FINTRAC MSB KYC requirements for crypto and payment firms (2026)

Last reviewed: 31 October 2026 · Not legal advice

FINTRAC MSB rules decide whether a crypto exchange, a stablecoin startup or a payments company can serve people in Canada. Registration comes first, then know your client (KYC) at fixed CAD thresholds, reports, the travel rule and ongoing monitoring under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA).^[1][3]

This guide reads the official FINTRAC, Bank of Canada and Department of Finance pages as of 31 October 2026, and ends with an onboarding flow and a checklist. For the identity methods themselves, read our pillar guide on FINTRAC identity verification in 2026.

FINTRAC MSB KYC requirements at a glance

FINTRAC MSB registration: who must register

FINTRAC treats dealing in virtual currency as an MSB service. It "includes both virtual currency exchange and virtual currency transfer services".^[1] Some payment businesses are caught too: FINTRAC says providers of "invoice payment services or payment services for goods and services are engaged in the business of remitting or transmitting funds or dealing in virtual currency."^[1]

A business without a place of business in Canada is a foreign MSB when it provides an MSB service, directs that service at persons or entities in Canada and provides it to clients in Canada.^[1] Directing services needs only one sign: marketing aimed at people in Canada, a ".ca" domain, or a listing in a Canadian business directory.^[1]

Simplified from FINTRAC's MSB guidance.

The application needs criminal record checks for listed individuals, issued no more than 6 months before you apply.^[2] Operating unregistered "may result in administrative monetary penalties or criminal charges".^[2] Regulations in force since 1 October 2025 strengthened the registration framework.^[13] In 2025-26 FINTRAC revoked 82 MSB registrations, up from 12 the year before, for failing to answer clarification requests or demands for information.^[21] FINTRAC says this information, including crypto wallet addresses, is crucial to its enforcement work.^[21]

FINTRAC registers MSBs; it does not license them. Quebec is different: Revenu Québec issues the licences MSBs "need to operate their businesses" under the province's Money-Services Businesses Act.^[28] Check with counsel whether you need it too.

Timeline: the dates that shaped MSB and crypto KYC

1. 1 June 2021Travel ruleGuidance for EFTs and virtual currency transfers in effect.^[6]
2. 8 September 2025RPAA dutiesRisk management and safeguarding in force.^[25]
3. 1 October 2025RegistrationStronger MSB registration framework.^[13]
4. 26 March 2026C-12, Stablecoin ActNew penalty regime; Stablecoin Act enacted.^[15][23]
5. 2027 (expected)StablecoinsFinance expects the framework in force.^[22]

When an MSB must verify identity: the CAD 1,000 and CAD 10,000 triggers

Amounts are in Canadian dollars, verified "when the transaction takes place"; the CAD 10,000 receipt trigger also follows the 24-hour rule.^[3] For virtual currency: "You must verify the identity of every person who requests that you exchange virtual currency for funds, funds for virtual currency, or one virtual currency for another, in an amount equivalent to $1,000 or more when the transaction takes place."^[3]

The second time an MSB must verify the same client, or when it signs a service agreement with an entity in Canada, it enters into a business relationship.^[1] Business relationships trigger ongoing monitoring; transaction records and transaction-based PEP checks have separate triggers.^[8][10][7]

How to verify a person remotely

For a client who is not physically present, you may use the government-issued photo identification method if you have "a process in place to authenticate" the document.^[4] Its example has two parts: technology that checks the document's security features, such as holograms, barcodes and embedded electronic chips, then a selfie compared by facial recognition plus a name match.^[4]

Section 2.1FINTRAC, Methods to verify the identity of persons and entities

"It is not enough to only view a person and their government-issued photo identification document through a video conference or another type of virtual application."

Source: FINTRAC, Methods to verify the identity of persons and entities^[4]

The credit file and dual-process methods are the alternatives, and an agent or mandatary can verify for you under a written agreement signed beforehand; you stay responsible.^[4] The FINTRAC identity verification guide walks through all five methods as a decision tree.

