MSB Registration · RPAA · AML Compliance Programs

Payments, MSB and Anti-Money Laundering Legal Services

FINTRAC, Bank of Canada RPAA and PCMLTFA compliance

We help payment service providers, money services businesses, virtual currency dealers and fintech companies enter and operate in Canada: identifying every registration that applies, building AML programs that hold up in examinations, and responding when regulators ask questions.

Practice
MSB and foreign MSB registration · RPAA registration · AML compliance programs · Examination response
Clients
Payment service providers · MSBs · Virtual currency dealers · Fintech and crowdfunding platforms
Regulators
FINTRAC · Bank of Canada · AMF (Québec)
Legislation
PCMLTFA · Retail Payment Activities Act · Québec Money-Services Businesses Act
Language
English, French and Mandarin Chinese throughout
Contents
  1. Our focus
  2. Who needs to register
  3. FINTRAC MSB registration
  4. Retail Payment Activities Act
  5. Anti-money laundering compliance program
  6. Payment processors and banking
  7. Examinations and enforcement
  8. Find guidance for your situation
  9. Our process and timeline
  10. Frequently asked questions
  11. Book a compliance assessment
§ 01

Our focus

Canadian payment businesses can answer to several regulators at once. We map the obligations, build the program and stay with you through examinations and growth.

01 · REGISTRATION

MSB and foreign MSB registration

FINTRAC registration for domestic and foreign money services businesses, including virtual currency dealers.

02 · RPAA

Retail payment activities

Bank of Canada registration, risk management, incident response and safeguarding of end-user funds.

03 · AML PROGRAM

Compliance programs

Policies, risk assessment, compliance officer, training and two-year effectiveness reviews.

04 · ENFORCEMENT

Examinations and penalties

FINTRAC and AMF examinations, notices of violation, reviews and remediation plans.

§ 02

Who needs to register

Does my business need to register?

If you exchange currency, move funds, issue or redeem money orders, deal in virtual currency, run a crowdfunding platform or transport currency for others, you likely need FINTRAC registration. If you hold funds or process electronic payments for end users in Canada, the RPAA may also apply. Operating in Québec adds a provincial licence.

FINTRAC · MSB

Foreign exchange dealing

Buying or selling currency for clients, in person or online.

FINTRAC · MSB

Remitting or transmitting funds

Money transfer, remittance and payment services that move funds between people or businesses.

FINTRAC · MSB

Money orders and traveller's cheques

Issuing or redeeming money orders, traveller's cheques or similar negotiable instruments.

FINTRAC · MSB

Dealing in virtual currency

Exchanges, brokers, transfer services and virtual currency ATM operators.

FINTRAC · MSB

Crowdfunding platforms

Platform services for crowdfunding, added to the MSB regime in April 2022.

FINTRAC · MSB

Armoured car services

Transporting currency, money orders or similar instruments, also added in April 2022.

Bank of Canada · RPAA

Payment service providers

Businesses performing payment functions for end users in Canada: holding funds, initiating, authorising, clearing or settling electronic funds transfers.

AMF · Québec

Québec money-services businesses

Currency exchange, funds transfer, money orders and traveller's cheques, cheque cashing and ATM operation in Québec require a provincial licence.

FINTRAC · FMSB

Foreign MSBs serving Canada

Businesses outside Canada that direct MSB services at people or entities in Canada must register as foreign MSBs.

§ 03

FINTRAC MSB registration

Registration is with FINTRAC under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act. Domestic and foreign businesses follow different paths, and Québec adds its own regime.

ComparisonMSBForeign MSBQuébec licence
WhoBusinesses with a place of business in Canada.Businesses outside Canada directing services at people or entities in Canada.Businesses offering money services in Québec.
RegulatorFINTRACFINTRACAutorité des marchés financiers
Key requirementsCanadian address, compliance program, reporting and record keeping.Same program obligations, plus an agent for service in Canada.Background checks on owners and key people; licence by category of service.
TimingAbout 3–6 weeks after a complete filing.About 3–6 weeks after a complete filing.Typically 6–9 months.
RenewalEvery two years; changes reported within 30 days.Every two years; changes reported within 30 days.Ongoing licence conditions and renewals.
Registration requirements

Registration requires information on the business, its ownership, the services offered, agents and banking relationships. There is no minimum capital requirement, and foreign nationals can own and direct the business. Certain criminal convictions make a person ineligible.

