Key takeaways
- Under Canada's Retail Payment Activities Act (RPAA), payment service providers (PSPs) that hold end-user funds must safeguard them until they are withdrawn or transferred.
- The safeguarding requirements, supervised by the Bank of Canada, came into force on 8 September 2025.
- There are two methods: hold the funds in trust in a trust account used for no other purpose, or hold them in a segregated account with insurance or a guarantee at least equal to the amount held.
- Every PSP holding end-user funds must keep a written safeguarding framework explaining how end users get reliable, timely access to their funds, including if the PSP becomes insolvent.
- The Bank of Canada's final Safeguarding End-User Funds Guideline, published on 12 December 2024, sets out its expectations in detail.
What the RPAA is and who it covers
The Retail Payment Activities Act is the federal law that brought payment service providers in Canada under supervision for the first time. A PSP is a business that performs payment functions for end users, such as holding funds in an account, initiating or authorising transfers, or providing clearing and settlement, where it has a place of business in Canada or serves end users in Canada. Banks and certain other regulated institutions are excluded.
PSPs must register with the Bank of Canada, manage operational risk, respond to incidents, report to the Bank and, where they hold end-user funds, safeguard those funds. The registry and the operational risk and safeguarding requirements took effect on 8 September 2025.
The two safeguarding methods
A PSP that holds end-user funds must use one of two methods. Under the trust method, it holds the funds in trust in a trust account that is not used for any other purpose. Outside Québec, this requires a valid express trust under Canadian common law, and the account must be held at one of the financial institutions listed in the Act, such as a bank or credit union.
Under the insurance or guarantee method, the PSP holds the funds in a segregated account used for no other purpose and maintains insurance or a guarantee for an amount at least equal to the funds in the account. The Bank's guideline accepts that volumes fluctuate, but the PSP's framework must explain how cover keeps pace with the balance.
| Method | Where funds are held | Protection on insolvency | Key condition |
|---|---|---|---|
| Trust | Trust account used for no other purpose | Funds held in trust for end users | Valid express trust; eligible financial institution |
| Insurance or guarantee | Segregated account used for no other purpose | Proceeds of the insurance or guarantee | Cover at least equal to the funds held |
The written safeguarding framework
Every PSP holding end-user funds must keep a written framework. It must explain how end users will have reliable and timely access to their funds, how funds will be paid out if the PSP becomes insolvent, and the legal and operational risks that could prevent either from happening. It must also cover any situation where end-user funds are not placed in the safeguarding account immediately on receipt, and how those funds are protected in the meantime.
The framework is not a policy document to be filed and forgotten. The Bank expects it to describe the actual systems, controls and processes the PSP uses. In practice, that means showing how the PSP confirms each day that the funds in its safeguarding account match what it owes end users. Our guides to what the safeguarding framework must contain and how to calculate end-user funds go into the detail.
Changes the Bank must be told about
A PSP must notify the Bank of Canada of significant changes to its safeguarding arrangements. These include opening or closing an account that holds end-user funds, a change to the terms of the account agreement, and, for PSPs using the insurance or guarantee method, a change of insurer or guarantor or a change to the policy or guarantee terms. The Bank can enter into a formal compliance agreement with a PSP to fix non-compliance, and can take enforcement action.
Worked example: insurance cover and a peak balance
A Canadian payroll platform uses the insurance method with cover of CAD 20.0 million. Its end-user balance usually sits around CAD 18.4 million. On the day before a large payroll run, employers fund their accounts and the balance reaches CAD 21.0 million for one night.
For that night, CAD 1.0 million of end-user funds is not covered. The platform's framework should anticipate this: either by sizing cover to the peak, adding cover before known funding dates, or moving the excess into a trust account. Daily reconciliation of the safeguarding account against end-user balances is what makes the peak visible before it becomes a gap.
| Day | End-user funds held (CAD) | Insurance cover (CAD) | Uncovered (CAD) |
|---|---|---|---|
| Normal day | 18,400,000 | 20,000,000 | 0 |
| Night before payroll run | 21,000,000 | 20,000,000 | 1,000,000 |
| Day after payroll run | 17,900,000 | 20,000,000 | 0 |
Canada alongside the US and UK
Many PSPs operating in Canada also hold customer funds in the United States and the United Kingdom, where the rules work differently. US money transmitters must hold permissible investments against outstanding obligations. UK payment and e-money firms must reconcile safeguarded funds daily under CASS 15. Each regime starts from the same reconciled position: what is owed to customers in each entity and currency, and what is held for them.
Safeheld reconciles each entity's position across banks, processors and ledgers and applies the rules of each jurisdiction, including the RPAA, to the reconciled figures. See Safeheld reconciliation and what payment reconciliation involves.
Frequently asked questions
When did RPAA safeguarding requirements take effect?
On 8 September 2025.
What are the RPAA safeguarding methods?
Holding end-user funds in trust in a dedicated trust account, or holding them in a dedicated segregated account with insurance or a guarantee at least equal to the funds held.
Who supervises RPAA safeguarding?
The Bank of Canada.
Does every PSP need a safeguarding framework?
Every PSP that holds end-user funds must keep a written safeguarding framework.
What changes must be notified to the Bank of Canada?
Significant changes, including opening or closing an account holding end-user funds, changing the account agreement, and changing insurers, guarantors or policy terms.
References
- Bank of Canada, Retail payment supervision: requirements for payment service providers
- Bank of Canada, Safeguarding end-user funds: consultation findings and responses (December 2024)
- Retail Payment Activities Act (S.C. 2021, c. 23, s. 177)
About Safeheld
Safeheld reconciles client money every day, resolves every difference and prepares every regulatory return for sign-off, for regulated firms in the United States, the United Kingdom, the European Union, Canada, Australia, Singapore and Hong Kong. To discuss your operations, contact us at safeheld.com/contact.
This article is for general information and does not constitute legal or regulatory advice.