Crypto & Virtual Assets Compliance in Canada

Canada is open to crypto businesses, but only on a registered basis, and the federal and provincial layers apply at the same time. Federally, dealing in virtual currencies is a money services business activity under the anti-money laundering statute, supervised by the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC). Provincially, a platform whose customers hold contractual rights to crypto is generally dealing in securities or derivatives and must register with the securities regulator of each province where it has clients.

The principal regulators are FINTRAC, the provincial securities commissions (led in practice by the Ontario Securities Commission, the British Columbia Securities Commission and Québec's Autorité des marchés financiers) and the Canadian Investment Regulatory Organization. The Bank of Canada is preparing to supervise stablecoin issuers.

The biggest obstacle for a new entrant is the securities layer: the interim restricted-dealer route has closed to new applicants, so a new trading platform now applies directly for investment dealer registration and CIRO membership, with the capital, custody and compliance infrastructure that implies.

1. Who regulates this sector

Securities regulators in the other provinces and territories also register platforms serving their residents; Ontario, British Columbia and Québec are the reference provinces here. The Office of the Superintendent of Financial Institutions (OSFI) governs banks' crypto exposures, not platforms.

2. Licensing and authorisation

FINTRAC registration as a money services business

The Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) applies to persons and entities with a place of business in Canada that are in the business of "dealing in virtual currencies" (s. 5(h)(iv)), and to foreign businesses without a place of business in Canada that direct that service at, and provide it to, clients in Canada (s. 5(h.1)(iv)). Both must register with FINTRAC (s. 11.1) before they begin to operate, even if a province has licensed them, and must renew every two years (s. 11.19). Applications include criminal record checks for the chief executive, president, directors and anyone owning or controlling 20% or more, issued no more than six months before the application; a foreign money services business must also name a representative resident in Canada for service of FINTRAC notices. Banks and other reporting entities may not open or maintain an account for an unregistered foreign money services business (s. 9.31).

Securities registration for trading platforms

Provincial securities regulators treat a crypto asset trading platform (CTP) as within securities law where the user's contractual right to the crypto asset may itself be a security or derivative (a "crypto contract"). The Ontario Securities Commission requires such platforms operating in Ontario to register and has taken enforcement action against unregistered offshore platforms. On 6 August 2024 the Canadian Securities Administrators and CIRO announced that the time-limited restricted dealer route and new pre-registration undertakings would end, and that platforms are expected to register as investment dealers and become CIRO Dealer Members. CIRO membership requires a Canadian entity, registration in each jurisdiction where the business requires it, and a membership application reviewed by CIRO staff and approved by its Board.

Registered platforms operate under individual exemptive relief decisions whose terms and conditions bind them.

Québec cryptoasset ATMs

Québec's Money-Services Businesses Act requires a Revenu Québec licence for each activity class, including operating cryptoasset automated teller machines, subject to Sûreté du Québec security clearance. British Columbia's Money Services Businesses Act (2023) is not yet in force.

3. AML, KYC and customer due diligence

A virtual currency dealer is a reporting entity under PCMLTFA s. 5(h) or (h.1). A platform registered as a dealer is authorised under provincial legislation to deal in securities, which also brings it within s. 5(g) (securities dealers); as a securities dealer it must verify an individual account holder before the first transaction other than an initial deposit.

Identity verification triggers

Verify identity when a person asks to exchange CAD 1,000 or more in virtual currency, to transfer CAD 1,000 or more, or is the beneficiary of a virtual currency remittance of CAD 1,000 or more (Regulations s. 95(1)(d), (e), (f)). Verification takes place at the time of the transaction (s. 105(7)(a)).

Business relationship and monitoring

A business relationship begins at the second required verification, or when a service agreement is signed with an entity client (s. 4.1). The firm must record its purpose and intended nature and carry out risk-based ongoing monitoring (ss. 145, 123.1).

Politically exposed persons

Determine whether a person is politically exposed when they transfer, or receive as beneficiary, CAD 100,000 or more in virtual currency, and at and periodically during any business relationship (s. 120).

Records

Keep records of transfers and remittances of CAD 1,000 or more and a transaction ticket for every virtual currency exchange, for at least five years (ss. 36, 148).

Reporting

Amounts in virtual currency are converted to Canadian dollars at a Bank of Canada rate or, where none is published, at the rate the business uses in its ordinary course (s. 125); FINTRAC expects that rate to be documented in the compliance policies. Ministerial directives on Russia, Iran and North Korea add requirements: under the Russia directive, any virtual currency transaction involving roubles is high risk and identity must be verified at any amount.

