Since September 8, 2025, Canadian payment service providers have been supervised by the Bank of Canada under the Retail Payment Activities Act (RPAA). Many PSPs treated that registration as the finish line. It isn’t. If your business moves funds on behalf of clients, you almost certainly also answer to FINTRAC under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) — and since Bill C-12 received royal assent on March 26, 2026, a serious gap on that side can cost far more than anything the RPAA can impose.

PSP FINTRAC Compliance: Two Regulators, Two Different Questions

PSP FINTRAC compliance is where most payment companies we review are weakest, because the two regimes look similar on paper but ask completely different questions:

• The Bank of Canada (RPAA) asks: Will your end users’ money be safe and available? Its focus is operational risk, incident response, and safeguarding of end-user funds.
• FINTRAC (PCMLTFA) asks: Do you know who is moving money through you, and do you report what you should? Its focus is client identification, record-keeping, transaction reporting, and a documented compliance program.

The Bank of Canada does not supervise your AML program, and FINTRAC does not care whether your safeguarding account is set up correctly. Passing one examination tells you nothing about the other. A PSP that remits or transmits funds is generally a money services business (MSB) under the PCMLTFA and must be registered with FINTRAC before it operates — on top of its RPAA registration.

Why the Stakes Changed in 2026

Under the RPAA, administrative monetary penalties top out at $10 million per very serious violation. The Bank’s first published penalties in 2026 were set at $0 — a warning shot rather than a fine (we covered that in our analysis of the first RPAA penalties).

FINTRAC is a different story. Bill C-12 raised PCMLTFA penalties by a factor of forty. For violations committed after March 26, 2026, maximums are now:

• $40,000 for a minor violation
• $4 million for a serious violation
• $20 million for a very serious violation
• For multiple violations, a cap of the greater of $20 million or 3% of gross global revenue

Bill C-12 also sets up universal enrolment for all PCMLTFA reporting entities, with the in-force date still to be set by regulation. For PSPs that are already MSBs, the practical message is simpler: FINTRAC now has a much bigger stick, and it has said publicly that its supervision is becoming more outcomes-focused.

Where PSPs Actually Fall Short

Across RPAA-registered PSPs, the AML gaps we see most often are not exotic. They are basic program elements that were built once and never tested:

• Wrong or missing MSB registration. The business model changed — new payout corridors, wallet balances, cross-border flows — but the FINTRAC registration still describes the original service. Registration details must be kept current, and renewal is required every two years.
• A risk assessment that doesn’t match the product. A generic template that never mentions your actual merchant types, geographies, or delivery channels will not survive an examination.
• Reporting gaps on electronic funds transfers. International EFTs of $10,000 or more (including 24-hour aggregation) must be reported to FINTRAC, MSBs must verify identity and keep records for remittances of $1,000 or more, and the travel rule requires originator and beneficiary information to travel with the transfer. Payment flows split across processors and banking partners are where these break.
• Suspicious transaction reporting that depends on one person. STRs must be submitted “as soon as practicable.” If your monitoring alerts land in a single analyst’s inbox with no escalation path, you have a timing problem.
• No two-year effectiveness review. The PCMLTFA requires an effectiveness review of the compliance program at least every two years. Many PSPs have never commissioned one — or had their own compliance officer review their own work.

A 30-Day Self-Check for Dual-Regulated PSPs

If you are RPAA-registered and want to know where you stand with FINTRAC, work through these steps in order:

• Week 1 — Classify. Map every product against the PCMLTFA definition of an MSB activity. Confirm your FINTRAC registration covers each one. If you are not registered and should be, stop and get advice before you do anything else.
• Week 2 — Map your funds flow. Draw how money actually moves: client to you, you to banking partner, banking partner to beneficiary. Mark every point where a reporting threshold ($10,000 for LCTRs and EFT reports, $1,000 for remittance identification and records) could be crossed, and confirm which system captures it.
• Week 3 — Test the program. Pull 20 recent client files and check identity verification, beneficial ownership, and PEP determination. Pull 10 monitoring alerts and confirm each one was decided, documented, and — where needed — reported.
• Week 4 — Align the two frameworks. Your RPAA incident response plan and your AML escalation procedures should reference each other. A fraud or data incident is often both an RPAA incident and a potential STR trigger.

Budget-wise, an independent AML effectiveness review for a small or mid-sized PSP typically runs in the low-to-mid five figures, depending on transaction volume and number of products. Compared with a $4 million serious-violation ceiling, that is cheap insurance. If you want a second set of eyes on the gap analysis, our AML & regulatory compliance services are built for exactly this kind of dual-regime review.

The Bottom Line

RPAA registration proves you can keep client money safe. It does not prove you know whose money it is. For Canadian PSPs, FINTRAC compliance is a separate program with separate obligations — and as of March 2026, separate penalties that are now far larger than anything the Bank of Canada can impose. Treat them as two programs, test them both, and make sure they talk to each other.

Need guidance? Reach out to our team — no pressure, no jargon.