Large virtual currency transaction reports and the 24-hour rule

An MSB that receives virtual currency worth CAD 10,000 or more in a single transaction must file a large virtual currency transaction report (LVCTR) "within 5 working days after the day on which you receive the amount."^[5] The 24-hour rule adds up two or more amounts that total CAD 10,000 or more within a consecutive 24-hour window when you know they come from the same person or entity, are made on behalf of the same person or entity, or are for the same beneficiary.^[5]

Because "the Bank of Canada does not publish exchange rates for virtual currency", you use the exchange rate you set in the normal course of business, and your compliance policies must describe how you set it.^[5] Keep a record of each large virtual currency transaction and of virtual currency transfers of CAD 1,000 or more, and keep a copy of each report for at least 5 years.^[10]

The travel rule for virtual currency transfers

FINTRAC's travel rule guidance came into effect on 1 June 2021.^[6] MSBs and FMSBs "must include the travel rule information when they send VC transfers", and must take reasonable measures to make sure it is included when they receive virtual currency transfers that require a record.^[6] The information is the name, address and account or other reference number (if any) of the originator and of the beneficiary.^[6]

Simplified. The receiving side must take reasonable measures to obtain missing data.^[6]

When information is missing after reasonable measures, your written, risk-based policies "must address under which circumstances you allow, suspend or reject the transaction, and outline any follow-up measures you will take."^[6]

PEPs, beneficial owners and ongoing monitoring

MSBs must take reasonable measures to determine whether a person they enter into a business relationship with is a politically exposed person (PEP), a head of an international organization (HIO), a family member of one of those persons, or a close associate of a foreign PEP, repeat it periodically, and do it again when they detect a relevant fact.^[7] For a PEP or HIO, the guidance gives 30 days from the relationship or the fact to take reasonable measures to establish the source of wealth, if applicable.^[7]

When an MSB initiates or transfers CAD 100,000 or more for a foreign PEP, a family member or a close associate, it must take reasonable measures to establish the source of the funds or virtual currency and the source of the person's wealth, and a member of senior management must review the transaction.^[7] For entity clients, beneficial owners are the people who own or control 25% or more, and you must confirm what you collect with reasonable measures that "cannot be the same as the measures you used to obtain the information."^[9]

Ongoing monitoring must detect suspicious transactions, keep client and beneficial ownership information up to date and reassess risk.^[8] A suspicious transaction report (STR) has no monetary threshold and goes to FINTRAC "as soon as practicable" once you have reasonable grounds to suspect, including for attempted transactions.^[11][21]

Stablecoins: the Stablecoin Act and the securities regulators

The Stablecoin Act was enacted by the Budget 2025 Implementation Act, No. 1, which received royal assent on 26 March 2026.^[13][23] Its provisions come into force "on a day or days to be fixed by order of the Governor in Council", and the Department of Finance expects regulatory work over 12 to 18 months from early 2026, with the framework "coming into force in 2027".^[23][22]

Trading platforms already answer to provincial securities law. Under CSA Staff Notice 21-333, the Canadian Securities Administrators (CSA) set terms for value-referenced crypto assets (VRCAs), and after 31 December 2024 registered platforms, or those that gave a pre-registration undertaking (PRU), "can only offer VRCAs that comply with the conditions of their registration and exemptive relief decisions, or their PRUs."^[24] Check with your securities regulator for anything newer.

Payment providers: RPAA registration and safeguarding at the Bank of Canada

The RPAA is a separate regime run by the Bank of Canada. It covers payment service providers (PSPs) that perform payment functions for electronic funds transfers in Canadian or foreign currencies, "excluding digital currencies", including foreign PSPs that serve and direct activities at end users in Canada.^[25]

Check both: FINTRAC registration depends on your MSB services, RPAA registration on your payment activities and its exclusions.

