For any business handling virtual assets in Canada, the compliance officer and MLRO (money laundering reporting officer) functions are not optional extras – they are mandatory structural requirements under FINTRAC (the Financial Transactions and Reports Analysis Centre of Canada) and the Proceeds of Crime (Money Laundering) and Terrorist Financing Act regime. Registration as a MSBB (money services business dealing in virtual currency) triggers the full suite of obligations: a designated compliance officer, a written AML/CFT program, risk-based KYC procedures, transaction monitoring, and reporting. The failure to build this structure correctly – not just nominally – is one of the most common reasons Canadian-registered crypto businesses face enforcement action or lose their banking relationships. This page sets out exactly what is required, how it operates across a cross-border business, and where the structural risks concentrate.
Why the MLRO function is foundational, not administrative
FINTRAC's regulatory posture toward virtual-currency MSBs has hardened materially in recent years. The compliance officer function is the load-bearing element of every registered firm's AML program: it is the individual on whom regulatory accountability sits, the person who must respond to a FINTRAC examination, and the face of the program during an enforcement review. Appointing a nominal compliance officer who holds no real authority, owns no budget, and cannot halt a transaction creates regulatory exposure that dwarfs the short-term convenience.
Under the applicable PCMLTFA regime, the compliance officer must be a person with the seniority and mandate to implement the program. That does not necessarily mean a dedicated full-time hire for a smaller operator – but it does mean documented authority, access to management, and genuine decision-making power over client onboarding and transaction escalation. Regulators in the leading hubs increasingly expect the compliance officer to be named in governance documents and to be reachable on examination.
The MLRO function – the specific obligation to file suspicious transaction reports (STRs) and to receive internal reports from staff – is often combined with the compliance officer role in Canadian crypto firms. The key point is that both functions must be genuinely operational. A program on paper, with a compliance officer who lacks access to transaction data, will not survive a FINTRAC examination.
The process above describes the standard structural path. Your facts – the entity's ownership, the user base's geography, the banking relationships – change the analysis. For a scoped assessment of your compliance structure, contact OBOLUS at info@oboluslaw.com or map your options here.
Who must register with FINTRAC as a virtual-currency MSB?
Any business that deals in virtual currency – meaning it exchanges virtual currency for fiat, for another virtual currency, or transfers virtual currency on behalf of clients – must register with FINTRAC as an MSB under the applicable PCMLTFA provisions. This applies regardless of whether the business is incorporated in Canada or operates into Canada from abroad: if a foreign firm has Canadian clients or conducts transactions from or to Canada, the registration obligation is triggered. This is the single most important cross-border point for inbound operators to understand.
The registration requirement is not discretionary. Operating as an unregistered virtual-currency MSB exposes the business to significant civil penalties and, in aggravated cases, to criminal liability under the applicable provisions. FINTRAC has the authority to conduct compliance examinations without prior notice and to publish findings.
In our practice, we consistently see inbound operators – particularly those licensed in the EU under MiCA or in Dubai under VARA – assume that their existing licence covers Canadian users. It does not. Canadian regulatory obligations are domestic and arise from the activity, not from the licensing status in another jurisdiction. A business operating compliantly under MiCA's CASP framework or under VARA's activity-based regime still needs a separate FINTRAC registration to serve Canadian clients and must build a compliant Canadian AML program around it.
What does a compliant Canadian crypto AML program require?
A compliant program under FINTRAC's rules for virtual-currency MSBs rests on five structural pillars, each of which must be documented and operationally embedded.
First, the written compliance program. The business must maintain a written AML/CFT policy that reflects its specific risk profile. Generic policies imported from another jurisdiction will not satisfy a FINTRAC examination. The policy must cover the firm's products, customer types, delivery channels and geographic exposure, and it must be reviewed and updated on a regular cycle. FINTRAC publishes detailed guidance on what a compliant program must address, and that guidance is treated as a floor, not a ceiling.
