. Before it passed, companies like Stripe and Square operated in Canada without any formal prudential oversight — they were registered as money service businesses with FINTRAC for anti-money laundering purposes, but nobody was specifically watching whether your payout funds were protected.
The RPAA changed that. It creates a registration regime, mandates operational risk management standards, and — most importantly for merchants — requires PSPs to safeguard end-user funds separately from the company's own operating capital.
The Bank of Canada maintains a public registry of registered PSPs. Full enforcement began September 8, 2025. PSPs that missed the registration deadline were required to stop operating in Canada.
The short version: Your Stripe or Square payout balance is now legally required to be held in a separate, protected account — not commingled with the company's general funds. If your processor goes insolvent, your money has a meaningful claim on those assets. That's new.
The RPAA covers non-bank payment service providers that perform retail payment activities in Canada. In practical terms: Stripe, Square, PayPal, Helcim, Lightspeed Payments, Shopify Payments, Moneris's ISO partners, and many others.
It does not cover the Big 6 banks (RBC, TD, BMO, Scotiabank, CIBC, National Bank) — those are regulated under the Bank Act and have always been subject to OSFI oversight. Moneris itself, as a bank-owned entity, was also already covered.
| Processor Type | Regulated Under | Fund Safeguarding |
|---|---|---|
| Big 6 banks (RBC, TD, BMO, etc.) | Bank Act / OSFI | Existing CDIC deposit protection |
| Moneris (RBC + BMO joint venture) | Bank Act / OSFI | Existing bank regulation |
| Stripe Canada | RPAA — Bank of Canada | New RPAA safeguarding requirement |
| Square Canada | RPAA — Bank of Canada | New RPAA safeguarding requirement |
| PayPal Canada | RPAA — Bank of Canada | New RPAA safeguarding requirement |
| Helcim | RPAA — Bank of Canada | New RPAA safeguarding requirement |
| Shopify Payments | RPAA — Bank of Canada | New RPAA safeguarding requirement |
The RPAA imposes three main obligations on registered PSPs. As a merchant, the first and second matter most to you.
PSPs must apply for and maintain registration. The Bank of Canada publishes a public registry at bankofcanada.ca. Registration is not an endorsement — it means the company has met the filing requirements and is subject to ongoing supervision. An unregistered PSP is operating illegally in Canada and should be avoided.
This is the protection that matters most for merchants. PSPs must hold end-user funds — meaning your pending payout balance — in qualifying liquid assets that are kept separate from the company's own operating funds. They cannot invest your money in the company's business. They cannot commingle it with general corporate accounts.
Qualifying assets include bank deposits at federally regulated financial institutions and certain government securities. If the PSP becomes insolvent, safeguarded funds have priority claim status over the company's other creditors.
PSPs must maintain documented operational risk frameworks covering system reliability, incident response, cybersecurity controls, and business continuity. The Bank of Canada can audit compliance and impose administrative monetary penalties for non-compliance.
Before the RPAA, if Stripe Canada's parent entity had a financial crisis, your payout balance sitting in their system was essentially an unsecured creditor claim. You might get pennies on the dollar, years later, after bankruptcy proceedings.
That was the actual risk with large fintechs holding merchant funds. It happened in the US with some smaller processors — not with Stripe or Square specifically, but the legal structure was the same.
Under the RPAA, safeguarded funds are held in qualifying assets outside the company's general corporate treasury. In an insolvency, those funds have priority. You'd still face delays, but the protection is categorically better than the pre-RPAA situation.
If your processor holds a rolling reserve — typically 5–10% of your processing volume held back for 90–180 days — those funds are also subject to safeguarding requirements. This is new protection for the reserve amounts that processors sometimes freeze alongside account holds. See our guide on account holds and rolling reserves for more context.
September 8, 2025 was the date of full RPAA enforcement. Before that date, PSPs could apply for registration and continue operating during the transition period. After September 8, unregistered PSPs had to stop processing Canadian payments or face enforcement action from the Bank of Canada.
In practice, all the major processors — Stripe, Square, PayPal, Helcim, Lightspeed, Shopify — were registered well ahead of the deadline. The enforcement action is more likely to catch smaller or fly-by-night operators than the processors most Canadian merchants use.
The fund safeguarding requirements came into force on the same date. PSPs had to demonstrate they had the systems and accounts in place to properly segregate end-user funds before registration was granted.
Registration does not mean the Bank of Canada endorses a processor's rates, service quality, or contract terms. A registered processor can still have terrible ETF clauses, tiered pricing, or frozen accounts. The RPAA is a prudential supervision framework — it protects your funds if the worst happens, not your day-to-day processing experience. See our contract red flags guide for what to watch on the commercial side.
The Bank of Canada maintains a public registry of all registered PSPs at bankofcanada.ca/core-functions/retail-payments-supervision/. The registry is searchable by company name. Before signing with any new payment processor, checking this registry takes thirty seconds and confirms they're operating legally in Canada.
If a processor you're currently using is not on the registry, that's worth investigating. They may have been denied registration, may be in the process of applying, or may have missed the deadline. Contact them directly and ask for their registration status and application ID.
bankofcanada.ca/core-functions/retail-payments-supervision/ — search by your processor's legal name or operating name
Registered PSPs receive a unique registration number. Keep this on file — you may need it for insurance or dispute purposes
Registration can be suspended or revoked. If you're processing significant volume, an annual check takes a minute
The RPAA is the foundation for something bigger. As part of modernizing Canada's payment infrastructure, RPAA-registered PSPs are expected to be able to join Payments Canada directly — giving them access to the Real-Time Rail (RTR) and Interac e-Transfer rails without needing to route through a bank sponsor.
This is currently expected in a 2026–2027 timeframe. When it happens, it means fintech processors like Stripe and Helcim could process Interac e-Transfers and RTR instant payments directly, without the bank intermediary layer that currently exists. For merchants, this could mean faster settlements and lower costs on bank-transfer-based transactions.
The practical implication now: any processor you sign with should be RPAA-registered, because that registration status is the prerequisite for accessing next-generation Canadian payment rails. An unregistered processor will be locked out of these networks.
Payment Processor Contract Red Flags — the 10 clauses that cost Canadian merchants money
Account Holds and Rolling Reserves — what happens when your processor freezes your funds
Real-Time Rail (RTR) for Canadian Merchants — what instant payments mean for your business
Open Banking in Canada — the broader framework the RPAA fits into