Operating a crypto payment or exchange business in Canada without the right authorisation is not merely a compliance gap — it is a live enforcement risk. The Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) and the oversight of the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) together form the primary regulatory regime that governs virtual asset service providers (VASPs) and money service businesses offering digital-asset payment services in Canada. A separate, parallel stream applies to businesses that reach the payment-product threshold associated with what practitioners commonly term an electronic money institution (EMI) authorisation. This page explains both tracks, the inbound process for international operators, and the cross-border interaction with banking and tax that determines whether a Canadian authorisation actually works in practice.
What Does an EMI Licence Mean for Crypto Firms in Canada?
Canada does not issue a licence labelled "EMI" in the European sense — the operative instrument is MSB (money service business) registration with FINTRAC, which covers foreign exchange dealing, money transferring, and virtual currency exchange and transfer. For a crypto firm, this registration is the functional equivalent of an EMI authorisation: it permits the business to issue prepaid-value instruments, process payments denominated in virtual currency, and offer conversion services to Canadian users and counterparties.
The distinction matters for inbound operators. A European or Middle Eastern exchange that holds a MiCA CASP authorisation or a VARA licence from Dubai cannot use that authorisation to conduct regulated MSB activity in Canada. The PCMLTFA regime is self-contained. Any business — domestic or foreign — that conducts virtual currency exchange or transfer services in relation to Canada must register with FINTRAC as a virtual currency dealer (a subcategory of MSB).
The second layer involves provincial securities regulators. If the digital assets you deal in meet the definition of a security or derivative under applicable Canadian securities law — as assessed by the Canadian Securities Administrators (CSA) — the relevant provincial regulator (the OSC in Ontario, the AMF in Québec, the BCSC in British Columbia, and others) also has jurisdiction. Holding a FINTRAC MSB registration does not satisfy a securities registration obligation, and vice versa. A crypto firm operating in Canada therefore faces a two-axis analysis: the federal AML/payments layer and the provincial securities layer.
The process above describes the standard path. Your facts — the entity structure, the user base, the asset classes you list, and whether you hold client funds — change the analysis significantly. For a scoped assessment of your Canadian authorisation requirements, contact OBOLUS at info@oboluslaw.com.
Who Needs to Register: The Regulatory Perimeter Under FINTRAC
Any business that provides virtual currency exchange or virtual currency transfer services — even if conducted entirely from abroad — must register with FINTRAC as an MSB if those services reach Canadian persons or are offered from a Canadian place of business. The perimeter is broad by design.
The PCMLTFA defines a foreign MSB (FMSB) as an entity that provides MSB services to persons in Canada from a place of business outside Canada. FINTRAC's foreign MSB registration requirement has real enforcement teeth: providing services without registration exposes the business to administrative monetary penalties and, in serious cases, criminal prosecution. Banking relationships in Canada are conditioned on registration status — no compliant Canadian correspondent bank will process for an unregistered virtual currency dealer.
The following operator profiles generally require registration:
- Crypto exchanges and trading platforms with Canadian retail or institutional users.
- Custodians holding virtual assets on behalf of Canadian clients.
- Payment processors or stablecoin issuers routing transactions through Canadian accounts.
- Over-the-counter desks dealing in virtual currency with Canadian counterparties.
- DeFi front-end operators that facilitate transfers for identifiable Canadian users where that nexus is legally meaningful.
Operators in the last category face genuine ambiguity. In our practice, we routinely advise DeFi and aggregator platforms on where the regulatory nexus begins — the answer turns on whether the operator controls a point of user interaction that a regulator can attribute to Canada. That analysis should happen before launch, not after FINTRAC issues a compliance order.
The Provincial Securities Layer: When a Crypto Asset Becomes a Security
Canada's securities regime is provincial, and the Canadian Securities Administrators (CSA) is the umbrella body coordinating its members across thirteen jurisdictions. Whether a particular token or digital asset constitutes a security is assessed by reference to the investment-contract test applied by Canadian courts and the CSA's published guidance — not by the label the issuer gives the asset.
The CSA's Staff Notices on crypto-asset trading platforms have progressively clarified that most centrally operated exchanges offering trading in assets that confer profit-sharing, governance rights, or an expectation of value derived from the issuer's efforts are subject to securities registration requirements. The practical effect is that a crypto trading platform serving Canadian users will almost certainly need to engage with at least one provincial securities regulator in addition to FINTRAC.
