Preparing a Bank of Canada PSP Application: The Documents Reviewers Actually Ask About

A Bank of Canada registration application is mostly structured answers typed into PSP Connect. Only a handful of questions ask for uploaded files. Most of the work lies in making sure the uploads, the typed answers and your own records tell the same story.

The Bank of Canada PSP application documents you must upload, each as a single PDF, are:

• a corporate organization chart (5.1)
• documentation describing your payment services and processes (6.1)
• sample contracts (6.2)

Question 6.3 asks you to describe your payment functions. You can do that either by uploading a PDF, with diagrams if you have them, or by typing a written description into the text field. Some uploads are conditional: an organization chart of affiliated entities if you report affiliates (15.5), and an optional prefunding document if it applies to your end-user funds (6.5.1). Your internal compliance records, such as policies and risk assessments, are not application attachments.

CSV files replace manual entries if you have more than five reportable third-party service providers, agents or affiliates. Everything else is entered directly: ownership, directors, payment functions, safeguarding arrangements, volumes, end users, third parties and your FINTRAC status.

This guide follows the Bank's How to complete a registration application: A step-by-step guide (September 2025). As of mid-October 2026, that is still the version linked from the Bank's supervisory framework page. Question numbers refer to that guide. For the overall registration steps, see our RPAA registration guide.

Two timing points apply to anyone applying today:

• The 15-day registration phase in the guide is historical. It belonged to the 2024–2025 transition period and is not a current deadline.
• New applicants must wait for a decision before operating. The Bank's FAQ says new entrants after September 8, 2025 must be registered, meaning they have received a registration decision, before performing any retail payment activities. Submitting an application does not authorize you to operate.

Five kinds of evidence

In the guide, the framework question is a Yes or No question about whether the framework is established or planned, and no framework upload is prescribed. Section 17 of the Retail Payment Activities Act and sections 5 to 12 of the Regulations separately require a PSP to "establish, implement and maintain" one, whatever the form asks. The framework section below covers what the declaration does and does not show.

Readiness matrix

Corporate structure: three different ownership tests

The organization chart (5.1) must identify all individuals or entities that control, or are controlled by, the applicant, using the control rules in section 21 of the Regulations. Upload it as one PDF. For a corporation, control means holding securities carrying one-third or more of the votes to elect directors. Acquiring control of an entity that controls the applicant also counts. Controllers are also entered at 5.16.

Shareholder disclosure (5.4) is a different test. It covers any individual or entity that holds, "or whose benefit is held", directly or indirectly, otherwise than by way of security only, securities carrying 10% or more of the votes to elect directors. A parent company's owner can therefore be caught even though it is not on your share register. The guide gives no look-through calculation method, so record how you reached each answer. For other entity types, question 5.9 asks about a 10% or greater interest in profits, net assets or dissolution proceeds.

FINTRAC's 25% beneficial ownership threshold is a third test. It belongs to the AML regime, for example when a bank or MSB identifies the beneficial owners of a client entity. The RPAA application does not ask for it.

Fictional example. An applicant's voting shares are held as follows:

• 40% by Holdco, which is wholly owned by Individual A
• 28% by Individual E
• 12% by Individual D
• 20% by several holders, each with less than 10%

Holdco and Individual A are both disclosed at 5.4, with Individual A's interest shown as indirect. The tests overlap here, but they are not interchangeable: Individual D is a 10% holder without being a controller or a 25% beneficial owner, and Individual E is a 25% beneficial owner without being a controller. Mixing the thresholds is a common source of inconsistent answers.

Section 5 also collects:

• Directors (5.12): each one's name, address, contact details, citizenship, residence and other board seats
• Senior officers (5.13): up to five of the highest-compensated in the last calendar year
• Creditors (5.15): the five largest during the last and current calendar years
• State-owned enterprises (5.11, 5.14): any interests, or appointment powers

Collect these from source records, not from memory: the shareholder register, director resolutions, payroll and the loan ledger.

Payment services and processes

Questions 6.1 to 6.3 are where reviewers learn what you actually do.

• 6.1 asks for documentation of how you describe your payment services and processes for all retail payment activities, combined into one PDF.
• 6.2 asks for sample contracts or agreements between you and any client, third-party service provider, end user or other party, also as one PDF.
• 6.3 asks you to describe the payment functions you perform. You can either upload a PDF or write the description in the open-text field. The guide asks for diagrams "if available". If you upload several documents, they must be combined into one PDF.

Questions 6.6.2 and 6.6.4 may refer back to the 6.1 PDF, so one well-structured document can support several answers.

Questions 6.4 to 6.8 then ask, function by function, what you do. Map each function before you answer:

A diagram that answers reviewers' questions (hypothetical):

Canadian sender → app (applicant: initiation) → applicant's trust account at a Canadian bank (applicant holds funds) → payout instruction sent through a messaging provider (TPSP) → settlement partner abroad (third party) → beneficiary

Label each box with the legal entity's name and role, and mark:

• where funds sit, and in whose name
• which steps the applicant performs
• where fees are deducted
• what happens to a failed or returned payment

If the diagram, the 6.5 answer and the safeguarding providers named in 6.5.2 do not agree, a reviewer will notice.