4. Identity verification and onboarding

Section 105 of the PCMLTF Regulations sets the permitted methods for verifying a person's identity, and documents must be authentic, valid and current (s. 105(5)):

• Government-issued photo identification: a federal, provincial or foreign (non-municipal) document with name and photograph, confirmed to be the person's.
• Credit file: a Canadian credit file at least three years old, drawing on more than one source, matching name, address and date of birth. FINTRAC accepts automated matching; the search must be made at the time of verification.
• Dual process: two of name and address, name and date of birth, or name and a confirmed deposit, prepaid or credit account, each from a different reliable source (not social media, not the client, not the firm).
• Affiliate or member and reliance: confirming a prior verification by an affiliated reporting entity, or relying on another reporting entity under a written agreement.

FINTRAC's guidance on methods to verify identity (modified 3 December 2024) states that when the person is not physically present, the firm must have a process to authenticate the photo ID, for example technology that checks its security features, and must confirm the name and photograph match the person, for example through a live video chat or a selfie compared to the document using facial recognition. Since 1 October 2025 an agent or mandatary acting under a written agreement may also verify the identity of entities; the reporting entity remains responsible.

Registered platforms add securities-law onboarding: a suitability assessment and a risk statement before trading. Account eligibility is not uniform: it is each platform's own criteria, described in its decision. Kraken's Canadian platform (2025) accepts Canadian residents aged 18 or over; Crypto.com's (2025) requires Canadian citizens or permanent residents aged 18 or over; Coinbase's (2024) accepts Canadian residents of the age of majority in their province. The common binding condition is that Canadian residents must use the platform's Canadian entity. Platforms that become CIRO Dealer Members also follow CIRO's know-your-client rule, which requires them to establish each client's identity and to identify beneficial owners of 25% or more of a corporate client within 30 days of account opening, restricting the account until they do (Investment Dealer and Partially Consolidated Rules, rules 3202, 3204 and 3206).

5. Digital channels: what's different

Bottom line: the AML thresholds are channel-neutral, but a remote photo ID check must use document authentication technology and a live-person match, and online platforms carry a securities registration burden that a cryptoasset ATM or over-the-counter desk does not automatically share.

Remote photo ID needs technology, not a glance

FINTRAC's guidance states that it is not enough only to view a person through a video conference. FINTRAC's notice of 31 January 2022 ended the temporary pandemic-era flexibility on 31 March 2022; since then, authenticating a photo ID that is not examined in person requires a process involving more than human judgement.

Investment limits are an online onboarding step

Exemptive relief decisions for registered platforms impose a 12-month net purchase limit, generally CAD 30,000, on crypto assets other than specified ones such as bitcoin and ether, so the platform must know the client's province and investor status at onboarding. Exempt provinces vary by decision: Alberta, British Columbia, Manitoba and Québec in a 2024 decision, with Saskatchewan added in 2025 decisions. One 2025 decision also sets CAD 100,000 for eligible, non-accredited investors.

6. Data protection and biometrics

The Personal Information Protection and Electronic Documents Act governs private-sector onboarding data in most provinces; Québec and British Columbia have their own private-sector laws. The Office of the Privacy Commissioner's guidance for businesses on biometrics (August 2025) treats biometric information that can uniquely identify a person as sensitive in any context, generally requiring express consent, a proportionate purpose, deletion when no longer needed (including vendor copies) and a real alternative. It prefers one-to-one verification, such as a selfie matched to a document.

In Québec, under the Act to establish a legal framework for information technology as explained by the Commission d'accès à l'information, biometric identity verification cannot be required: it needs express consent and an alternative method for people who refuse (s. 44), and the process must be declared to the Commission before use; a bank of biometric characteristics must be declared at least 60 days before it goes into service (s. 45). PCMLTFA verification records must still be kept for five years, so biometric templates need their own retention schedule.

Federal reform: Bill C-36, which would replace the private-sector part of PIPEDA with a Protecting Privacy and Consumer Data Act, was introduced on 15 June 2026 [Bill, not enacted].

7. Sector-specific obligations

Travel rule

Every virtual currency transfer for which a record is required must carry the name, address and any account or reference number of both the requester and the beneficiary, and the firm must take reasonable measures to ensure incoming transfers include them (Regulations s. 124.1(1)). Written risk-based policies must decide whether to suspend or reject a transfer that arrives without the information, and what follow-up applies (s. 124.1(2)). FINTRAC's travel rule guidance (modified 27 April 2022) does not set separate rules for self-hosted wallets, so transfers to or from them are handled through these risk-based policies.

