RPAA safeguarding for MSBs: three accounts under one roof
By Artem Balduk, Account Executive at PaySaxas
If your MSB holds client money, the question is no longer only where it sits. It is whether you can prove it is kept apart from your own.
Since 8 September 2025, the Bank of Canada supervises payment service providers under the Retail Payment Activities Act (RPAA), and RPAA safeguarding rules apply to every PSP that holds end-user funds. In 2026 the Bank started publishing enforcement decisions against PSPs, and those decisions stay public for five years.
This guide explains in plain words what the RPAA asks, where MSBs usually get stuck and how one provider can cover your own money, your clients' flows and, as an option, your clients' balances.
What RPAA safeguarding asks of payment service providers
The RPAA applies to payment service providers that perform retail payment activities in Canada, and many MSBs fall into that group. They must register with the Bank of Canada before they start, manage operational risk, report incidents and file an annual report.
If you hold funds for end users until they withdraw them or send them on, you must safeguard those funds. The law gives two ways to do it:
- hold the funds in trust, in a trust account used for nothing else, or
- hold them in an account used for nothing else, backed by insurance or a guarantee at least equal to the amount held.
Either way, client money has to be segregated from your own, and you need a safeguarding framework that shows how end users get their money without delay, including if your business fails.
Two details matter when you choose where to hold the account:
- Who holds it. The account can sit with a qualifying Canadian financial institution or with a foreign financial institution regulated under a prudential regime comparable to Canada's in capital, liquidity, governance, supervision and risk management.
- How you hold it. The Bank of Canada generally expects a direct relationship between the PSP and its safeguarding account provider.
The stakes are real. The most serious violations can cost up to CAD 10 million, and enforcement decisions are noted on the PSP's entry in the Bank's public registry.
Money in motion vs money at rest
Not all client money is the same. Payments that arrive with an instruction to send them straight on are money in motion. Balances your clients leave with you are money at rest.
RPAA safeguarding duties attach to funds you hold, so it pays to keep the two apart from the start: one account for flows that come in and go out, and a separate, clearly designated account for balances that stay.
Where MSBs usually get stuck
- Everything in one account. Company revenue, client payments and client balances share one IBAN, and nobody can tell them apart without a spreadsheet.
- No written proof. Segregation exists inside the business, but the account provider has never confirmed it in writing for the regulator or the auditor.
- Fees paid from client money. Provider fees are debited from the account that holds client funds.
- Too many providers. One provider for operating money, another for client flows, a third for balances, each with its own onboarding.
- Slow euro payouts. Payments to Europe still pass through several banks.
Three accounts under one roof
With PaySaxas Oy, an electronic money institution licensed and supervised in Finland, an MSB can hold all three in its own name. Each account has its own Finnish IBAN and direct access to SEPA and SEPA Instant.
1. Operational account: your own money
The account for your company's money: salaries, suppliers, taxes and your margin. PaySaxas fees are charged to this account, never to the accounts that carry client funds.
2. Pooled account: your clients' flows
One account in your name for money in motion: collections from your clients, payouts to them, B2B and C2B payments and OTC settlements. You keep the ledger of whose money is whose, and the account keeps those flows away from your operating money. Funds on the pooled account are meant to move on promptly. Balances that stay belong on the safeguarding account.
3. Safeguarding, as an option: your clients' balances
When client balances need to rest, a dedicated safeguarding account keeps them apart from your operational funds. PaySaxas Oy issues a reference letter confirming that:
- the account is designated solely for your customers' funds and kept separate from your operational account;
- neither PaySaxas Oy nor its creditors have any right of set-off, lien or other claim over those funds, in line with Section 26 of the Finnish Payment Institutions Act (297/2010), EMD2 and PSD2.
The letter can be submitted to the financial regulatory authorities in Canada. It confirms the account set-up and is not a guarantee.
Our own Canadian MSB, PaySaxas Financial Solutions Corporation, runs on exactly this set-up with PaySaxas Oy.
How it works in practice
- Your clients and counterparties pay into the pooled account.
- You pay out from it to your clients, to beneficiaries or to OTC counterparties, by SEPA or SEPA Instant.
- Your margin moves to the operational account, where you run the business.
- If clients keep balances with you, those funds sit on the safeguarding account, covered by the reference letter.
What this does and does not do
The set-up gives you clean segregation and written confirmation from your account provider. It does not replace your own RPAA assessment. If you are a registered PSP, your safeguarding framework, the method you choose and whether a foreign institution meets the comparable-regime test are for you and your counsel to confirm against the Bank of Canada's guidance.
If your MSB is not subject to the RPAA, segregated client money and a letter from the account provider are still what auditors and banking partners often ask to see.
Why MSBs choose PaySaxas
- Licensed in Finland. PaySaxas Oy is an electronic money institution supervised by FIN-FSA.
- Real IBANs in your name. One Finnish IBAN per account, no virtual IBANs.
- Direct SEPA and SEPA Instant, with Verification of Payee on outgoing payments. See how SEPA payments work with PaySaxas.
- One provider, one onboarding. Every regulated client is assessed case by case.
- Proven on ourselves. Our Canadian MSB uses the same set-up.
Final thoughts
RPAA safeguarding turns client money into a documented responsibility. The simplest way to carry it is to stop mixing: own money in one account, client flows in another, client balances in a third, all with one provider and written confirmation of how the funds are held.
Talk to our team about operational, pooled and safeguarding accounts for your MSB, or read more about MSB business accounts.
Account opening is subject to KYB and compliance review. This article is general information, not legal advice.
FAQ
Does the RPAA apply to MSBs?
It applies to payment service providers that perform retail payment activities in Canada, and many MSBs fall into that group. FINTRAC registration as an MSB is a separate regime. Whether you must register with the Bank of Canada depends on your activities, so check the Bank's criteria with your counsel.
What counts as RPAA safeguarding?
Holding end-user funds in trust in a trust account used for nothing else, or holding them in a separate account backed by insurance or a guarantee at least equal to the funds. You also need a safeguarding framework that shows how end users get their money back.
Can a foreign institution hold safeguarded funds?
The rules allow a foreign financial institution if it is regulated under a prudential regime comparable to Canada's in capital, liquidity, governance, supervision and risk management. You assess this as part of your safeguarding framework.
What does the PaySaxas reference letter confirm?
That the safeguarding account is designated solely for your customers' funds and kept separate from your operational account, and that neither PaySaxas Oy nor its creditors have any right of set-off, lien or other claim over those funds under Section 26 of the Finnish Payment Institutions Act. It can be submitted to Canadian regulators and is not a guarantee.
Do I need all three accounts?
Not always. Safeguarding is optional: if your client funds only pass through, the operational and pooled accounts cover your flows. If clients keep balances with you, add the safeguarding account.