Canada’s Retail Payment Activities Regulations (RPAR), SOR/2023-229, are federal regulations made under the Retail Payment Activities Act (RPAA). As of June 23, 2026, the regulations are in force. The transition and initial application phase began on November 1, 2024, and the remaining operational-risk, safeguarding, reporting and related provisions took effect on September 8, 2025. The Bank of Canada administers the federal retail-payments supervision framework.
What the Retail Payment Activities Regulations cover
The RPAR supplies detailed rules for the RPAA regime governing payment service providers. The enabling Act applies to covered providers with a place of business in Canada and to certain foreign providers that direct retail payment activities at end users in Canada. Its definition of a retail payment activity is tied to a payment function involving an electronic funds transfer in Canadian or foreign currency, or in another unit that meets criteria prescribed by regulation.
The regulations also refine the perimeter. They exclude qualifying securities-related transactions performed by a person regulated or exempt under Canadian securities legislation, treat genuinely incidental payment activities as outside the Act in specified circumstances, and prescribe SWIFT as an excluded entity. Scope therefore depends on the activity, the provider, the payment instrument and the statutory exclusions rather than on a company’s label alone.
Key requirements for payment service providers
Registration and supervisory information
Covered payment service providers must be registered with the Bank before performing retail payment activities. The RPAR specifies information for applications and the public registry, ownership and control thresholds, national-security review information, prescribed changes that can require a new application, and a formula for the application fee. The Bank publishes its registry as screening decisions are completed.
Operational risk and incident response
Providers must maintain a written framework addressing business continuity, cybersecurity, fraud, information technology, data management, change management, physical security and third-party risk. The framework must assign oversight, set measurable reliability objectives, provide for training, monitoring, testing and recovery, and be reviewed at least annually. Material incidents trigger notice obligations to the Bank and materially affected parties without delay.
Safeguarding end-user funds
Where a provider holds end-user funds, the RPAA requires an authorized safeguarding method, such as a dedicated trust account or a separate account supported by qualifying insurance or a guarantee. The RPAR adds requirements for account and protection providers, insolvency treatment, liquidity arrangements, an end-user ledger, senior-officer oversight, annual review and periodic independent review. The objective is reliable access to funds and prompt return following an insolvency event.
Reporting, records and enforcement
A provider that performs retail payment activities during a calendar year must file its annual report by March 31 of the following year. Notice of a significant change or new retail payment activity is generally due at least five Bank business days before implementation. Providers must keep intelligible records sufficient to demonstrate compliance, protect those records, and retain them for the prescribed period, including when agents or third-party service providers hold them.
The RPAR designates contraventions that may be pursued as administrative monetary penalty violations. The prescribed maximum is C$1 million for a serious violation and C$10 million for a very serious violation, while specified late-reporting violations use separate daily or range-based amounts. These are statutory maximums, not automatic penalties.
Crypto and stablecoin relevance
The current RPAR text does not itself prescribe a cryptoasset, virtual currency or stablecoin as the additional “unit” contemplated by the RPAA definition. Finance Canada states that Bank of Canada supervision of payment functions performed in a fiat-backed stablecoin remains conditional on that stablecoin being prescribed by regulation. Supporting stablecoin regulations are under development, so this profile should not be read as treating the RPAR as a general crypto or stablecoin regime.
Status and review
The consolidated regulations are current through May 26, 2026 and record September 8, 2025 as the latest amendment and full commencement date. Future amendments, Bank supervisory publications and the proposed stablecoin prescription process remain relevant review points. This profile describes the federal framework at a high level and is not legal or compliance advice.