In August 2024, the Bank of Canada (the Bank) released further guidance on changes to the Retail Payment Activities Act (RPAA), which included case studies on Payment Service Providers (PSPs) that would need to register with the Bank under the RPAA. Now in effect, the RPAA's initial registration period opened on November 1, 2024, and will conclude on November 15, 2024.
Entities impacted by the RPAA include, but are not limited to, payroll services, e-commerce web tools, and cloud computing. The above-noted case studies also include details and guidance on “providers of services backed by cryptocurrencies.” This category has notable overlap with entities that are regulated under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA), which applies broadly to companies dealing in virtual currency.
The Bank has issued guidance as to the persons and services captured under the RPAA to supplement the somewhat vague wording of current legislation. As we will explore, the RPAA effectively requires registration and compliance for all persons who meet the definition of a money services business under the PCMLTFA and also meet the definition of a payment service provider under the RPAA. All persons who meet the definition of a PSP will meet the definition of a ‘money-services business' (MSB). However, not all MSBs will necessarily be a PSP.
What is a Payment Service Provider?
Under the RPAA, the Bank is responsible for supervising PSPs, with the goal of building confidence for consumers and end-users of the services in the reliability and safety of the service provided. The Bank promotes compliance with the RPAA by reviewing evolving technologies that are to be captured under the requirements and ensuring that PSPs offering those products are registered with the Bank to “mitigate operational risks and safeguard end-user funds.”1 With the Bank turning its attention to fintech and cryptocurrencies in recent years, and with its most recent guidance on the industry published in October 2024, crypto-trading platforms (CTPs) and companies dealing in cryptocurrencies need to be mindful about whether they will be classified as PSPs and upcoming registration deadlines.
A PSP is defined under the RPAA as “an individual or entity that performs payment functions as a service or business activity that is not incidental to another service or business activity.”2 Among other criteria, you may be classified as a PSP if you perform any of the following payment functions:3
- provision or maintenance of an account held on behalf of one or more end users for electronic funds transfers;
- holding of funds on behalf of an end user;
- initiation of an electronic funds transfer at the request of an end user;
- authorization of an electronic funds transfer or the transmission, reception or facilitation of an instruction in relation to an electronic funds transfer; or
- provision of clearing or settlement services.4
The RPAA requires that PSPs register with the Bank before performing anything it deems to be a retail payment activity, which it defines as “a payment function that is performed in relation to an electronic funds transfer that is made in [a fiat currency or a prescribed unit].”5 By releasing the case scenarios, the Bank provided greater clarity for entities to determine which frameworks might apply to their business.
As mentioned above, in October 2024, the Bank provided the following guidance and case scenarios about providers of services backed by cryptocurrencies:6
- Crypto exchanges dealing solely in cryptocurrency: Companies dealing exclusively in providing payment functions not related to electronic funds transfers involving Canadian dollars, foreign currencies, or prescribed units are not required to register under the RPAA. In other words, if the company only performs retail payment activities related to cryptocurrencies, it is not a PSP.
- Centralized crypto exchange dealing in cryptocurrency and fiat currencies: If a company deals in both cryptocurrencies and fiat currencies but only provides payment services which are incidental to its main business and do not generate additional revenue it will likely not have to register under the RPAA.
- Company offering prepaid cards backed by cryptocurrencies: A company offering prepaid cards backed by cryptocurrencies that also provides payment functions such as the facilitation of electronic funds transfers may be required to register. Additional factors such as whether these activities generate revenue and if they're actively marketed will be a determining factor in any assessment.
For further clarity, the above scenarios are designed by the Bank to highlight what registrable payment functions would look like in a cryptocurrency context.7 If your digital assets business performs one of these payment functions, they are additive to the earlier guidance, and you may need to register even if it was not described in the previous case studies.
What is a Money Services Business?
As discussed, a PSP will be an MSB subject to FINTRAC supervision, although not all MSBs will be a PSP. The PCMLTFA is a separate regime overseen by Financial Transactions and Reports Analysis Centre of Canada (FINTRAC). This legislation requires companies categorized as an MSB to register with FINTRAC. Under the PCMLTFA, businesses offering services dealing in virtual currency are deemed to be MSBs and must:8
- Register with FINTRAC;
- Implement a compliance program;
- Implement “know your client” protocols;
- Submit “Suspicious Transaction Reports,” “Terrorist Property Reports,” “Large Cash Transaction Reports,” “Large Virtual Currency Transaction Reports,” and “Electronic Funds Transfer Reports” to FINTRAC;
- Keep certain records;
- Enact travel rule requirements related to electronic funds transfers and virtual currency transfers; and
- Comply with all ministerial directives.
