RPAA change of control and key-person changes: notice or approval?

Under the RPAA, a change of control of a registered payment service provider (PSP) needs a new registration from the Bank of Canada before the deal closes. A new director or senior officer needs only a notice, with no Bank approval step. Prescribed information changes and significant change notices sit between the two, each with its own deadline.

This article starts from an audience question at the Bank's 2 November 2026 supervision update for PSPs. We checked each rule against the Retail Payment Activities Act (RPAA), the Retail Payment Activities Regulations (RPAR) and the Bank's published policies on 3 November 2026.

How should PSPs handle changes in control, new owners or new key persons, and does the Bank need advance notice or approval?

An acquisition of control needs a new application, with registration granted before closing. A new director or senior officer needs only a registration information change in PSP Connect.

Staff gave that answer at the 2 November 2026 session. They said the Bank has "received some notifications after the fact", and that the filing and the new registration must both come before the acquisition takes place. On key personnel, staff said: "Advanced notice is required, but there is no need to receive an approval." Those are session remarks. The published rules below govern, and they set the timing of key-person notices in more detail than the remark did.

Why does an acquisition of control need a new registration?

Subsection 24(1) of the Retail Payment Activities Act requires it. If an individual or entity plans to acquire control of a registered PSP, the PSP must submit a new application for registration that takes the planned acquisition into account, and be registered under it, before the acquisition.

The Bank's supervisory policy on acquisitions of control and prescribed changes (published 21 August 2024) fills in the mechanics. The PSP being acquired files, through the re-registration option in PSP Connect, and the acquirer supplies the information it needs. The Bank suggests applying after a non-binding letter of intent that sets out the material terms, or after signing purchase agreements conditional on re-registration. A PSP that completes the acquisition before it is re-registered is operating without valid registration, according to the Bank, which is a breach of section 23 of the RPAA.

Until the new registration is granted, the PSP keeps operating under its existing one. After closing, the Bank expects confirmation through PSP Connect within five business days.

What counts as control depends on the PSP's legal form, under section 21 of the RPAR. Our guide to buying a Canadian PSP and RPAA re-registration covers those tests, indirect control and the exclusion for PSPs that will leave the RPAA's scope.

The same rule applies to a prescribed change under subsection 24(2). Section 22 of the Retail Payment Activities Regulations prescribes one: a state-owned enterprise, as defined in the Investment Canada Act, acquiring the power to appoint the CEO, other senior management or board members, any director-voting securities of a corporate PSP, or any ownership interest in a non-corporate PSP. There is no minimum threshold, so a small stake can trigger it.

Where does the national security review fit?

It follows the Bank's own review. Asked "When can we expect all applicants to be reviewed?", staff at the 2 November session said they could not give a date because the Bank is not the only party involved. Once the Bank has finished with an application, it passes the information to the Department of Finance, which coordinates the national security review. The Bank's acquisitions policy confirms that a complete section 24 application is shared with FINTRAC and the Department of Finance in the same way.

The statutory periods are:

The Bank cannot register the applicant during the Minister's decision period unless the Minister decides against a review (RPAA s. 35). PSPs should not expect expedited review because they applied late, the Bank's policy says, so make re-registration a closing condition and set the outside date with these periods in mind.

Who is a key person, and how is a change reported?

The RPAA does not use the term "key person". The registration information about people is in subsection 24(9) of the RPAR, which lists what the Minister needs for national security review:

Section 1 of the RPAR defines "senior officer" broadly, from the CEO, CFO and chief risk officer to any officer who reports directly to the board, the CEO or the COO.

When is a key-person notice due?

Changes to this information are reported under section 60 of the RPAA. The default in subsection 60(2) is notice as soon as feasible after the PSP becomes aware of the change and before it takes effect, unless the regulations set another period. For board members, the top five senior officers and 10% holders, section 36 of the RPAR does: as soon as feasible after the PSP becomes aware, even if the change has already taken effect.

The Bank's policy on reporting changes to registration information (last updated 29 June 2026) says to tell the Bank before the change if you know about it in advance, and as soon as possible afterwards if you learn of it later. Board appointments and senior hires are usually decided before they take effect, which fits the staff description of advance notice. Neither the RPAA nor the policy requires Bank approval before the new person starts, although the Bank must pass every section 60 notice to the Minister of Finance (RPAA s. 60(3)). The filing itself is a registration information change in PSP Connect.

Which prescribed information changes need 30 or 60 days' notice?

Under subsection 36(2) of the RPAR, some section 60 items must be reported well ahead of the change:

A share purchase below the control threshold does not need re-registration unless a state-owned enterprise is involved. If it changes the organization chart, though, the Bank needs 30 days' notice before it takes effect.

The rest of the registration information falls under section 59 of the RPAA: the PSP's name, contact information, agents, third-party service providers and provincial registration. Those changes are due within 30 days after the change (RPAR s. 35).

When does a change also need a significant change notice?

When it could reasonably be expected to have a material impact on operational risks or on the way end-user funds are safeguarded, which is the test in subsection 22(2) of the RPAA. The notice is due at least five business days before the change (RPAR s. 20) and is a separate filing from a registration information change.

The Bank's guideline on notice of significant change or new activity (October 2024) says a change to the organizational structure or staffing of the parts of the PSP relevant to operational risk or safeguarding could be significant, depending on the facts. A departing chief risk officer, or a new owner who restructures the payments operations team, may therefore need a section 22 notice as well as a section 60 notice. Routine administrative changes in support functions such as payroll are unlikely to qualify. The guideline adds that PSPs will generally not hear back when the Bank finishes reviewing a notice, although the Bank may start a supervisory assessment. Our RPAA operational risk framework guide covers building these triggers in.

A section 24 application can absorb the other filings. Under the Bank's acquisitions policy, the PSP does not need separate section 59, 60 or 22 reports for changes that arise from the planned acquisition and are reflected in the application. Changes that come up after filing still need their own reports.

Change type, filing, timing and approval at a glance

What happens if a filing is late or missing?

The missed filing is a violation in its own right. At the 2 November session, staff said: "Failing to report a reportable incident or a change is itself a compliance issue." The RPAR sets the penalties:

Our guide to the Bank of Canada notice of violation under the RPAA explains how a notice works and how to respond. For the evidence behind a new application, see our PSP application documents checklist. If you are planning an ownership or management change and want the filings mapped against these deadlines, our PSP registration team can help.

Frequently asked questions

When can we expect all applicants to be reviewed?

Staff at the 2 November 2026 session did not give a date, because the Department of Finance coordinates a national security review after the Bank's own review. Staff said a complete application avoids back-and-forth, and that the Bank updates its lists of applicants and registered PSPs frequently.

Does a new director or CEO need Bank of Canada approval?

No. A new board member, or a new senior officer among the five most highly compensated, is reported through a registration information change under section 60 of the RPAA. File as soon as feasible after you become aware, and before the change if you know in advance. Then check whether it affects operational risk or safeguarding enough to need a significant change notice.

Can an acquisition close while the re-registration application is still under review?

No. Subsection 24(1) requires the PSP to be registered under the new application before the acquisition, and the Bank's policy treats an early closing as operating without valid registration. If the review is not finished, the closing date has to move.

Does buying a minority stake need any filing?

It can. A new 10% holder is reported as soon as feasible under section 60, and a change to the organization chart needs at least 30 days' notice. If the buyer is a state-owned enterprise, any director-voting securities or ownership interest triggers a new application under subsection 24(2), whatever the size of the stake.