Second, the risk assessment. The firm must conduct and document an enterprise-level risk assessment. This is separate from customer-level KYC: it is an assessment of the business's exposure to money laundering and terrorist financing risk across its entire operation. For a cross-border crypto business, the risk assessment must address the jurisdictions from which clients are drawn, the transaction types offered, and the channels used for fund movement. Regulators expect this document to be substantive and current.
Third, KYC and CDD procedures. The applicable PCMLTFA provisions impose customer identification requirements at defined thresholds, enhanced due diligence obligations for higher-risk clients, and ongoing monitoring requirements. For virtual-currency transactions, the thresholds and the methods for identity verification are set out in FINTRAC guidance and have been updated to address remote onboarding. A KYC framework that was adequate for a prior regulatory period may no longer meet current standards.
Fourth, transaction monitoring and reporting. MSBs dealing in virtual currency must report large virtual-currency transactions, suspicious transactions, and attempted suspicious transactions to FINTRAC within the timeframes specified in the applicable provisions. The reporting obligations for virtual currency mirror those for fiat-currency MSBs in structure, but the underlying data – wallet addresses, transaction hashes, exchange counterparties – differs from traditional MSB data, and the compliance officer must be equipped to gather and interpret it.
Fifth, the Travel Rule obligation. Canada has implemented the Travel Rule (the obligation to collect and transmit originator and beneficiary data with a virtual-currency transfer) under FINTRAC's rules. The applicable threshold above which Travel Rule data must be collected and transmitted is set by FINTRAC's current guidance; the threshold is not infinite, and in practice most commercial transfers will be caught. Compliance officers must ensure their systems can collect, store and transmit this data in the required format and within the required timeframe.
How does the Travel Rule operate for Canadian crypto firms in practice?
The Travel Rule in Canada requires a virtual-currency MSB to collect prescribed originator and beneficiary information for transfers at or above the applicable threshold and to transmit that information to the receiving VASP. The obligation sits on both the sending and receiving sides of a transfer. This creates a practical problem that many compliance officers underestimate: the counterpart VASP must also be capable of receiving and processing the data in a compatible format.
In practice, Travel Rule compliance for a Canadian crypto business with an international user base requires a technology solution – typically a Travel Rule protocol – that can communicate with counterpart VASPs across jurisdictions that have implemented the Travel Rule at different thresholds and with different data requirements. The MiCA regime, the MAS Payment Services Act framework, the FCA's rules, and the FATF Recommendation 15 baseline all impose Travel Rule obligations, but the implementation details differ. A Canadian operator sending transfers to counterpart firms in the EU, Singapore or the UK must ensure its Travel Rule solution addresses those jurisdictions' specific requirements, not just the Canadian ones.
The compliance officer's role in Travel Rule governance is central. That officer must map the firm's counterpart VASP relationships, assess each counterpart's Travel Rule status, document the assessment, and establish a process for handling transfers to or from unhosted wallets or counterparts that cannot comply. FINTRAC expects this mapping to exist and to be current.
How does the Canadian AML framework interact with cross-border banking and tax?
The compliance structure required by FINTRAC does not operate in isolation. For a business with a Canadian FINTRAC registration alongside licences in other jurisdictions – whether a VARA licence in Dubai, a CASP authorisation under MiCA, or a DPT service licence under the MAS Payment Services Act – the compliance officer must manage a multi-regime AML program. This is not merely additive: the risk assessment, the KYC framework and the transaction monitoring logic must be calibrated to the requirements of every jurisdiction in which the business is active.
Banking is closely tied to the compliance structure. Canadian banks and payment processors have been cautious in opening accounts for virtual-currency MSBs. In our practice, we have seen that firms with well-documented AML programs – a comprehensive risk assessment, a named compliance officer with clear authority, a current Travel Rule solution and clean FINTRAC examination history – are materially better positioned to maintain banking relationships than firms that hold a registration but have a thin compliance program. The program is, in effect, the primary due-diligence document that a correspondent bank will review.
