FINTRAC MSB Registration: Scope, Application and Operational Readiness

Start with the service, not the company label

FINTRAC registration is an anti-money-laundering and anti-terrorist-financing obligation. It is not a financial-services licence, an endorsement or a guarantee of banking access. The first question is whether the business provides a prescribed money service, not whether its website calls it a fintech, exchange or payment platform.

Document the services you actually perform: foreign exchange, remittances or funds transmission, issuing or redeeming relevant payment instruments, dealing in virtual currency, and other prescribed services. Then assess the geographic tests. A Canadian place of business matters for an MSB; a foreign business can be in scope when it directs and provides qualifying services to Canadian clients. Check FINTRAC’s service definitions rather than relying on a product name.

Build an application file that matches the operation

FINTRAC requires registration before a Canadian MSB begins operating. The process starts with a pre-registration request and proceeds to a registration form. The regulator charges no registration fee. This does not eliminate the work or cost of implementing compliance, and there is no universal approval timeline on which to base a launch promise.

Prepare a consistent record of the applicant’s legal identity, ownership, management, locations, agents or mandataries, services and supporting information required by the current form. Incorporation details are relevant if the applicant is a corporation; incorporation is not a universal prerequisite established by FINTRAC’s guidance. Incomplete applications may be closed and require resubmission.

• Reconcile the application with contracts, website descriptions and actual funds flows.
• Identify who controls the business and who is accountable for compliance.
• Keep a versioned copy of submitted information and responses to clarification requests.

Turn the five compliance elements into working controls

The compliance program requires a compliance officer, written policies and procedures, a risk assessment, ongoing training and an effectiveness review at least every two years. Policies must be current and approved by a senior officer. A purchased template is not evidence that these elements have been implemented.

The risk assessment should reflect customers, products, delivery channels, geographic exposure and other relevant risks. Translate its findings into decisions: when additional information is required, which activity needs closer monitoring, who can approve a high-risk relationship and when a transaction must be escalated. Staff training should reflect the decisions employees actually make, not merely ask them to acknowledge a policy.

Separate identification, records and reporting

Do not compress every obligation into one transaction threshold. Identity verification, recordkeeping, ongoing monitoring, travel-rule information and reports each have their own triggers. Suspicious transaction reporting has no minimum dollar threshold. Large cash and large virtual currency reporting are not the only reports that can be relevant.

Before launch, walk a realistic customer and transaction through each control. Can staff retrieve the required record? Does the system flag relevant aggregation? Can the compliance officer explain why an alert was closed? Document exceptions and corrective action instead of treating a successful signup as a compliance test.

Treat registration as a continuing obligation

Renewal is required every two years. Registration details must remain current and clarification requests need a timely response. Separately calendar the effectiveness review; a registration renewal does not replace that review.

Keep an obligations register covering FINTRAC and any additional regimes. A payment business may also fall under Bank of Canada supervision; a crypto platform may require securities analysis. Before changing a product, agent arrangement or customer market, revisit scope rather than assuming the original registration covers the new activity.

• Assign an owner to renewal and registration-information updates.
• Retain training records, review findings and evidence of corrective action.
• Reassess new products and jurisdictions before they go live.