VASP licensing in Canada: Legal Requirements for Businesses
Operating a virtual asset business in Canada without completing the mandatory registration exposes the business to enforcement action, account closures and the loss of payment-rail access at precisely the moment the business needs them most. Canada's federal anti-money-laundering regime – administered by the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) – requires any entity that qualifies as a money services business (MSB) dealing in virtual currencies to register before conducting regulated activity. That registration obligation applies whether the business is incorporated in Canada or is a foreign entity serving Canadian residents from abroad. This page sets out who must register, how the process works, where cross-border complexity compounds the analysis, and the decision points an inbound operator must resolve before go-live.
Who Must Register as a VASP in Canada?
Any business that deals in virtual currency – buying, selling, exchanging or transferring digital assets for clients – is a virtual currency dealing (VCD) activity under Canada's Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) regime, and the entity conducting it must register as an MSB with FINTRAC. The definition is deliberately broad. It covers exchanges, OTC desks, payment processors routing crypto, and platforms that facilitate peer-to-peer transfers. Stablecoin issuers and custodians fall within scope where they perform transfer or exchange functions. Foreign businesses that direct services at Canadian residents are also caught; FINTRAC treats a foreign MSB (FMSB) as a distinct registration category with its own compliance obligations.
Operators sometimes assume that a corporate entity registered in a tax-efficient offshore jurisdiction is sufficient. It is not. The regulatory trigger is the customer's location, not the legal domicile of the entity. An exchange incorporated in the British Virgin Islands, serving Canadian retail accounts, must hold a FINTRAC MSB registration regardless of where the server sits or where profits are booked.
The categories of businesses most frequently caught by the regime include: crypto-to-fiat and crypto-to-crypto exchanges; OTC brokers dealing in virtual currency; wallet providers with transfer functionality; crypto payment processors; and any platform that facilitates the issuance or redemption of stablecoins backed by fiat reserves.
What Is the Regulatory Framework Governing VASPs in Canada?
Canada's VASP registration regime sits under the PCMLTFA and its accompanying regulations, with FINTRAC as the registrar and supervisor. FINTRAC does not issue a "crypto licence" in the traditional sense; it issues an MSB registration that triggers an ongoing set of compliance obligations. Those obligations are substantive. A registered MSB must implement a compliance program, appoint a compliance officer, conduct know-your-client (KYC) procedures, file suspicious transaction reports, apply transaction monitoring, and retain records for the prescribed period. The Travel Rule – the obligation to transmit originator and beneficiary data alongside a transfer – applies to virtual currency transfers above the applicable threshold, aligned with FATF Recommendation 15.
Beyond FINTRAC, operators must also consider the provincial securities layer. The Canadian Securities Administrators (CSA) have made clear that trading platforms dealing in crypto assets that qualify as securities or derivatives must register with the relevant provincial securities regulator. Several large exchanges operating in Canada have entered into pre-registration undertakings with provincial regulators, agreeing to abide by investor-protection conditions while their full registration applications are processed. An operator whose token suite includes instruments that could be characterised as securities faces a layered regulatory burden: FINTRAC at the federal AML level, and provincial securities law on top.
For businesses that also issue, manage or transfer electronic money or payment instruments, federal oversight under the Bank Act and the Retail Payment Activities Act (RPAA) regime – administered by the Bank of Canada for retail payment service providers – adds a further dimension. Operators running stablecoin payment flows or acting as payment processors should assess whether the RPAA framework applies independently of the FINTRAC MSB requirement.
Contact OBOLUS to map your regulatory obligations across the federal and provincial layers before you register. The process above describes the baseline path. Your specific fact pattern – the asset types you list, the clients you serve, the payment flows you operate – changes the analysis materially. Reach us at info@oboluslaw.com or via Telegram at t.me/oboluslaw.
How Does the FINTRAC MSB Registration Process Work?
The FINTRAC MSB registration is completed through FINTRAC's online portal, and the process is more demanding in substance than its administrative appearance suggests. The application requires the business to identify all principals and beneficial owners, describe its business activities in precise regulatory terms, identify the jurisdictions in which it operates, and confirm the existence of a documented compliance program. FINTRAC conducts a fit-and-proper assessment of the principals; undisclosed adverse regulatory or criminal history is a material risk to the application.
