Canada’s MSB Reset: FINTRAC’s Enforcement Surge and the RPAA Compliance Gate

Canada is moving from a registration-driven MSB market toward active supervision of AML controls, payment operations, customer funds, ownership changes, and stablecoin activity.

For years, the Canadian MSB market had an appealing simplicity. Incorporate a Canadian company, register it with FINTRAC, prepare an AML compliance program, and a business could describe itself as a Canadian-regulated money services business.

That description was always incomplete. FINTRAC registration was never an endorsement, prudential license, banking approval, or guarantee that the business had been examined. But the distinction was frequently lost in the market. Registration certificates—or, more accurately, registration records—were treated as commercially valuable regulatory assets.

That era is ending.

Canada is moving toward a system in which appearing on a registry is only the beginning. FINTRAC is concentrating supervisory resources on MSBs, virtual-asset businesses, payment companies, and other entities it considers particularly vulnerable to money laundering. The Bank of Canada is simultaneously supervising payment service providers under the Retail Payment Activities Act, or RPAA.

Canada is also constructing a federal stablecoin framework. Proposed regulations published in October 2026 would place qualifying stablecoin issuers under Bank of Canada supervision and expressly bring payment service providers that use prescribed stablecoins within the RPAA perimeter.

The result is a two-regulator environment:

• FINTRAC examines financial-crime compliance.
• The Bank of Canada examines operational resilience, incident management, regulatory reporting, and the safeguarding of end-user funds.

Companies operating in Québec may need a third authorization from Revenu Québec. British Columbia has enacted a provincial MSB law that is not yet in force but is expected to introduce another registration and supervisory layer.

The commercially valuable Canadian payments company of the future will therefore not be the one that merely holds a FINTRAC number. It will be the one that can demonstrate real controls, clean ownership, accurate reporting, protected customer funds, credible banking arrangements, and a defensible regulatory history.

The report that triggered the concern

The development that prompted this analysis was FINTRAC’s 2025–26 annual report, released on October 26, 2026.

FINTRAC reported a record 4,874 “assessment and monitoring activities.” It also said that more than 55% of its supervisory activities were directed toward MSBs, reflecting the sector’s designation as having a very high vulnerability to money laundering and terrorist financing. fintrac-canafe.canada.ca

The headline numbers were striking:

FINTRAC also reported 35 notices of violation across all sectors, representing more than C$247 million in penalties. The number of notices was 52% higher than in the previous year. fintrac-canafe.canada.ca

Those figures describe a considerably more aggressive regulator. But they require careful interpretation.

FINTRAC did not conduct 4,874 full audits

The figure of 4,874 should not be read as 4,874 traditional compliance examinations.

It includes:

• Automated or semi-automated risk questionnaires
• Self-attestations
• Information demands
• Targeted examinations
• Full-scope examinations
• Remediation monitoring
• Other assessment and supervisory activities

A risk questionnaire may require a business to describe its services, customers, transaction volumes, geographic exposure, reporting practices, agents, banking arrangements, virtual-currency activity, and compliance controls.

A self-attestation may require senior personnel to formally confirm that specified requirements are being met.

A targeted examination may concentrate on one or several higher-risk areas, such as suspicious transaction reporting, large virtual-currency transaction reporting, customer identification, beneficial ownership, sanctions, or the effectiveness of the company’s risk assessment.

A full-scope examination is much more extensive. It can review the complete compliance program, transaction records, regulatory reports, customer files, governance, training, two-year effectiveness reviews, and the work performed by agents or mandataries.

The distinction matters because FINTRAC’s supervisory volume has increased partly through lighter-touch and automated assessments. Three days after FINTRAC published its annual report, the Auditor General concluded that FINTRAC had relied increasingly on self-reported information and that these assessments provided less assurance than thorough examinations.

The Auditor General recommended that FINTRAC establish procedures to verify information submitted by businesses in higher-risk sectors. MSBs are expressly classified as a very-high-vulnerability sector, making them an obvious candidate for stronger verification. Canada.ca

The likely consequence is not simply more questionnaires. It is more follow-up when the answers appear incomplete, inconsistent, improbable, or unsupported by transaction-level evidence.

Why MSBs are receiving so much attention

Canada’s 2025 national assessment gave the MSB sector a very high vulnerability rating. The sector now includes considerably more than traditional remittance shops and currency exchanges.

