RPAA: What Payment Service Providers Must Know Now — Registration, Safeguarding & Senior Officer Duties
The Retail Payment Activities Act (RPAA) introduces a modern regulatory framework for payment service providers (PSPs) operating in Canada. The Bank of Canada’s supervisory policies and guidance set out practical expectations for registration, risk management, safeguarding of end-user funds, incident reporting and governance, including the appointment of a Senior Officer with authority to oversee compliance. Platino Consulting translates that guidance into concrete next steps for PSPs and explains where firms should prioritize work to remain compliant.
Key dates and registration posture — what changed and why it matters
The RPAA’s registration window and staged implementation mean PSPs need to be attentive to timing. Firms that registered during the initial period (November 1–15, 2024) were permitted to continue or begin retail payment activities immediately. PSPs registering after that initial window face phased start rules: a 60-day waiting period applies in many cases, and PSPs that register close to enforcement milestones may need explicit Bank approval before commencing activities. The remainder of RPAA obligations, including formalized requirements on risk management, safeguarding and incident reporting, come into force on September 8, 2025. Annual reporting obligations begin in 2026 (with annual reports due by March 31, 2026 for the 2025 calendar year). These schedules have direct operational consequences for rollout, technology readiness and staffing.
What the Bank of Canada expects — supervisory priorities
The Bank’s supervisory policies emphasize three interlocking priorities:
• Robust risk management — PSPs must adopt a written risk management program that addresses operational resilience (business continuity, cyber and IT risk), fraud controls, third-party risk and change management. The program must be proportionate to the PSP’s size and complexity and subject to periodic testing and review.
• Safeguarding of end-user funds — PSPs that hold or are responsible for end-user funds must implement safeguarding frameworks that make clear how funds are held, reconciled, protected from misuse and recovered in the event of a failure. The Bank has published final guidance on safeguarding to clarify expectations and acceptable approaches.
• Incident response and reporting — PSPs must maintain comprehensive incident response and reporting capabilities, including continuous monitoring, escalation procedures, and documented recovery plans. PSPs must be able to detect incidents promptly and notify the Bank as required.
Governance and the Senior Officer — roles, authority and practical design
A recurring theme in the Bank’s guidance is clarity of responsibility. PSPs must assign and document roles for establishment, implementation and oversight of RPAA programs. A named Senior Officer, senior enough to make material decisions and to drive remediation, is a required element of that governance model. The Senior Officer should have documented skills and training appropriate to the role, and responsibilities must be aligned with reporting lines and escalation paths. In larger firms those duties may be split across executive roles (COO, CFO, Head of Security); in small firms one person may carry multiple responsibilities, but the regulator expects clarity, authority and documented competence either way.
Practical implementation roadmap (what to do this quarter)
Confirm registration status and deadlines. If you registered in the initial window, ensure your registration records are complete and accurate; if you registered later, confirm whether you must observe the waiting period or seek Bank approval. Update registration details in PSP Connect as required.
Map customer flows and funds custody. Identify precisely where you hold, route, or custody end-user funds; this mapping determines what safeguarding measures and contractual protections you must implement.
Build or update a documented risk management program. Prioritize cyber resilience, third-party oversight and recovery objectives; ensure the program includes periodic independent reviews (at least triennial where indicated).
Design an incident detection and reporting playbook. Implement monitoring indicators, escalation triggers, and templates for Bank notifications. Test the playbook with tabletop exercises.
Appoint and document the Senior Officer and role matrix. Draft role descriptions, required competencies and reporting lines, and document delegation where third parties or affiliates perform functions on your behalf.
Common pitfalls and how to avoid them
Underestimating safeguarding complexity. Safeguarding is not just an accounting treatment; it requires legal, operational and contractual controls. Treat it as a multidisciplinary project (legal, treasury, operations, IT).
Unclear governance. Vague delegations or absent documentation around who owns incident response or safeguarding invites regulator questions. Document authority and escalation clearly.
Third-party blind spots. Many PSPs use payment processors, custodians or gateways. Ensure contractual terms and oversight procedures are in place and tested.
Preparing for Bank supervision and annual reporting
The Bank will collect prescribed supervisory information and will expect PSPs to retain records the regulator can’t compel into court proceedings. Begin preparing annual reporting templates and evidence packages now, reconciliations, audit results, test outcomes and incident logs should be organized to match the Bank’s expectations.
RPAA compliance is multidisciplinary and operationally demanding. If you need help mapping obligations, building safeguarding controls, drafting your risk management program, or appointing and training a Senior Officer, contact Platino Consulting for a targeted RPAA advisory engagement can accelerate readiness and reduce regulatory risk.