Several larger platforms have entered into interim agreements with provincial regulators while full registration applications are processed — a pragmatic structure that the CSA has supported for established operators meeting baseline conditions. New entrants, by contrast, are expected to obtain registration before commencing services. The OSC, AMF, and BCSC have each published public notices making this expectation unambiguous.
For a firm already licensed under MiCA in the EU, the VARA regime in Dubai, or the Payment Services Act in Singapore, Canadian requirements add a distinct, non-passportable layer. We have seen international operators underestimate this. The registration obligations are real, the enforcement posture has hardened, and the provincial regulators have demonstrated willingness to use their powers.
How Does the FINTRAC Registration Process Work?
FINTRAC MSB registration is a federal process conducted through FINTRAC's online reporting system. It is not a licensing process in the traditional sense — there is no capital adequacy requirement imposed at the federal level for the registration itself — but the application requires detailed disclosure of the business structure, beneficial ownership, the services to be provided, and the AML/CFT compliance program the applicant has in place.
The core elements of a successful application include:
- Compliance program documentation: a written AML/CFT policies and procedures manual, a designated compliance officer, an ongoing training program, and a risk assessment. FINTRAC will examine the program's substance, not merely its existence.
- Beneficial ownership disclosure: full disclosure of the ownership and control structure, including ultimate beneficial owners and any politically exposed persons in the chain.
- Business activity description: a precise description of the virtual currency services to be provided, with the Canadian nexus identified.
- Office and agent details: for a foreign MSB, the Canadian contact point and the jurisdictions from which services will be provided.
Registration is generally processed within a matter of weeks for a well-prepared application. However, FINTRAC has broad authority to conduct compliance examinations after registration — typically within the first year for new registrants — at which point the quality of the compliance program is tested against FINTRAC's examination guidance. Operators who treat registration as a checkbox and do not build a genuine program will fail that examination.
The Travel Rule — the obligation to pass originator and beneficiary data with a virtual asset transfer — applies in Canada under the PCMLTFA amendments. Canadian Travel Rule requirements apply to virtual currency transfers above the applicable threshold. The specific threshold is set by regulation and should be confirmed against current legislation before reliance. Compliance with the Travel Rule requires a technical solution: a VASP-to-VASP messaging protocol compatible with the receiving counterparty.
Cross-Border Reality: Banking, Custody, and the Multi-Jurisdiction Stack
A FINTRAC registration, standing alone, does not solve the banking problem. Canadian chartered banks remain highly selective in their approach to crypto MSBs, and correspondent banking access for foreign MSBs is tighter still. In practice, an inbound operator will need to demonstrate not only FINTRAC registration but also a credible AML program, a Canadian operational presence or at least a designated compliance officer, and — where provincial securities registration applies — evidence of good standing with the relevant regulator.
The custody layer adds another dimension. If your business holds client virtual assets — as opposed to merely processing transfers — the custody activity is regulated separately under most provincial securities regimes. The OSC, in particular, has articulated expectations around client-asset safeguarding and segregation that align conceptually with the safeguarding requirements under MiCA or the FSRA regime in Abu Dhabi, but the Canadian rules are not identical to either.
Cross-border structuring therefore requires a deliberate decision about where the regulated entity sits, where client funds are held, where the custodian is licensed, and where the banking relationship lives. An operator structured primarily in a European MiCA jurisdiction that wants to serve Canadian users must build a Canadian spoke — whether a registered FMSB, a provincially registered platform, or a full subsidiary — rather than relying on the European authorisation to stretch across the Atlantic.
In a recent mandate, an established payments company licensed in a European jurisdiction sought to extend its Canadian user base. We identified that the company's stablecoin transfer service constituted virtual currency transfer services under the PCMLTFA and that certain of its listed assets triggered the provincial securities analysis. We structured a phased approach: FINTRAC foreign MSB registration in the first phase, followed by engagement with the relevant provincial regulator under an interim operational agreement while the full securities registration was progressed. The company maintained its service launch timeline without operating in breach.
Tax Interaction: What the Authorisation Does Not Cover
Canadian regulatory authorisation and Canadian tax compliance are distinct workstreams, but they interact in ways that affect the business case for a Canadian presence. The Canada Revenue Agency (CRA) taxes virtual currency transactions as property — gains and losses on exchange are generally treated as income or capital depending on the nature of the activity, and the CRA has published guidance to that effect.
