AML and KYC Basics When You Accept Bitcoin

Canadian businesses are increasingly curious about compliance when they start accepting bitcoin. The terms AML (anti-money laundering) and KYC (know your customer) come up constantly, but the obligations they create depend heavily on what type of business you run and how you handle bitcoin. This guide explains how these frameworks apply in Canada, which regulator you need to know, and where the thresholds actually sit.

This is an educational overview, not legal or compliance advice. Rules change, so confirm current requirements directly with FINTRAC, a compliance consultant, or a lawyer familiar with Canadian financial regulations.

What AML and KYC Actually Mean

AML stands for anti-money laundering. It refers to the set of laws, regulations, and internal procedures businesses use to detect and report activity that might involve disguising the proceeds of crime as legitimate funds. KYC is a component of AML: it describes the process of verifying who your customers are so that you can recognize unusual or suspicious behaviour.

In Canada, the primary AML legislation is the Proceeds of Crime (Money Laundering) and Terrorist Financing Act, commonly shortened to PCMLTFA. The regulator responsible for enforcing it is FINTRAC, the Financial Transactions and Reports Analysis Centre of Canada. FINTRAC does not investigate crime directly; its role is to collect and analyze financial intelligence, then pass relevant information to law enforcement when the legal threshold is met.

KYC in practice means collecting and verifying information about customers, typically their name, address, date of birth, and a piece of government-issued identification. The depth of verification required depends on the type of transaction and the type of business.

How FINTRAC Classifies Bitcoin Businesses

FINTRAC regulates a category of business called a Money Services Business, or MSB. Since June 2020, the definition of MSB in Canada explicitly includes entities that deal in virtual currency. The operative phrase is "dealing in virtual currency," which FINTRAC defines as the exchange or transfer of virtual currency.

This matters because the obligations that come with MSB status are significant. A business classified as an MSB must:

• Register with FINTRAC before conducting business
• Develop and maintain a written AML compliance program
• Appoint a compliance officer
• Conduct a risk assessment of their business
• Implement ongoing training for staff
• Keep detailed transaction records
• File specific reports with FINTRAC

The important distinction for many Canadian merchants is that simply accepting bitcoin as payment for goods or services does not, on its own, make you an MSB. If you sell handmade furniture and a customer pays with bitcoin, you are accepting payment, not exchanging or transferring virtual currency as a business activity. FINTRAC's guidance describes the MSB trigger as businesses whose primary or core activity involves virtual currency exchange or transfer services.

That said, if your business model starts to blend into exchange-like activity, or if you begin offering services like peer-to-peer transfer facilitation, the classification question becomes more complex. When in doubt, FINTRAC publishes guidance documents and has an outreach function for businesses trying to determine their status.

KYC Requirements: When Identity Verification Applies

For businesses that are classified as MSBs dealing in virtual currency, FINTRAC sets specific thresholds that trigger identity verification obligations.

Under the current framework, an MSB must verify the identity of a client when a virtual currency transaction is equivalent to CAD $1,000 or more. This applies whether the transaction is a single exchange or multiple transactions that the business has reason to believe are related to each other.

Beyond the $1,000 threshold, MSBs are also required to conduct enhanced due diligence for politically exposed persons (PEPs), heads of international organizations, and their family members or close associates. These are categories of clients considered to carry higher inherent risk.

For businesses that are not MSBs, formal KYC obligations under FINTRAC do not apply in the same structured way. However, they may still be subject to reporting obligations in certain situations, which is covered in the next section.

A practical note: many businesses that accept bitcoin, even those that are not MSBs, implement informal KYC practices as part of fraud prevention and chargebacks mitigation. This is separate from any regulatory requirement and is a business decision rather than a compliance obligation.

Reporting Obligations and Key Thresholds

Even if your business is not an MSB, certain reporting requirements may still apply if you are a reporting entity under the PCMLTFA for another reason (for example, if you are a financial entity, a securities dealer, or a real estate broker).