FINTRAC’s MSB perimeter covers activities including:

• Foreign-exchange dealing
• Remitting or transmitting funds
• Issuing or redeeming money orders and similar negotiable instruments
• Dealing in virtual currency
• Crowdfunding platform services
• Certain payment services
• Cheque cashing
• Certain private automated banking machine activities
• Armored-car activities involving prescribed services

Foreign companies can also qualify as foreign MSBs when they direct prescribed services at people or entities in Canada and provide those services to Canadian clients.

This is particularly important for crypto exchanges and digital-payment platforms. A business does not avoid Canadian obligations merely by having no Canadian incorporation, office, employees, or bank account.

FINTRAC’s C$19.552 million penalty against Peken Global, operating as KuCoin, followed its conclusion that the Seychelles company operated as a foreign MSB in Canada without registering and failed to submit thousands of required virtual-currency and suspicious-transaction reports. The decision is under appeal. FINTRAC – Canada.ca

The C$176.96 million penalty imposed on Xeltox Enterprises, operating as Cryptomus, involved 2,593 alleged instances across six categories of violations. These included suspicious-transaction reporting failures, large virtual-currency reporting failures, compliance-program deficiencies, sanctions-related concerns, and failure to update registration information. That penalty is also under appeal. fintrac-canafe.canada.ca

These two large cases account for most of the more than C$198 million imposed on MSBs during the reporting year. The aggregate figure therefore should not be interpreted as the typical penalty for an ordinary Canadian remittance company. Nevertheless, the cases demonstrate the regulator’s willingness to impose penalties of a scale that can destroy a business.

Registration revocation is becoming an active supervisory tool

FINTRAC revoked 82 MSB registrations during 2025–26, compared with 12 in the previous year.

That is nearly a sevenfold increase.

A revocation does not necessarily mean that FINTRAC proved the business was laundering money. Registration may be revoked because an MSB:

• Is no longer eligible for registration
• Fails to answer a clarification request
• Fails to respond to an information demand
• Fails to assist FINTRAC during an assessment
• Fails to maintain accurate registration information
• Does not notify FINTRAC of certain required changes
• Has principals who become ineligible under the legislation

FINTRAC generally gives an MSB 30 days to respond to a registration clarification request. Failing to respond can lead to revocation, penalties, or criminal consequences. fintrac-canafe.canada.ca

This means a registered company cannot be left unattended.

A dormant company still needs a monitored regulatory email address, a responsible contact person, current directors and owners, accurate locations and agent records, timely renewal, and someone capable of answering FINTRAC properly. A company sold to a new owner cannot simply continue using old ownership, compliance, banking, or business-model information.

The registration has become a continuing obligation rather than a static entry obtained once every two years.

The compliance standard has changed

On March 26, 2026, amendments under the Strengthening Canada’s Immigration System and Borders Act came into force.

A reporting entity’s compliance program must now be:

• Reasonably designed
• Risk-based
• Effective

The word “effective” is the critical addition.

Historically, a company could concentrate heavily on showing FINTRAC that it possessed the required components:

• A compliance officer
• Written policies and procedures
• A documented risk assessment
• A training program
• A two-year effectiveness review

The revised standard gives FINTRAC a stronger basis for asking whether those components actually work.

For example:

• Do transaction-monitoring rules generate appropriate alerts?
• Are alerts investigated promptly?
• Are suspicious transaction reports filed when reasonable grounds to suspect are reached?
• Do customer files contain the records claimed in the policy?
• Are high-risk clients subjected to enhanced measures?
• Are agents following the same controls as the principal MSB?
• Does the risk assessment reflect the actual countries, products, customers, delivery channels, and transaction volumes?
• Can management demonstrate that deficiencies from the last effectiveness review were corrected?

A beautifully drafted manual that bears little resemblance to the operating business is therefore becoming a liability rather than protection.

The same legislative amendments strengthened FINTRAC’s enforcement toolkit. Maximum administrative penalties can be increased by as much as 40 times the previous limits. FINTRAC can impose compliance agreements, issue compliance orders, and treat violations of those orders as separate contraventions. Certain compliance-program failures have also been elevated to “very serious” violations. fintrac-canafe.canada.ca

Violations occurring after March 26, 2026, fall under the new framework. FINTRAC is still developing parts of its updated penalty policy and guidance, but the statutory direction is already clear.

What a FINTRAC examination now looks like

FINTRAC’s published examination manual confirms that its assessment begins before the formal examination notice.

