Operating a payments business in Canada without the right regulatory permissions exposes the enterprise to enforcement action, rail suspension and banking loss – risks that compound quickly when digital assets are in the product stack. The question is not whether to engage with Canada's payments regime, but how to structure that engagement correctly before you launch or scale.
Payment institution licensing in Canada sits primarily within the federal Retail Payment Activities Act (RPAA) regime administered by the Bank of Canada, overlaid by provincial money-services-business (MSB) obligations enforced by FINTRAC (the Financial Transactions and Reports Analysis Centre of Canada) and, where a business touches securities-adjacent crypto activity, the provincial securities administrators operating under the Canadian Securities Administrators (CSA) umbrella. For a digital-asset or fintech operator inbound to Canada, all three layers are in play simultaneously – and the interaction between them is where structuring errors tend to occur.
This page maps the regulated perimeter, the registration and licensing process, the cross-border interaction with banking and tax, and the decision points that matter most for businesses building or acquiring payment capabilities in Canada.
Who is caught by Canadian payment regulation?
Any business that performs retail payment activities – defined under the RPAA as holding end-user funds in the course of executing electronic payment transactions – must register with the Bank of Canada as a payment service provider (PSP) before commencing those activities. The obligation is technology-neutral and entity-neutral: it catches domestic companies and foreign entities serving Canadian end-users alike. Size thresholds exist, but registration is the rule rather than the exception for any operator of meaningful scale.
Separately, any person in Canada that deals in virtual currencies (including exchanging, transferring or dealing in crypto assets) is a money services business under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA), and must register with FINTRAC. This obligation predates the RPAA and remains fully operative. In our practice, the most common gap we see is a business that has FINTRAC registration but has not assessed its RPAA PSP status – treating one registration as a substitute for the other.
The provincial securities layer adds a third dimension. Where a token is structured in a way that meets the common-enterprise and investment-expectation tests that Canadian securities regulators have applied to crypto assets, the CSA and individual provincial regulators – most prominently the Ontario Securities Commission (OSC) – treat the activity as trading in securities, triggering dealer registration and prospectus obligations. That analysis must run in parallel with the payment and MSB assessment.
What does RPAA PSP registration actually require?
PSP registration under the RPAA requires the applicant to submit a complete registration package to the Bank of Canada, demonstrate operational readiness for the regime's two core obligations, and maintain registration on an ongoing basis with annual attestation. The two substantive obligations are safeguarding end-user funds (holding them in trust or equivalent arrangements, or obtaining insurance or guarantee coverage) and incident reporting (notifying the Bank of Canada of operational incidents that affect or could affect end-users).
The registration package requires the applicant to identify every retail payment activity it performs, describe its end-user fund safeguarding arrangements with supporting documentation, and confirm its operational incident management processes. The Bank of Canada has authority to impose conditions on registration and to refuse or revoke it for non-compliance. Registration is not a light-touch process – it is the entry point to ongoing prudential supervision.
Timeline is a function of application completeness. The Bank of Canada has published indicative review timelines, but the practical experience in our advisory work is that incomplete applications – particularly those lacking adequate safeguarding documentation or with insufficient operational incident procedures – extend the process materially. Operators targeting a specific commercial launch date should build review time into their project plan and engage with the regulator pre-submission where the regime allows.
A common structuring point: a foreign PSP serving Canadian end-users from outside Canada is caught by the RPAA if it performs retail payment activities for those users. The registration obligation reaches beyond Canada's borders. Businesses structured offshore on the assumption that a foreign regulatory status exempts them from Canadian requirements regularly discover otherwise – often at the point of a banking or compliance review.
For a scoped assessment of your RPAA exposure and registration readiness, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity, the user base, the banking – change the analysis. Map your options.
How does FINTRAC MSB registration interact with PSP status?
FINTRAC MSB registration and Bank of Canada PSP registration are separate, parallel obligations that a digital-asset payments business in Canada will typically need to satisfy concurrently. They do not substitute for one another, and the compliance programs they require are structurally different – though they share an AML/CFT foundation.
MSB registration with FINTRAC triggers the full suite of obligations under the PCMLTFA: a written compliance program, a designated compliance officer, transaction record-keeping, large-transaction and suspicious-transaction reporting, and – critically – Travel Rule compliance. The Travel Rule (the obligation to pass originator and beneficiary data with a virtual-currency transfer above a prescribed threshold) is enforced in Canada through the PCMLTFA regime. Canada adopted Travel Rule requirements aligned with the FATF Recommendation 15 standard, and FINTRAC has been active in its examination and enforcement of compliance.
In practice, a business building a payment product that includes crypto-to-fiat conversion, stablecoin settlement or virtual-currency transfer functionality will need both registrations, a compliant AML program that satisfies both regimes, and a Travel Rule solution integrated into the payment flow. We have seen businesses that treated FINTRAC registration as the ceiling of their Canadian regulatory obligation miss the RPAA layer entirely – and vice versa. The cross-reference is not automatic; it requires deliberate structural analysis.