For an inbound operator establishing a Canadian entity to hold the FMSB registration or the securities registration, the entity will be subject to Canadian corporate income tax on its Canadian-source income. Transfer pricing rules apply to cross-border transactions between the Canadian entity and its foreign parent or affiliates. A thin-capitalization analysis may be relevant where the Canadian entity is funded by related-party debt.
The interaction between the regulatory authorisation and the tax structure is a reason to plan both together. We regularly advise clients on building the licence, banking, and tax stack as a single mandate. An entity incorporated and registered for regulatory purposes that generates unexpected permanent-establishment exposure, or that fails a transfer-pricing audit because the economic substance is inadequate, is a liability rather than an asset.
What Mistakes Do Inbound Operators Typically Make?
A common assumption is that a single offshore licence — whether a VARA authorisation, a MiCA CASP registration, or a BVI VASP Act registration — is sufficient to serve clients globally, including in Canada. It is not. Canada's PCMLTFA regime applies on the basis of service reach into Canada, not on the basis of where the operator is incorporated or licensed. FINTRAC has pursued enforcement actions against foreign entities that treated their home-jurisdiction licence as a global permission.
The second frequent error is treating FINTRAC registration and provincial securities registration as alternatives rather than as parallel obligations. The two regimes answer different questions. FINTRAC asks: does this business move money or virtual currency? The provincial regulator asks: does this business deal in securities? A crypto exchange almost certainly triggers both.
The third mistake is building a compliance program that satisfies the registration form but does not survive a FINTRAC examination. The program must include a genuine risk assessment of the business's specific client base and asset classes, not a generic template. FINTRAC examiners test this in practice. Operators we advise build the program around the actual transaction flows and user risk profile from the outset.
Finally, some operators underestimate the timeline for provincial securities registration. Where a full securities registration is required — rather than an interim agreement — the process can extend across many months and involves detailed regulatory engagement. Building this into the launch timeline before committing to a Canadian market entry is essential.
If a prior Canadian application stalled or your banking relationship was closed following a compliance review, a second read of the structural cause may surface a route forward. Contact OBOLUS at info@oboluslaw.com or via t.me/oboluslaw to discuss.
Related at OBOLUS
Related at OBOLUS
- Licensing and Registration for Digital-Asset Businesses – end-to-end counsel on regulatory authorisation across 70+ jurisdictions.
- How to Build Economic Substance for a Licensed VASP – practical guidance on substance requirements that satisfy regulators and tax authorities.
- Client Funds Safeguarding in Liechtenstein – the safeguarding and custody regime in a leading EEA digital-asset jurisdiction.
FAQ
How long does a crypto licence take to obtain?
Timeline varies significantly by jurisdiction and by the specific authorisation required. In Canada, FINTRAC MSB registration for a well-prepared applicant is typically processed within a matter of weeks. Provincial securities registration is a longer process — often many months — and involves substantive regulatory engagement. Internationally, timelines range from several weeks for a BVI VASP Act registration to a year or more for a full MiCA CASP authorisation in a demanding EU member state. Preparation quality is the primary variable within the applicant's control.
Which jurisdiction is best for licensing my crypto business?
There is no single answer. The right jurisdiction depends on where your users are, which asset classes you deal in, what banking you need, and your long-term market targets. A MiCA CASP authorisation provides EU passporting but carries substantive capital and compliance obligations. A VARA licence opens the Dubai market. A FINTRAC registration is required for Canadian access regardless of where you are otherwise licensed. We map the full licence, banking, and tax stack before any commitment is made.
Do I need a separate custody licence?
In most flagship regimes, custody of client virtual assets is a separately regulated activity. In Canada, holding client assets triggers provincial securities obligations around safeguarding and segregation, independent of FINTRAC registration. Under MiCA, custody is a distinct CASP activity requiring specific authorisation. Under VARA and the FSRA in Abu Dhabi, custody licences are issued separately from exchange or brokerage licences. Whether you need a standalone custody authorisation depends on your specific service model and the jurisdictions you operate in.
About OBOLUS
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers, and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking, and compliance obligations that sit around them. Digital assets are the whole of our practice. We structure licensing, banking, and tax as one mandate rather than three disconnected workstreams — mapping the full stack before our clients commit capital or launch into a new market. To discuss your Canadian regulatory position or your global authorisation strategy, contact info@oboluslaw.com.
By Aisha Tan, Licensing & Jurisdictions Analyst — specialising in multi-jurisdictional VASP authorisation, inbound market-entry structuring, and the interaction between federal and provincial regulatory requirements in Canada.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.