Canada has no separate crypto licence. A crypto business that deals in virtual currency for Canadian clients registers with FINTRAC as a money services business (MSB), or as a foreign MSB if it operates from outside Canada, and then runs a documented anti-money laundering compliance programme. FINTRAC states that registration is required before operations begin, and that this applies to foreign businesses directing services to clients in Canada, even where a provincial or territorial licence is already held.
This guide is for founders, compliance officers and general counsel at exchanges, custodians, payment providers and token platforms deciding whether and how to enter Canada. It follows the structure a regulator-facing review would take: mandate, licensable activities, financial standards, governance, AML/CFT and Travel Rule, technology and custody, enforcement exposure and practical structuring.
Regulatory mandate
The federal anti-money laundering regime rests on the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) and its Regulations. MSBs must meet their obligations under that Act, and FINTRAC, the Financial Transactions and Reports Analysis Centre of Canada, is the supervisor that registers them and examines their compliance.
Three points shape everything that follows:
- Registration is a supervisory status, not an endorsement. It places the entity under federal oversight. It does not certify that the business model is sound or that other regimes, such as provincial securities law, are satisfied.
- Foreign operators are in scope. A business outside Canada that directs and provides covered services to persons in Canada is treated as a foreign MSB. Having no Canadian office is not a defence.
- Registration precedes operation. The sequence is registration first, launch second. Pre-launch marketing to Canadian users should be reviewed with this in mind.
To test whether you are caught, FINTRAC publishes a short questionnaire for determining whether you need to register. Treat its output as a starting point and document the analysis in your file, particularly where your product mixes custody, conversion and transfer.
Licensable activities
For crypto businesses, the covered activities are the dealing in and transfer of virtual currency, and fiat-to-crypto or crypto-to-fiat conversion where that is part of the service. FINTRAC's guidance on large virtual currency transactions and on virtual currency transfers under the Travel Rule shows that both MSBs and foreign MSBs are expected to carry those duties for virtual currency.
A practical mapping for common business models:
| Business model | Typical MSB analysis | Points to document |
|---|---|---|
| Centralised exchange | Exchange and transfer of virtual currency; fiat on-ramps | Which entity contracts with Canadian users |
| Custody or wallet provider | Depends on whether you exchange or transfer on behalf of clients | Control of keys, ability to initiate transfers |
| Payment or card infrastructure | Transfer and conversion flows | Where the funds flow and who the counterparty is |
| OTC desk | Dealing in virtual currency | Counterparty onboarding, large-transaction records |
| DeFi front end | Fact-specific; depends on control and revenue model | Degree of administrative control over the protocol |
The table is an analytical frame, not a conclusion. Each row turns on facts, and a registration application will force you to describe them precisely.
MSB registration also does not answer the securities question. A token that is an investment contract, or a platform that trades such instruments, can fall under provincial securities regulation. That analysis runs in parallel and should be settled before the application narrative is written, so the two filings are consistent.
Capital and prudential standards
The FINTRAC registration process is not a prudential licence. FINTRAC does not charge registration fees, and the application is built around identity, ownership and compliance-officer information rather than a capital adequacy submission.
That does not mean the business needs no financial planning. Boards should model:
- The real cost of preparation. Criminal record checks for owners and senior managers, certified translations and legal review carry external costs, discussed below.
- Compliance headcount and tooling. Transaction monitoring, sanctions screening and Travel Rule messaging are recurring costs that scale with volume.
- Banking. Many MSBs find the practical constraint is a banking relationship, not the registration. A bank will ask for the same compliance evidence a supervisor does.
- Parallel regimes. Where securities-law registration or a future stablecoin framework applies, the capital and reserve conditions of those regimes apply separately.
In the UAE, by contrast, prudential requirements are set by the regulator through its rulebooks. If you are comparing Canada with a Gulf licence, our multi-jurisdiction crypto regulation guide sets out how the models differ.
Governance and control requirements
The application and the compliance programme both test who controls the business. According to FINTRAC's registration instructions, applicants must provide information on the compliance officer, ownership (including holders of 20% or more), incorporation details and criminal record checks for senior management.