Operating without having applied may breach section 104 of the RPAA, which the Bank calls "a serious violation", and the Bank can refuse or revoke registration based on information from FINTRAC.^[25]

Open banking is not live. The Consumer-Driven Banking Act received royal assent in March 2026; the regulations "required to bring the Act into force" were proposed on 27 June 2026, and RPAA-registered PSPs would be able to opt in.^[27] No launch date is given in the sources we read.

What FINTRAC penalties against crypto and payment firms found

FINTRAC publishes notices of its administrative monetary penalties. The notices below are named as FINTRAC published them; several are under appeal.

Three lessons repeat. FINTRAC determined that Peken Global Limited met the FMSB criteria despite its claim that it was not one; the company appealed.^[17] Declining a risky transaction is not the end of the job: MP Technology Services declined most of 261 attempted transactions because transaction monitoring flagged wallet addresses, but "no suspicious transaction report was submitted for the attempted transactions".^[19] And written controls must run in practice: at Necosmart, proof of address from the last three months "was not evidenced in the client file reviews", and documented crypto wallet scans were "not being carried out in practice".^[20]

In 2025-26 FINTRAC imposed penalties on nine MSBs for more than CAD 198 million.^[21] Bill C-12, which received royal assent on 26 March 2026, raises maximum penalties "up to 40 times current limits" for violations after that date, adds ability to pay as a factor, makes compliance agreements mandatory for prescribed violations and creates compliance orders.^[15][14] It also requires compliance programs to be "reasonably designed, risk-based and effective".^[13]

An onboarding flow for a stablecoin, crypto or payments startup

The flow below assumes you verify every client at sign-up rather than waiting for the CAD 1,000 trigger.

A product view of the obligations. Your risk assessment sets the details.

For entity clients, add a business check: registry record, directors and owners at 25% or more, confirmed by a separate measure.^[9] For thin-file clients, see our guide to non-document verification in Canada. Selfies collected in Quebec raise extra duties, covered in Quebec Law 25 and biometrics; for age-gated products, see age verification in Canada.

A checklist for this month

• Map every service you offer against FINTRAC's MSB service list, including payment and invoice services.^[1]
• Confirm your FINTRAC registration and its expiry: a registration is valid for two years.^[45]
• Test 24-hour aggregation across wallets and accounts for the same conductor, third party or beneficiary.^[5]
• Set the travel rule policy for allow, suspend or reject.^[6]
• Run PEP determinations at each new business relationship, periodically and on new facts.^[7]
• Route every declined risky attempt to an STR review.^[11][19]
• Compare your enhanced due diligence policy with what analysts actually do.^[20]
• Check whether you also need RPAA registration and a safeguarding framework.^[25]

How Didit helps MSBs, crypto platforms and payment providers

Didit's AML screening can run as a step of the same verification session as identity checks, next to transaction monitoring. Didit supports your program; it does not replace your compliance officer, policies or reports.

• ID verification authenticates government-issued documents and checks them for tampering, across 220+ countries and territories; liveness and a 1:1 face match confirm the person; near-field communication (NFC) reads e-passport and eID chips.^{[30][31][32][33]} Together these map to the government-issued photo ID method as FINTRAC describes it for remote clients.^[4]
• For Canada, the docs describe a credit-bureau check that "Verifies input data against Credit Header data obtained from a Credit Bureau in Canada and responds with data sufficient to meet FINTRAC requirements"; an agency application is required.^[29]
• AML screening covers 1,300+ sanctions, PEP and watchlist sources plus adverse media, with daily re-screening.^[34]
• Transaction monitoring scores transactions with configurable rules, screens crypto wallets, groups alerts into cases and runs travel rule data exchange with other virtual asset service providers.^{[35][36][38][37]} Your team files the reports.
• Business verification searches Canadian registries such as Corporations Canada and the Registraire des entreprises du Québec; questionnaire templates cover source of funds.^[39][40]
• Retention runs from 1 month to 10 years; data is stored in the EU by default, with in-country processing on request for Enterprise, subject to availability.^[41][42] The flow runs in French.^[44] Certifications: SOC 2 Type 1 and Type 2, ISO/IEC 27001, iBeta Level 1.^[43]

