Bank of Canada RPAA enforcement: the record so far and what changes in 2027

Bank of Canada enforcement under the Retail Payment Activities Act (RPAA) has so far produced 13 published notices of violation, as of November 3, 2026. All 13 were for performing retail payment activities before registration, and every one carried a $0 penalty. At its November 2, 2026 supervision update, Bank staff said notices with monetary penalties will follow and will be published. They also said late 2027 annual reports will likely meet tougher tools than the warning letters used in 2026.

If you have already received a notice, our guide to the Bank of Canada notice of violation, review and appeal process covers the 30-day deadline and your options. Temporary orders are covered in our analysis of the XTM Inc. compliance order.

What enforcement action has the Bank of Canada taken under the RPAA so far?

The Bank's enforcement decisions page, checked on November 3, 2026, lists 13 notices of violation (NOVs), one prescribed review decision and two temporary orders made to XTM Inc. in February 2026. Each NOV summary says the PSP committed a violation of section 23 of the RPAA, which requires a PSP to be registered with the Bank before it performs retail payment activities. Each one records a total administrative monetary penalty (AMP) of $0.

NOV issuedNumber of PSPsAMPMay 13, 20264$0 eachJune 4, 20262$0 eachJune 25, 20261$0July 8, 20262$0 eachJuly 30, 20261$0August 6, 20261$0September 1, 20261$0September 16, 20261$0

Each summary gives the same reason for the $0 amount: the PSP took steps to comply and reduced potential harm by applying for registration. Staff described these as entities that applied late, and said a $0 NOV records the violation and deters others while crediting the PSP's efforts to comply.

Much of the Bank's enforcement never appears online. Staff said its early approach, after registration opened in November 2024, relied on outreach, education and private warning letters. Warning letters stay between the Bank and the PSP and are not published. The Bank's enforcement tools policy adds that a prior warning may be taken into account in a later investigation of the same PSP, so a letter still counts.

How does the Bank choose an enforcement tool?

Staff described a graduated approach in which the Bank picks the tool that fits the case. A matter usually reaches the enforcement team as a referral from supervision or registration staff, or from another regulator. If it opens an investigation, the Bank sends a notice of investigation. Its enforcement process policy sets out the next steps: information gathering, an exit interview on preliminary findings, and a findings report. Supervisory engagement usually comes first, staff said, though serious cases can escalate.

The enforcement tools policy names three factors for choosing a tool. They are the actual or potential harm, the PSP's compliance history, and the circumstances, such as cooperation, intent, negligence and efforts to fix the problem.

What is the difference between a serious and a very serious violation?

The Retail Payment Activities Regulations classify each designated violation as serious or very serious in a schedule, and section 48 sets the maximum penalty for each class. Staff's two examples match the schedule: ignoring a request for information is serious, and operating unregistered is very serious.

If one NOV identifies two or more serious violations of the same provision, the regulations treat the series as a single very serious violation. Within each range, the Bank's AMP policy weights harm most heavily (up to about 60% of the maximum), with violation history and intent or negligence each worth up to 20%. Section 76(4) of the RPAA states that a penalty exists to promote compliance and not to punish.

How does the 50% reduction for a compliance agreement work?

Under paragraph 76(2)(b) of the RPAA, the Bank can serve an NOV with an offer to reduce the penalty by half if the PSP enters into a compliance agreement. The agreement names the provision breached, sets the remediation steps and deadline, and states the reduced penalty. According to the Bank's compliance agreement policy, the PSP must sign and pay within 30 days of receiving the NOV, or it is treated as having refused and owes the full amount.

Signing still counts as committing the violation (section 80), and it goes on your violation history. If you then default, the Bank can serve a notice of default for the remaining 50% plus an additional penalty that section 50 of the regulations sets equal to the full original penalty. In a hypothetical case with a $400,000 AMP, the PSP would pay $200,000 on signing and could owe another $600,000 on default, so only sign up to remediation you can deliver.

When will NOVs with monetary penalties be published?

Staff said there will be circumstances where the Bank is prepared to issue NOVs with monetary penalties, and that once it does, those notices will also appear on the website. The law requires it. Once a PSP is deemed or found to have committed a violation, section 93 of the RPAA obliges the Bank to make public the nature of the violation, the PSP's name and the amount of any penalty.

