Canadian Crypto Exchanges: FINTRAC Duties and Securities-Law Boundaries

An MSB registration is not an exchange licence

Dealing in virtual currency can bring a business within FINTRAC’s MSB rules. That registration addresses AML/ATF obligations; it does not establish that a trading platform may offer every crypto product or serve clients under provincial securities law. Assess exchange, transfer, brokerage, custody and fiat functions separately.

A platform’s marketing description is not a legal classification. “Spot”, “non-custodial” and “white-label” do not determine the result. Write down what the customer owns, what rights the contract gives them, how delivery occurs, who controls assets and what happens when the customer asks to withdraw.

Examine the customer’s claim against the platform

CSA Staff Notice 21-327 explains that securities legislation may apply to the contractual right or claim a user has against a platform, even when the underlying crypto asset is not itself a security or derivative. Immediate delivery and the platform’s continuing involvement matter; the analysis cannot be reduced to whether an asset is called Bitcoin or whether a trade is labelled spot.

CSA/IIROC Staff Notice 21-329 discusses the different platform models and the relevant registration framework. Assets offered, custody arrangements, trading features and client rights all matter. These notices provide a starting point for legal analysis, not permission to operate or assurance that a pre-registration undertaking will be available. Check current provincial requirements and regulator records before relying on a claimed status.

Keep travel-rule controls distinct from thresholds

FINTRAC’s travel rule concerns required information accompanying covered transfers and the handling of missing information. It should not be described simply as “the rule for transfers over $1,000”. Identification, transaction records, travel-rule information and reports have different triggers; build an obligation matrix using the guidance for the precise activity.

The large virtual currency transaction reporting regime generally covers receipt of virtual currency worth $10,000 or more in a single transaction, subject to applicable rules and exceptions. Aggregation rules also require attention. Suspicious transaction reporting is a separate assessment with no minimum dollar threshold. A transaction below a large-report threshold is not automatically outside the AML control framework.

Test the information chain, not just the trading engine

A functioning order book proves little about compliance readiness. Verify how required sender and beneficiary information is collected, retained and passed to counterparties; how missing information is handled; and how staff retrieve transaction and identity records. Document treatment of failed transfers, rejected onboarding and higher-risk customer relationships.

Walk through a fiat deposit, a crypto purchase, an external wallet transfer and a withdrawal. Identify which party performs each regulated function and where evidence is stored. Monitor for patterns as well as single transactions. Assign clear escalation responsibility and retain the rationale for reporting and non-reporting decisions.

Due diligence on a white-label supplier

Software can support screening, onboarding, monitoring and reporting, but those features do not transfer the operator’s obligations to the vendor. Evaluate configuration, data access, audit trails, control over assets, incident response and the ability to change suppliers. A vendor demonstration should include failure cases, not only the successful customer journey.

Before soliciting clients, obtain jurisdiction-specific analysis of the product and contractual model. Verify applicable registrations and any undertakings against regulator records. Revisit the assessment when adding tokens, staking, lending, leverage or another customer market; approval or analysis of one operating model cannot be assumed to cover a different one.

• Map every fiat, exchange, custody and transfer function to its responsible entity.
• Review customer contractual rights and delivery mechanics with securities counsel.
• Test missing travel-rule information, record retrieval and alert escalation.
• Verify regulatory status independently of a vendor’s claims.