Board-level points to settle before filing:
- Appoint a compliance officer with real authority. The role should have direct access to the board and the independence to escalate or refuse onboarding.
- Map beneficial ownership to the 20% threshold. Layered holding structures should be charted to the natural persons behind them, and the records should be ready to hand over.
- Assign a named owner for each obligation. Reporting, record-keeping, training and the effectiveness review should each have an accountable person.
- Minute the risk assessment. FINTRAC's guidance expects a compliance programme built on documented risk assessments and written AML/CTF policies. A board that has not reviewed and approved them will struggle to show supervision readiness.
Criminal record checks must be dated no more than six months before submission, and documents that are not in English or French need a certified translation. For a founder team spread over several countries, this alone can dictate the filing timetable.
AML/CFT and Travel Rule implications
This is where most of the ongoing burden sits. Three obligations deserve board attention.
Travel Rule for virtual currency transfers
FINTRAC's guidance says that MSBs and foreign MSBs must include travel rule information when they send virtual currency transfers, and take reasonable measures to ensure it is included when they receive them. The research we reviewed notes the requirement has applied since 1 June 2021.
"Reasonable measures" is a qualitative standard, so the defensible approach is a written, risk-based procedure. It should define:
- which counterparties and wallet types you accept transfers from;
- what you do when information is missing: hold, return or reject;
- who may release a held transfer, and on what evidence;
- how you record each decision.
A policy that leaves these to case-by-case judgement is hard to defend at examination.
Identity verification for large transactions
You must verify the identity of every person or entity from whom you receive virtual currency of CAD 10,000 or more when the transaction takes place. A matching large virtual currency transaction record must be kept. Your systems should detect when several smaller receipts add up to the threshold, and your procedures should say what happens then.
Suspicious transaction detection
FINTRAC publishes money laundering and terrorist financing indicators specific to virtual currency transactions. Map each indicator to a monitoring rule or manual review step, and keep the mapping on file. Regulators expect you to be able to identify, escalate and report suspicious activity, not merely to have a policy that says so.
For firms that also serve US customers, the Canadian and US regimes differ in thresholds and reporting formats. Our guides to US crypto AML requirements and general AML practice for crypto firms help you avoid building two disconnected programmes.
Technology and custody controls
FINTRAC does not prescribe a custody architecture in the registration process, but the compliance programme will fail if technology cannot produce the records the law requires. Examine these controls:
- Segregation of client assets. Keep client virtual currency and fiat identifiable in your ledgers and wallets, separate from corporate funds. This protects clients and supports your own reconciliation and reporting.
- Key management. Document who can authorise a transfer, how many approvals are needed, and how you recover from loss. A transfer that cannot be traced to an approval cannot be defended.
- Travel Rule messaging. Choose a method that can carry originator and beneficiary information with the transfer and store it against the transaction record.
- Blockchain analytics and screening. Wallet screening feeds both your suspicious-transaction process and your decisions on held transfers.
- Record retrieval. Records must be producible on request, so test retrieval before an examiner asks.
Each control should be described in the programme and evidenced by logs, not simply asserted.
Enforcement exposure and penalty framework
Registration brings an ongoing duty to cooperate. Registered MSBs have a legal obligation to answer clarification requests, to notify FINTRAC of changes and to renew or update their registration. Missing a renewal or a change notification is an avoidable breach.
FINTRAC maintains a public Money Services Business Registry showing the most recent registration status of MSBs and foreign MSBs. Banks, counterparties and journalists can check it, so a lapse or revocation is visible quickly.
The exposure falls into three groups:
- Registration status. Operating without registration, or with a lapsed one, is the most serious position.
- Administrative penalties. Examination findings on policies, risk assessment, training, reporting and record-keeping can lead to monetary penalties. Penalty levels have been subject to legislative change, so confirm the current maximums with counsel before modelling exposure.
- Commercial consequences. Banking and counterparty relationships often react to a regulatory finding faster than the regulator does.
