Crypto MSB (dealers in virtual currency): obligations and risks

As of June 1, 2020, all companies dealing in virtual currency are required to register with FINTRAC as a Money Services Business (MSB). This requirement was Canada’s response to FATF recommendations and closed gaps in the national anti-money laundering system. Additional obligations, including KYC verification for all cryptocurrency exchanges, came into force on June 1, 2021.

The reason for such regulation is simple: the cryptocurrency sector creates vulnerabilities for financial crime in the absence of proper oversight. MSB registration moves a crypto business out of the gray zone into a transparent legal environment, where standards for sanctions screening, transaction monitoring, and reporting apply.

Types of activities requiring an MSB license

Registration is required if a company carries out at least one of the following activities:

• Virtual currency exchange — conversion of cryptocurrency into fiat money, fiat into crypto, or one cryptocurrency into another
• Virtual currency transfer — transfer of crypto assets between users or wallets
• Custodial services — holding cryptocurrency on behalf of clients
• Fiat money operations — currency exchange, money transfers, issuance of monetary instruments

It is important to understand the trade-off: even if a business has no physical presence in Canada but provides services to Canadian clients, it must register as a Foreign MSB (FMSB). This applies to international platforms marketing to a Canadian audience or using a .ca domain.

Basic obligations and the registration process

Registration with FINTRAC: step-by-step process

All MSBs must register with FINTRAC before starting operations, even if they are already licensed at the provincial level. Registration is free, but it requires careful document preparation.

The procedure includes:

1. Pre-registration — completing an online form with basic company information
2. Interaction with a compliance officer — FINTRAC assigns an officer who sends the final registration form
3. Submission of documents — criminal record checks for owners with a 20%+ stake, directors, and key managers, issued no more than 6 months ago
4. Approval — usually takes 2-12 weeks with a complete document package

Specialists at MapleBiz help prepare the registration package correctly the first time, minimizing requests for revisions and speeding up the MSB status acquisition process.

Compliance program: 5 mandatory elements

After registration, the company must implement and maintain a compliance program consisting of five key elements:

Critical nuance: the program must be functional, not merely formal. Cryptomus received a $176.9 million fine in part because it had no written compliance program at all.

Reporting and recordkeeping

MSBs are required to submit several types of reports:

• Suspicious Transaction Reports (STR) — within 30 days when there are grounds to suspect money laundering
• Large Cash Transaction Reports (LCTR) — when receiving CAD 10,000+ in cash
• Large Virtual Currency Transaction Reports (LVCTR) — when receiving cryptocurrency equivalent to CAD 10,000+ in a single transaction
• Electronic Funds Transfer Reports (EFTR) — for international transfers of CAD 10,000+

The so-called LVCTR reporting has a special feature: the 24-hour rule applies — two or more transactions totaling above the threshold within a 24-hour window are treated as one and require a report. This prevents splitting large transfers to avoid reporting.

All transaction and customer identification records must be retained for at least 5 years.

Non-compliance risks and practical cases

Financial penalties and administrative sanctions

FINTRAC has been granted the authority to impose administrative monetary penalties (AMPs), the size of which increased significantly in 2025. In October 2025, Cryptomus (Xeltox Enterprises) received a record CAD 176.9 million fine for 2,593 violations, including failure to file 1,068 STRs and 1,500 large transaction reports.

Other significant cases:

• KuCoin — CAD 19.5 million for operating as an unregistered FMSB and failing to file 2,952 reports
• Canaccord Genuity — CAD 544,500 for the absence of STRs and ignoring Ministerial Directives
• Cryptomus also failed to report 7,557 transactions from Iran, violating sanctions requirements

Maximum penalties have increased to CAD 20 million per violation; aggregate fines can reach 3% of global revenue. FINTRAC publishes the names of fined companies, creating reputational risk alongside financial risk.

