Canada's VASP regime requires businesses handling digital assets to register with FINTRAC before soliciting Canadian clients – and operating without that registration exposes the business to enforcement, frozen banking rails and exclusion from the regulated market.
For any exchange, custodian, OTC desk or payment processor with Canadian users, the first legal question is straightforward: does this activity constitute a money services business (MSB) or a virtual asset service provider (VASP) under Canadian federal anti-money laundering law? If it does – and for most digital-asset businesses the answer is yes – registration with the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) is mandatory before operations begin. The consequences of non-compliance are not theoretical: regulators have frozen accounts, issued compliance orders and referred matters for prosecution. This page maps the legal basis, the application process, the practical challenges and the cross-border considerations that most advisory memos leave out.
With VASP supervision tightening across the major hubs and Canada's Proceeds of Crime (Money Laundering) and Terrorist Financing Act extending its reach to foreign businesses serving Canadian residents, inbound operators face a more complex picture than a straightforward domestic registration. The following sections walk through every layer of that picture.
Who Needs to Register as a VASP in Canada?
Any business that deals in virtual currencies as a money services business – exchanging fiat for crypto, transferring crypto between parties, or providing crypto ATM services – must register with FINTRAC as an MSB or a foreign MSB (FMSB). The regime does not distinguish between a Toronto-incorporated exchange and a Cayman-domiciled operator with a Canadian-facing website: if you serve Canadian residents, you are caught.
The scope is deliberately broad. Under the applicable provisions of the Proceeds of Crime (Money Laundering) and Terrorist Financing Act and its regulations, a virtual currency exchange transaction includes any conversion of virtual currency to fiat or another virtual currency for a client. A virtual currency transfer – sending virtual currency at a client's instruction – is equally in scope. ATM operators that exchange fiat for virtual currency at a physical machine are explicitly regulated.
The foreign MSB category is the element most international operators underestimate. A business incorporated in the British Virgin Islands, registered under the BVI FSC under the VASP Act 2022, and operating a platform accessible to Canadian residents is still a foreign MSB in Canada. It must register with FINTRAC separately from any offshore licence it holds. One offshore registration is not a substitute for Canadian compliance. This is a structurally important point: we regularly advise operators who arrive with a well-developed offshore regulatory posture but no Canadian registration, believing their existing licence extends globally. It does not.
What Does the FINTRAC Registration Process Involve?
FINTRAC registration is not a licence in the classical sense – it is a compliance registration, but its practical effect on operations is equivalent because banking partners and payment processors in Canada will not engage an unregistered entity. The registration process involves a structured application through FINTRAC's online portal, submission of business information, compliance program documentation, and the appointment of a compliance officer.
The core elements of a compliant application include:
- A written compliance program – policies, procedures and controls covering customer due diligence (CDD), record-keeping, transaction reporting and risk assessment;
- Appointment of a dedicated compliance officer with operational authority;
- A documented risk-based approach to detecting money laundering and terrorist financing;
- An ongoing training program for staff;
- A two-year review cycle for the compliance program; and
- For foreign MSBs, evidence of the agent or branch through which Canadian services are directed.
FINTRAC does not publish a standard timeline for registration decisions, and in our practice we have seen processing times range from several weeks for straightforward applications to considerably longer where the compliance documentation is incomplete or the ownership structure raises questions. Preparing the compliance program to a professional standard before submission is the single most consequential investment an applicant can make. Thin documentation does not fail quickly – it delays interminably and can result in a return-to-applicant notice that resets the clock.
FINTRAC registration does not confer securities authorisation. If a digital-asset business issues tokens that qualify as securities or derivatives under provincial law, a separate regulatory pathway – through provincial securities regulators coordinated under the Canadian Securities Administrators (CSA) – applies in addition. Treating federal registration as a universal clearance is a category error with serious consequences.
The process above describes the standard registration path. Your entity structure, the jurisdictions where your users sit, and your banking relationships all change the analysis. For a scoped assessment of your situation, contact OBOLUS at info@oboluslaw.com.
What AML and Travel Rule Obligations Apply to Canadian VASPs?
