Fintech & Digital Payments Compliance in Canada

Canada is open to non-bank payment and remittance businesses, including those operating entirely online and from abroad. There is no single fintech licence: a firm assembles its permissions activity by activity, from federal anti-money laundering registration, federal payments supervision and, in some provinces, provincial licensing.

The principal regulators are the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) for anti-money laundering, the Bank of Canada for retail payment supervision, and Revenu Québec for money-services licensing in Québec.

The biggest obstacle for a new entrant is time and scrutiny at registration: Bank of Canada registration depends on a national security review coordinated by the Department of Finance, and FINTRAC charges no registration fee, accepts only complete applications and requires criminal record checks for senior managers and significant owners before a money services business may operate.

1. Who regulates this sector

Lending, mortgage and consumer credit rules are set mainly by each province, and provincial securities regulators govern crypto trading platforms.

2. Licensing and authorisation

FINTRAC registration as a money services business

A business is a money services business if it has a place of business in Canada and offers at least one MSB service: foreign exchange dealing, remitting or transmitting funds, issuing or redeeming money orders and similar instruments, or dealing in virtual currency. FINTRAC treats invoice payment services and intermediated payments for goods and services as remitting or transmitting funds. A business with no place of business in Canada that directs these services at, and provides them to, people in Canada is a foreign money services business with the same core obligations. Either must register with FINTRAC before it begins to operate, even if it already holds a provincial licence. FINTRAC charges no registration fee, accepts only complete applications and requires criminal record checks for the chief executive, president, directors and anyone owning or controlling 20% or more (FINTRAC, Register your MSB; PCMLTFA s. 11.1).

Bank of Canada registration as a payment service provider

The RPAA covers anyone performing payment functions as a service or business activity that is not incidental to another business: holding accounts or funds for end users, initiating or authorising electronic funds transfers, transmitting payment instructions, and clearing or settlement (RPAA s. 2). It applies to providers in Canada and to foreign providers that direct retail payment activities at people in Canada (s. 5). A provider must be registered with the Bank of Canada before it performs any retail payment activity (s. 23), and a new application is needed before a change of control (s. 24). Banks, credit unions, insurers and trust and loan companies are excluded (s. 9). The Minister of Finance may review an application on national security grounds, and the Bank may not register the applicant while that review is pending (ss. 34 to 38).

Provincial licences

Québec: anyone operating a money-services business for remuneration must hold a licence of the appropriate class under the Money-Services Businesses Act (CQLR c. E-12.000001, ss. 1, 3 and 4). The six classes are currency exchange, funds transfer, traveller's cheques and money orders, cheque cashing, automated teller machines and cryptoasset automated teller machines. The application is filed through a respondent resident in Québec, including for businesses with no establishment there (s. 5), and the Sûreté du Québec issues security clearance reports on the business, its officers, owners and relevant staff (s. 8). Licensees must show their licence number in every app and website used for the business (s. 22.1). Revenu Québec administers the licences and the public register (Revenu Québec). British Columbia: the Money Services Businesses Act, SBC 2023, c. 19 [Adopted, effective date not yet set] was assented to on 11 May 2023, but Parts 1 to 5 are not in force as of the BC Laws text current to 20 October 2026.

3. AML, KYC and customer due diligence

Money services businesses and foreign money services businesses are reporting entities under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA), S.C. 2000, c. 17, and the Proceeds of Crime (Money Laundering) and Terrorist Financing Regulations, SOR/2002-184. Registration with the Bank of Canada under the RPAA does not create anti-money laundering obligations by itself: they arise from the MSB activities a provider performs.

Compliance programme

Every MSB must implement a compliance programme. Since 26 March 2026 the programme must be "reasonably designed, risk-based and effective" (PCMLTFA s. 9.6(1.1)).

Know your client

Verify identity at the transaction thresholds below, take reasonable measures for politically exposed persons, determine third parties and obtain and confirm beneficial ownership for entities. Anonymous accounts and clients are prohibited (s. 9.2).

Business relationship

An MSB enters a business relationship the second time it must verify a client within five years, or when it signs a service agreement with an entity. Ongoing monitoring then applies.

Travel rule

MSBs have travel rule requirements for both electronic funds transfers and virtual currency transfers.

When an MSB must verify identity

Source: FINTRAC, When to verify the identity of persons and entities: MSBs (modified 9 September 2025).

Reporting and records

MSBs file Suspicious Transaction Reports, including suspected sanctions evasion, as soon as practicable once reasonable grounds to suspect are established, with no monetary threshold. They file Large Cash Transaction Reports and Large Virtual Currency Transaction Reports for $10,000 or more, and Electronic Funds Transfer Reports when they initiate, or finally receive for remittance, an international transfer of $10,000 or more, all subject to the 24-hour aggregation rule. Listed Person or Entity Property Reports cover property of terrorist or sanctioned persons. Records and report copies are kept for at least five years.

