At a glance

1. A foreign business can become a foreign money services business (FMSB) without incorporating in Canada. The FINTRAC test focuses on whether the business provides covered money services and directs those services at clients in Canada.

2. FINTRAC registration and Bank of Canada registration are separate. FINTRAC supervises AML obligations under the PCMLTFA. The Bank of Canada supervises retail payment activities under the RPAA. A foreign payment business may need both. [1, 2]

3. FINTRAC registration is free, but the application must be complete. An FMSB file includes ownership and governance evidence, criminal record checks, service and volume information, a compliance officer and a Canadian representative for service. [3]

4. A foreign PSP within the RPAA must be registered before it performs retail payment activities. It must identify a Canadian agent or mandatary for service, pay the applicable application fee and prepare operational-risk, incident-response and, where relevant, safeguarding controls. [2, 4]

5. Registration does not replace operating readiness. Banking, settlement, customer verification, transaction reporting, travel-rule data, record keeping, third-party oversight and end-user-fund protection must work before launch.

6. The safest sequence is to map the service, customer, funds and data flows first; run the FINTRAC and RPAA tests separately; then build one evidence pack that reconciles both applications to the product that will actually launch.

Foreign fintech and crypto founders frequently search for a “Canada MSB licence” because the route appears to offer access to a large market without a Canadian subsidiary. The phrase is commercially useful but legally incomplete. FINTRAC registers MSBs and FMSBs for anti-money-laundering supervision; it does not issue a general financial-services licence or approve the business model. A payment provider may also fall within the Retail Payment Activities Act and require separate registration with the Bank of Canada. [1, 5]

This guide explains the 2027 decision process for a business with no place of business in Canada. It covers the foreign MSB test, the parallel RPAA test, the application evidence, Canadian representatives, operating controls and the launch sequence that prevents one registration from being mistaken for the whole regulatory perimeter.

1. What is a foreign money services business in Canada?

A Canadian MSB has a place of business in Canada. An FMSB does not have a place of business in Canada but directs and provides covered services to clients in Canada. FINTRAC identifies the covered services as foreign-exchange dealing, remitting or transmitting funds, issuing or redeeming certain negotiable instruments, dealing in virtual currency and crowdfunding-platform services. [1]

The practical analysis has three parts:

1. Service: does the company provide at least one covered money service?
2. Geography: does it direct the service at persons or entities in Canada?
3. Delivery: does it actually provide that service to clients in Canada?

A foreign incorporation does not remove the obligation. A website, onboarding flow, Canadian-dollar product, local marketing, Canadian customer support or Canadian counterparties may all be relevant to how the service is directed and delivered. The conclusion should be based on the complete commercial model rather than one website disclaimer.

2. FINTRAC registration is not a general licence

FINTRAC states that registration confirms only that the business has met the statutory registration requirement. It is not an endorsement, a certificate of quality or permission to conduct every financial activity in Canada. FINTRAC does not approve transactions, hold customer funds, recover funds or assess the commercial practices of an MSB. [5]

This matters in discussions with banks, payment partners and customers. The correct statement is that the business is registered as an FMSB with FINTRAC and is subject to the applicable AML obligations. It should not represent itself as a FINTRAC-licensed bank, payment institution or investment firm.

The scope must also remain accurate. If the company adds virtual-currency dealing, a new transfer product, agents, locations, owners or senior managers, it must assess whether its registration information and compliance controls need to be updated.

3. Do you also need Bank of Canada registration?

The RPAA uses a different regulatory test. A business must assess whether it is a payment service provider, performs a retail payment activity, falls within the geographic scope and is not covered by an exclusion. The Bank identifies five payment functions: maintaining an account for an end user, holding end-user funds, initiating an electronic funds transfer, authorising or transmitting payment instructions, and providing clearing or settlement services. [2]

A business outside Canada falls within the geographic test where it both performs retail payment activities for an end user in Canada and directs retail payment activities at persons or entities in Canada. Registration with FINTRAC does not satisfy this requirement. The Bank expressly states that an in-scope foreign PSP must register even if it is already registered as an FMSB. [2, 4]

The tests overlap but are not identical. Virtual-currency activity can trigger FINTRAC even where a transfer is not an RPAA retail payment activity in fiat currency. Conversely, a technology company facilitating fiat payment instructions may fall within the RPAA even if its precise role requires separate analysis under the FINTRAC framework.

4. The double-registration decision matrix

Do not classify the business from the marketing label alone. The same “payment platform” can produce different outcomes depending on whether it holds funds, maintains balances, initiates transfers, acts as agent, provides only software or contracts directly with the end user.