  • PCMLTFA
  • MSB / FMSB
  • NO MINIMUM CAPITAL
Québec dual licensing

Businesses serving Québec need a separate licence from the AMF under the Money-Services Businesses Act, in addition to FINTRAC registration. Plan for a longer review and background checks on owners, directors and key people.

  • AMF
  • QUÉBEC MSB ACT
Ministerial directives and sanctions

MSBs must apply enhanced measures to transactions linked to jurisdictions named in ministerial directives, and screen customers and transactions against Canadian sanctions lists.

  • MINISTERIAL DIRECTIVES
  • SANCTIONS SCREENING
Changes and renewals

Report changes to registration information within 30 days and renew registration every two years. We maintain a calendar so renewals are not missed.

  • 30-DAY NOTICE
  • TWO-YEAR RENEWAL
§ 04

Retail Payment Activities Act

Who must register with the Bank of Canada?

Payment service providers that perform payment functions for end users in Canada, including foreign providers that serve Canadian end users. Registration opened in November 2024, and the risk management, incident response and safeguarding obligations apply from September 2025.

Are you a payment service provider?

The Act lists five payment functions:

  • Providing or maintaining an account for an end user.
  • Holding funds on behalf of an end user.
  • Initiating an electronic funds transfer at an end user's request.
  • Authorising or transmitting an electronic funds transfer.
  • Clearing or settling an electronic funds transfer.

Some entities and incidental activities are excluded, so each business model needs its own analysis.

  • PAYMENT FUNCTIONS
  • EXCLUSIONS
Registration with the Bank of Canada

We prepare the registration, coordinate with any FINTRAC filing so information is consistent, and respond to Bank of Canada questions.

  • REGISTRATION
  • NATIONAL SECURITY REVIEW
Risk management and incident response

A documented framework covering operational risk, incident response, and notification to the Bank and affected end users when incidents occur.

  • OPERATIONAL RISK
  • INCIDENT REPORTING
Safeguarding end-user funds

Funds held for end users must be safeguarded, either in a trust account or a segregated account protected by insurance or a guarantee, with reconciliation and records.

  • TRUST ACCOUNT
  • INSURANCE OR GUARANTEE
Reporting and significant changes

Annual reporting and advance notice of significant changes or new activities.

  • ANNUAL REPORT
  • CHANGE NOTICES
§ 05

Anti-money laundering compliance program

Every reporting entity needs a compliance program with five elements in place before it operates. We build programs around how your business actually works, so they hold up when FINTRAC examines them.

Can a template policy satisfy FINTRAC?

Rarely. Examiners test whether your policies describe what your staff actually do. Generic templates are one of the most common examination findings.

Written policies and procedures

Client identification, beneficial ownership, politically exposed persons, record keeping, reporting and ministerial directives, kept current and approved by senior management.

  • POLICIES
  • PROCEDURES
Risk assessment

An assessment of your clients, products, delivery channels, geography and new technologies, with enhanced measures where risk is high.

  • RISK-BASED APPROACH
  • EDD
Compliance officer

A named officer with the authority, resources and access to senior management to implement the program, in-house or with outsourced support.

  • COMPLIANCE OFFICER
Training and two-year effectiveness review

Written ongoing training for staff and agents, and an effectiveness review at least every two years.

  • TRAINING PROGRAM
  • EFFECTIVENESS REVIEW
Reporting obligations

Suspicious transaction reports, large cash and large virtual currency transaction reports of $10,000 or more, international electronic funds transfer reports, and terrorist and listed-person property reports.

  • STR
  • LCTR
  • EFTR
  • LVCTR
Travel rule and record keeping

Required originator and beneficiary information must travel with funds and virtual currency transfers, and records must be kept for at least five years.

  • TRAVEL RULE
  • RECORDS
§ 06

Payment processors and banking

Registered payment businesses still face de-risking. We help you present your business in the way banks and payment partners need to see it.

Banking introductions

A due diligence package covering registration, ownership, AML program and flow of funds, and introductions to institutions that serve MSBs and payment businesses.

  • DE-RISKING
  • DUE DILIGENCE PACK
Payment processor and card program agreements

Review and negotiation of processor, sponsor bank and card program agreements, including incentive and compliance terms.

  • PSP
  • CARD NETWORKS
Agent and partner due diligence

Agreements and controls for agents, mandataries and partners whose activities fall within your compliance program.

  • AGENTS
  • THIRD PARTIES
§ 07

Examinations and enforcement

What happens after a FINTRAC notice of violation?

