XTM Inc. & the RPAA: What the Bank of Canada Compliance Order Means for PSPs

XTM Inc., a Toronto-based payment service provider registered with the Bank of Canada, operated a platform used by restaurant owners to aggregate and distribute staff tips through prepaid cards — formerly branded AnyDay, more recently referred to as Everyday. On February 17, 2026, the Bank of Canada issued a temporary order under section 94(4) of the Retail Payment Activities Act (RPAA), directing XTM to immediately cease all retail payment activities. The Bank said it had serious concerns that XTM failed to safeguard end-user funds in its possession, causing a significant shortfall.

Ten days later, following the start of court-supervised restructuring proceedings, the Bank replaced that order with a revised temporary order permitting a narrowly defined, supervised continuation of the AnyDay platform. The case provides a clear public example of how the Bank can use its section 94 powers when it believes immediate intervention is required, and it carries a direct lesson for any Canadian PSP that holds end-user funds.

What Happened to XTM Inc.?

Why Did the Bank of Canada Issue the February 17 Order?

According to the order itself, XTM is registered as a PSP and provides a payment service for restaurant owners to aggregate and distribute staff tips through prepaid cards on the AnyDay platform. The order states that XTM's own public financial statements confirmed that, while operating the platform, XTM failed to safeguard end-user funds, causing a significant shortfall to accrue. The Bank's Managing Director, Supervision, said she was concerned that a shortfall of this magnitude had caused harm to end users, and that XTM's continuing role could have a significant adverse impact on them.

On that basis, the Bank concluded that waiting for XTM's representations under the RPAA's normal process would be prejudicial to the public interest — the legal trigger allowing a temporary order under section 94(4).

What Changed on February 27?

Ten days after the initial order, the Ontario Superior Court of Justice commenced CCAA proceedings against XTM and appointed a Monitor. Considering the CCAA Initial Order's terms and other information XTM provided, the Bank's Managing Director concluded the AnyDay platform could be operated in compliance with the RPAA and in protection of the public interest under Court and Monitor oversight, and replaced the February 17 order with a revised temporary order.

The revised order did not lift the Bank's restrictions. XTM may perform retail payment activities only to the extent necessary to enable the AnyDay platform's operation by other parties, and remains barred from directing transactions or withdrawals from trust accounts tied to the platform, in its own name or an affiliate's. XTM must meet every requirement of the CCAA Initial Order, cooperate fully with the Monitor, ensure the platform follows the processes and controls in that Initial Order, and preserve all relevant records. The Bank did not clear XTM of its concerns — it authorized a narrowly defined, supervised continuation under a court process.

What Is a Temporary Order Under Section 94 of the RPAA?

Under section 94(1), if the Bank's Managing Director for retail payments supervision believes a PSP is committing, or about to commit, an act that could significantly harm end users or other specified parties, the Managing Director can order the PSP to stop and take remedial action. Section 94(3) ordinarily requires the PSP be given a chance to make representations first. Section 94(4) is the exception: where waiting could be prejudicial to the public interest, a temporary order can be made immediately, with the same effect as a full section 94(1) order. It automatically ceases 30 days after it's made unless the PSP makes no representations in that window, or does make representations but the Managing Director isn't satisfied there are grounds to revoke it — in either case, the order continues beyond 30 days.

This gives the Bank an operational lever, not only a punitive one: it can stop a PSP's activity immediately, before a full enforcement process runs its course. That doesn't mean every safeguarding concern results in an immediate stop order — this case turned on a stated, evidenced shortfall, not a general compliance gap. (A factual explanation of the RPAA, not legal advice.)

What the XTM Case Shows About RPAA Supervision

Registration is the beginning of supervision, not the end

XTM was, according to the Bank's order, a registered PSP. Registration means a PSP has satisfied the legal requirements to register; it does not amount to an endorsement or licence from the Bank. Registered PSPs remain subject to ongoing risk supervision and enforcement, and the Bank's supervisory tools, including section 94 orders, continue to apply after registration.

Safeguarding must work in practice

The Bank's stated concern was that XTM failed to safeguard end-user funds "in its possession" and that this produced an actual shortfall — not that its documentation was incomplete. Separately, the Bank's current safeguarding guidance requires PSPs that hold end-user funds to protect them so users have reliable, undelayed access and are shielded from loss if the PSP becomes insolvent. The order is a reminder that a safeguarding arrangement is only as good as its day-to-day operation.

Trust structures and fund controls need operational discipline

Separately from anything specific to XTM, current Bank guidance requires PSPs that hold end-user funds to use one of two mechanisms: trust in a trust account, or a segregated account with qualifying insurance or a guarantee. Either way, funds must stay segregated from the PSP's own operating funds and any other funds it holds. Documenting an arrangement at registration is different from operating it correctly, daily.

