Bank Of Canada Publishes First RPAA Enforcement Decisions Against Payment Service Providers

The Bank of Canada (the Bank) has begun to exercise its enforcement powers under the Retail Payment Activities Act (RPAA), publishing its first enforcement decisions involving Notices of Violation against payment service providers (PSPs). Each published enforcement decision to date has involved a zero dollar administrative monetary penalty (AMP). These early decisions provide an initial indication of the Bank’s approach to enforcement under the relatively new supervisory framework.

The RPAA Enforcement Framework

As we have written about previously in December 2024 and April 2024, the RPAA establishes a comprehensive supervisory regime for PSPs in Canada, with oversight by the Bank. The Bank's stated objects under the RPAA include supervising PSPs for compliance, promoting the adoption of appropriate policies and procedures (in particular to protect retail end users in the event of an insolvency of a PSP) and monitoring trends in retail payment activities.

Part 5 of the RPAA grants the Bank broad enforcement powers, including the ability to issue Notices of Violation and impose AMPs of up to C$10,000,000 for "very serious" violations and up to C$1,000,000 for "serious" violations. Notably, subsection 76(4) of the RPAA states that "[t]he purpose of the penalty is to promote compliance with this Act and not to punish." The Retail Payment Activities Regulations (the Regulations) classify each designated violation (e.g., violations that are subject to AMPs) and set out criteria for determining penalty amounts, such as the actual or potential harm, the alleged violator's compliance history and the degree of intention or negligence.

The Notices of Violation

Each published decision to date (as of August 25, 2026) concerned the same contravention: breaching section 23 of the RPAA, which requires that a PSP be registered with the Bank before performing any retail payment activities. Although this violation is classified as a "very serious" violation under the Schedule to the Regulations which, as noted above, carries a potential AMP of up to C$10,000,000, in every case the Bank imposed a total AMP of zero dollars.

Notably, all published decisions to date involve operating without registration, underscoring the importance of ensuring compliance with the RPAA's registration requirement.

The Bank noted in several instances where a PSP "took steps to comply and mitigated potential harm by submitting its registration application." One PSP, Equals Money PLC, made representations seeking withdrawal of the Notice of Violation and the issuance of a warning letter instead. The Bank's delegate concluded that subsection 78(2) of the RPAA did not authorize that remedy and confirmed the Notice of Violation and zero dollar AMP.

Practical Takeaways for PSPs

The Bank's early enforcement actions carry several practical lessons for PSPs:

• The Bank is actively monitoring the market: Entities that have not yet registered should revisit their analysis promptly to ensure compliance with the RPAA's registration requirements. The zero dollar AMPs should not be understood as establishing a general grace period for non-compliance.
• Proactive remediation matters: In the published decisions, the Bank expressly noted that the PSPs took steps to comply and mitigated potential harm by submitting registration applications. Entities that identify a compliance gap should act promptly and document the steps taken.
• A zero dollar AMP does not eliminate the consequences of a violation: Enforcement decisions remain publicly accessible for five years, and the violation is also noted on the PSP’s registry entry. A prior violation may also be relevant to the calculation of an AMP in a future matter. Accordingly, even a zero dollar AMP may carry reputational and regulatory consequences.

If you have any questions regarding enforcement under the RPAA or the PSP registration process, please contact any of the authors, or a member of the Bennett Jones Fintech group.