You can pay the penalty or request a review by FINTRAC's Director within a short deadline, with a further appeal to the Federal Court. Penalties and the names of businesses penalised can be made public, so early advice matters.

Compliance examinations

Preparation for desk and on-site examinations, document production, staff interviews and a consistent written response.

  • DESK EXAMINATION
  • ON-SITE
Administrative monetary penalties

Assessment of the alleged violations, representations to FINTRAC, review requests and appeals.

  • NOTICE OF VIOLATION
  • REVIEW
Remediation planning

Remediation plans with owners and deadlines that address findings and show the regulator the program now works.

  • ACTION PLAN
AMF and Bank of Canada inquiries

Responses to provincial licence inquiries and RPAA supervisory requests, coordinated with your FINTRAC position.

  • AMF
  • BANK OF CANADA
§ 08

Find guidance for your situation

Registration

Overseas payments business with Canadian customers

Decide between MSB and foreign MSB registration, check whether RPAA applies, and confirm whether a Québec licence is needed.

Registration

Launching a crypto exchange or wallet

Virtual currency dealers must register with FINTRAC and have a full compliance program in place before onboarding clients.

Registration

Unsure whether you are a PSP under the RPAA

Map each of your payment functions against the Act. Some activities are excluded, others trigger registration even if you are already an MSB.

Registration

Expanding into Québec

Apply to the AMF for a money-services licence. Review typically takes longer than federal registration.

Compliance program

Using a downloaded template policy

Generic policies are a common examination finding. Replace them with procedures that match how your business actually operates.

Compliance program

Internal or outsourced compliance officer

Choose based on team size and complexity, but the officer must have real authority, resources and access to senior management.

Compliance program

Bank declined your account

Prepare a due diligence package built around your registration, AML program and flow of funds, and approach partners that serve MSBs.

Regulatory response

FINTRAC examination notice

Verify facts internally, gather records, and prepare one consistent response within the stated deadline.

Regulatory response

Notice of violation received

Assess grounds for a review by the Director, which has a short deadline, and begin remediation in parallel.

Regulatory response

Registration expiring

FINTRAC registration must be renewed every two years. Late renewal can force you to stop offering MSB services.

§ 09

Our process and timeline

A typical engagement follows six stages. Registration itself is fast; building a program that works takes longer.

Preliminary assessment

3–7 business days

Conflict check and a review of your activities, customers, flow of funds and corporate structure to identify every registration that applies.

§ 10

Frequently asked questions

Do MSB applicants need to be Canadian citizens or residents?

No. Foreign nationals can be shareholders, directors and, in many cases, the compliance officer. There is no minimum capital requirement. A domestic MSB needs a Canadian address, and the compliance officer must genuinely perform the role.

Is FINTRAC registration a government licence?

No. Registration confirms that you have met the obligation to register under the PCMLTFA. It is not an endorsement or approval of your business, and should not be described to customers as a licence.

Can we build the compliance program after we launch?

No. All five program elements must be in place before you start offering services. A missing element can make the whole program non-compliant in an examination.

If we are registered with FINTRAC, do we also need RPAA registration?

Possibly. The two regimes have different purposes. FINTRAC covers money laundering and terrorist financing; the RPAA, supervised by the Bank of Canada, covers operational risk and safeguarding of end-user funds. Many payment businesses fall under both.

What else is needed for operations in Québec?

A separate money-services business licence from the AMF under Québec's Money-Services Businesses Act, with its own background checks and a longer review than federal registration.

How long does FINTRAC registration take?

Usually around 3–6 weeks after a complete filing, but building the compliance program properly typically takes 2–4 months end to end.

How quickly must we respond to a FINTRAC examination?

The deadline is stated in the notice. Complete internal verification first and keep every answer consistent with your policies, records and previous filings.

§ 11

Book a compliance assessment

A 30-minute assessment with a lawyer in our payments practice will identify every registration that applies, the program you need and the main risks to your launch date.

A short summary is enough to start

Your corporate structure, the jurisdictions or activities you are considering, your target launch date and any correspondence you have received from a regulator. We confirm the conflict check and respond within one business day.

Book a 30-minute assessment

The content on this page is general legal information and is not legal advice. Contacting us or submitting information does not create a lawyer–client relationship. A written retainer agreement is required before we act for you.

Scan to message us on WhatsApp

WhatsApp QR code for Lazarus LegalOpen WhatsApp →

Registration is the starting point. A working compliance program protects the business

Tell us what you do, where your customers are and how funds move. We will map every registration that applies and the program you need behind it.

Book a 30-minute compliance assessment