Stablecoins

The Stablecoin Act (S.C. 2026, c. 3, Royal Assent 26 March 2026) [Adopted, effective date not yet set] will require non-financial issuers of stablecoins with interprovincial or international reach to register with the Bank of Canada, hold reserves, redeem at par and not pay interest or yield. Proposed Stablecoin Regulations published on 24 October 2026 [Proposed, 60-day comment period] would require reserves at least equal to outstanding coins, redemption within three business days with fees capped at 1%, and would bring platforms offering custodial wallets for prescribed stablecoins under Bank of Canada supervision as payment service providers; the stated intention is that the framework takes effect in fall 2027. FINTRAC states that stablecoin issuers will also register as money services businesses. Meanwhile, platforms may offer only value-referenced crypto assets that meet the conditions of their registration or relief.

Custody

Registered platform decisions require at least 80% of client crypto assets by value to be held in trust with an acceptable third-party custodian, segregated from the platform's own assets.

Tax reporting of users

Bill C-31, the Budget 2025 Implementation Act, No. 2 (first reading 6 May 2026) [Bill, not enacted], would implement the Crypto-Asset Reporting Framework: crypto-asset service providers would collect tax-residence self-certifications, check them against identity documents gathered under the PCMLTFA and file an annual return with the Canada Revenue Agency before 2 May covering the previous year, starting with calendar year 2027 as introduced. Senate committees reported on the bill's subject matter in October 2026.

8. Risk indicators and red flags

Virtual currency indicators from FINTRAC

• Clustered sign-ups: many accounts opened in a short period sharing an address, device, phone number or IP address.
• Anonymous contact details: email from an encrypted anonymous service; shared prepaid or VoIP numbers at cryptoasset ATMs.
• Obfuscation: funds linked to mixers, tumblers, darknet markets, ransomware or theft, or rapid hops through many addresses.
• Privacy coins: large Bitcoin-to-privacy-coin swaps or a portfolio mostly in privacy coins with no explanation.
• Unregistered peer-to-peer trading: the client's email tied to commercial-scale peer-to-peer advertisements.
• Structuring at ATMs: repeated transactions just under CAD 999 across machines, often between 9 p.m. and 3 a.m.
• High-risk off-ramps: funds sent to exchanges that do not perform KYC, including in Iran, Russia and Belarus.

9. Enforcement and penalties

FINTRAC imposes administrative monetary penalties per violation. For violations after 26 March 2026, the ranges are CAD 1 to 40,000 for a minor violation, CAD 1 to 4,000,000 for a serious violation and CAD 1 to 20,000,000 for a very serious violation (AMP Regulations s. 5). The cap per prescribed violation is CAD 4 million for an individual and CAD 20 million for an entity, and the total on one notice of violation is capped at the greater of CAD 20 million and 3% of the entity's gross global revenue, or the group's revenue where it is affiliated (PCMLTFA s. 73.1(2) to (4)). FINTRAC can also issue compliance orders; earlier violations stay under the former regime.

• Xeltox Enterprises Ltd. (Cryptomus), CAD 176,960,190, imposed 16 October 2025: 1,068 missed suspicious transaction reports and 1,518 missed large virtual currency reports in July 2024, plus failures on a ministerial directive, policies and risk assessment. The British Columbia Securities Commission had issued a temporary order against the same platform on 20 May 2025.
• Peken Global Limited (KuCoin), CAD 19,552,000, imposed 28 July 2025: failure to register as a foreign money services business, to file large virtual currency reports and to file suspicious transaction reports.

10. Recent changes and what to watch

• 24 October 2026: proposed Stablecoin Regulations and Retail Payment Activities Regulations amendments published [Proposed, 60-day comment period].
• 10 September 2026: OSFI finalises its crypto-asset capital and liquidity guideline for banks [Adopted, effective 1 Nov 2026 or 1 Jan 2027].
• 6 May 2026: Bill C-31 introduced with the Crypto-Asset Reporting Framework [Bill, not enacted].
• 26 March 2026: Strengthening Canada's Immigration System and Borders Act raises AMP maximums and adds compliance orders [In force].
• 26 March 2026: Stablecoin Act receives Royal Assent [Adopted, effective date not yet set].
• 1 October 2025: listed person or entity property reporting extended to Special Economic Measures Act listings, and agents may verify entities [In force].
• 6 August 2024: CSA and CIRO end the interim restricted dealer route for new platforms [In force].

11. What this means for identity verification

• Documents: federal, provincial or foreign national government photo ID; not municipal documents.
• Remote methods: document authentication plus a selfie or live face match; credit file and dual process as non-documentary fallbacks.
• Biometrics: express consent, a separate retention schedule for templates, an alternative method, and a declaration in Québec.
• Re-verification: at any amount under the Russia directive or on suspicion; PEP checks at CAD 100,000 transfers and periodically.
• Retention and eligibility: five years of verification records; capture province of residence (it drives investment limits) and, where the platform's criteria require it, citizenship or permanent residence status.