The provincial MSB registration layer adds another consideration. Several Canadian provinces maintain their own MSB or currency-exchange licensing regimes operating alongside the federal FINTRAC registration. British Columbia and Quebec, in particular, have historically maintained substantive provincial-level obligations. A national payments rollout requires mapping both federal and applicable provincial MSB status, not only federal registration.
Are crypto asset exchanges and VASPs treated differently?
Crypto asset exchanges and virtual asset service providers (VASPs) in Canada occupy a complex multi-regulator environment, and the answer to the securities question is determinative of the total licence stack. Where a platform deals in crypto assets that CSA guidance treats as securities or derivatives, the applicable regime is dealer or adviser registration under provincial securities law – not merely MSB registration and RPAA PSP status.
The CSA has published guidance indicating that crypto trading platforms dealing in crypto contracts (an arrangement that gives a customer rights to a crypto asset without immediate delivery) are engaging in regulated derivatives activity in most provinces, and dealer registration requirements apply. Several major platforms have obtained registration with the OSC and other provincial securities commissions under this framework, bringing them within an ongoing supervisory relationship with those regulators.
A business that structures its crypto offering to avoid the securities characterisation – by ensuring direct, immediate delivery of the underlying asset – may remain within the MSB/PSP framework without triggering the full securities dealer obligations. The structure of the product, the mechanics of custody and delivery, and the rights conferred on the customer are all material to this analysis. The label the business applies to its product is not.
In our cross-border practice, we regularly advise operators structuring inbound Canadian launches on this classification question early – before the technical architecture is fixed – because changing the delivery and custody mechanics after build is significantly more costly than designing them correctly from the outset.
How does Canadian banking access work for payment and crypto businesses?
Securing reliable fiat rails in Canada is the operational constraint that most licensed payment and crypto businesses encounter after registration. Canadian banks have historically been cautious about banking crypto-adjacent businesses, and that posture has not materially relaxed. The practical result is that a business may complete FINTRAC registration and RPAA PSP registration and still find itself without a domestic banking relationship adequate for its payment flow.
The strategies we see working in practice involve a combination of approaches. First, demonstrating a well-documented compliance program at the point of account application – not a generic AML policy but a program that maps specifically to the business's product, transaction types and customer base, and evidences Travel Rule implementation. Second, targeting institutions that have developed a specialised digital-asset or fintech banking capability rather than applying generally across the major chartered banks. Third, structuring the entity architecture so that the regulated Canadian entity presents a clean compliance profile, even where the wider group includes offshore structures.
Where domestic Canadian banking is unavailable on acceptable terms, operators sometimes access fiat rails through EMI relationships with European payment institutions that have established Canadian-dollar or USD clearing arrangements. This is a transitional solution, not a permanent one, but it can bridge the gap while a domestic banking relationship is built. We advise clients on this interaction regularly, structuring the EMI onboarding and the Canadian regulatory position together rather than separately.
Cross-border note: a business accessing Canadian-dollar rails through a European EMI must ensure that the EMI's own regulatory permissions cover the activities being processed, that the Travel Rule data flow between the Canadian entity and the EMI is compliant, and that the arrangement does not inadvertently create a second regulated entity in the EMI's home jurisdiction. These are solvable problems, but they require deliberate legal design.
If a prior banking application stalled or an account was closed, a second read of the structure and compliance presentation can surface the reason and the route forward. Write to info@oboluslaw.com or map your options here.
What are the tax and cross-border structuring considerations?
Tax treatment of payment and crypto activity in Canada is governed primarily by the federal Income Tax Act and the Excise Tax Act (GST/HST framework), with the Canada Revenue Agency (CRA) having published guidance on the treatment of crypto asset transactions. The characterisation question – income versus capital – turns on the facts of the business, and regularity of trading activity is treated as a strong indicator of income character for most exchange and payment businesses.
For inbound operators, the permanent-establishment question is significant. A foreign company operating a payment platform or exchange that services Canadian end-users may, depending on its activities in Canada and the structure of its Canadian-facing operations, create a taxable presence in Canada even without a domestic subsidiary. The interaction between the RPAA PSP registration obligation (which requires the entity to register with the Bank of Canada) and the tax PE analysis means that the two workstreams must be run together.
GST/HST treatment of virtual currency transactions has evolved through CRA guidance. Generally, the exchange of virtual currency for fiat or goods and services is treated as a barter transaction, and detailed guidance applies to how output tax obligations arise and how input tax credits are claimed. Payment service providers processing virtual-currency payments need to map these rules to their transaction types before going live.
Operators building group structures that include a Canadian operating entity alongside offshore holding or IP structures should also consider the transfer-pricing rules under the Income Tax Act, which apply to transactions between related parties. CRA scrutiny of cross-border digital-asset structures has increased, and the documentation requirements are demanding. We map the licence, banking and tax stack as one mandate.