Its risk assessment may consider:

• The company’s FINTRAC registration record
• Transaction reports submitted to FINTRAC
• The quality, timing, and volume of those reports
• Previous examination findings
• Promised remediation
• Voluntary declarations of non-compliance
• Questions previously submitted to FINTRAC
• Information from other regulators or law enforcement
• Public information found online
• The company’s customers, countries, products, transaction volumes, and delivery channels
• Enforcement involving the company or related parties

FINTRAC can then review policies, customer records, transactions, regulatory reports, agent files, risk assessments, training records, effectiveness reviews, and governance documents. It can also interview employees and senior management. fintrac-canafe.canada.ca

This makes public consistency increasingly important. A company should not tell:

• FINTRAC that it provides one service,
• the Bank of Canada that it provides a second,
• its bank that it provides a third,
• and customers on its website that it provides all three.

Product descriptions, transaction flows, bank onboarding materials, compliance policies, regulatory filings, customer agreements, and website claims need to describe the same business.

The contradiction inside FINTRAC

FINTRAC is simultaneously becoming more aggressive and struggling with significant operational weaknesses.

A March 2024 cyber incident caused FINTRAC to take its MSB registration system offline. Although FINTRAC reported that there was no evidence that information had been removed or lost, the registration system was replaced with a labor-intensive temporary process.

As of the Auditor General’s October 29, 2026 report:

• Approximately 2,500 MSB registration, renewal, and change requests remained unprocessed.
• FINTRAC was still using a temporary manual registration process.
• A permanent replacement system was not expected until the 2027–28 fiscal year.
• The delays had continued for more than two years. Canada.ca

FINTRAC says that most complete applications are processed within three months, although complex applications can take longer. The backlog suggests that three months should not be treated as a dependable transaction-closing assumption. FINTRAC – Canada.ca

For renewals, FINTRAC has adopted an important temporary position: if an MSB submits its renewal before expiry, it remains registered while FINTRAC processes the renewal. The public registry should continue to show it as registered. If the renewal was not submitted on time, the registration expires.

That distinction is important for banking, counterparties, acquirers, and due diligence.

A pending renewal may be administratively delayed but legally preserved. An expired registration caused by a missed renewal is a compliance failure.

The Auditor General may cause more—not fewer—examinations

At first glance, the Auditor General’s criticism appears favorable to the industry because it says FINTRAC’s oversight has been insufficient.

That would be the wrong conclusion.

The audit found that FINTRAC:

• Relied too heavily on self-attestations and automated assessments
• Did not adequately verify information from higher-risk businesses
• Had weak information technology
• Maintained a serious registration backlog
• Took too long to provide financial intelligence to law enforcement
• Focused its public reporting more on activity counts than regulatory outcomes

FINTRAC accepted the recommendations. The institutional response is therefore likely to involve more verification, better targeting, stronger transaction sampling, improved follow-up, and more demonstrable supervisory outcomes.

FINTRAC will be under pressure to show Parliament, the Auditor General, FATF, and the public that its record activity produces actual compliance.

The September 2026 FATF evaluation reinforces that pressure. FATF recognized improvements in Canada’s AML system but called for stronger risk-based supervision and more effective oversight of financial institutions, virtual-asset providers, and other vulnerable sectors. fatf-gafi.org

For an MSB, the practical message is simple: do not assume that FINTRAC’s administrative problems make enforcement less likely. They create political pressure for enforcement to become more visible.

FINTRAC and RPAA regulate different risks

One of the most common mistakes in the Canadian market is treating FINTRAC registration and Bank of Canada registration as interchangeable.

They are not.

An MSB may be subject to both regimes.

A company can also be subject to only one. For example, a business may perform an RPAA payment function without conducting a prescribed FINTRAC MSB service. Conversely, some traditional cash-based MSBs may be subject to FINTRAC but fall outside the RPAA because they are not performing an in-scope retail electronic payment function.

Each business must be classified from its actual flow of funds and operational role.

Who falls under the RPAA?

A business generally needs Bank of Canada registration when all four of the following apply:

1. It performs at least one of the five statutory payment functions as a service or business activity.
2. The function relates to an electronic funds transfer in fiat currency or another prescribed unit.
3. It has a Canadian place of business or both directs services at and performs services for Canadian end users.
4. No entity-based or activity-based exclusion applies.

The five payment functions are:

• Providing or maintaining an account for an end user
• Holding funds for an end user
• Initiating an electronic funds transfer at an end user’s request
• Authorizing an electronic funds transfer, or transmitting, receiving, or facilitating payment instructions
• Providing clearing or settlement services

The definition is deliberately broad. A company does not necessarily need to hold customer funds to be a PSP. Merely maintaining payment credentials for future transfers, initiating transfers, or transmitting payment instructions may be sufficient. Bank of Canada

Foreign PSPs are also covered when they direct and provide services to Canadian end users. Being regulated elsewhere does not create automatic equivalence or exemption. Bank of Canada

RPAA has moved beyond registration

The Bank of Canada began its RPAA registration process in November 2024. The substantive supervision requirements came into force on September 8, 2025.