5. What FINTRAC requires in an FMSB application

FINTRAC's current process begins with a pre-registration request. A compliance officer then provides the registration form and submission route. FINTRAC accepts complete applications only; incomplete applications are closed and must be resubmitted. [3]

The information can include:

• bank-account information;
• the compliance officer and number of employees;
• incorporation and entity information;
• owners, directors and senior management;
• expected annual transaction value by service;
• locations and operating addresses;
• the Canadian representative for service;
• documents confirming existence, ownership, control and governance; and
• criminal record checks and certified translations where required.

For an entity, FINTRAC requires criminal record checks for the chief executive officer, president, directors and persons who directly or indirectly own or control 20% or more. The checks must be issued by a competent authority in the country of residence and be no more than six months old when submitted. Non-English or non-French checks require an appropriately certified translation and evidence of the translator's status. [3]

The secure document-transfer link issued during the process can expire. Treat the application as a controlled filing: freeze the corporate data, assign owners to each document and submit one reconciled pack rather than collecting evidence after the upload window opens.

6. Canadian representatives: similar words, separate appointments

An FMSB must provide a Canadian representative for service to FINTRAC. This is an individual in Canada appointed to receive notices and documents on behalf of the FMSB. [3]

A foreign PSP under the RPAA must identify an agent or mandatary in Canada authorised to receive notices and orders from the Bank of Canada. The appointment appears similar, but it belongs to a separate regime and should be documented for that purpose. [4]

The business should define:

• the legal entity making each appointment;
• the exact statutory role and authority;
• the Canadian address and reliable delivery process;
• how urgent notices are escalated to management and compliance;
• backup coverage during absence; and
• how changes are reported to the relevant regulator.

A mail-forwarding arrangement without an escalation procedure is operationally weak. Regulatory deadlines continue to run even when the notice is sitting in an unattended inbox.

7. Build the FINTRAC compliance programme before launch

Registration is only one obligation. FINTRAC requires an MSB or FMSB to implement a compliance programme that supports customer identification, beneficial-ownership work, business relationships, ongoing monitoring, politically exposed person checks, record keeping and required reporting. [1, 6]

The operating model should identify a compliance officer with authority and access to customer, transaction and product information. It should include documented policies and procedures, an enterprise risk assessment, role-based training and the prescribed review of the programme's effectiveness.

Crypto businesses should connect customer risk to wallet and blockchain evidence. Payment businesses should connect customer files to sender, beneficiary, corridor, settlement and reconciliation data. In both models, the company must be able to explain why a transaction was accepted, escalated, rejected or reported.

8. Prepare the RPAA application and operating framework

The Bank of Canada uses PSP Connect for applications, fees, updates and reporting. Application information includes the business structure, owners, debtholders, key staff, payment functions, agents, affiliates, material third parties, end-user numbers, funds held, safeguarding methods and plans for operational risk and incident response. [4]

The applicable registration fee is non-refundable and adjusted under the regulations; confirm the Bank's fee bulletin for the filing year. Payment of the fee starts the assessment process but does not authorise the business to operate.

For a launch after 8 September 2025, the Bank states that the PSP must receive a registration decision before performing retail payment activities. This makes sequencing critical. Product build, banking and commercial launch dates should not assume that submitting an application is the same as being registered. [7]

The RPAA operating file should include:

• a documented operational-risk and incident-response framework;
• roles, resources, controls, monitoring, recovery and testing;
• third-party and cloud-provider risk management;
• incident classification and notification procedures;
• significant-change assessment and notice procedures;
• annual reporting data and ownership; and
• a safeguarding framework if the PSP holds end-user funds.

9. Safeguarding end-user funds

A PSP that holds end-user funds must protect them until they are withdrawn or transferred. The Bank identifies two routes: hold the funds in trust in a trust account, or hold them in a segregated account supported by insurance or a guarantee. The PSP must also maintain a written safeguarding framework. [8]

The design should be settled with the bank, legal advisers and operations team before launch. The ledger must identify the amount held for each end user, reconcile to safeguarding accounts and support timely withdrawals. Corporate operating expenses should not be paid from the safeguarding account.

The framework should address liquidity, insolvency, legal and operational risks, access rights, reconciliation, shortfalls, provider failure and independent review. A contract labelled “client account” does not by itself prove that the arrangement meets the RPAA requirements.

10. Banking and payment partners will assess more than registration

A FINTRAC number helps establish the regulatory perimeter, but a bank still needs to understand the business. It may ask for ownership, management experience, source of capital, customer countries, transaction corridors, projected volumes, fiat and virtual-currency flows, compliance controls, reporting, safeguarding and third-party providers.

The strongest banking pack uses the same facts as the regulatory applications. If FINTRAC shows one annual volume, the RPAA application another and the bank deck a third, the discrepancy becomes a credibility problem. Maintain one approved data sheet for customers, countries, products, limits, volumes, counterparties and funds flows.

