FINTRAC Regulatory FAQs for MSBs and FMSBs
What does FINTRAC registration involve, and what comes next? For Money Services Businesses (MSBs) and Foreign MSBs (FMSBs), understanding Canada’s Anti-Money Laundering and Anti-Terrorist Financing (AML/ATF) requirements can raise questions about registration, client checks, reporting and ongoing compliance.
In this article, the SALVUS Regulatory Compliance team in Canada answers common questions about registration, ongoing obligations and practical compliance planning for MSBs and Foreign MSBs (FMSBs).
1. Registration and Regulatory Scope
2. Ongoing Obligations in Practice
3. Turning Requirements into Business Processes
4. How SALVUS Can Help
We regularly share bite-sized insights on LinkedIn such as those found in this article
1. Registration and Regulatory Scope
Which activities can require registration?
FINTRAC’s current registration guidance covers:
- Foreign exchange dealing.
- Remitting or transmitting funds.
- Issuing or redeeming money orders, traveller’s cheques or similar instruments, subject to applicable exclusions.
- Dealing in virtual currency.
- Crowdfunding platform services.
- Transporting currency or specified negotiable instruments.
- Cheque cashing.
- Acquirer services for private automated banking machines.
Certain payment processing models fall within remitting or transmitting funds. Classification depends on what the business does, including its contractual responsibilities and payment flows.
What distinguishes an MSB from an FMSB?
An MSB has a place of business in Canada. Indicators include Canadian incorporation, a physical location, or employees, agents or branches in Canada.
An FMSB has no place of business in Canada, directs qualifying services at persons or entities in Canada and provides those services to clients in Canada.
A foreign headquarters or Canadian customer alone does not settle the classification.
Does registration mean FINTRAC approves business?
No. FINTRAC registration is not a licence, endorsement or assurance that a business is compliant. Businesses should describe their status accurately and assess any additional federal, provincial or territorial requirements relevant to their activities. fintrac-canafe.canada.ca
When must a business register and renew?
An MSB or FMSB must register before operating the services that trigger registration.
Registration is valid for two years and must be renewed before expiry. Changes to registration information generally must be reported within 30 days. A business that ceases to meet the definition must cease its registration within 30 days. fintrac-canafe.canada.ca
Does FINTRAC registration replace RPAA registration?
No. A business may also be a payment service provider subject to the Retail Payment Activities Act (RPAA), supervised by the Bank of Canada.
The RPAA focuses on matters including operational risk, incident response and safeguarding end-user funds where applicable. Assess both regimes separately; FINTRAC registration does not fulfil Bank of Canada registration requirements.
2. Ongoing Obligations in Practice
What must the Compliance Program contain?
The required elements include:
- Appointed Compliance Officer.
- Current written policies and procedures.
- A documented business risk assessment.
- An ongoing training program with a documented delivery plan.
- An effectiveness review with a documented plan.
For an entity, a senior officer must approve the policies and procedures. Since March 26, 2026, programs must be reasonably designed, risk-based and effective.
| Area | What Businesses Need to Address |
|---|---|
| Client Due Diligence | Identify clients and verify identity when required; address beneficial ownership, third parties and politically exposed person or head of an international organization requirements as applicable. |
| Risk and Monitoring | Apply business relationship and ongoing monitoring requirements, with enhanced measures for high-risk situations. |
| Records | Keep the prescribed client, transaction and reporting records for the applicable retention periods and make them retrievable. |
| Transfers | Apply travel rule requirements to relevant electronic funds and virtual currency transfers. |
| Oversight | Maintain training evidence, test controls and resolve identified deficiencies. |
Which reports may be required?
Depending on the activities and circumstances, reports include:
- Suspicious Transaction Reports (STRs).
- Large Cash Transaction Reports (LCTRs).
- Large Virtual Currency Transaction Reports (LVCTRs).
- Qualifying international Electronic Funds Transfer Reports (EFTRs).
- Listed Person or Entity Property Reports.
Apply the relevant thresholds, aggregation rules, exceptions and deadlines for each report.
An STR is not limited to large transactions. It applies to attempted or completed transactions where there are reasonable grounds to suspect a connection to money laundering, terrorist financing or sanctions evasion.
A reporting process should explain how concerns are investigated, documented, and escalated.
What applies when engaging agents or mandataries?
MSBs must verify eligibility and obtain and review the required criminal record checks before engaging with a new agent or mandatary.
Where the agent is an entity, checks cover its CEO, president, directors and individuals who directly or indirectly own or control 20% or more. Continued engagements require renewed eligibility verification and updated checks within 30 days after the second anniversary of the most recent verification and review.
These obligations took effect on October 1, 2025. Agents engaged before that date are subject to a transition deadline of October 1, 2027.
An ineligible person or entity must not be engaged or must cease acting on the MSB’s behalf. This agent eligibility test is separate from customer beneficial ownership requirements.
Is an External Audit required every two years?
A documented effectiveness review is required at least every two years.
An external audit is not mandatory in every case: the review is performed by an internal or external auditor, or by the business itself if it has no auditor. Impartiality is the best practice.
For an entity, the prescribed review information must reach a senior officer in writing within 30 days after completion.
3. Turning Requirements into Business Processes
Map Services Before Selecting Controls
Start with a clear description of the services, customers, jurisdictions, and payment flows. Identify which company receives instructions, handles funds, performs checks and submits reports.
This helps establish a regulatory scope and avoids gaps between the business and its providers.
Assign Owners and Retain Evidence
For each obligation, identify its trigger, responsible person, procedure, deadline, and required records.
Practical evidence includes onboarding decisions, investigation notes, training records, and management follow-up. Technology can support these tasks, but controls still need oversight and testing.
Reassess Changes Before Implementation
New services, providers, agents or customer markets may change both risk exposure and regulatory obligations.
Assess the impact before launch and update registrations, procedures and training where required. A periodic review calendar can help keep routine obligations visible.
4. How SALVUS Can Help
At SALVUS, our Regulatory Compliance team in Canada supports businesses with regulatory scope assessments, registration preparation and practical implementation of ongoing AML/ATF obligations. We help translate regulatory requirements into procedures that reflect how the business operates.
Our support includes FINTRAC MSB registration, RPAA registration, AML/ATF frameworks, regulatory gap assessments, business risk assessments, policies and procedures, and ongoing compliance support.
We can also assist businesses establishing or expanding in Canada with practical local presence solutions, including office subleasing and fractional AMLCO appointments, subject to the applicable requirements and agreed scope.
Contact us at info@salvusfunds.com to explore how our Canada team can support your business with MSB and RPAA registration, FINTRAC and Bank of Canada compliance, internal audit, entities for sale, and M&A advisory.
#StayAhead
The information provided in this article is for general information purposes only. You should always seek professional advice suitable to your needs.