If you’re building a remittance, foreign exchange, crypto, or payments business in Canada, you’ll soon search for “MSB license.” The first thing to know is that Canada doesn’t issue a federal license the way many US states do. It has a registration regime run by FINTRAC, the Financial Transactions and Reports Analysis Centre of Canada. In practice the two are treated alike, because operating without registration is a serious offence.

This guide covers what you need to register, what you must maintain afterward, and what has changed recently.

1. Are You a Money Services Business?

Under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA), a business is an MSB if it provides one or more of these services to the public:

• Foreign exchange dealing

• Money transferring (domestic or international remittance)

• Dealing in virtual currency (crypto exchange and transfer services)

• Issuing or redeeming money orders, traveler’s cheques, or similar instruments

• Crowdfunding platform services

• Armored car services (cash collection and delivery)

Foreign MSBs count too. If you’re based outside Canada but direct these services at people in Canada, you must register as a foreign MSB.

2. The Registration Basics

• Registration is with FINTRAC and carries no fee. MSB registration is free and renews every two years.

• Registration is national. One FINTRAC registration covers Canada. There is no state-by-state patchwork.

• Quebec is the exception. In Quebec, the AMF also regulates MSBs. Businesses operating there need to look at the Autorité des marchés financiers’ separate requirements.

• You must register before you operate. Offering MSB services while unregistered is a criminal offence.

What FINTRAC will ask for

Expect to provide:

• Legal and operating names, addresses, and details of every location and website

• Identification and background information on directors, officers, owners, and anyone with significant control

• Your services, including which ones you offer in Canada

• Your banking relationships and, if applicable, your agents and mandataries

• Details of your compliance officer

Who can’t register?

FINTRAC can refuse or revoke registration where key individuals have been convicted of certain offences, including those involving money laundering, terrorist financing, fraud, and drug trafficking. Screen your leadership and owners before you apply.

3. The Five-Pillar Compliance Program

This is where most of the work lies. Every MSB must maintain a written, risk-based compliance program with these elements:

1. A designated compliance officers. A named person with real authority and the knowledge to run the program.

2. Written policies and procedures. They must be kept up to date and approved by senior management.

3. A documented risk assessment. It should cover your clients, products and services, delivery channels, geographies, and new technologies.

4. An ongoing compliance training program. It must include a written plan and cover employees, agents, and anyone acting on your behalf.

5. A two-year effectiveness reviews. This must be an independent review of your policies, risk assessment, and training, carried out at least every two years.

Treat the program as a living system. FINTRAC examines documentation closely, and a program that exists only on paper fails examinations.

4. Day-to-Day Obligations

Know Your Client (KYC)

You must verify identity using the methods FINTRAC allows (government-issued photo ID, credit file, dual-process, reliance, and others). Third-party determination, beneficial ownership, and politically exposed person (PEP) checks apply in defined circumstances.

Reporting

Core reports include:

• Suspicious Transaction Reports (STRs). These are required where there are reasonable grounds to suspect a transaction relates to money laundering or terrorist financing. They must be filed as soon as practicable once that threshold is met.

• Large Cash Transaction Reports. These cover cash of CAD 10,000 or more.

• Large Virtual Currency Transaction Reports. These apply at the same threshold for virtual currency.

• International Electronic Funds Transfer Reports. These apply to international transfers of CAD 10,000 or more.

• Terrorist Property Reports and listed-person or sanctions-related reports.

The 24-hour rule and its aggregation requirements catch many MSBs out, so build automated monitoring around them.

The Travel Rule

When you send or receive qualifying transfers, including virtual currency transfers, you must collect and pass along required originator and beneficiary information.

Record Keeping

Keep records of transactions, identification, and your compliance program, generally for at least five years, in a form that lets you give them to FINTRAC within the required time.

Ministerial Directives

Canada’s Minister of Finance can issue directives on high-risk jurisdictions. Your controls must be able to apply these quickly.

5. Staying Registered

Registration isn’t a one-off event. Two obligations catch businesses out:

• Notify FINTRAC of changes. MSBs must update their registration within 30 days when information changes, such as legal name, new locations, agent details, or the services offered.

• Renew on time. Missed renewals are one way a registration lapse.

The enforcement data shows why these matters. A recent analysis of FINTRAC penalties found that 13 of 25 penalized MSBs (52 percent) had registration-related violations, which makes registration upkeep one of the most common weak spots. FINTRAC can also cancel registrations where an MSB no longer meets eligibility requirements, including maintaining a compliant program.

6. What’s Changed: The 2026 Reforms

Penalties are much higher

On March 26, 2026, the Strengthening Canada’s Immigration System and Borders Act (Bill C-12) received Royal Assent, amending the PCMLTFA and its administrative monetary penalties regulations. Among other things, Bill C-12 increases the administrative monetary penalties FINTRAC may impose by a factor of forty. The amendments also create a new violation for contravening a compliance order. FINTRAC is updating its penalties policy and guidance.

Higher expectations for compliance programs

Commentators expect the reforms to give FINTRAC more room to judge whether a program is effective, not only whether it ticks the regulatory boxes. Treat your risk assessment and effectiveness review as the evidence you’ll rely on in an examination.

Universal enrolment is coming for other sectors

Other reporting entities will have to enroll with FINTRAC, but domestic and foreign MSBs that already register is exempt. MSBs are already registered, but this signals a broader tightening of the regime. FINTRAC published a roadmap on April 13, 2026, setting out when the legislative and regulatory changes will apply. Check it for timing.

Stable coins

Some commentators note that stable coin issuers will face a FINTRAC MSB registration requirement. If you issue or handle stable coins, track this closely.

7. The Second Regime: The Bank of Canada and the RPAA

Many MSBs overlook this. The Retail Payment Activities Act (RPAA) sits alongside the PCMLTFA and is a separate regime run by the Bank of Canada.

• Payment service providers (PSPs) must register with the Bank of Canada before performing retail payment activities. That applies to foreign PSPs that direct activities at people in Canada.

• As of September 8, 2025, PSPs must have established risk management and funds safeguarding frameworks.

• The Bank of Canada also supervises ongoing reporting. It has issued reminders on PSP reporting obligations and announced it will begin publishing notices of violation.

FINTRAC’s regime is about financial crime. The RPAA is about operational risk and safeguarding end-user funds. A payments MSB may need both, so don’t assume one covers the other.

8. Your Pre-Launch Checklist

☐ Confirm which MSB activities you perform, and whether the RPAA also applies

☐ Screen directors, officers, and owners for eligibility

☐ Appoint a qualified compliance officer

☐ Write the policies and procedures, risk assessment, and training plan

☐ Set up KYC, transaction monitoring, and reporting workflows

☐ Prepare record-keeping and Travel Rule processes

☐ File your FINTRAC registration (and Quebec/AMF or Bank of Canada applications as needed)

☐ Diarize renewal, the 30-day change notifications, and the two-year effectiveness review

Final Thoughts

Getting registered is the easy part. The harder part is running a defensible program every day, with evidence to show for it, as penalties rise and FINTRAC expects more. Businesses that automate monitoring, reporting, and recordkeeping from the start spend less time on audits and more time growing.