Registered Canadian MSBs and foreign MSBs must implement a full AML/CFT compliance program aligned to the Travel Rule – the obligation to pass originator and beneficiary data with virtual currency transfers. Canada implemented its Travel Rule obligations through amendments to the PCMLTFA regulations, making it one of the first jurisdictions outside the Financial Action Task Force's (FATF) core working group to bring the rule into domestic law for virtual currency businesses.
Under the applicable regime, a VASP conducting a virtual currency transfer above a defined threshold must collect and transmit the name, account number and address of the originator, and the name and account number of the beneficiary. The threshold is set in the regulations; operators should confirm the current figure with counsel, as it has been subject to regulatory revision. For transfers below the threshold, reduced record-keeping obligations still apply.
The Travel Rule creates an acute operational challenge for cross-border transactions. Where the counterparty VASP is in a jurisdiction without an equivalent Travel Rule regime, or where the counterparty does not use compatible messaging infrastructure, the sending VASP must document its reasonable steps to comply. FATF's Recommendation 15 underpins the Canadian rule, and FINTRAC has signalled that Travel Rule compliance will be a primary examination focus during supervisory visits.
In addition to the Travel Rule, registered businesses must file Suspicious Transaction Reports (STRs) and Large Virtual Currency Transaction Reports (LVCTRs) with FINTRAC within mandated windows. Failure to report is an independent offence, separate from any underlying compliance failure. In our cross-border practice, we have seen operators with strong AML policies nonetheless face examination findings because their reporting workflows – specifically the triggering logic for LVCTRs – were not calibrated to the Canadian thresholds.
How Does the Provincial Securities Layer Interact with FINTRAC Registration?
Canadian securities regulation is provincial, not federal – and digital-asset businesses operating in Canada routinely encounter the intersection between FINTRAC's federal MSB regime and the provincial securities regimes administered by regulators such as the Ontario Securities Commission (OSC), the Autorité des marchés financiers (AMF) in Québec, and the British Columbia Securities Commission (BCSC), all coordinated through the CSA.
Whether a token is a security in Canada turns on the same substance-over-form analysis familiar from other common-law jurisdictions: the focus is on whether the token represents an investment in a common enterprise with an expectation of profit derived from the efforts of others. The CSA has issued guidance indicating that many tokens traded on secondary markets meet this threshold. A platform trading those tokens without registration as a restricted dealer or investment dealer, or without an exemption, operates outside the law even if it holds a valid FINTRAC registration.
The CSA has taken an accommodating but firm approach to crypto platforms seeking to operate in compliance. Several exchanges have entered into pre-registration undertakings (PRUs) with the CSA – commitments to operate within prescribed conditions while their full registration applications are processed. This pathway is available but demanding: it requires detailed disclosure of business operations, custody arrangements, and financial condition. A business that enters a PRU without adequate internal controls and disclosure infrastructure will find it extremely difficult to transition to full registration status.
The interaction also extends to stablecoins. A stablecoin that meets the definition of a security or a derivative – or, in some analyses, a deposit instrument – may require a different regulatory classification entirely. The CSA has specifically signalled concern about fiat-backed stablecoins offered to Canadian investors without proper disclosure. Any business with a stablecoin component to its product should take dedicated legal advice on the Canadian securities analysis before deploying in the market.
If a prior application stalled or a banking relationship was terminated, a second read of the structure often surfaces the underlying cause. To pressure-test your structure before you commit, message us via t.me/oboluslaw.
What Are the Banking and Payment-Rail Challenges for Canadian VASPs?
FINTRAC registration is a necessary but not sufficient condition for banking. Canada's chartered banks have applied de-risking policies to the digital-asset sector that are more restrictive than their regulatory obligations require, and obtaining a stable banking relationship remains the central operational bottleneck for most licensed VASPs in the country.
The practical picture is that domestic banks – including the major Schedule I institutions – routinely decline to open accounts for crypto businesses or terminate existing accounts on short notice. The businesses most likely to obtain stable banking are those that can demonstrate: a clean FINTRAC registration with no examination findings; a compliance program that has been independently reviewed; a clearly articulated product that does not involve high-risk jurisdictions; and, increasingly, a track record of LVICTR and STR filings that demonstrates active regulatory engagement rather than passive registration.
