An RPAA framework your PSP can run, test and show to the Bank of Canada

PSP registration with the Bank opened on 1 November 2024; the framework requirements came into force on 8 September 2025.

Elements the framework must contain

Section 5 of the Regulations lists them:

• integrity, confidentiality and availability objectives, with measurable reliability targets and indicators;
• the people, budget and skills the framework needs;
• roles and responsibilities, with a senior officer overseeing compliance with sections 6 to 10;
• causes of operational risk, including cybersecurity, fraud, third parties, change and continuity;
• controls, continuous monitoring, and plans for incidents and anomalous events.

Each element is proportionate to the impact a disruption could have on end users and other participants (s. 5(2)).

The Regulations set the rhythm after approval:

• Approval. The senior officer, and the board if there is one, approve the framework at least once a year and after each material change (s. 5(6)).
• Review. At least annually and before any material change, the PSP reviews the framework, records the findings and reports them to the senior officer (s. 8).
• Testing. The PSP sets its own testing methodology, frequency and scope, tests before material changes and keeps records (s. 9).

Choosing reliability targets

The Bank's guideline expects availability objectives that fit the business model, and stricter ones for more widely used or interconnected PSPs. We pick indicators you can actually measure.

What each notice contains

• To the Bank (Regulations s. 11): through the Bank's electronic system, naming a contact person, describing the incident, its material impact and the measures taken. A final notice follows once root cause and impact are known.
• To end users and other participants (s. 12): to each materially affected person at their latest contact details, or on the PSP's website, with the steps people can take themselves.

The incident plan under s. 5(1)(i) assigns in advance who escalates, investigates, contains harm, informs each party and tracks transaction status. When personal information is involved, PIPEDA breach rules run in parallel; we cover that case on our incident response page.

Providers and agents

Cloud hosting, processing, KYC vendors and outsourced support all enter the assessment cycle; agents and mandataries are assessed annually against set criteria (s. 5(4)).

Who can perform the independent review

Per the Bank's guideline, the requirement applies to PSPs that regularly use an internal or external auditor. The reviewer must be sufficiently skilled and must have had no role in building or running the framework; an employee or an external party qualifies. A certification or other audit counts when the PSP shows in writing that its scope covers the Regulations.

When we built your framework, another party reviews it; we prepare the evidence pack.

1. Activity map. Which of the five payment functions listed in s. 2 of the RPAA you perform, on which systems, with which providers and agents.
2. Gap review. Against sections 5 to 10 and the Bank's guideline, with what to close before your next annual report.
3. Documents. Framework, reliability targets, incident plan, third-party register, testing methodology, review calendar.
4. Fixes. Access control, MFA, backups with a tested restore, event logging. Hands-on technical work in Canada can be carried out through itopsi.com, the group's IT brand.
5. Tabletop exercise. We rehearse the incident plan with your responders and revise it.

Registration and licensing questions are handled by our licensing practice.