Contracts. A sample agreement is what 6.2 asks for. It does not mean every contract you have signed. Before uploading, check that the sample:

• names the applicant entity, not a group company
• describes the services you claim in 6.1
• matches your website and how the product actually works

Geography, volumes and end users

Section 8 asks:

• the Canadian financial institutions you use for accounts and settlement (8.1)
• whether you have a place of business in Canada (8.2)
• if not, whether you direct services at people in Canada (8.3), and whether you have an agent or mandatary in Canada for receiving RPAA notices (8.4)
• which foreign regulators supervise your retail payment activities, and under which statutes (8.5)

The 8.2 answer decides which metric tables appear later. Answer it carefully.

Sections 9 and 10 branch on whether you have begun operations (9.1, 10.1) and on your 8.2 answer:

• Operating applicants give 12 months of monthly EFT number and value. Applicants with a Canadian place of business give these for all end users and for Canadian end users; foreign applicants give Canadian end users only. Applicants that hold funds also give the average day-end funds held each month, with the currency mix.
• New applicants give Year 1 projections instead.
• Section 10 asks for end-user numbers, and for other PSPs you served or plan to serve.

Do not mix payment volume (flows) with funds held (balances). Do not count one payment two or three times as it passes through authorization, transmission and settlement.

End-user funds

Question 6.5 asks whether you hold, or plan to hold, end-user funds until they are withdrawn or transferred. If you do, the following questions ask for:

• the safeguarding arrangement used: a trust account, an account covered by insurance, or an account covered by a guarantee
• each account provider, insurer or guarantor, and whether it is regulated by OSFI or a provincial regulator
• whether provincial deposit insurance applies

Apart from the optional prefunding upload at 6.5.1, the application does not ask for safeguarding agreements. Those agreements still need to exist. Section 20 of the Act requires the funds to be held in a trust account not used for any other purpose, or in an account protected by insurance or a guarantee. Sections 13 to 17 of the Regulations add requirements for account providers, insurance and guarantees, a safeguarding framework, insolvency evaluation and independent review. The Bank's safeguarding guideline sets out its expectations.

A PSP that does not hold end-user funds answers "No" and does not invent safeguarding arrangements.

The risk framework declaration

Question 11.1 asks, as Yes or No, whether the applicant has established, or plans to establish, a risk management and incident response framework. The published guide does not prescribe a framework upload at this question. The Act asks for more than a tick box, though. Paragraph 29(1)(i) of the Act lists "a description of the applicant's risk management and incident response framework or the framework that the applicant plans to establish and implement" among the information an application must contain. The Bank can also request further information about anything in the application.

So a "Yes" does not show compliance, and it should be backed by a framework you can describe and produce. Answering "established" should mean an approved framework exists. If it is still being built, say so.

Applying while a framework is still planned is possible. Operating is different. Section 17 of the Act requires a PSP that performs retail payment activities to establish, implement and maintain the framework, and the supervisory framework page notes that the framework requirements came into force on September 8, 2025. A new entrant can only operate after registration, and its framework, and its safeguarding arrangements if it holds funds, need to be in place from its first payment.

Keep the framework, its approval record, the risk register, incident procedures, continuity plans, third-party assessments and testing evidence ready for supervision. The Bank's operational risk guideline sets out what it expects. Building the framework is covered in our RPAA operational risk framework guide.

Data, third parties, agents and affiliates

Section 12 asks what categories of personal or financial information you collect, where they are stored or processed, and who outside your employees, agents and mandataries can access them.

Section 13 first asks whether you use third-party service providers for retail payment functions (13.1). It then asks whether any have a material impact on your operational risk or on how you safeguard end-user funds (13.1.1). Only material providers are detailed. For each one, you give:

• legal and trade names
• addresses and contacts
• the payment functions it performs
• its risk role
• the location of the technology used
• whether it stores data, and whether you give it access to data

Above five material providers, upload the CSV template instead. A KYC vendor or cloud host is listed only if its failure would materially affect you, and that assessment should be documented.

A group company can be both an affiliate and a TPSP. If so, disclose it in both places consistently.

FINTRAC and provincial registrations

Question 16.1 asks whether the applicant is registered with FINTRAC. If it is, you give the registration number (16.1.1) and issue date (16.1.2). Section 17 asks about provincial or territorial retail payment registrations, both applied for and granted.

Bank of Canada registration and FINTRAC MSB registration are separate. Many PSPs need both, but not all. Answer for the applicant entity as it stands today, and make sure the activities registered with FINTRAC match what you describe in section 6. The differences between the two are explained in MSB vs PSP registration.