The Bank's June 12, 2026 announcement confirmed that NOVs are posted after the period for representations has ended, and that the violation is also noted on the PSP's entry in the registry. Its public notice policy adds a brief description of the reasons and of any compliance agreement. A penalized NOV will be visible to your banking partners, investors and competitors.

What changes for the 2027 annual report?

Staff said 92% of registered PSPs submitted their first annual report, and that the Bank followed up with the remaining 8% because non-reporting is a violation. Warning letters went to PSPs that did not submit on time, which staff described as the lighter end of the toolkit. They then signalled a change: "the 2027 annual report cycle will likely involve different enforcement tools." A second speaker went further: "there will be no tolerance for late or non-reporting." The same speaker extended that to false or misleading information. Staff said the tools available include an NOV with an AMP.

The amounts for a late report are already set. Section 21 of the RPAA requires the annual report, and section 18 of the regulations sets the March 31 deadline. Section 48(2) sets the penalty at $500 for each day of a violation lasting up to 30 days, and at $15,000 to $1,000,000 beyond that. The annual reporting policy confirms the report covers the previous calendar year, except for financial metrics, which use the PSP's most recent financial year-end. The next report covers 2026 and is due March 31, 2027.

What went wrong in Section 4 of the first annual report?

Staff said the Bank is following up with PSPs over data quality in Section 4, the ubiquity and interconnectedness metrics. They named three problems:

The Bank's metrics reporting policy sets out how PSPs with a place of business in Canada report all end users and Canadian end users separately. Staff said the 2027 form will add validation rules, clearer wording, better skip logic and bulk paste from Excel. The PSP remains responsible for accuracy.

How to prepare for the March 31, 2027 deadline

Before March 31, 2027, a PSP can reduce its risk by:

What will be the significant changes in oversight and regulation over the next 12 months?

Staff said they do not anticipate major shifts under the RPAA over the next 12 months. Supervision continues through reporting, information requests, assessments and, where needed, enforcement. The Bank expects PSPs to be compliant already, so documentation that proves it matters most. Our guide to the RPAA operational risk management framework covers the evidence an assessment looks for. The new item staff named was the assessment fee formula for cost recovery. Staff said they expect cost recovery to come into force in 2027, adding that timelines and coming-into-force dates may be subject to change.

If you are unsure whether your registration or reporting is on track, ComplyFactor's PSP registration and RPAA compliance support can review where you stand before March 2027.

Frequently asked questions

What happens if PSPs that should be registered don't register? What should PSPs do if they see competitors in their vertical not registered as a PSP at the Bank?

A PSP that performs retail payment activities without being registered commits a very serious violation, which carries the higher penalty range of up to $10 million. Staff said several such entities have received NOVs after the Bank investigated them, and advised any PSP that has not applied to do so immediately. A PSP with concerns about an unregistered competitor can send the information through the general inquiries form on the Bank's website. Staff said the Bank reviews these reports but gives the reporter no updates. Our RPAA registration guide explains who needs to register.

How does the Bank plan to align RPAA requirements with other Canadian regimes such as FINTRAC and provincial money services business rules to avoid duplicate obligations?

Staff said alignment work has started and is not finished. The regimes ask for some similar information but serve different purposes: the RPAA covers operational resilience and safeguarding of end-user funds, while FINTRAC covers anti-money laundering and anti-terrorist financing. A memorandum of understanding with FINTRAC could be explored, and staff called the effort "a little bit of work in progress." Our comparison of MSB and PSP registration in Canada sets out where they differ.

What are the biggest lessons the Bank has learned so far? Have there been any surprises?

Staff said compliance issues were expected with a new regime. They stressed that the RPAA is an activities-based registration regime, and that registration does not mean a PSP demonstrated compliance before it was registered. They also named the size and diversity of the sector, the need for supervisory judgment, and the value of detailed information exchange with PSPs.

Can a PSP ask for a warning letter instead of a notice of violation?

Not at the review stage. In the only prescribed review decision listed as of November 3, 2026, the PSP accepted the section 23 violation and the $0 penalty, and asked for the NOV to be replaced with a warning letter. The decision states that subsection 78(2) of the RPAA does not give the decision-maker authority to issue a warning letter instead of an NOV.

Are warning letters made public?

No. Staff said warning letters stay between the Bank and the PSP, though the Bank may weigh a prior warning in a later investigation.