From that date, in-scope PSPs were expected to have:

• An operational-risk and incident-response framework
• Documented controls over systems, data, personnel and third parties
• Business-continuity and recovery arrangements
• Incident-detection, investigation and remediation procedures
• A safeguarding framework if they hold end-user funds
• Regulatory reporting procedures
• Governance and senior-officer accountability

The Bank said that it was supervising close to 1,500 applicants when the substantive regime began. Its 2025 annual report subsequently referred to approximately 1,600 PSPs entering the supervisory system. Bank of Canada

Because the Bank’s live registry and applicant lists are dynamic, it does not publish a stable total on the main registry page. An independent October 30, 2026 extraction of the Bank’s data counted approximately:

• 1,789 registered PSPs
• 419 applications still under review
• 57 refusals
• 15 revocations

Those totals should be treated as a dated snapshot rather than official static statistics, but they illustrate the size of the new regulatory population. reqodata.com

The transitional divide matters

A PSP that applied before September 8, 2025, may generally continue operating while its application remains under review, until it receives a registration or refusal decision.

A company applying on or after September 8, 2025, must receive its registration before performing the regulated payment activities.

That creates two very different types of “pending RPAA” company:

• A grandfathered applicant that may continue operating while being reviewed
• A later applicant that cannot lawfully begin the in-scope activity until registered

A buyer, bank, processor, or prospective partner should not accept the phrase “RPAA application pending” without checking when the application was filed and whether the company qualifies for transitional treatment. Bank of Canada

Safeguarding is becoming the decisive requirement

For PSPs that hold end-user funds, RPAA safeguarding is likely to become one of the most important commercial dividing lines in the Canadian market.

A PSP must safeguard those funds through either:

• A valid trust arrangement using an account that is not used for another purpose, or
• A segregated safeguarding account supported by qualifying insurance or a guarantee

The PSP must maintain accurate end-user records and ledgers, plan for liquidity demands, identify legal and operational risks, establish reimbursement arrangements for insolvency, designate a responsible senior officer, and review the safeguarding framework at least annually.

An independent safeguarding review is required at least once every three years. bankofcanada.ca

A normal operating account at a CDIC-member bank is not sufficient. CDIC protects against the bank’s insolvency; it does not protect end users against the PSP’s insolvency. The Bank of Canada may also request a written legal opinion confirming that the trust arrangement is valid. Bank of Canada

This has immediate implications for banking access. A PSP may need:

• An operating account
• A settlement account
• One or more properly structured safeguarding or trust accounts
• Contractual acknowledgment from the account provider
• Reconciliation processes
• Clear ownership and control over customer funds
• A legal opinion supporting the arrangement

Obtaining a FINTRAC registration is usually easier than obtaining this banking infrastructure.

The Bank of Canada has demonstrated that it will intervene

The RPAA is not merely a registry project.

In February 2026, the Bank of Canada issued an immediate temporary order directing XTM Inc. and affiliated entities to stop retail payment activities. The Bank cited serious concerns about the safeguarding of client funds and prohibited transactions and withdrawals involving accounts associated with the company’s platform.

Ten days later, the Bank issued a revised order allowing activities to recommence under the supervision of a court-appointed monitor and subject to specified conditions. Bank of Canada

That was an important signal: where the Bank believes customer funds are at risk, it can intervene in the operating business rather than merely issue a future penalty.

The Bank has also begun publishing notices of violation against Canadian and foreign businesses that performed retail payment activities without registration. Several received C$0 penalties after applying and mitigating the breach, but the violations were still publicly recorded. The list includes remittance, payroll, merchant-payment and expense-management businesses. Bank of Canada

The October 27, 2026 decision involving Charge Anywhere LLC is particularly instructive. Charge Anywhere is based in New Jersey, yet the Bank issued a notice of violation because it had performed retail payment activities without first being registered under the RPAA. The company subsequently filed an application and took steps that the Bank considered sufficient to mitigate potential harm, so the administrative monetary penalty was set at C$0. The violation nevertheless remains part of the Bank’s public enforcement record.