For foreign MSBs in particular, banking in Canada often runs through correspondent relationships rather than direct accounts. A non-resident entity registered as a foreign MSB may bank offshore – in a jurisdiction such as the AIFC in Kazakhstan, or through an EU-licensed entity under MiCA – and use payment processors to access the Canadian market. This structure introduces its own compliance considerations: each additional jurisdiction in the payment chain has its own AML/Travel Rule expectations, and the combined compliance burden can be substantial.
Credit unions in certain provinces have historically been more receptive to digital-asset businesses than the major banks, and some electronic money institutions (EMIs) operating under provincial licensing have provided payment services to the sector. The regulatory picture for these providers is itself evolving, and operators should confirm the current state of play before relying on a particular payment channel.
How Should a Cross-Border Business Structure Its Canadian Presence?
For a business sitting between an offshore hub and the Canadian market, the legal question turns on where the regulated activity occurs – not where the entity is incorporated. Canada's foreign MSB category makes this explicit: the nexus to Canadian regulation is the act of providing services to Canadian residents, not the domestic presence of the operator.
Several structural configurations are common in our practice. A business with an EU CASP authorisation under MiCA may seek to serve Canadian clients directly as a foreign MSB, relying on its EU authorisation to satisfy the compliance-program standard (with Canadian-specific adaptations). This is workable but requires careful mapping of the gaps: MiCA's Travel Rule implementation and FINTRAC's are aligned in principle but differ in operational detail.
An operator using a BVI or Cayman holding structure – common in the venture-backed exchange market – will typically need a separate Canadian-registered subsidiary or a clearly designated agent for FINTRAC purposes. The foreign MSB registration is not a substitute for a domestic entity where the business model requires a Canadian bank account or a Canadian payment processor relationship.
Where the business includes a securities-linked product, the most common structure is a separate regulated entity in a province with CSA registration or a PRU, sitting alongside the federal MSB registration. The two regulatory relationships operate in parallel and require parallel compliance infrastructure. Attempting to run both through a single compliance program without dedicated provincial-level disclosure and reporting is a common cause of examination findings.
Tax interacts with all of this. Canada's tax treatment of digital assets – including income from exchange operations, gains on proprietary positions, and GST/HST on service fees – is administered by the Canada Revenue Agency (CRA). The cross-border structuring that minimizes Canadian tax exposure can conflict with the entity presence needed to satisfy FINTRAC's foreign MSB requirements. These tensions are best resolved before committing to a structure, not after the first CRA inquiry.
A Recent Cross-Border Registration Matter
In a recent licensing matter, a payments company incorporated in a common-law offshore jurisdiction had been operating a crypto-to-fiat exchange accessible to Canadian users for over a year without FINTRAC registration. Its compliance program had been drafted for its home jurisdiction and did not address Travel Rule mechanics or LVICTR reporting obligations. We conducted a gap analysis against the PCMLTFA regime, rebuilt the compliance program to Canadian standard, managed the FINTRAC foreign MSB registration process, and assisted the client in establishing a correspondent banking relationship through a payment institution operating under provincial licensing. The registration was completed within a single quarter, and the business was able to retain its existing Canadian user base.
Which Operator Profile Fits Which Canadian Registration Path?
The right structure depends on the operator's profile. The following prose decision matrix reflects the patterns we see most frequently.
Profile A – Domestic startup building a Canadian exchange: A freshly incorporated Canadian company offering crypto-to-fiat exchange should register directly with FINTRAC as an MSB, simultaneously engage the CSA (or the relevant provincial regulator) if any token traded meets the securities threshold, and build a compliance program to FINTRAC examination standard before launch. The timeline to registration is typically a matter of weeks for a well-prepared applicant; the CSA PRU pathway adds several months of additional process. The key risk is underinvestment in the compliance program at the application stage, which delays registration and signals compliance immaturity to banking partners.
Profile B – Offshore-licensed exchange expanding into Canada: An operator already licensed under MiCA, the BVI FSC regime or the VARA rulebooks should register as a foreign MSB, mapping its existing compliance program to the Canadian-specific requirements. The offshore licence is not recognized as equivalent – it is evidence of compliance maturity, not a substitute for registration. The key risk is assuming that a well-developed offshore compliance posture satisfies FINTRAC without adaptation. It typically does not. Banking will likely need to run through correspondent channels initially.