The fee. Section 18 collects the application fee by payment card. The fee page shows a base of $2,500 from November 1, 2024. The fee is indexed each year, so check the Bank's latest fee bulletin for the current amount. Review starts only after payment, and a submitted application cannot be cancelled.

An internal evidence tracker

Illustrative internal preparation tool, not a Bank form. Fictional entries.

The gap in the question 13 row is the reason to keep a tracker: it shows what is missing before submission, not after.

Inconsistencies that lead to questions

Two kinds of request have different deadlines:

• Application requests. When the Bank asks for additional information about what is in your application, subsection 29(3) of the Act gives you 30 days after the day the request is made.
• Supervisory Requests for Information. These are sent to registered PSPs and to applicants on the Bank's list of applicants. Under the Bank's supervisory framework, the response timelines are set by the regulations. They are typically 15 days, and 24 hours in specific circumstances.

Check which kind you have received, and work to the deadline stated in the request. The examples below are hypothetical, reviewer-style questions, not published Bank findings.

Giving false or misleading information is a ground for refusal under paragraph 48(1)(b) of the Act.

Two fictional applicants

1. A Canadian remittance fintech that does not hold funds. The fintech has three shareholders: two founders with 45% and 30% of the votes, and an investor with 25%. Customers pay a regulated settlement partner directly, and the fintech's app sends payout instructions.

• Section 5. The 5.1 chart shows the founder with 45% as a controller. All three shareholders are listed at 5.4, because each holds at least 10%.
• Section 6. The diagram shows funds moving from the customer straight to the partner's account. The fintech answers "Yes" to initiation (6.6) and transmission (6.7), and "No" to holding funds (6.5) and to clearing or settlement (6.8).
• Sample contracts. The 6.2 PDF contains the end-user terms and a redacted partner agreement.
• Section 13. The settlement partner and a messaging provider are material TPSPs.
• Volumes. The figures come from 12 months of reconciled instruction logs.
• What it leaves out. It claims no safeguarding arrangements, because it holds no funds.

2. A foreign PSP entering Canada. A European payment account provider will serve Canadian end users from abroad, with no Canadian place of business. Its group affiliate runs the technology, and a Canadian bank provides the safeguarding account.

• Section 8. It answers "No" at 8.2, "Yes" at 8.3, and gives its home regulator at 8.5.
• Metrics. It completes the Canadian-only tables.
• Safeguarding. At 6.5 it names the Canadian trust account provider.
• Affiliates and TPSPs. The affiliate appears in section 15, and also in section 13 as a material TPSP, because it runs the platform.
• The inconsistency. Before submission, the team finds that the draft end-user terms name the affiliate as the service provider. The terms are corrected to name the applicant, and the diagram is updated to match.
• FINTRAC. It assesses whether it is also a foreign MSB under FINTRAC rules. The answer at 16.1 reflects its actual registration status, not a planned one.

Submission checklist

• RPAA applicability confirmed; current guide and form checked
• Legal name, trade names and addresses consistent across every answer and upload
• Organization chart prepared using the one-third control test; 10% holders, direct and indirect, listed separately
• Directors, top five officers, five largest creditors and controllers taken from source records
• Services PDF, sample contracts and flow diagram all name the applicant, and agree with each other
• Payment function answers match the diagram
• End-user funds answer and safeguarding providers accurate (or "No", where funds are not held)
• Volumes, values, funds held and end users reconciled, with the method documented
• Framework status declared accurately
• Material TPSPs, agents and affiliates identified; CSVs used above five
• FINTRAC and provincial status verified
• Internal review completed; fee confirmed; downloaded copy of the application retained

Frequently asked questions

What if a director or controlling shareholder changes while the application is under review?

Section 30 of the Act requires an applicant that becomes aware that information in its application has changed, or is about to change, to notify the Bank "as soon as possible". Report the change through an amendment in PSP Connect (see the next question), and keep the corporate records showing the change. A planned acquisition of control can raise further questions, discussed in buying a Canadian PSP.

What if we find an error after submitting?

A submitted application cannot be cancelled, but it can be formally amended. Under the Bank's policy on amendments to registration applications, you:

1. log into PSP Connect
2. select Registration Application, then Submit an amendment
3. choose the sections to correct
4. make the changes and submit

Use this workflow rather than relying on an informal email. Submit the amendment as soon as feasible. The Bank encourages grouping several changes into one amendment, and notes that amendments can lengthen the review.

An amendment corrects the applicant's own application. It is not the route when a different legal entity will perform the retail payment activities, for example a new entity formed by amalgamation. That entity needs its own registration application.

Most of the effort in a PSP application goes into making the organization chart, payment flows, contracts, metrics and safeguarding answers agree. ComplyFactor supports Bank of Canada registration for payment service providers. That includes preparing the RPAA application in PSP Connect, mapping EFT flows, documenting safeguarding arrangements and building the operational risk framework.