How a structuring problem actually resolves
In a recent matter, a fintech operator based in a major offshore financial centre sought to launch a crypto-to-fiat payment product serving Canadian retail and business users. The operator had FINTRAC registration but had not assessed its RPAA PSP exposure, and its banking arrangement was with a non-Canadian EMI that had not fully mapped the Travel Rule data obligations on the Canadian side of the transfer chain. We identified the PSP registration gap, scoped the additional compliance program work required, and restructured the EMI relationship so that Travel Rule obligations were correctly allocated between the two regulated entities. Banking was secured with a Canadian financial institution prepared to service a fully documented compliance program. The operator launched without enforcement interruption in the subsequent quarter.
Self-assessment: are you structured correctly for Canada?
The following questions identify the most common structural gaps we see in inbound Canadian payment and crypto businesses. These are not a substitute for legal advice, but they surface the issues that most frequently require correction before launch or scaling.
- Have you assessed whether your activities constitute retail payment activities under the RPAA, and have you either registered as a PSP with the Bank of Canada or confirmed that you fall within an applicable exemption?
- Are you registered as an MSB with FINTRAC, and does your compliance program include a Travel Rule solution mapped to your specific virtual-currency transfer flows?
- Have you assessed whether any of the crypto assets you deal in are characterised as securities or derivatives under CSA guidance, triggering provincial dealer registration obligations?
- Have you mapped applicable provincial MSB or currency-exchange licensing obligations in the provinces where you operate or into which you market?
- Does your banking arrangement – whether domestic or through an EMI – correctly cover the regulated activities you are conducting, and have you documented that the arrangement satisfies the RPAA's end-user fund safeguarding requirements?
- Have you assessed whether your Canadian activities create a permanent establishment for tax purposes, and have you documented your transfer-pricing positions for intra-group transactions?
Addressing a common assumption
A common assumption among operators expanding to Canada is that an offshore licence – whether from a Caribbean jurisdiction, an EU member state or a major Asian hub – provides sufficient regulatory cover to serve Canadian users without engaging Canadian regulation. This is incorrect. The RPAA PSP registration obligation applies to any entity performing retail payment activities for Canadian end-users, regardless of where the entity is incorporated or licensed. FINTRAC MSB registration applies to any person in Canada dealing in virtual currencies. And CSA guidance on crypto trading platforms applies to any platform actively soliciting Canadian investors, regardless of where the platform is hosted.
Offshore licensing is a legitimate and often important part of a multi-jurisdictional digital-asset structure. It does not, however, substitute for Canadian regulatory engagement where Canadian users are being served. The cost of discovering this through enforcement – account suspensions, rail freezes, regulatory orders – is materially higher than the cost of mapping the correct licence stack at the outset.
We structure licensing, banking and tax as one mandate rather than three disconnected workstreams. To pressure-test your Canadian structure before you commit, message us via t.me/oboluslaw or map your options here.
Related at OBOLUS
- Banking, Payments and EMI Onboarding for Digital Asset Businesses – how OBOLUS structures the full banking and payment layer for crypto operators across jurisdictions
- EMI Onboarding for VASPs in the United Kingdom – the UK route to fiat rails and what it means for a business also active in Canada
- How to Respond in the First 48 Hours After a Crypto Theft – the immediate legal steps when digital assets are misappropriated
FAQ
Why do banks close crypto company accounts?
Banks close crypto company accounts primarily because the business's compliance documentation does not satisfy the bank's own AML risk appetite. The most common causes are an underdocumented compliance program, insufficient Travel Rule implementation, unclear transaction monitoring, and a business model the bank's compliance team cannot map to a known risk category. A well-structured, jurisdiction-specific compliance program – demonstrating how AML obligations are met for the specific product – is the most effective response to account closure or refusal. Regulatory registration alone is not sufficient; the program behind it must be demonstrable and current.
How can a VASP onboard with an EMI?
A VASP (virtual asset service provider) can onboard with an EMI (electronic money institution) by demonstrating regulatory registration, a compliant AML program and Travel Rule capability to the EMI's satisfaction. Most EMIs that accept VASP clients operate a structured onboarding assessment covering the VASP's jurisdictional licence status, its transaction monitoring procedures and its customer due diligence processes. Preparation – assembling the compliance program, FINTRAC or equivalent registration, and Travel Rule solution documentation in advance – materially shortens the onboarding timeline. The EMI's own regulator also influences which VASPs it can accept.
What does client-money safeguarding require?
Under the RPAA regime in Canada, a PSP must safeguard end-user funds held in the course of retail payment activities through a qualifying arrangement – typically holding funds in trust, obtaining an insurance policy or guarantee, or using a segregated account structure that meets the Bank of Canada's requirements. The specific structure must be documented and disclosed as part of the registration. The principle is that end-user funds must be protected from the PSP's own insolvency and must not be commingled with the PSP's operational funds. The precise requirements vary by the method chosen and are confirmed in Bank of Canada guidance.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We map the licence stack across operating, custody and payment layers before you commit – and we structure licensing, banking and tax as one mandate rather than three disconnected workstreams. To discuss your situation, contact info@oboluslaw.com.
By Victor Olsen, Regulatory & Compliance Analyst – specialising in payment institution licensing, VASP registration and cross-border regulatory structuring for digital-asset businesses.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.