That decision reinforces the RPAA’s extraterritorial reach. A PSP does not need a Canadian company, office, employee or bank account to fall within the regime. A foreign business that directs covered services at Canadian end users and actually provides those services can be required to register. Filing only after the Bank makes contact may reduce the financial penalty in an early-remediation case, but it does not guarantee that the business will avoid a public notice of violation.

The initial C$0 decisions should not be mistaken for permanent leniency. They appear to reflect early-stage enforcement and prompt remediation. Repeated, deliberate, or harmful non-compliance could produce a different result.

Canada is creating a federal stablecoin perimeter

On October 24, 2026, the federal government published proposed Stablecoin Regulations under the Stablecoin Act and related amendments to the Retail Payment Activities Regulations. The consultation remains open until December 23, 2026, and the government intends the framework to come into force in fall 2027. Canada Gazette

The framework addresses two legally distinct roles:

1. Issuing a stablecoin that is made available in Canada
2. Performing payment functions using that stablecoin

The issuer would be supervised under the Stablecoin Act. A PSP that uses a prescribed stablecoin to perform payment functions could separately fall within the RPAA. A business that performs both roles may therefore face overlapping Bank of Canada obligations, along with FINTRAC registration and reporting requirements where its activities constitute dealing in virtual currency or another prescribed MSB service.

Under the proposed framework, a non-bank issuer would generally need to register with the Bank of Canada before issuing a covered stablecoin. The issuer would be expected to:

• Maintain reserve assets denominated in the stablecoin’s reference currency
• Keep the market value of those assets at least equal to the value of outstanding stablecoins at the end of each day
• Hold reserves only in prescribed high-quality liquid assets
• Offer redemption at one-to-one value in the reference currency
• Complete redemption within three business days after a valid request
• Impose no minimum redemption amount
• Keep redemption fees at or below 1%
• Publish a clear redemption policy
• Maintain governance, risk-management, data-security, recovery and resolution arrangements
• Meet public disclosure and reporting requirements

Eligible reserve assets would be limited to instruments such as demand deposits, very short-dated government debt, overnight reverse-repurchase agreements and money-market funds composed entirely of eligible assets. The proposal is therefore designed to prevent an issuer from treating the reserve as a general investment portfolio or using it to chase yield.

The proposed rules would also prohibit an issuer from paying interest or yield merely because a person holds the stablecoin. Issuers could not present the token as legal tender, a bank deposit, evidence of a deposit, government guaranteed or covered by public deposit insurance. Those restrictions are intended to prevent a stablecoin from being marketed as though it carried the protections of sovereign money or an insured bank account.

The federal definition of issuance is broader than simply writing code that mints tokens. The proposed regulations focus on the entity that controls both creation and making the stablecoin available for purchase. This means contractual delegation of distribution, technology or reserve administration may not remove the issuer from the regulatory perimeter when it retains practical control over the arrangement.

National security is also built into the regime. The Minister of Finance could review an application, impose conditions or undertakings, require or prohibit specified conduct, or direct the Bank of Canada to refuse registration. The initial review period could extend to 180 days and could be prolonged through additional 180-day periods.

Existing issuers would receive only limited transitional relief. An issuer operating when the regime comes into force would need to submit its application within 30 days to continue issuing while the application is considered. A refusal would require it to cease issuance.

For payment companies, the central lesson is that avoiding formal issuance does not necessarily avoid regulation. A wallet provider, payment facilitator, remittance business, settlement platform or merchant-payment company may remain an RPAA-regulated PSP when it performs covered payment functions using a prescribed stablecoin. The company’s role must be mapped across minting, distribution, custody, transfer initiation, payment-instruction messaging, redemption, reserve control, safeguarding and settlement.

The proposed regime also changes the acquisition market. A Canadian company described as a “stablecoin business” will need to be valued according to what it actually controls. A buyer must determine whether it is acquiring an issuer, a distributor, a custodian, an RPAA-regulated PSP, a FINTRAC-registered virtual-currency dealer, a technology provider—or several of those roles at once.

RPAA makes acquisitions considerably harder

An RPAA-registered company cannot simply be sold and have the purchaser inherit the registration without further regulatory action.

Before another person or entity acquires control, the PSP must:

1. Submit a new registration application reflecting the proposed ownership and post-acquisition structure.
2. Undergo the Bank of Canada review.
3. Undergo the applicable Department of Finance national-security process.
4. Receive re-registration under the new application.
5. Complete the acquisition only after re-registration has been granted.

The Bank expressly warns that it will not expedite its process merely because the parties agreed to an aggressive closing date.

Once the application is deemed complete:

• The Bank has up to 45 days for aspects of its refusal assessment.
• The Minister may have 60 days to decide whether to commence a national-security review, with extensions possible.
• A full national-security review can take up to 180 days and can also be extended.