Tax interaction is significant for cross-border operators. Canada's tax authority – the Canada Revenue Agency – treats virtual-currency transactions as giving rise to income or capital gains depending on the nature and frequency of the activity. A compliance officer who also oversees transaction reporting must ensure that the transaction data captured for FINTRAC reporting is also adequate for tax-reporting purposes. These two sets of obligations can and should be served by the same underlying data architecture, but the reporting fields and the retention requirements differ. Operators we advise regularly discover gaps between their FINTRAC-compliant data capture and their CRA-compliant tax reporting, and closing those gaps retroactively is more expensive than building the right architecture at the outset.
If a prior application stalled, a banking relationship was closed, or a FINTRAC examination flagged deficiencies, a structural review can surface the underlying cause. Write to OBOLUS at info@oboluslaw.com or request a review here.
How should an inbound operator build the MLRO function for Canada?
For a business entering the Canadian market from another jurisdiction, the sequence for building the MLRO and compliance officer function follows a defined path.
The first step is entity assessment. The operator must determine whether its existing corporate structure – the entity that holds the foreign licence – will register with FINTRAC directly, or whether a Canadian legal entity is required. In many cases, a foreign entity can register, but the compliance officer must be reachable by FINTRAC and must have genuine authority over Canadian operations. A compliance officer based entirely outside Canada, with no familiarity with FINTRAC's regime, creates practical and regulatory risk.
The second step is compliance program design. This means building – not importing – a Canadian AML program that reflects the business's specific Canadian risk profile. A program drafted for MiCA, for VARA, or for the MAS Payment Services Act will address different risk categories and will use different terminology than FINTRAC requires. The Canadian program must be self-standing, even if it is coordinated with programs in other jurisdictions.
The third step is Travel Rule architecture. The compliance officer must assess which Travel Rule solution the firm will use for its Canadian operations and how that solution interacts with the solutions used in other jurisdictions. A fragmented Travel Rule architecture – one solution for EU transfers, a different one for Canadian transfers, no solution for transfers to smaller-market counterparts – creates data integrity risks and examination exposure.
The fourth step is staff training. FINTRAC requires that all relevant staff be trained on their obligations under the Canadian AML program. Training records must be maintained. The compliance officer is responsible for the training program and must ensure it is updated when the applicable requirements change.
The fifth step is FINTRAC registration. Registration is a prerequisite for operating, not a post-launch formality. The registration process itself is administrative and can be completed online, but the program and controls infrastructure must be in place at the point of registration. FINTRAC expects a registered entity to be examination-ready from day one.
A recent Canadian AML restructuring: closing a Travel Rule gap
In a recent matter, a payments firm with an existing EU CASP authorisation began onboarding Canadian users without completing a FINTRAC registration or building a Canada-specific AML program. The firm's compliance officer was based in the EU and had no familiarity with FINTRAC's Travel Rule thresholds or reporting formats. A correspondence from FINTRAC requesting information about the firm's Canadian operations triggered an urgent review. We advised the firm on the registration process, restructured the compliance program to address FINTRAC's requirements as a standalone layer alongside the EU program, sourced a Travel Rule solution capable of operating across both regimes, and prepared the compliance officer for examination. The firm's registration was completed and the examination was resolved without adverse findings. The lesson was clear: a foreign licence, however robust, does not substitute for Canadian compliance infrastructure.
A common assumption that costs businesses dearly
A common assumption among operators expanding into Canada is that a licence or registration in a well-regarded offshore jurisdiction – the Cayman Islands under CIMA, the BVI under the VASP Act, or a Malta VFA authorisation – satisfies Canadian obligations. It does not. FINTRAC's registration requirement is activity-based: if the business takes Canadian clients or moves Canadian funds, it needs a FINTRAC registration and a Canadian AML program, regardless of its licensing elsewhere. Operators we advise who rely on a single offshore registration typically discover the gap at the worst possible moment – when a bank requests a compliance review, when FINTRAC initiates an examination, or when a payment rail is suspended. Building the right structure from the outset is faster and less expensive than remediation under pressure.
