The Retail Payment Activities Act (RPAA) and its supporting regulations require payment service providers (PSPs) to notify the Bank of Canada when they make significant changes to their operations or start new activities. This rule ensures that regulators are aware of material shifts in a company’s risk profile and can confirm that the business remains compliant.
Many PSPs underestimate this requirement, assuming that only major business overhauls qualify. In reality, the definition of “significant change” is broader, covering new products, changes in systems, and even entry into new markets. Understanding when and how to submit a notice through PSP Connect is critical to avoid regulatory scrutiny.
For reference, see the Bank of Canada’s step-by-step guidance: Notice of significant change or new activity and How to complete a notice.
What qualifies as a significant change or new activity
Under the RPAA, a PSP must submit a notice if it makes a material change to its operations or starts a new activity that affects its payment services. The key test is whether the change could impact risks to end users, other PSPs, or the overall payment system.
Examples of qualifying changes include:
- Introducing a new payment product or service that holds or processes customer funds
- Expanding into a new geographic market where different risks may apply
- Replacing or materially upgrading payment processing systems
- Changing safeguarding arrangements for end-user funds (Safeguarding Guidance)
- Altering governance, oversight, or third-party arrangements in ways that affect compliance (Governance Oversight Guidance)
The Bank of Canada emphasizes that the responsibility lies with the PSP to assess whether a change is significant. If in doubt, PSPs are expected to err on the side of caution and submit a notice.
The five-business-day notice requirement
The regulations set a clear deadline: PSPs must submit the notice no later than five business days after the significant change or new activity has been implemented. Notices are submitted electronically through the PSP Connect portal.
The Bank of Canada expects PSPs to provide sufficient detail in their notice to explain:
- The nature of the change or activity
- The reasons for it
- The expected impact on payment services and end users
- Updates to risk management, incident response, and safeguarding frameworks that address any new risks
- Supporting evidence such as Board approvals, contracts with third parties, or revised policies (Incident Notification Guidance)
This requirement ensures that regulators have timely visibility into changes that could introduce new risks. Failure to notify within the five-day window may be treated as non-compliance, even if the change itself is well managed.
Real-world examples of significant changes
To make the rules more practical, here are some examples of what would trigger a notice requirement:
- System upgrades: A PSP migrates its transaction processing to a new cloud provider. This alters operational risk and third-party oversight obligations, making it a significant change.
- New product launches: A money transfer service begins offering a digital wallet that holds customer funds. Since this involves safeguarding requirements and introduces new risks, a notice must be filed.
- New geographic markets: An MSB that only operated in Canada expands to the U.S. This adds new compliance and operational risks that qualify as a significant change.
- Governance updates: A PSP outsources part of its compliance function to a third-party provider. Because this shifts responsibility for key risk controls, it requires notification.
Each of these examples demonstrates how even routine business decisions can qualify as significant under the RPAA.
Why significant change notices matter
The RPAA’s significant change rule is not just a bureaucratic formality. It is designed to give the Bank of Canada an early warning about changes that could affect the safety of the retail payments system. By submitting notices promptly, PSPs demonstrate transparency, reduce supervisory risk, and build trust with regulators.
For PSPs, proactively managing this process also has business benefits. It ensures that risk assessments, incident response plans, and safeguarding frameworks are updated alongside operational changes, reducing the chance of disruptions or compliance failures.
Final thoughts
Significant change notices are a key part of RPAA compliance. Any PSP making material changes to systems, products, or markets must notify the Bank of Canada within five business days. By treating this as an integral part of governance, PSPs can stay compliant, protect customers, and maintain regulator confidence.If your company is planning a new product, market entry, or system upgrade, visit Comply North’s pricing page to see how compliance tools can streamline the process, or reach out to our experts for tailored support.