FINTRAC reports relevant to virtual currency include:

Report Type	Trigger
Virtual Currency Transaction Report (VCTR)	Receiving virtual currency equivalent to CAD $10,000 or more in a single transaction
Suspicious Transaction Report (STR)	Reasonable grounds to suspect the transaction is related to money laundering or terrorist financing, regardless of amount
Large Cash Transaction Report (LCTR)	Receiving CAD $10,000 or more in cash (relevant if a customer uses cash to purchase crypto from you)

The VCTR was introduced in June 2021 and applies specifically to virtual currency received by reporting entities. A Suspicious Transaction Report carries no minimum threshold and must be filed whenever there are reasonable grounds to suspect a connection to crime or terrorist financing, even if the transaction appears otherwise routine.

For merchants who accept bitcoin as payment but are not reporting entities, the STR obligation does not apply in the same way. However, operating a business always carries general criminal law obligations. You cannot knowingly accept proceeds of crime, regardless of whether you are a regulated entity.

Core Elements of a Basic AML Compliance Program

If your business is an MSB, FINTRAC requires a written compliance program. Even for businesses that fall outside MSB classification, having documented procedures for handling unusual transactions is good practice.

A basic program typically covers five areas:

Policies and procedures. Written documentation of how the business identifies customers, handles high-risk transactions, and escalates concerns internally. These need to reflect the actual risk profile of the business.

Risk assessment. A written analysis of the money laundering and terrorist financing risks your business faces, based on factors like the types of customers you serve, the geographic areas you operate in, and the channels through which transactions occur.

Compliance officer. Someone responsible for overseeing the program, keeping it current, and managing required filings. For small businesses, this can be the owner.

Ongoing training. Staff need to understand how to spot suspicious activity and what to do when they encounter it. The training requirements scale with the size and complexity of the operation.

Record keeping. FINTRAC sets specific timelines for retaining transaction records, typically five years. See the companion article on recordkeeping for bitcoin payments at tax time for details on what to track and how long to keep it.

FINTRAC offers compliance guidance documents and a self-assessment tool on its website. The content is technical but comprehensive.

Frequently Asked Questions

Does accepting bitcoin as payment automatically make my business subject to FINTRAC registration?

Generally, no. Accepting bitcoin for goods or services does not on its own make a business an MSB under Canadian law. The MSB classification applies to businesses whose activities include exchanging or transferring virtual currency as a service. Merchants who simply receive bitcoin as one payment method among several are typically outside the MSB definition, though the specifics depend on the full scope of the business activity.

What is the difference between an STR and a VCTR?

A Virtual Currency Transaction Report (VCTR) is filed based on transaction size -- when a reporting entity receives virtual currency worth CAD $10,000 or more in a single transaction. A Suspicious Transaction Report (STR) is based on reasonable grounds to suspect money laundering or terrorist financing and has no minimum dollar amount. Both can apply to the same transaction if the amount and the circumstances both trigger reporting.

Can I run a bitcoin ATM or exchange kiosk without registering with FINTRAC?

No. Operating a virtual currency exchange service, including a bitcoin ATM or kiosk, requires MSB registration with FINTRAC before you begin. Operating without registration is an offence under the PCMLTFA and can result in penalties. FINTRAC has a public MSB registry where you can verify whether an operator is registered.

Does AML compliance affect how I report bitcoin income to the CRA?

AML and tax reporting are separate obligations managed by different agencies. FINTRAC handles AML; the CRA handles tax. Accepting bitcoin creates taxable events under CRA rules regardless of whether you have any FINTRAC obligations. For an overview of the tax side, see bitcoin taxes for Canada businesses explained and the guide on whether you charge GST/HST on bitcoin sales.

What happens if I receive what looks like a suspicious bitcoin payment?

If you are a reporting entity under the PCMLTFA, you have an obligation to file a Suspicious Transaction Report with FINTRAC. If you are not a reporting entity, you still cannot knowingly accept the proceeds of crime under Canadian criminal law. In either case, it is reasonable to document what made the transaction look unusual and, if needed, consult a lawyer before deciding how to proceed. FINTRAC guidance notes that reasonable grounds to suspect does not require certainty -- it is a lower threshold than proof.