Once submitted, registration is generally confirmed within a matter of weeks for straightforward applications. Complex structures – those involving layered holding entities, multiple jurisdictions, or activities that straddle the VCD and payment-services categories – take longer to process. Registration does not lapse automatically; however, a registered MSB must notify FINTRAC of material changes to its business, ownership or principals, and failure to do so is itself a compliance breach.
The compliance program required at registration is not a formality. FINTRAC conducts examinations – both announced and unannounced – and has issued substantial administrative monetary penalties (AMPs) to registered MSBs that maintained deficient programs. An AML program must include a written compliance policy, an internal compliance officer, a risk assessment, an ongoing training program, and an effectiveness review conducted at a prescribed frequency. For a virtual-currency dealing business, the risk assessment must address the specific risks posed by pseudonymous transactions, high-velocity transfers and the global reach of digital-asset activity.
Foreign MSBs (FMSBs) – entities incorporated outside Canada that serve Canadian clients – register in the same portal but must identify a Canadian contact for FINTRAC communications. The substantive compliance obligations mirror those of domestic registrants. FMSBs are examined in the same manner and are subject to the same penalty regime. Operating as an FMSB without registration, or ceasing to serve Canadian clients without deregistering, each carry enforcement risk.
What Do Crypto Exchanges Need to Know About Provincial Securities Law?
Canada's securities regulation is provincial, not federal, which means an exchange operating nationally is effectively regulated by thirteen different provincial and territorial securities commissions – with the CSA coordinating policy across them. The CSA's guidance on crypto trading platforms takes the position that where a platform offers contracts for crypto assets that are not delivered immediately to the client's own wallet, those contracts may constitute securities or derivatives regardless of the underlying asset's intrinsic character.
That analysis has practical consequences. A platform that holds client crypto assets in omnibus wallets – as most retail exchanges do – is likely offering a form of securities dealing or investment contract. The CSA's framework requires such platforms to apply for registration in the category appropriate to their activities: typically as a restricted dealer or investment dealer, depending on the scope of services offered. Several platforms have sought and received restricted dealer registration; others operate under interim terms while their applications proceed.
For an inbound operator – a business incorporated outside Canada that wishes to access the Canadian market – the provincial registration question is often more consequential than the FINTRAC registration. A foreign entity that is already regulated by a recognised overseas regulator may be able to seek exemptive relief from provincial registration requirements, but relief is not automatic and the criteria are narrow. The analysis turns on the regulatory quality of the home jurisdiction, the nature of the Canadian client base, and the assets traded.
In our cross-border practice, we regularly advise exchanges entering Canada on structuring the registration sequence: FINTRAC first, then the provincial registration strategy, then the banking approach – in that order, because Canadian banks conduct their own regulatory due diligence before opening MSB accounts and will not onboard an entity whose regulatory status is unresolved.
Why Is Canadian Banking the Practical Bottleneck for VASPs?
Regulatory registration does not guarantee banking access. Canadian chartered banks apply their own risk appetite to MSB account applications, and the appetite for crypto-native businesses among the major domestic banks has historically been limited. A FINTRAC registration demonstrates baseline regulatory compliance; it does not, by itself, satisfy a bank's enhanced due diligence requirements for MSB clients. The bank will typically require sight of the full compliance program, the AML risk assessment, the KYC procedures, the customer base profile, transaction volume projections and the beneficial ownership structure of the applicant entity.
Businesses that have structured their holding company in a low-tax offshore jurisdiction – a common arrangement for international exchanges – face particular scrutiny. Canadian banks' correspondent banking relationships with US institutions mean that US Bank Secrecy Act compliance risk flows back through the Canadian bank's own exposure. An MSB whose ultimate beneficial owner is located in a jurisdiction on a financial action task force (FATF) grey list, or whose transaction flows involve high-risk counterparties, will find the banking conversation correspondingly difficult.
Operators we advise routinely approach the banking question in parallel with the regulatory application, not after it. The preparation for a bank's due diligence and the preparation for FINTRAC registration draw on substantially overlapping documentation. Running both tracks simultaneously compresses the overall timeline to go-live.