Québec's parallel identity duty

Québec licensees also verify customers under the Regulation under the Money-Services Businesses Act (CQLR c. E-12.000001, r. 1): for funds transfers of $1,000 or more, currency exchange or money orders of $3,000 or more, and every cheque cashed (s. 8), collecting date of birth and occupation (s. 9). Customer information is kept for six years, one year longer than the federal rule (Act s. 30; r. 1, s. 16), and transactions suspected of breaching the Act are notified to the Minister (Act s. 31).

4. Identity verification and onboarding

Section 105(1) of the PCMLTF Regulations sets the permitted methods for verifying a person, which FINTRAC groups into five:

• Government-issued photo identification: a federal, provincial or foreign government document with name and photograph, confirming they are the person's.
• Credit file: a Canadian credit file at least three years old, drawing on more than one source, matching name, address and date of birth, searched at the time of verification.
• Dual process: two of name and address, name and date of birth, or confirmation of a deposit, prepaid or credit account, each from a different reliable source.
• Affiliate or member: confirmation that an affiliated financial entity or member institution previously verified the person.
• Reliance: on measures already taken by another reporting entity or a supervised affiliated foreign entity, under a written agreement; the relying firm remains responsible.

Since 1 October 2025, an agent or mandatary may verify a person on a firm's behalf using the photo ID, credit file or dual-process method. The PCMLTF Regulations specify no liveness or presentation-attack standard and no assurance level; FINTRAC expects the compliance programme to document how authenticity, validity and the person-to-photo match are established.

5. Digital channels: what's different

Bottom line: the identification rules are largely channel-neutral, but a photo ID used for a customer who is not physically present must be authenticated with technology rather than human judgement, and both federal registration regimes reach foreign apps that target people in Canada.

Technology-based document authentication

FINTRAC's temporary flexibility for remote photo ID ended on 31 March 2022; since then, authenticating a document when the person is not physically present requires more than human judgement. FINTRAC's guidance gives the example of having the customer scan the document with a phone camera and using technology to compare its characteristics, security features (holograms, barcodes, embedded chips) and markers against known features, then confirming that it is valid and current. The authenticity check and the person-to-photo check do not have to happen at the same time.

Québec's own remote methods

For a remote transaction, the Québec regulation lists three methods: the number of an account or document the business itself issued after verifying the customer with an original photo ID; confirmation that the customer holds a deposit account at a financial institution that verified them at opening; or confirmation of a transaction on a bank card issued in the customer's name (r. 1, s. 10). These sit alongside the federal methods rather than replacing them, so a flow serving Québec customers must satisfy both.

Reach into foreign apps

Both federal regimes apply by targeting rather than location. FINTRAC has penalised several foreign MSBs, including virtual currency platforms, for failing to register, and the RPAA applies to providers without a Canadian place of business that direct retail payment activities at people in Canada.

Pending changes

Universal enrolment with FINTRAC for all reporting entities [Adopted, effective date not yet set] and the Stablecoin Act [Adopted, effective date not yet set] will add registration steps for digital businesses; neither has a coming-into-force date as of October 2026.

6. Data protection and biometrics

Federally, the Personal Information Protection and Electronic Documents Act (PIPEDA) governs the identity data a fintech collects. The Office of the Privacy Commissioner's Guidance for processing biometrics (2025) treats biometric information as generally sensitive, says express consent will usually be the appropriate form, requires the purpose to be appropriate even with consent, and expects biometric data to be destroyed from all locations, including back-ups and third-party processors, once it is no longer needed.

In Québec, anyone who verifies or confirms identity through a process that captures biometric characteristics must disclose it to the Commission d'accès à l'information, and creating a biometric database must be disclosed at least 60 days before it is put into service. Selfie-to-document facial comparison captures biometric characteristics, so onboarding flows that use it for Québec customers should plan for this disclosure. British Columbia's Personal Information Protection Act applies to BC businesses alongside PIPEDA.

FINTRAC's guidance notes that personal information collected for anti-money laundering purposes is subject to restrictions on other uses. Bill C-36, which would enact the Protecting Privacy and Consumer Data Act and amend PIPEDA, [Bill, not enacted] has been at second reading in the House of Commons since its introduction on 15 June 2026.

7. Sector-specific obligations

Safeguarding end-user funds

A payment service provider that holds end-user funds must keep them in a trust account used for no other purpose, or in a dedicated account covered by insurance or a guarantee at least equal to the funds held, or in a prescribed manner (RPAA s. 20). Risk management and safeguarding frameworks have been mandatory since 8 September 2025, together with incident notification and other reporting to the Bank. Applicants still awaiting registration must already comply.

Agents and partners

An agent or mandatary of a registered payment service provider is outside the RPAA when acting within that authority and included on the agent list the provider files with the Bank (RPAA s. 10). Under the PCMLTFA, an MSB that uses agents remains responsible for their compliance, and an agent acting exclusively for another reporting entity will be exempt from universal enrolment.