These are maximum statutory periods rather than standard processing promises, but they make regulatory approval a genuine closing condition. Bank of Canada

This substantially changes the market for “RPAA-registered companies for sale.” A seller cannot credibly promise immediate regulatory continuity after a stock transfer.

FINTRAC also requires registration information—including owners, directors, senior management, agents, locations and activities—to remain current. Relevant changes generally need to be reported within 30 days. New owners and senior personnel may require criminal-record checks and eligibility verification. FINTRAC – Canada.ca

A purchase agreement should therefore distinguish clearly between:

• Signing
• FINTRAC updates and confirmations
• RPAA re-registration
• National-security clearance
• Banking consent
• Safeguarding-account continuity
• Processor and partner consent
• Final closing

What this does to the Canadian MSB acquisition market

The market is separating into three categories.

1. Registry-only companies

These companies possess a FINTRAC registration but have little or no demonstrable operating infrastructure.

They may lack:

• A credible banking relationship
• Transaction history
• Regulatory reporting history
• A completed effectiveness review
• Working transaction monitoring
• RPAA registration
• A safeguarding arrangement
• Processor or payment-rail access
• Experienced compliance personnel

Their value should decline.

The principal asset is an entry in a public registry that may need to be updated, renewed, examined, or revoked. If the buyer introduces a new business model, countries, owners, products, agents or virtual-currency activity, the historical registration provides limited regulatory comfort.

2. Transitional RPAA applicants

These companies filed before September 8, 2025, and may continue operating while awaiting a decision.

They can have commercial value, but the buyer must determine:

• Whether the original filing was complete
• Whether national-security screening is outstanding
• Whether the Bank has requested additional information
• Whether the company has already implemented RPAA controls
• Whether the proposed purchase triggers a new application
• Whether the transitional operating right survives the contemplated transaction

The last point is especially important. An acquisition of control triggers re-registration. The buyer cannot assume that a seller’s pending or grandfathered status can simply be transferred.

3. Operational, dual-registered companies

The premium assets will be companies that have:

• Active FINTRAC registration
• Active RPAA registration
• A clean ownership and control record
• A compliant operational-risk framework
• A defensible safeguarding arrangement
• Reliable reconciliation
• Complete annual and incident reporting
• An operating bank account
• A safeguarding or trust account
• Processor and payment-rail relationships
• Actual transaction history
• Evidence of AML reporting and case management
• A clean or remediated examination history

These businesses offer something materially more valuable than registration: a functioning regulatory and banking platform.

If you are weighing a purchase, the Canadian MSBs and other regulated companies listed on DealHarbor’s Licenses for Sale are a practical place to see what is on the market. Read every listing against the three categories above, and test it against the due-diligence checklist below before you treat it as a finished asset.

Banking access may improve—but only for the strongest firms

Neither FINTRAC nor Bank of Canada registration obliges a bank to open or maintain an account.

Canadian banks remain responsible for their own AML, sanctions, fraud, reputational, correspondent and operational risks. A bank can decide that an MSB’s products, countries, owners, customers, virtual-asset exposure, agents or transaction volumes exceed its risk appetite.

More enforcement can therefore produce two opposing effects.

First, credible RPAA supervision may make established PSPs easier to distinguish from informal or weakly controlled operators.

Second, publicly visible penalties, revocations and notices of violation may make banks more cautious about the entire sector.

There is evidence of improved infrastructure access for stronger firms. Interac has broadened participation in Interac e-Transfer to qualifying PSPs that are both registered under RPAA and registered with FINTRAC. Interac Corp.

That is significant. Dual registration may increasingly become a prerequisite for direct or enhanced payment-system access.

But registration is merely the entrance ticket. Banks and payment-system operators will still examine capital, liquidity, ownership, controls, safeguarding, fraud performance, technical resilience and transaction behavior.

The agent and white-label markets will face closer scrutiny

Many Canadian MSB structures rely on agents, mandataries, program managers, white-label distributors or foreign fintech clients.

These arrangements are not prohibited, but the principal entity must demonstrate actual oversight.

FINTRAC’s strengthened MSB framework requires eligibility verification and criminal-record checks for specified principals and agents. Registration information must include detailed information about agents and locations. The MSB remains responsible for ensuring that its AML obligations are performed across the network.

Under RPAA, a PSP’s operational-risk framework must also account for agents, third-party service providers, processors, cloud providers and outsourced functions. Changes to important third-party arrangements may need to be reported to the Bank.