Payment processors – entities that provide fiat on-ramp and off-ramp services to exchanges – add a further layer. Canada's RPAA regime, which came into force in stages beginning in 2024, requires retail payment service providers that process electronic funds transfers to register with the Bank of Canada. An exchange that routes fiat payments through its own payment infrastructure, rather than through a bank or licensed third-party processor, may itself be caught by the RPAA framework alongside its FINTRAC MSB registration.
How Should an Inbound Operator Structure Its Canadian Entry?
For a business entering Canada from an established licensing hub – the UAE, Singapore, the EU or Switzerland – the structural question is whether to establish a Canadian legal entity or to serve the market as a foreign MSB. Each approach carries different regulatory, tax and banking implications.
A Canadian subsidiary provides a cleaner banking narrative and a clearer regulatory hook, but it also establishes a full Canadian corporate-tax presence. Canada taxes corporations on their worldwide income if they are deemed resident in Canada; a subsidiary incorporated in Canada is automatically resident. The interaction between Canadian corporate tax, the thin-capitalisation rules applicable to foreign-owned Canadian entities, and withholding tax on dividends repatriated to the parent is a structuring question that must be resolved before the entity is incorporated, not after.
A foreign MSB registration avoids the Canadian corporate-tax presence but limits the banking options and may complicate the provincial securities registration path. It is also a weaker structural position if the business later seeks to grow its Canadian user base significantly. Regulators and banks treat a committed Canadian entity differently from a foreign registrant that has not embedded itself in the local regulatory ecosystem.
The decision matrix for most operators looks like this. An exchange with a primarily international user base that is adding Canada as one of several markets will typically start with a foreign MSB registration and a limited Canadian banking relationship, then reassess after demonstrating revenue. An operator whose strategic plan centres on the Canadian market – or whose investor base includes Canadian institutional money – will nearly always be better served by establishing a Canadian entity early, managing the tax structure carefully, and building the regulatory relationship with the substantive presence that Canadian regulators expect.
In a recent matter, a payments-technology business incorporated in a European licensing hub sought to extend its stablecoin transfer product into Canada. We mapped the FINTRAC MSB registration, the potential RPAA registration for the payment processing function, and the provincial securities analysis for the stablecoin instrument itself – across three regulators. The business launched in Canada within a commercially viable timeframe, having resolved the regulatory sequencing and prepared the banking documentation in parallel. The key issue that nearly derailed the timeline was an incomplete beneficial ownership disclosure in the initial FINTRAC filing; correcting it required a structured re-submission and direct engagement with the supervisor.
If your Canadian market entry is already in motion, or if a prior registration attempt stalled, contact OBOLUS for a structured second review. A second read of the file often identifies the structural issue that caused the delay. Write to us at info@oboluslaw.com.
What Are the Ongoing AML and Travel Rule Obligations After Registration?
Registration is the beginning of the regulatory relationship with FINTRAC, not the end of it. The ongoing compliance obligations are demanding and are enforced through a structured examination program. FINTRAC publishes its examination methodology and expects MSBs to conduct their own self-assessment against published guidance before an examination occurs. An MSB that has not updated its compliance program since registration – treating the initial filing as a one-time exercise – is a high-risk examination candidate.
The Travel Rule applies in Canada to virtual currency transfers. A registered MSB that transfers virtual currency on behalf of a client must collect and transmit the originator's and beneficiary's identifying information to the receiving institution where the transfer meets or exceeds the applicable threshold. Implementation requires a technical solution: either a proprietary messaging layer or a third-party Travel Rule compliance platform integrated with the MSB's transaction processing infrastructure. The choice of technology and its integration with FINTRAC's reporting obligations is an operational-legal question, not purely a systems question.
Suspicious transaction reporting (STR) obligations are a further live compliance pressure. FINTRAC's guidance on the indicators of suspicious activity in virtual currency contexts is detailed and has expanded significantly as the agency's understanding of on-chain risk has matured. An MSB that applies legacy fiat-era STR typologies to its crypto activity is likely under-reporting. FINTRAC has found, in published examination findings, that inadequate STR practices are one of the most common deficiencies among virtual-currency MSBs.