Frequently asked questions

Sources

1. Money services businesses (MSBs), FINTRAC, modified 1 October 2025.
2. Register your money services business (MSB) or your foreign money services business (FMSB), FINTRAC, modified 27 August 2026.
3. When to verify the identity of persons and entities: money services businesses and foreign money services businesses, FINTRAC, modified 9 September 2025.
4. Methods to verify the identity of persons and entities, FINTRAC, modified 3 December 2024.
5. Reporting large virtual currency transactions to FINTRAC, FINTRAC, modified 8 April 2024.
6. Travel rule for electronic funds and virtual currency transfers, FINTRAC, modified 27 April 2022.
7. Politically exposed persons and heads of international organizations guidance for non-account-based reporting entities, FINTRAC, modified 10 July 2025.
8. Ongoing monitoring requirements, FINTRAC, modified 17 February 2021.
9. Beneficial ownership requirements, FINTRAC, modified 30 July 2026.
10. Record keeping requirements for money services businesses, FINTRAC, modified 9 September 2025.
11. Reporting suspicious transactions to FINTRAC, FINTRAC, modified 22 May 2025.
12. Compliance program requirements, FINTRAC, modified 11 October 2024.
13. Modernization and upcoming changes impacting reporting entities, FINTRAC, modified 13 April 2026.
14. Administrative monetary penalties: changes following legislative amendments, FINTRAC, modified 6 May 2026.
15. Bill C-12, Strengthening Canada's Immigration System and Borders Act, LEGISinfo, Parliament of Canada, royal assent 26 March 2026.
16. Administrative monetary penalty on Xeltox Enterprises Ltd., FINTRAC, 22 October 2025.
17. Administrative monetary penalty on Peken Global Limited, FINTRAC, 25 September 2025.
18. Administrative monetary penalty imposed on Binance Holdings Limited, FINTRAC, 9 May 2024.
19. Administrative monetary penalty on MP Technology Services Ltd., FINTRAC, 18 December 2025.
20. Administrative monetary penalty on 13010431 Canada Inc., FINTRAC, 14 May 2026.
21. FINTRAC Annual Report 2025-26, FINTRAC, modified 26 October 2026.
22. Canada's Stablecoin Framework, Department of Finance Canada, modified 31 March 2026.
23. Budget 2025 Implementation Act, No. 1, S.C. 2026, c. 3, Division 45: Stablecoin Act, Justice Laws Website, modified 15 October 2026.
24. CSA provides update to crypto asset trading platforms about value-referenced crypto assets, Canadian Securities Administrators.
25. Retail payments supervisory framework, Bank of Canada, read 31 October 2026.
26. Frequently asked questions about retail payments supervision, Bank of Canada, August 2026.
27. Consumer-Driven Banking Regulations (proposed), Canada Gazette, Part I, 27 June 2026.
28. Revenu Québec's role and responsibilities with regard to money-services businesses, Revenu Québec, read 31 October 2026.
29. Canada Credit Bureau (FINTRAC) verification, Didit documentation.
30. ID verification overview, Didit documentation.
31. Liveness detection, Didit documentation.
32. Face match (1:1), Didit documentation.
33. NFC verification, Didit documentation.
34. AML screening, Didit documentation.
35. Transaction monitoring overview, Didit documentation.
36. Crypto and wallet screening, Didit documentation.
37. Travel rule, Didit documentation.
38. Alerts and cases, Didit documentation.
39. Business registry sources, Didit documentation.
40. Questionnaires, Didit documentation.
41. Data retention, Didit documentation.
42. Security and compliance, Didit documentation.
43. Certifications, Didit documentation.
44. Supported languages, Didit documentation.
45. Answer clarification requests, update, renew or cancel your registration, FINTRAC, modified 27 August 2026.

See the AML screening page, read about identity verification in Canada, check database validation and ID verification, or see current prices on the pricing page.