With the new scenarios released by the Bank, MSBs dealing in virtual currencies may also have to add registration as a PSP to this list of requirements.
What is the Difference?
The term “Money Services Business” captures a much broader scope of activities. Under the PCMLTFA, any person or entity offering an enumerated MSB service will qualify as an MSB.9 These services include, but are not limited to, remitting or transmitting funds, providing crowdfunding platform services and of course, dealing in virtual currency. Comparatively, the RPAA has a far narrower scope. PSPs are limited to entities performing a payment activity in the retail context. A detailed list of this activities has been included in the “What is a Payment Service Provider?” section above.
Further, while these acts regulate similar businesses they do so with different objectives. The RPAA is designed to protect Canadian businesses and consumers through regulating retail payments. By contrast, the PCMLTFA is intended to “fight money laundering and terrorist financing, both domestically and internationally.”10
Do I Have to Register Under Both Regimes?
It is possible that businesses will be required to register under both the RPAA and the PCMLTFA. Cryptocurrency businesses that are currently registered as MSBs with FINTRAC may also be captured as PSPs under the RPAA. Despite similarities between these two regimes, registration under one does not preclude you from registration under the other. Companies that fall under the scope of both acts must register under both acts.
There are some important exceptions to the need for double registration. The RPAA has excluded from PSP registration activities “giving effect to” an eligible financial contract under the Canada Deposit Insurance Corporation Act (CDIC) as well as those regulated by or exempt from securities regulations are not required to register as a PSP.11
Eligible financial contracts are defined in Section 2 of the Eligible Financial Contract Regulations of the CDIC to include derivative agreements and agreements related to the borrowing, lending and repurchasing of securities.12 The Bank considers activities to be “giving effect to” an eligible financial contract if:13
- it is done for the purpose of entering into or acquiring, amending, transferring or disposing of rights under an eligible financial contract;
- it is done for the purpose of satisfying any entitlement, liability, debt or obligation under an eligible financial contract; or
- it relates to trading or advising in eligible financial contracts.
The Bank has carved out an additional exclusion for qualifying securities businesses. Securities-related entities may be exempt from PSP registration if they:14
- Perform a retail payment activity for the purposes of effecting a transaction in relation to securities; and
- They are currently regulated or exempted from regulation under Canadian securities legislation.
Any MSB that is qualifying securities-related entity would therefore not be required to register as both a PSP and an MSB.
How Do I Register as a PSP?
The Bank of Canada has provided a detailed step-by-step guide on PSP registration applications. You can consult their guide for more information about what is required to be included in any application. If you believe you qualify as a PSP, you will want to be mindful of the upcoming registration periods.
The RPAA's initial registration period began on November 1, 2024, and will end on November 15, 2024. If you miss this deadline, you can still register from November 16, 2024, onwards, however you will face delays. Any business that applies after the initial registration period must wait at least 60 days from their application date to commence retail payment activities.
Next Steps
As regulation and legislation surrounding digital assets begin taking shape, companies dealing in virtual currency, whether directly or indirectly, must ensure that they remain compliant with the law. The Bank's decisions for PSP registration applications submitted during the initial registration period are expected to be issued beginning in early September 2025. Companies should determine whether they have an obligation to register as a PSP ahead of the above deadlines.
Footnotes
1 Retail Payment Activities Act, SC 2021, c 23 [RPAA].
2 RPAA, s 177.
3 Bank of Canada, “Criteria for registering payment
service providers” (last modified 2 October 2024), online:
4 To help individuals and entities assess whether they may be subject to PSP registration under the RPAA, the Bank provides a self-assessment tool.
5 RPAA, s 2.
6 Bank of Canada, “Case scenarios about providers
of services backed by cryptocurrencies” (2 October 2024),
online:
7 Ibid.
8 Financial Transactions and Reports Analysis Centre of
Canada (FINTRAC), “Money services businesses” (last
modified 18 September 2024), online:
9 Ibid.
10 Financial Transactions and Reports Analysis Centre of
Canada (FINTRAC), “The Proceeds of Crime (Money Laundering)
and Terrorist Activity Financing Act and Client Identity
Verification” (last modified 29 June 2017), online:
11 Canada Deposit Insurance Corporation Act, RSC 1985, c C-3.
12 Eligible Financial Contract Regulations (Canada Deposit Insurance Corporation Act), SOR/2007-255.
13 Bank of Canada, supra note 3.
14 Ibid.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