The commercial model in which a registered Canadian company lends its regulatory identity to multiple unrelated programs without controlling onboarding, monitoring, reporting, settlement and customer funds will become increasingly difficult to defend.

A sustainable sponsorship model requires:

• Contractual authority
• Data access
• Approval rights
• Transaction visibility
• Monitoring capability
• Audit rights
• Incident notification
• Safeguarding clarity
• Termination rights
• Evidence that the sponsor can stop prohibited activity

Québec remains a separate licensing jurisdiction

An MSB operating in Québec may also require a Québec money-services-business license administered by Revenu Québec.

The Québec regime covers:

• Currency exchange
• Funds transfer
• Money orders, traveler’s checks and bank drafts
• Check cashing
• Traditional ATMs
• Cryptoasset ATMs

The licensing process includes security-clearance reports from the Sûreté du Québec for the business and associated persons. Revenu Québec conducts inspections, investigations and enforcement and maintains a separate public register. Revenu Québec

A federal FINTRAC registration does not replace the Québec license.

An RPAA registration does not replace it either.

British Columbia is the next provincial layer to watch

British Columbia enacted its Money Services Businesses Act in 2023. The framework contemplates registration, background checks, reporting, investigations and penalties administered by the BC Financial Services Authority.

However, as of October 27, 2026, the substantive provisions remained not in force. They require commencement by regulation. bclaws.gov.bc.ca

BC should therefore be treated as pending regulation—not as a currently operational MSB licensing regime.

Once implemented, a business operating nationally could potentially face:

1. FINTRAC registration and AML supervision
2. Bank of Canada RPAA registration and payments supervision
3. Québec licensing if operating in Québec
4. British Columbia registration if operating in BC
5. Additional securities, consumer, privacy or lending regulation depending on its products

Due diligence for a Canadian MSB or PSP acquisition

A serious acquisition review should now cover at least the following. (For the wider process, see our guide to buying a Canadian MSB.)

FINTRAC status

• Confirm the exact legal name and registration number.
• Verify the current status directly in FINTRAC’s registry.
• Confirm the original registration and expiry dates.
• Determine whether a renewal is pending.
• Confirm whether FINTRAC has issued unanswered clarification requests.
• Review all changes submitted since registration.
• Compare registered services with actual products.
• Compare registered agents and locations with the operating network.
• Confirm that all owners, controllers, directors and senior officers are correctly disclosed.
• Review criminal-record-check compliance.

AML program

• Obtain the current policies and procedures.
• Obtain every previous version relevant to the examination period.
• Review the enterprise and product risk assessments.
• Review the two-year effectiveness reviews.
• Confirm that identified deficiencies were remediated.
• Test customer-identification and beneficial-ownership files.
• Test high-risk-client controls.
• Review suspicious-transaction investigations and decisions.
• Reconcile transaction volumes against regulatory reports.
• Review large cash, electronic funds transfer and virtual-currency reporting.
• Review sanctions and terrorist-property controls.
• Examine training records and employee understanding.
• Review agent monitoring and audit files.

Regulatory history

• Obtain all correspondence with FINTRAC.
• Identify previous examinations, questionnaires and self-attestations.
• Obtain findings letters and remediation commitments.
• Identify voluntary declarations of non-compliance.
• Check public penalty and revocation records.
• Determine whether any matter was referred to law enforcement.
• Confirm whether an administrative appeal is pending.

RPAA status

• Verify whether the business is registered, pending, refused or revoked.
• Confirm the original application date.
• Determine whether transitional operating treatment applies.
• Review the payment functions disclosed in the application.
• Compare those functions with actual operations.
• Review national-security information and outstanding requests.
• Review annual reports submitted to the Bank.
• Review incident notifications.
• Review significant-change and new-activity notices.
• Confirm that changes in owners, directors, data storage and third parties were reported.

Stablecoin activity

• Identify every stablecoin issued, distributed, held, transferred, redeemed or used for payment.
• Determine which entity controls token creation and making the token available in Canada.
• Determine whether any group entity will require Stablecoin Act registration.
• Map which entities perform RPAA payment functions using the stablecoin.
• Confirm whether FINTRAC treats the relevant entity as dealing in virtual currency.
• Review reserve ownership, custody, permitted investments and daily valuation.
• Test whether outstanding tokens are covered at least one-to-one at the end of each day.
• Review redemption timing, fees, minimums, banking arrangements and customer disclosures.
• Identify any yield, reward or marketing feature that could conflict with the proposed prohibition on interest for holding the stablecoin.
• Review insolvency, recovery, resolution and reserve-segregation arrangements.
• Assess national-security ownership, control, data and jurisdictional issues.
• Determine whether transitional filing deadlines will apply when the regime comes into force.