Record retention, currency transaction reporting for cash transactions above the relevant threshold, and large virtual currency transaction reporting each carry independent timelines and formatting requirements. For a business operating at scale, the compliance burden is substantial and requires dedicated compliance resource – either in-house or through a specialist external provider.
A Common Assumption About Offshore Licences Serving Canada
A persistent assumption among founders entering the Canadian market is that a licence or registration in an established offshore centre – the British Virgin Islands, Cayman Islands or a comparable offshore regime – is sufficient to serve Canadian clients without a FINTRAC registration. That assumption is incorrect. FINTRAC's registration requirement is triggered by the provision of regulated services to persons in Canada, regardless of the legal domicile of the entity providing them. An operator without a FINTRAC MSB registration that is serving Canadian clients is not a licensed or registered business in Canada – it is an unregistered business conducting regulated activity, which is an enforcement risk.
An offshore licence or registration is a compliance asset. It demonstrates to FINTRAC, to Canadian banks and to provincial securities regulators that the business operates within a regulated environment and has passed a fit-and-proper assessment. But it is a complement to Canadian registration, not a substitute for it. The businesses we advise that have misunderstood this point have typically incurred avoidable remediation costs and lost banking relationships that were difficult to restore.
We have also seen operators assume that a US FinCEN MSB registration covers the Canadian market. It does not. FinCEN registration addresses US anti-money-laundering obligations; it has no legal effect on Canada's PCMLTFA regime. A business serving both US and Canadian clients needs separate registrations in both jurisdictions, and the compliance program for each must address the specific requirements of its respective regulator.
Related at OBOLUS
- Licensing and Registration for Digital Asset Businesses – end-to-end licensing counsel across more than seventy jurisdictions for exchanges, custodians and issuers
- Crypto Exchange Setup in the Isle of Man – how a common-law offshore hub compares for exchange licensing and banking access
- Tax Treatment of Tokens: Legal Counsel for Digital Asset Firms – structuring the tax position of token issuers, exchanges and funds across jurisdictions
FAQ
How long does a crypto licence take to obtain?
The FINTRAC MSB registration itself is confirmed within a matter of weeks once a complete application is submitted. More complex situations – those requiring provincial securities registration, resolution of beneficial ownership disclosure issues, or parallel banking diligence – extend the overall go-live timeline materially. In our practice, operators who prepare all compliance documentation before filing consistently achieve faster confirmation than those who complete the filing first and prepare documentation later.
Which jurisdiction is best for licensing my crypto business?
There is no single best jurisdiction. The right licensing structure depends on where your clients are located, what assets you offer, your banking relationships and your tax position. Canada's FINTRAC regime is a mandatory baseline for Canadian-market access, not an alternative to other registrations. Operators serving multiple markets typically hold registrations in Canada, the EU under MiCA, and one or more additional hubs. We map the full licence stack – operating, custody and payment layers – across all relevant jurisdictions before a client commits to a structure.
Do I need a separate custody licence?
In Canada, custody of virtual assets is not separately licensed in the same way as exchange or transfer activity under the FINTRAC regime. However, if a platform holds client assets in a way that constitutes the provision of securities or investment services under provincial law, a provincial securities registration may be required in addition to the federal MSB registration. Custody as a standalone regulated activity is a developing area across Canadian provincial frameworks, and the analysis turns on the precise nature of the assets held and the rights granted to clients.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions – including the FINTRAC MSB registration, provincial securities compliance and the cross-border structuring decisions that sit around them. We also advise on disputes, on-chain asset recovery across 25+ forums, and the tax and banking considerations that every digital-asset business must resolve before go-live. Digital assets are the whole of our practice. Operators we advise regularly tell us that mapping the licence stack before commitment – across operating, custody and payment layers – averted structural problems that would have been costly to correct later. To discuss your Canadian market entry or your cross-border compliance stack, contact us at info@oboluslaw.com or via Telegram at t.me/oboluslaw.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in regulatory entry strategies for digital-asset businesses across the major licensing hubs, including Canada's federal and provincial registration frameworks.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.