Profile C – Institutional OTC desk with a Canadian institutional client base: A business conducting large virtual currency transfers for institutional counterparties is fully in scope, even at the institutional level. The Travel Rule obligations apply regardless of counterparty sophistication. The compliance program should be calibrated for high-value, lower-frequency transactions with enhanced due diligence. The timeline and process are the same as Profile A, but the risk profile – specifically the LVICTR filing obligations and the AML scrutiny attached to large transactions – is higher.
What Are the Most Common Mistakes in the Canadian VASP Application Process?
Operators entering the Canadian market repeat a recognizable set of errors. Awareness of them does not eliminate the risk, but it does reduce the probability of a preventable delay or enforcement action.
The first and most consistent mistake is submitting a compliance program that was drafted for a different jurisdiction without Canadian-specific adaptation. FINTRAC's compliance program requirements are detailed and specific: a generic AML policy drafted for VARA or the FCA will not satisfy the PCMLTFA standard without amendment. The examining officer will identify the gaps. The result is a return-to-applicant process that adds months to the timeline.
The second mistake is conflating federal registration with securities authorisation. An operator that registers with FINTRAC and begins trading securities-linked tokens without engaging the CSA or the relevant provincial regulator is not in compliance – it is in a different enforcement risk category. We have seen businesses receive CSA enforcement notices within weeks of completing their FINTRAC registration because they treated the two regimes as alternatives rather than cumulative requirements.
A common assumption is that an offshore licence provides global market access. It does not. Every major jurisdiction with a VASP regime – Canada, the UK under the FCA's MLR registration, Singapore under the MAS Payment Services Act, the EU under MiCA – imposes independent registration or authorisation obligations on businesses serving residents of that jurisdiction. An operator holding a single offshore registration and serving clients in multiple regulated markets is non-compliant in each of those markets.
The fourth mistake is delayed engagement with banking. The standard sequence is: build compliance program → submit FINTRAC registration → approach banks. The better sequence is: build compliance program → approach banks in parallel with FINTRAC submission → submit registration. Banks conduct their own due diligence independently of FINTRAC, and starting that process early reduces the gap between regulatory clearance and operational readiness.
Related at OBOLUS
- Licensing and Registration for Digital-Asset Businesses – our full-scope licensing service across 70+ jurisdictions, from first application to ongoing compliance management.
- VASP Licence Application in South Korea – a comparative jurisdiction guide for operators expanding into the Korean digital-asset market.
- MLRO and Compliance Officer Function in Brazil – the AML/CFT compliance officer requirements under Brazil's digital-asset framework.
FAQ
How long does a crypto licence take to obtain?
In Canada, FINTRAC MSB or foreign MSB registration typically takes several weeks for a well-prepared application – one with a complete compliance program, a named compliance officer and clean ownership documentation. Where documentation is incomplete or the compliance program requires revision, the process extends to several months. Provincial securities registration or a CSA pre-registration undertaking runs on a separate and generally longer timeline. Timelines vary materially based on application quality.
Which jurisdiction is best for licensing my crypto business?
There is no universal answer. The right jurisdiction depends on your user base, product type, banking needs and long-term operating model. Canada suits businesses with a North American institutional or retail client base that requires local market access. An EU CASP authorisation under MiCA suits businesses needing passportable access across the EEA. A VARA licence in Dubai suits businesses building a regional hub in the Middle East. Most international operators need more than one registration – the question is sequencing, not selection of a single answer.
Do I need a separate custody licence?
In Canada, custody of virtual assets for clients may bring the business within the scope of securities regulation if the assets held qualify as securities – in which case a custodian registration or exemption is required in addition to FINTRAC registration. The FINTRAC MSB registration does not cover custody as a regulated securities activity. Whether a dedicated custody layer is required depends on the assets held and the custody model. In most flagship jurisdictions, custody is a regulated activity that requires independent authorisation. Confirm the position under applicable Canadian and provincial law before offering custody services.
About OBOLUS
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance structures that sit around them. We map the licence stack across operating, custody and payment layers before you commit – so that the entity structure, the FINTRAC registration, the banking relationship and the tax position work as a single integrated system rather than a series of siloed applications. We also work alongside forensic partners to convert on-chain evidence into court-ready disclosure applications where recovery matters arise. Digital assets are the whole of our practice. To discuss your situation, contact info@oboluslaw.com.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in VASP registration across North American and Asia-Pacific digital-asset regimes.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.