A second assumption – less common but equally costly – is that the compliance officer role can be held by a director who also manages commercial relationships. The conflict is real: a compliance officer who is also a revenue-generating partner cannot credibly halt a transaction or file an STR against a major client. FINTRAC's program requirements contemplate genuine independence of the compliance function. For smaller firms, this means documented authority and a clear escalation path, even if the role is not full-time. For larger firms, it means a dedicated compliance officer with a reporting line that is separate from commercial management.
Decision matrix: which operator profile needs what structure?
Profile A – Foreign firm with Canadian users, no Canadian entity. This operator must register with FINTRAC as a foreign MSB, appoint a compliance officer with genuine FINTRAC-facing authority, and build a Canadian-specific AML program. The Travel Rule obligation applies from the first qualifying transfer. The primary risk is examining exposure before the program is mature. Timeline to a registration-ready position is typically several weeks, depending on the complexity of the risk assessment and the Travel Rule architecture. Key risk: a thin program that passes the administrative registration but fails an examination.
Profile B – Canadian entity with an existing foreign AML program. This operator has the corporate structure already in place but must build a Canadian layer. The foreign program provides useful raw material but cannot be used as-is. The compliance officer – even if already designated for the foreign regime – must understand FINTRAC's specific requirements and be capable of managing FINTRAC reporting independently. Timeline depends on how divergent the foreign program is from Canadian requirements; in our practice, the gap assessment and rebuild typically takes a matter of weeks. Key risk: the compliance officer treats the Canadian program as a formality and fails to embed it operationally.
Profile C – De novo Canadian crypto firm. This operator builds the program from scratch and faces the full scope of obligations: risk assessment, written policy, KYC framework, transaction monitoring, Travel Rule architecture, training, and FINTRAC registration. The advantage is that there are no legacy systems or foreign-program assumptions to unwind. The risk is moving to market before the program is examination-ready. A firm that registers before its controls are operational creates examination liability from day one.
Related at OBOLUS
- AML and Travel Rule compliance for digital-asset businesses – the full practice overview covering all major regimes and the multi-jurisdiction compliance stack.
- AML/CFT policy drafting under heightened regulatory scrutiny – how we build examination-ready compliance programs for operators facing regulator attention.
- Transfer pricing for crypto groups in the Czech Republic – structuring cross-border digital-asset groups to manage intra-group pricing and tax exposure.
FAQ
What does the Travel Rule require from a VASP?
The Travel Rule requires a virtual asset service provider to collect prescribed originator and beneficiary information – including names, account numbers and, where applicable, wallet addresses – for transfers at or above the applicable threshold, and to transmit that information to the receiving VASP. Canada has implemented this obligation under FINTRAC's applicable provisions. The compliance officer is responsible for ensuring the firm's systems can collect, store and transmit the required data. Counterpart VASP compatibility must be assessed and documented.
Who must act as MLRO for a crypto firm?
The MLRO function in a Canadian virtual-currency MSB is typically held by the designated compliance officer. The individual must have seniority and genuine authority to implement the AML program, file suspicious transaction reports, and respond to FINTRAC examinations. A nominal appointment – where the designated officer lacks access to transaction data or management authority – will not satisfy FINTRAC's requirements. For smaller firms, the role may be part-time, but the authority and the documentation must be real.
How do regulators audit crypto AML programs?
FINTRAC conducts compliance examinations of registered virtual-currency MSBs, which may be scheduled or unannounced. Examiners review the written compliance program, the risk assessment, KYC records, transaction monitoring logs, reporting records and Travel Rule data. They assess whether the program reflects the firm's actual risk profile and whether the compliance officer can demonstrate operational ownership of the program. Deficiencies are documented in examination reports; repeated or serious deficiencies may result in administrative monetary penalties or publication of findings.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. We map the licence stack across operating, custody and payment layers before you commit, and we have advised crypto exchanges, custodians, token issuers and funds across more than seventy licensing jurisdictions. Digital assets are the whole of our practice. To discuss your situation, contact info@oboluslaw.com or message us via t.me/oboluslaw.
By Victor Olsen, Regulatory & Compliance Analyst – specialising in AML program design, FINTRAC compliance architecture and cross-border VASP regulatory obligations for digital-asset businesses.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.