Safeguarding

• Determine whether the business holds end-user funds.
• Identify every account through which those funds pass.
• Confirm whether safeguarding relies on trust, insurance, guarantee or a combination.
• Obtain the trust agreement and legal opinion.
• Review account-provider acknowledgment.
• Reconcile safeguarded balances against end-user ledgers.
• Review daily shortfall and exception reports.
• Examine liquidity procedures.
• Review insolvency-reimbursement procedures.
• Check the most recent independent safeguarding review.

Operational resilience

• Review the operational-risk framework.
• Review business continuity and disaster recovery.
• Examine incident-response plans and testing.
• Review cybersecurity assessments.
• Review access controls and segregation of duties.
• Identify critical vendors and concentration risks.
• Review cloud, processor and banking dependencies.
• Examine transaction-recovery and reconciliation procedures.
• Review actual incidents and corrective actions.

Banking and commercial infrastructure

• Confirm whether accounts will survive a change of control.
• Obtain written bank or processor consent where required.
• Verify safeguarding-account continuity.
• Confirm access to payment rails.
• Review reserves, rolling holds and collateral.
• Check whether contracts contain regulatory-change or ownership-change termination rights.
• Confirm whether Interac, card, ACH, EFT or international payout arrangements are assignable.
• Identify customer or partner concentration.

What happens next

The most likely direction over the coming year is increased supervisory intensity on both sides of the market.

FINTRAC is likely to:

• Send more risk questionnaires and information demands
• Verify self-attestations more aggressively
• Conduct more targeted MSB and virtual-asset examinations
• Test whether compliance programs are effective in practice
• Use registration revocation against unresponsive or ineligible firms
• Apply the stronger post-March 2026 penalty regime
• Demonstrate more measurable outcomes following the Auditor General’s criticism

The Bank of Canada is likely to:

• Examine first-cycle annual reports
• Test safeguarding arrangements
• Request legal opinions for trust structures
• Review material incidents and notification timing
• Publish more notices of violation
• Scrutinize unregistered foreign PSPs
• Examine acquisitions, major shareholders and data-storage changes
• Use orders quickly where end-user funds appear endangered
• Develop supervisory guidance for stablecoin issuers
• Bring stablecoin payment functions expressly within RPAA supervision
• Review issuer reserves, redemption, governance and recovery arrangements
• Apply national-security screening to stablecoin registration and control changes

The acquisition market is likely to become more selective. Weak, dormant or registry-only companies will remain available, but buyers should attach less value to them. Businesses with dual registration, banking, safeguarding and a credible operating record will command a larger premium.

The central conclusion

Canada has not stopped being an attractive jurisdiction for payments and money services. It is becoming a more substantive one.

That is good for legitimate operators, but only if they are prepared for the costs and controls of operating a regulated financial business.

The value hierarchy is changing:

1. A FINTRAC number by itself has limited value.
2. FINTRAC registration plus a real AML program is better.
3. FINTRAC and RPAA registration together are stronger.
4. Dual registration with safeguarded funds, clean regulatory history and banking access is materially more valuable.
5. A company with all of the above plus payment-rail access and transaction history is the real regulated asset.
6. A stablecoin business has additional value only when its issuer, reserve, redemption, RPAA, FINTRAC and national-security positions are all defensible.

The Canadian market is therefore not disappearing. It is maturing.

The question is no longer, “Is the company registered?”

The question is, “Can the company survive an examination, protect customer funds, obtain banking, pass a change-of-control review, and continue operating after the regulator begins asking difficult questions?”

Most important sources

• FINTRAC 2025–26 Annual Report
• FINTRAC 2025–26 Results by the Numbers
• Auditor General: FINTRAC’s Activities to Combat Money Laundering
• FINTRAC Assessment Manual
• FINTRAC’s New Administrative Monetary Penalty Framework
• FINTRAC Modernization and Upcoming Changes
• Bank of Canada Retail Payments Supervisory Framework
• Bank of Canada PSP Registry
• Bank of Canada RPAA Registration Criteria
• Bank of Canada Safeguarding Guideline
• Bank of Canada Acquisition-of-Control Requirements
• Bank of Canada RPAA Enforcement Decisions
• Canada Gazette: Proposed Stablecoin Regulations
• FATF/APG Mutual Evaluation of Canada 2026