Banking should therefore run in parallel with registration preparation, not after approval. The company needs to know whether its proposed settlement, safeguarding and reporting architecture can be supported by real providers.

11. Timeline and launch sequence

Neither route should be planned around a guaranteed approval date. FINTRAC closes incomplete applications and may request clarification. The Bank may request additional information and the registration process includes national-security review. Complexity, ownership, criminal record checks, translations, representatives, funds flows and the quality of the operating framework all affect readiness.

Do not acquire customers, accept funds or perform payment activities merely to demonstrate traction while a required registration is pending. The correct pre-launch boundary depends on the actual activities performed, not the label “pilot” or “beta”.

12. Foreign MSB application checklist

1. Identify every legal entity that contracts with Canadian customers or performs a payment function.
2. Map each service against FINTRAC's MSB categories.
3. Document how the service is directed at and provided to clients in Canada.
4. Run the separate four-part RPAA registration test.
5. Identify fiat, virtual-currency, customer-fund and payment-instruction flows.
6. Confirm the FMSB representative for service in Canada.
7. If the RPAA applies, appoint the Canadian agent or mandatary for notices and orders.
8. Freeze the ownership, director, senior-management and compliance-officer population.
9. Obtain valid criminal record checks and certified translations where required.
10. Prepare incorporation, governance, ownership and control evidence.
11. Reconcile products, countries, annual values and transaction volumes across both filings.
12. Build the FINTRAC compliance programme and operating procedures.
13. Build the RPAA operational-risk and incident-response framework.
14. If end-user funds are held, finalise safeguarding, ledger and reconciliation arrangements.
15. Prepare banking and settlement evidence before commercial launch.
16. Test reporting, record retrieval, travel-rule data and regulatory-notice escalation.

Frequently asked questions

Can a non-Canadian company register as an MSB with FINTRAC?

Yes. A company without a place of business in Canada may qualify as an FMSB where it directs and provides covered money services to clients in Canada. It must register before operating and meet the applicable AML obligations. [1, 3]

Does an FMSB need a Canadian company?

Not solely to fit the FMSB definition. The applicant can be a foreign entity. A Canadian structure may still be chosen for commercial, banking, tax, employment or operational reasons and changes the regulatory analysis.

Is FINTRAC registration the same as an RPAA registration?

No. FINTRAC registration concerns AML supervision. RPAA registration concerns retail payment functions and is administered by the Bank of Canada. A business may need both. [2, 4]

Can an FMSB operate while the Bank of Canada application is pending?

For businesses applying after 8 September 2025, the Bank states that an in-scope PSP must be registered before performing retail payment activities. Submission alone is not the registration decision. [7]

Does a crypto exchange need RPAA registration?

FINTRAC can apply to dealing in virtual currency. RPAA analysis depends on the payment functions and in-scope electronic funds transfers, particularly the fiat legs, accounts, instructions and funds held. A crypto label does not decide the result.

How much does FINTRAC registration cost?

FINTRAC does not charge a registration fee. The business still bears the cost of corporate evidence, criminal record checks, translations, representatives, compliance design, technology, banking and ongoing operation. [1, 3]

How long does foreign MSB registration take?

There is no safe universal approval promise. Completeness, ownership complexity, checks, translations and clarification requests affect the process. Plan the launch around evidence readiness and regulatory decisions rather than a marketing deadline.

Do I need a compliance programme before applying?

The company should design and operationalise the programme before launch. Registration without working customer, monitoring, reporting and record-keeping controls does not satisfy the continuing FINTRAC obligations.

Related DM Strategy guides

• Canada MSB and PSP Compliance, covering FINTRAC, the RPAA and current reporting requirements.
• Canada MSB vs US MSB, comparing registration, cost and state licensing exposure.
• Cross-Border Payment Licence, comparing EMI, PI, MSB and PSP routes.
• Crypto Exchange Licensing Jurisdictions Compared, comparing Canada with the EU, Switzerland, Dubai, the US and Panama.
• Canadian MSB Registration, outlining DM Strategy's registration and operating support.

Key primary sources

Disclaimer

This article is for information only and is not legal, tax, regulatory or banking advice. The applicable registrations and obligations depend on the contracting entities, services, customer locations, payment functions, funds flows, agency relationships and exclusions. Rules, forms, fees and supervisory guidance can change; confirm the current requirements before filing or launching.

DM Strategy helps foreign fintech, payment and crypto founders classify Canadian activities, prepare FINTRAC and Bank of Canada applications, design AML and RPAA controls and align the regulatory file with banking and settlement infrastructure. If you plan to serve Canadian clients, book an introductory call with DM Strategy before the product and customer flows are fixed.