Be cautious with commentary that quotes enforcement statistics without a primary source. Rely on FINTRAC's own publications for what the current rules and penalty levels are.
Practical structuring considerations
The application process
- Scoping. Decide which activities and which entity you are registering, and document the analysis.
- Evidence gathering. Collect ownership charts, incorporation documents, compliance officer details, criminal record checks and certified translations.
- Programme build. Have the compliance programme, risk assessment and Travel Rule procedure written before you file, not after.
- Submission and clarification. FINTRAC uses a secure document transfer system. Once a FINTRAC officer provides access, the link expires within 15 days, and an incomplete submission in that window closes the application and means starting again.
- Wait for a decision. FINTRAC says most complete applications are processed within three months. Our experience is that multi-jurisdictional crypto structures should plan for longer, since each unclear ownership layer generates questions.
Cost
There is no FINTRAC fee, but the true cost is in preparation: record checks obtained from authorities in each person's country of residence, translations, legal drafting and the compliance build-out.
Stablecoin issuers
Issuers should watch the new framework closely. FINTRAC's page on upcoming changes for reporting entities describes the Stablecoin Act, under which issuers that make stablecoins available to persons in Canada will be required to register with FINTRAC. Build that into the licensing roadmap now rather than retrofitting it.
Entity design
Decide early whether to register a Canadian entity or operate as a foreign MSB. The choice affects banking, staffing, tax and how the board evidences oversight. Where several group entities touch Canadian clients, define which one contracts, which one holds client assets and which one reports.
Our view: registration is the start of supervision
We advise crypto businesses across the UAE's regulators and more than 30 other crypto-friendly jurisdictions, including Canada's FINTRAC regime, and one pattern repeats. Founders treat registration as the finish line and the compliance programme as paperwork to follow. Supervisors read it the other way round: the programme is the thing they assess, and registration is the entry ticket.
Our approach is to write the risk assessment and the Travel Rule procedure first, because they force the business to decide what it actually does with customer funds. The application then describes a business that already exists on paper. That sequence tends to produce fewer clarification rounds, and it gives the board something concrete to approve.
For groups that already hold a licence elsewhere, we advise against copying that licence's policies across unchanged. Thresholds, record formats and reporting duties differ, and a policy written for another regulator will show its origin in the first examination.
— CRYPTOVERSE
Where we can help
We support crypto and fintech businesses with VASP licensing across the UAE and other jurisdictions, including the coordination of a Canadian filing with licences held elsewhere. Our team also drafts and tests AML/CTF and risk management frameworks that stand up to supervisory review. For a practical walk-through of the Canadian regime, read our FINTRAC crypto compliance guide for startups, or contact us to scope an engagement.
FAQ
Do I need a crypto licence in Canada?
Canada does not issue a crypto-specific licence at federal level. Businesses dealing in virtual currency register with FINTRAC as MSBs, and securities-law analysis may add further obligations. Confirm both questions before launch.
Does a foreign crypto business have to register?
Yes, where it directs services to clients in Canada. FINTRAC requires registration before operations start, even if the business holds a licence elsewhere or at provincial level.
How much does MSB registration cost?
FINTRAC charges no registration fee. Your costs come from criminal record checks, certified translations, legal work and building the compliance programme, which vary by team size and structure.
How long does registration take?
FINTRAC states that most complete applications are processed within three months. Complex applications, such as those with multi-jurisdictional ownership, can take longer, so plan the launch date with a margin.
Sources
- Money services businesses (MSBs), FINTRAC
- Register your money services business or your foreign money services business
- Check to see if you need to register with FINTRAC as a money services business
- When to verify the identity of persons and entities, MSBs and FMSBs
- Travel rule for electronic funds and virtual currency transfers
- Record keeping requirements for MSBs and FMSBs
- Money laundering and terrorist financing indicators: virtual currency transactions
- Respond to clarification requests, update, renew or cancel your registration
- Money Services Business Registry
- Modernization and upcoming changes impacting reporting entities