Operational risks for the business

Beyond direct fines, non-compliance creates secondary effects:

• Loss of bank accounts — Canadian banks close relationships with unregistered or non-compliant MSBs
• Inability to work with payment systems — providers require proof of registration and active compliance
• Revocation of registration — FINTRAC may cancel MSB status for serious violations, effectively shutting down the business
• Criminal prosecution — failure to file STRs can result in up to CAD 2 million in fines and/or 5 years in prison

The key trade-off: investing in compliance at the outset is far less costly than the potential losses from a FINTRAC inspection and subsequent sanctions.

How MapleBiz helps minimize risks

MapleBiz provides comprehensive support for cryptocurrency MSBs at every stage:

• Audit of the current compliance program and identification of gaps before a regulator inspection
• Development of AML/CTF policies and reporting procedures tailored to the specific business model
• Preparation for FINTRAC inspections with simulation of regulator requests
• Consulting on integrating sanctions screening and the Travel Rule for cryptocurrency transfers
• Representation in dealings with FINTRAC and remediation of violations

A proactive approach saves time and money: companies that fix deficiencies before an inspection receive significantly lower sanctions or avoid them altogether.

MSB vs Foreign MSB: choosing the optimal structure

Comparison of requirements

Canada offers two registration options depending on the business’s presence:

Important: both options require KYC for transactions over CAD 1,000, recordkeeping for at least 5 years, and compliance with the Travel Rule. The differences are mainly operational rather than in the level of obligations.

When MapleBiz recommends each model

MSB (domestic) is suitable if:

• Active interaction with Canadian banks is planned — local registration simplifies account opening
• The target audience is primarily Canadian — a local company inspires more trust
• There is an intention to expand into the U.S. market — a Canadian MSB is seen as a serious player
• A stable jurisdiction is needed for the team and operations

Foreign MSB is preferable when:

• The business is already incorporated abroad and does not want to create a Canadian structure
• Canadian clients are part of a global customer base rather than the main focus
• Physical infrastructure costs need to be minimized
• There is an opportunity to appoint a reliable local agent to interact with FINTRAC

Specialists at MapleBiz analyze the business model and recommend the optimal structure taking into account long-term development plans and tax implications.

Typical mistakes and how to avoid them

An analysis of penalty cases shows recurring patterns of violations:

Operating without registration or with an expired registration

KuCoin operated as an unregistered FMSB, which led to a CAD 19.5 million fine. Registration must be obtained before serving the first client. An MSB must renew its registration every two years.

No compliance program or a merely formal one

Cryptomus had no written compliance program at all, which was one of the factors behind the record fine. The program must be detailed, up to date, and actually used, not just a file on a shelf.

Failure to file mandatory reports

Cryptomus missed 1,068 STRs in July 2024 alone. Automating transaction monitoring and reporting triggers is critical.

Ignoring sanctions requirements

Cryptomus failed to report 7,557 transactions linked to Iran, violating Ministerial Directive 2020. Sanctions screening must be built into every transaction.

Outdated information in the registry

Cryptomus did not update its registration, listing incorrect contacts and failing to reflect that it dealt only in cryptocurrency. Changes must be reported to FINTRAC within 30 days.

Insufficient customer and third-party identification

SIGA was fined when it was found that 41% of reviewed clients had no documented risk assessment. KYC is not a one-time onboarding check, but an ongoing process.

How to avoid these mistakes:

• Start preparing the compliance program before submitting the registration application
• Invest in technology solutions to automate monitoring and reporting
• Appoint a qualified Compliance Officer with real authority
• Conduct regular internal audits of the program (at least once every two years)
• Train staff continuously, not just formally once a year
• Use professional consultants such as MapleBiz to assess readiness for FINTRAC inspections

Cryptocurrency business in Canada is under close regulatory scrutiny. Requirements for dealers in virtual currency will not become easier — on the contrary, the trend shows tighter control and higher fines. However, companies that build a compliance culture from the start gain a competitive advantage: access to banking services, the trust of clients and partners, and, most importantly, confidence in the business’s resilience.

If you are planning to launch or are already operating as a crypto MSB, contact MapleBiz. Our specialists will help you complete registration, build a robust compliance program, and prepare for any regulatory inspection.