Fintech companies in Canada face a two-layer regulatory reality. On the one hand — MSB registration (Money Services Business) with FINTRAC, which has existed for two decades. On the other — the new PSP registration (Payment Service Provider) with the Bank of Canada, introduced under the Retail Payment Activities Act (RPAA). The difference between MSB vs PSP may seem technical, but the cost of a mistake — blocked banking services or a public refusal of registration.
An MSB is registered with FINTRAC for foreign exchange, money transfers, negotiable instruments, and virtual currencies. The main purpose is combating money laundering and terrorist financing. FINTRAC does not license; it only registers: registration does not mean approval or licensing of the business.
PSP registration works differently. The Bank of Canada is responsible for supervising PSPs in order to increase confidence in the safety and reliability of their services, protecting end users from specific risks. PSP licensing under RPAA focuses on operational risk management, safeguarding client funds, and incident response. Under RPAA, the Bank of Canada concentrates on ensuring that PSPs implement robust operational risk management and incident response systems.
The key point: MSB requires you to report suspicious transactions and comply with AML rules, whereas PSP obligations include stress-testing systems, segregating client funds, and annual reporting on payment metrics.
A business may need both MSB and PSP registration if it performs foreign exchange, money transfers, or virtual currency activities and at the same time provides electronic payment functions. In other words, if you are launching a payment aggregator with a crypto wallet — you need both registrations.
Typical examples of dual registration: a crypto exchange with fiat transfers, a digital wallet with currency exchange, a remittance service with client funds held. The new requirement does not replace the existing MSB registration — for most MSBs, RPAA registration will be an additional obligation.
Tuesday, September 8, 2025, became a moment of truth for the Canadian payments sector. The Retail Payment Activities Act came into force on 08.09.2025, and the Bank of Canada published the list of registered PSPs, as well as the names of companies whose applications were rejected.
As of 08.09.2025, registered PSPs are required to comply with various operational risk management and end-user fund safeguarding requirements, as well as reporting and record-keeping requirements. Before that date, there was a «regulatory vacuum zone»: existing PSPs had to submit registration applications from November 1 to November 15, 2024.
It was on 08.09.2025 that the requirements for protecting client funds changed. The final safeguarding guidance and related RPAA provisions came into force on 08.09.2025. PSPs are required to segregate end-user funds from all other funds through a safeguarding account; either hold the funds in trust or use insurance or a guarantee.
The transition window (November 2024 — September 2025) allowed companies that had submitted applications to continue operating. PSPs that applied for registration by November 15, 2024, could continue providing services during the transition period. But those who were late or did not apply at all must wait for the Bank of Canada’s decision before providing payment services.
The most painful consequence is public censure. Rejections will be published publicly, and this may have business consequences — banks have access to this list, and if your business is marked as a rejected applicant, you may be denied banking services. Debanking after a public refusal is a real risk for fintech.
MSBs are regulated by FINTRAC, while PSPs fall under FINTRAC and the Bank of Canada’s Retail Payment Activities Act. This means dual oversight: FINTRAC AML checks and the Bank of Canada’s operational audits.
The list is obvious:
MapleBiz specialists will help determine exactly which registrations your business requires. We analyze the business model, fund flows, and jurisdictional specifics to avoid unpleasant surprises when dealing with banks.
Registration is required if you perform one or more payment functions that are not incidental to another service or business activity, and you perform functions related to electronic money transfers. It is precisely the «incidental activity» criterion that causes disputes.
FINTRAC interprets this narrowly: only companies dealing with utility payments, payroll and commission services, mortgage and rent payments, as well as certain tuition payments, are not considered MSBs because they are not in the business of transferring funds. If your product is a marketplace with integrated payments, but the main revenue is commission from the sale of goods, there is a chance the payments will be deemed ancillary.
Another gray area is merchant reserve funds. PSPs that hold merchant funds in reserve, specifically set aside to mitigate chargeback or fraud risks, are not considered to be holding end-user funds for RPAA purposes. But proving that the reserve is not mixed with operating funds must be documented.
A merchant payment processor without holding funds — PSP is required, MSB is usually not required; a payment facilitator that holds merchant funds — PSP is required, MSB status depends on the specific activities. If you only transmit transaction data between the acquiring bank and the merchant without touching the funds themselves — MSB may not be needed. But if the fintech receives funds from one side and passes them to another, that matches FINTRAC’s definition of a remitting MSB, and a 1-3 day settlement period confirms the handling of client funds.
Practical advice: if the settlement delay exceeds T+0, FINTRAC will most likely recognize you as an MSB. Banks require the MSB registration number already at the onboarding stage, and the bank will ask for the MSB registration number, the AML compliance program, and evidence of readiness for RPAA supervision.
Canada regulates crypto strictly. MSB covers 5 types of money service activities: virtual currency exchange (crypto-crypto, crypto-fiat), foreign currency exchange, money transfers and remittances, payment instruments, crowdfunding platforms. If your service is only non-custodial exchange (users control the keys), MSB may not be required, but companies that exclusively engage in cryptocurrency transfers, buying/selling, are not covered by the Act.
However, if a crypto operator offers prepaid cards and fiat transactions, it already goes through the full registration procedure. Custodial wallets, where you hold a client’s CAD or USD balance, require PSP. The combo «crypto exchange + fiat balance» = both registrations.
A common mistake is to think that working only with stablecoins exempts you from RPAA. The Canadian MSB license does NOT cover stablecoin operations — stablecoins may require a separate authorization from the Canadian Securities Administration (CSA), as they may be classified as securities.
Navigating MSB and PSP regulation is not a one-time task, but a continuous process. Non-compliant MSBs risk administrative monetary penalties, public disclosure of violations, and loss of banking relationships — regardless of their registration status. PSPs operating without a submitted application may violate section 104 of the RPAA — a serious breach that can lead to a notice of violation with a significant administrative monetary penalty.
MapleBiz specializes in legal support for businesses in Canada, including MSB and PSP registration. Our services include:
Registration is only the starting point. It is important not just to register with FINTRAC or the Bank of Canada, but whether your operations, team, and risk controls can withstand scrutiny. MapleBiz helps fintech companies not only obtain registrations, but also build resilient operational processes that satisfy both regulators and banking partners.
If you need advice on choosing the right regulatory path, developing a compliance framework, or support in dealing with FINTRAC and the Bank of Canada — contact the MapleBiz team.
