The Bank of Canada Just Published Its First RPAA Penalties — All Zero Dollars

On June 12, 2026, the Bank of Canada announced it would begin publishing Notices of Violation (NOVs) issued under the Retail Payment Activities Act (RPAA) once the affected payment service provider’s window to respond has closed. By late August, the first batch of enforcement decisions was live, including one against Equals Money PLC. Every case involved the same contravention, and every case resulted in an administrative monetary penalty (AMP) of exactly $0.

If you run a payment service provider and your instinct is to read that as “the Bank of Canada isn’t really enforcing this,” that instinct will cost you. The zero-dollar number is the least important fact in these decisions.

The Violation: Section 23, Operating Before Registration

Every published decision cited the same provision — section 23 of the RPAA, which prohibits performing retail payment activities before the PSP has registered with the Bank. Under the Bank’s own classification, a section 23 breach is a “very serious” violation, carrying a maximum AMP of up to $10,000,000. A “serious” violation caps out at $1,000,000. These are not symbolic ceilings; they were written into the Retail Payment Activities Regulations specifically so the Bank could scale a penalty to the harm.

So why did the Bank land on zero in every case it has published so far? Its stated reasoning: the PSPs involved had already taken steps to come into compliance and had mitigated potential harm by submitting their registration applications before or shortly after the violation was identified. In other words, self-correction was rewarded — but only because the PSPs moved before the Bank had to force the issue.

Why a $0 Penalty Still Costs You Something

Three consequences survive a zero-dollar outcome, and each one matters more to a growing PSP than a first fine would.

• The record is public for five years. Every published NOV — including the $0 ones — stays visible for five years and is noted directly on the PSP’s entry in the Bank’s public registry. Banking partners, payment processors, and institutional counterparties doing diligence on your business will see it.
• Repeat conduct doesn’t get the same grace. The mitigating factor that produced $0 this round — proactive registration after the fact — is a one-time story. A second violation, or a violation discovered without a PSP having already moved to fix it, will be assessed against the full $1M–$10M range with no comparable off-ramp.
• Thirty days is not a lot of runway. A PSP that receives an NOV has 30 days to make representations. Miss that window, and the violation is deemed to have occurred with full penalty exposure — no negotiation, no mitigation credit.

Read together, these first decisions are less a warning shot and more a demonstration of what a well-handled violation looks like — and a preview of what a badly handled one will cost.

What This Means If You’re Registered, Registering, or Not Sure Which

The RPAA’s registration requirement is only the entry point. Once registered, PSPs are expected to maintain an operational risk management framework reviewed annually, safeguard end-user funds in a manner that meets the Bank’s standards (typically a trust account structure), file annual reports with the Bank, and retain records for at least five years. Section 23 enforcement tells you what happens when the first of those obligations is missed; the same publication policy now applies to violations across the rest of the framework.

Practical steps for PSPs operating in or entering the Canadian market:

• Confirm registration status before you process a single transaction. “We’re in the queue” is not “we’re registered.” Section 23 does not distinguish between an oversight and a business decision to move first and register later.
• Build the paper trail before you need it. If a gap is ever identified, the evidence that you were already remediating — dated applications, internal risk assessments, correspondence with the Bank — is what separates a $0 outcome from a seven-figure one.
• Treat the 30-day representation window as a deadline, not a suggestion. Route incoming NOVs to whoever can respond immediately, not whoever happens to check that inbox.
• Audit the rest of your RPAR obligations now, not after an NOV. Safeguarding structures, annual risk framework reviews, and recordkeeping are all now subject to the same public-disclosure policy as registration itself.

Our AML & regulatory compliance services help payment service providers build RPAA programs that hold up to Bank of Canada scrutiny — registration, safeguarding, and reporting — before an examiner or an NOV forces the issue.

The Takeaway

A $0 penalty is not the same as no penalty. The Bank of Canada has now shown PSPs exactly what it takes to land on zero — early self-correction, a documented remediation trail, and a fast, complete response once contacted. It has also shown, by publishing the maximum exposure alongside the outcome, exactly what happens to the PSP that doesn’t do those things first.

Need guidance? Reach out to our team — no pressure, no jargon.