Key takeaways
- Payment service providers registered under the Retail Payment Activities Act (RPAA) must report to the Bank of Canada regularly and when certain events occur.
- Reporting covers registration information, operational risk management, incident response and, where funds are held, safeguarding of end-user funds.
- Significant changes to safeguarding arrangements, such as opening or closing an account holding end-user funds, must be notified.
- Figures reported on end-user funds should come from the same reconciled records used to manage safeguarding daily.
The reporting regime
The Retail Payment Activities Act brought payment service providers in Canada under Bank of Canada supervision, with operational risk and safeguarding requirements in force since 8 September 2025. Supervision depends on information. The Bank collects it through registration, periodic reports, notices of significant change and incident reports, and uses it to decide where to focus its supervisory attention.
Registration itself is an ongoing obligation. The Bank publishes a registry of PSPs, and the information behind each entry must stay accurate. A PSP that changes its activities, its ownership or the way it holds end-user funds needs to tell the Bank, and in some cases must give notice before the change takes effect.
The Bank's stated purpose for reporting is to keep up-to-date registration information and information about operational risk management, incident response and, where applicable, safeguarding practices for end-user funds. Our guide to RPAA safeguarding covers the safeguarding requirements themselves.
For PSPs that hold end-user funds, reporting is where the safeguarding framework meets supervision. The Bank will look at whether the method described in the framework, trust or insured segregated account, matches the accounts and arrangements the PSP actually reports, and whether the balances reported are consistent with the PSP's volumes.
What is reported
The table summarises the main reporting obligations. PSPs should confirm current forms, deadlines and thresholds with the Bank of Canada, which publishes detailed guidance and updates it.
| Report | When | What it covers |
|---|---|---|
| Annual report | Each year | Registration details, payment activities, operational risk management, safeguarding of end-user funds |
| Significant change or new activity notice | Before the change takes effect | Changes to activities, operations or safeguarding arrangements |
| Safeguarding changes | As they occur | Opening or closing accounts holding end-user funds, changes to account agreements, insurers or guarantors |
| Incident report | Promptly after an incident with a material impact | Operational incidents affecting end users, other PSPs or clearing houses |
Keeping figures consistent
The Bank will compare what a PSP reports across forms and over time. If the annual report describes a trust method but a notice shows a new insured account, or if reported end-user fund balances move in ways the PSP cannot explain, the Bank will ask questions. The simplest protection is to take every reported figure from the same reconciled daily records the PSP uses to manage safeguarding, and to keep a register of safeguarding accounts and arrangements that triggers a notice whenever something changes.
PSPs should also consider who signs off each report. The Bank expects senior management to be accountable for the information submitted. A short internal review before submission, comparing the report with the previous one and with the latest reconciliation, catches most inconsistencies before the Bank does.
PSPs operating in several countries should align RPAA reporting with their other regimes. The same reconciled position that supports Canadian reporting can support US permissible investment reporting and UK safeguarding returns.
A practical step is to keep a reporting calendar covering every regulator a group reports to, with the source of each figure noted next to each deadline. When the same reconciled figure feeds several reports, a correction made once flows through all of them.
How Safeheld supports RPAA reporting
Safeheld reconciles end-user funds against safeguarding accounts daily, keeps the account register that drives change notices, and produces consistent figures for the Bank's reports. See RPAA safeguarding and Safeheld reconciliation.
Frequently asked questions
What must PSPs report under the RPAA?
Annual reports, notices of significant change or new activities, changes to safeguarding arrangements and incident reports.
Must safeguarding account changes be reported?
Yes. Opening or closing an account holding end-user funds and changes to account agreements, insurers or guarantors must be notified.
Who receives RPAA reports?
The Bank of Canada.
How can PSPs keep RPAA reports consistent?
By taking every figure from the same reconciled daily safeguarding records.
References
- Bank of Canada, Retail payment supervision: requirements for payment service providers
- Retail Payment Activities Act (S.C. 2021, c. 23, s. 177)
About Safeheld
Safeheld reconciles client money every day, resolves every difference and prepares every regulatory return for sign-off, for regulated firms in the United States, the United Kingdom, the European Union, Canada, Australia, Singapore and Hong Kong. To discuss your operations, contact us at safeheld.com/contact.
This article is for general information and does not constitute legal or regulatory advice.