Financial distress can quickly become a payments-regulatory issue

The XTM case arrived alongside CCAA insolvency proceedings. Where a PSP holding end-user funds enters financial distress, whether those funds are properly segregated and accessible becomes an urgent regulatory concern in its own right, separate from whatever caused the distress. That doesn't mean insolvency automatically constitutes an RPAA violation — it means a fund-holding structure is tested precisely when the business is under the most strain.

The Bank can move quickly when it judges the public interest requires it

Section 94(4) allowed the Bank to issue the February 17 temporary order without first waiting for XTM's representations. That doesn't mean the Bank always acts this fast — the provision exists for cases where delay itself would risk harm. But it shows RPAA supervision includes real-time operational levers, not only after-the-fact penalties.

What Should Canadian PSPs Review After the XTM Order?

• Do we actually hold end-user funds in the RPAA sense — funds at rest, available for later withdrawal or transfer — or only funds in transit? (legal question)
• If we hold end-user funds, which safeguarding mechanism are we using: trust account, or segregated account with insurance or a guarantee? (legal requirement)
• If using a trust arrangement, can we demonstrate a valid express trust exists? If using insurance or a guarantee, does it meet the applicable RPAA/RPAR requirements? (supervisory expectation — the Bank's FAQ says it will request a written legal opinion on the trust arrangement during its safeguarding assessment)
• Are end-user funds actually segregated from operating and other funds in practice, not only documented that way at account opening? (legal requirement)
• Can we maintain an accurate end-user funds ledger, updated daily as required? (supervisory expectation)
• Can end users access funds without delay under normal conditions? (legal requirement)
• Has our safeguarding framework kept pace with changes in volume, product, or banking partners? (supervisory expectation)
• Have we assessed whether a planned change could materially affect operational risk or safeguarding, and submitted a significant-change notice — generally at least five business days ahead — where required? (legal requirement)
• Are our third-party dependencies — banking partners, program managers, agents — clearly documented? (practical)
• If the business came under severe financial stress tomorrow, could we show a regulator end-user funds are protected? (practical)

Is the XTM Order the Same as a Fine or Registration Revocation?

No. A temporary order under section 94 is a distinct supervisory tool from an Administrative Monetary Penalty, a Notice of Violation, or a registration revocation — each follows a different process. As of September 2026, the Bank's public enforcement decisions page lists only the two XTM temporary orders; it shows no AMP or Notice of Violation against the company, and no later XTM order beyond the February 27 amendment. XTM does not appear on the Bank's refused-or-revoked list in the sources reviewed. No later official XTM development was identified — verify the Bank's enforcement decisions page and PSP registry directly before relying on this summary.

What Does This Mean for PSP Compliance in Canada?

The XTM case is a public illustration of a point that applies to every registered PSP: RPAA compliance is a continuing obligation, not a one-time application. A PSP that holds end-user funds may need to periodically revisit its operational risk framework, safeguarding arrangement, incident response plan, governance and reporting practices, and documentation of material changes — because that's what ongoing RPAA supervision expects. Not every PSP needs the same depth of review; the right starting point is a clear-eyed look at whether the business actually holds end-user funds, and if so, whether its safeguarding arrangement would hold up under the kind of scrutiny the XTM case describes.

For PSPs still working through initial RPAA registration, ComplyFactor's RPAA registration guide walks through the Bank of Canada's application process. For PSPs focused on the ongoing supervisory side — safeguarding, operational risk, and incident response after registration — that's a different question from registration itself, and one ComplyFactor's PSP compliance work is built around.

Frequently Asked Questions

What does a "shortfall" in end-user funds mean under the RPAA?

The Bank of Canada's retail-payments glossary defines a shortfall as an instance where the amount of end-user funds placed in a trust account and/or covered by insurance or a guarantee is less than the amount of end-user funds held. In practical terms, the PSP is not safeguarding the full amount it holds for end users.

Are funds that are only "in transit" subject to the safeguarding requirement?

Generally no, if they are genuinely in transit rather than held at rest. Current Bank guidance says funds received with instructions for immediate transfer are not considered held, while funds kept at rest and available for future withdrawal or transfer are. The specific facts of the payment flow matter.

How often must a PSP's safeguarding compliance be independently reviewed?

Current regulations require an independent review of safeguarding compliance at least once every three years, by someone with no role in establishing or maintaining that framework.

When must a PSP notify the Bank about a significant change affecting safeguarding?

Where a planned change meets the RPAA's significant-change test — broadly, one that could materially affect operational risk or how end-user funds are safeguarded — the PSP is generally required to notify the Bank in advance, typically at least five business days before the change. Confirm the precise notice period against the current Regulations for your situation.

Does Bank of Canada registration mean the Bank endorses or licenses the PSP?

No. The Bank's current registry states registered PSPs are subject to risk supervision and enforcement, and that the Bank does not endorse or license them.