FINTRAC rules for businesses that accept bitcoin in Canada

If your business accepts bitcoin and handles it in ways that go beyond simple payment collection, FINTRAC may already have you in its sights. The rules are not complicated once you understand the two questions that matter: are you a Money Services Business, and what are your reporting thresholds?

This is educational information, not legal or compliance advice. FINTRAC's rules change, guidance documents get updated, and provincial rules can layer on top. Confirm current requirements with a compliance professional before acting.

Who FINTRAC actually regulates

FINTRAC is Canada's financial intelligence unit. Under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA), it oversees businesses that deal in financial transactions, including crypto. The relevant category for most bitcoin-accepting businesses is the Money Services Business (MSB).

You are an MSB under FINTRAC's rules if you deal in virtual currency in one of two ways:

• You exchange virtual currency for funds, other virtual currency, or other value
• You transfer virtual currency at the direction of a client

Selling a product and receiving bitcoin as payment does not, by itself, make you an MSB. A bakery that prices its bread in CAD and accepts bitcoin equivalent at checkout is getting paid, not dealing in currency. But once you start offering exchange services, holding crypto on behalf of clients, or processing transfers between parties, that changes.

FINTRAC's own published guidance draws this line, though the edges get fuzzy fast. If your business model sits anywhere near custody, exchange, or peer-to-peer transfers, get a legal read before assuming you fall outside the rules.

MSB registration and what it requires

If you are an MSB, you must register with FINTRAC before you start operations. There is no grace period once you meet the definition. Registration is done through the FINTRAC portal and must be renewed every two years.

Registration is the starting line, not the finish. Once registered, an MSB must maintain a compliance program with all of the following:

• A written compliance policies and procedures document
• A designated compliance officer
• An ongoing employee training program
• A risk assessment covering your clients, products, and geographic exposure
• An effectiveness review (internal audit or third-party) at least every two years

These are not checkbox items. FINTRAC conducts examinations and can issue administrative monetary penalties. Penalties can reach hundreds of thousands of dollars per violation, and repeat or serious violations can lead to criminal referrals.

For smaller businesses new to this, the FINTRAC compliance program requirements can feel like a lot of paperwork for a modest volume of transactions. They are. That's partly by design: the regime is meant to deter casual entry into high-risk financial activity.

Crypto AML rules: the "know your client" piece

Anti-money laundering (AML) obligations come down to knowing who your clients are and when to report unusual activity. For crypto MSBs in Canada, this means collecting identity information in specific circumstances.

When identity verification is required:

Situation	Threshold
Virtual currency exchange transaction	CAD $1,000 or more
Virtual currency transfer	CAD $1,000 or more
Suspicious transaction	Any amount
Large cash transaction associated with VC	CAD $10,000+ in a 24-hour period

"Large virtual currency transactions" (LVCT) are also a formal category: a single or aggregated transfer of CAD $10,000 or more in a 24-hour window must be reported to FINTRAC within five business days.

For ID verification, FINTRAC accepts several methods including government-issued photo ID reviewed in person, dual-process ID (two independent documents confirming name and address), credit file checks, and third-party verification services. Remote verification through certified platforms is permitted, which matters for businesses that operate online.

FINTRAC updated its virtual currency rules in 2022 to close gaps that had existed since the original 2014 regulations. The 2022 amendments added foreign MSB obligations, tightened the travel rule (see below), and clarified what counts as a "business relationship" for ongoing monitoring. If you are working from guidance that predates 2022, it may be out of date.

The travel rule for crypto transfers

The travel rule requires MSBs to collect and pass along certain information when transferring virtual currency of CAD $1,000 or more. It applies to both the sending and receiving side of a transfer.

The sending MSB must obtain and pass:

• The sender's name, address, and account number (or crypto wallet address)
• The recipient's name and account number or address

The receiving MSB must collect and retain that information. This is meant to create a paper trail that links transfers to identifiable people, the same way a wire transfer carries originator information.

In practice, this is harder with crypto than with bank wires because many wallets are non-custodial and pseudonymous. FINTRAC acknowledges this and has published technical guidance on compliant approaches, but the obligation exists regardless of how difficult it is to fulfill. Businesses that cannot reliably collect travel rule data on a given transfer type need to think carefully about whether they can offer that service at all.

Reporting obligations: what goes to FINTRAC and when

Registered MSBs must file four types of reports:

Suspicious Transaction Reports (STRs): Filed when there are reasonable grounds to suspect a transaction is related to money laundering or terrorist financing. There is no dollar threshold. An STR must be filed within 30 days of the suspicion arising, or within 3 days if there are reasonable grounds to suspect terrorist activity. The obligation to file does not depend on whether the transaction actually completes.

Large Virtual Currency Transaction Reports (LVCTRs): Filed for transfers of CAD $10,000 or more within a 24-hour period, within five business days of the transaction.

Terrorist Property Reports (TPRs): Filed immediately upon becoming aware that you possess or control property belonging to a listed terrorist group. No threshold.

Casino Disbursement Reports: Not relevant to bitcoin businesses.

STRs carry a "tipping off" prohibition: you cannot tell the client or a third party that you have filed or are considering filing an STR. This is a point where having legal counsel matters, because the prohibition interacts with normal client communication in ways that are not always intuitive.

Records related to all of these reports must be kept for at least five years. See recordkeeping for bitcoin payments at tax time for how FINTRAC's retention requirements overlap with CRA's.

What if you are not an MSB?

Most businesses that accept bitcoin as payment, without offering exchange or transfer services, fall outside the MSB definition. That means no FINTRAC registration requirement.

But it does not mean no obligations. CRA still expects you to track the CAD fair-market value of every bitcoin payment you receive, report it as income, and account for any capital gains when you dispose of the crypto. Those are CRA rules, not FINTRAC ones. You can read more about bitcoin taxes for Canadian businesses and GST/HST on bitcoin sales if you need the tax side of this picture.

The short version: FINTRAC governs whether you need a compliance program. CRA governs what you owe in tax. Both can apply at once if you are an MSB that also earns revenue.

FAQ

Does accepting bitcoin once or twice make me an MSB?

No. The MSB definition turns on the nature of your services, not the frequency of transactions. A retailer who accepts a handful of bitcoin payments as an alternative to cash is not an MSB. A business that offers to exchange bitcoin for CAD, even occasionally, is likely crossing the line.

Do foreign crypto exchanges serving Canadian clients have to register with FINTRAC?

Yes, since 2022. The PCMLTFA amendments extended MSB registration requirements to foreign businesses that direct services at Canadians. A non-Canadian exchange with Canadian users must register as a foreign MSB (FMSB) with FINTRAC. Many have not, which is an enforcement gap FINTRAC has said it intends to close.

What is the penalty for operating as an unregistered MSB?

Criminal penalties under the PCMLTFA can reach $2 million and/or five years in prison. Administrative monetary penalties for compliance failures range up to $1 million per violation in the most serious cases. The amounts have increased since the 2022 amendments.

Are bitcoin ATM operators MSBs?

Yes. A bitcoin ATM that exchanges cash for crypto (or vice versa) is dealing in virtual currency and meets the MSB definition. Operators must register, run a compliance program, verify identity for transactions over the relevant threshold, and file applicable reports. FINTRAC has specifically identified ATM operators in its published guidance.

Where do I find FINTRAC's actual published guidance?

FINTRAC publishes guidance documents on fintrac-canafe.gc.ca, including a dedicated section on virtual currency. The guidance is not legislation itself, but it reflects FINTRAC's interpretation of the PCMLTFA and is what examiners use. Read the guidance alongside the Act and regulations rather than treating either in isolation.