RPAA for MSBs: Payment Functions, Safeguarding and Operational Risk

Apply the RPAA test separately from FINTRAC

The Retail Payment Activities Act supervises covered payment service providers. FINTRAC focuses on AML/ATF obligations; the Bank of Canada’s regime addresses payment-related operational risk and protection of end-user funds. Being registered with FINTRAC neither establishes nor removes an RPAA obligation.

Assess whether you perform a covered payment function as a non-incidental service, whether it relates to an electronic funds transfer within the regime, whether the geographic connection is met, and whether an exclusion applies. The Bank’s framework addresses fiat-currency payment activity; examine fiat legs separately when a business also handles digital assets. Do not infer scope from the word “crypto” or “MSB”.

Identify the function performed by each party

The five payment functions encompass providing or maintaining an end-user account, holding end-user funds until withdrawal or transfer, initiating an electronic funds transfer at an end user’s request, authorizing or transmitting payment instructions, and providing clearing or settlement services. The actual role matters more than a label such as “gateway” or “technology provider”.

Trace instructions and funds through the service. Record which party performs each function and whether it is merely incidental to another service. A Canadian place of business can create a connection even when end users are abroad. For foreign providers, directing services at Canadian end users and performing covered retail payment activities for them can bring the provider into scope. Check exclusions explicitly rather than assuming an overseas entity falls outside the Act.

Safeguarding begins with the holding function

The safeguarding requirements concern PSPs that hold end-user funds until withdrawal or transfer. They are not a generic obligation attached to every payment message. Where the holding function applies, the framework specifies conditions for the available safeguarding approaches; “keep money in a separate account” is not a complete implementation plan.

Assess the required trust-account approach or the specified account-plus-insurance-or-guarantee approach against the Bank’s guidance. Document ownership, eligible institutions or providers, coverage, reconciliation, liquidity and the treatment of funds if the PSP becomes insolvent. The legal structure and day-to-day ledger need to tell the same story.

• Identify when end-user funds enter and leave the holding arrangement.
• Reconcile the end-user ledger to safeguarded funds and investigate differences.
• Document how funds would be returned following insolvency.

An incident plan is only one part of operational resilience

The operational-risk and incident-response framework must be documented, implemented and maintained. It should identify risks, protect systems and processes, detect problems, support response and recovery, and include testing and review. The framework must reflect the provider’s actual risks and dependencies.

Consider outages at a banking partner, a broken reconciliation process, compromised payment credentials and failure of a critical technology supplier. For each scenario, determine how the problem is detected, who makes decisions, what customer and regulatory communications may be required, and how service is restored. Outsourcing a function does not remove the need to understand and oversee the dependency.

Make reporting an ongoing operating process

The Bank’s annual-reporting guidance sets March 31 as the annual reporting deadline for PSPs performing retail payment activities. Collect evidence throughout the reporting period rather than reconstructing it at the deadline. Incident-related obligations and registration-information updates are separate from the annual report.

Before performing covered activities, confirm the registration requirement and your status through current Bank guidance. Maintain a single internal obligations calendar while preserving the distinction between RPAA duties and FINTRAC duties. An AML policy, a Bank registration and an insurance policy are each only part of the operating framework.

• Assign accountable owners to safeguarding and operational-risk controls.
• Retain test outcomes and evidence that identified weaknesses were addressed.
• Calendar March 31 annual reporting and separately track other notification duties.