Open banking

The Consumer-Driven Banking Act [Partly in force], enacted on 26 March 2026, creates a framework for consumers and businesses to share their financial data securely with accredited providers of their choice. Registered payment service providers may be accredited as participants, and the Bank of Canada will supervise them. Most operative provisions await an order in council, and proposed regulations have been published in the Canada Gazette, Part I.

8. Risk indicators and red flags

FINTRAC indicators relevant to MSBs

• Document cannot be authenticated: the identification presented fails authenticity checks or appears altered.
• Shared identifiers: the same address, phone number or hotel address used by apparently unrelated clients.
• Name variations: aliases or changing names from one transaction to another.
• Transaction altered after ID request: amounts changed once identification is asked for.
• Little knowledge of the payee: vague or withheld payee details, or funds collected by a third party.
• Indifference to cost: no concern about fees or exchange rates above posted levels.
• Unusual counterparties: transfers to locations inconsistent with the client's profile.
• Reporting avoidance: statements or behaviour aimed at avoiding reports.

Source: FINTRAC, Money laundering and terrorist financing indicators: money services businesses (modified 24 November 2025).

9. Enforcement and penalties

FINTRAC. Since 26 March 2026, the PCMLTFA caps an administrative monetary penalty at $4 million per violation for an individual and $20 million for an entity, and all violations on one notice at the greater of those amounts and 3% of gross global revenue (group revenue for affiliates) (s. 73.1). The AMP Regulations set ranges of up to $40,000 for minor, $4 million for serious and $20 million for very serious violations. A compliance order violation may reach the greater of $30 million and 3% of revenue for an entity. Violations committed before 26 March 2026 remain under the former, lower scale. Criminal fines were also raised: operating without the required FINTRAC registration can lead to a fine of up to $5 million on indictment, and failing to file required reports to up to $10 million on summary conviction.

Recent actions against MSBs include a penalty of $176,960,190 on Xeltox Enterprises Ltd. (Cryptomus) on 16 October 2025 for 2,593 contraventions, and $19,552,000 on Peken Global Limited (KuCoin), a foreign MSB, on 28 July 2025; both are under appeal to the Federal Court. MP Technology Services Ltd., a MoonPay subsidiary found to be a foreign MSB, received $536,853.35 on 20 November 2025, also under appeal.

Bank of Canada. Under the Retail Payment Activities Regulations, penalties reach $1 million for a serious violation and $10 million for a very serious one, with daily penalties for some filing failures. On 17 February 2026 the Bank issued a temporary order requiring XTM Inc. to stop all retail payment activities after its financial statements showed a shortfall in safeguarded end-user funds; an amended order of 27 February allowed it to resume under a court-appointed monitor. The Bank announced on 12 June 2026 that it will publish notices of violation.

Québec. Operating without a licence or breaching the Act's obligations carries fines of $15,000 to $200,000 for a business, doubled for repeat offences, plus administrative penalties for failures such as not verifying identity (Act ss. 65.1, 67 and 70).

10. Recent changes and what to watch

• 15 June 2026: Bill C-36, Protecting Privacy and Consumer Data Act [Bill, not enacted]. Introduced and at second reading in the House of Commons; it would reshape the federal privacy law that governs onboarding data.
• 26 March 2026: new FINTRAC penalty framework and compliance programme standard [In force]. Penalties up to 40 times higher for new violations; compliance agreements in every penalty case.
• 26 March 2026: universal FINTRAC enrolment [Adopted, effective date not yet set]. Every reporting entity not already registered will need to enrol and renew.
• 26 March 2026: Stablecoin Act [Adopted, effective date not yet set]. Issuers will register with FINTRAC as MSBs dealing in virtual currency and appear on a Bank of Canada registry.
• 26 March 2026: RPAA payment function extended to tokenised payment instruments and private keys [Adopted, effective date not yet set]. Wallet and tokenisation providers should test their scope.
• 1 October 2025: stronger MSB registration framework, agents permitted to verify identity, and sanctioned-property reporting [In force].
• 8 September 2025: RPAA risk management, safeguarding and reporting duties [In force]. Applicants must comply before registration is granted.

11. What this means for identity verification

Remote onboarding in Canada needs a documented path for each of the regulatory methods actually offered. For photo ID, the flow must authenticate the document with technology, check validity and expiry, and link the live person to the photo; facial comparison against a selfie or a live video comparison meets FINTRAC's examples, while a video call alone does not. Accept federal, provincial and foreign government photo documents; municipal documents do not qualify. Credit file and dual-process checks offer a document-free alternative. For Québec customers, add a bank-account or bank-card confirmation step to meet the provincial remote rule, and disclose any biometric verification to the CAI in advance.

Verification is transaction-driven, so a product can let customers register before full checks but must complete them before the first transfer or virtual currency transaction of $1,000 or more. Keep authenticity results, match outcomes and the method used as part of the client record for at least five years, and delete biometric templates once their purpose is served. Re-verify when identifiers change or when FINTRAC's indicators point to identity doubt, and screen against Canadian sanctions lists at onboarding and continuously.