Key takeaways
- MSB registration (FINTRAC) targets money laundering and terrorist financing under the PCMLTFA.
- PSP registration (Bank of Canada) targets operational reliability and consumer protection under the RPAA.
- They are not interchangeable — many fintechs need both, depending on the activities they perform.
- MSB registration is free and renews every two years; PSP registration introduces annual reporting and fund-safeguarding duties.
Canada's financial regulatory landscape changed significantly with the Retail Payment Activities Act (RPAA). Financial service providers now have to understand two distinct frameworks: MSB registration with FINTRAC, and PSP registration with the Bank of Canada.
This guide compares the two regimes based on official information from FINTRAC and the Bank of Canada. It explains what each one covers, what compliance looks like, and — most importantly — how to work out whether your business needs one, the other, or both.
MSB vs PSP at a glance
The two regimes serve different purposes and are run by different regulators. This is the high-level comparison:
MSB registration under FINTRAC
What qualifies as an MSB?
FINTRAC defines a Money Services Business as an entity engaged in any of the following as a business, offered to the public:
- Foreign exchange dealing — converting one currency to another.
- Money transferring — remitting or transmitting funds by any means or network.
- Issuing or redeeming money orders, traveller's cheques, or similar negotiable instruments.
- Dealing in virtual currencies — virtual currency exchange or transfer services.
- Operating a virtual currency ATM.
Registration requirements
To register as an MSB, a business completes FINTRAC's online registration form (covering corporate structure, ownership, services, locations, agents, and financial information), submits to a "fit and proper" screening of its directors, officers, and owners (criminal records, ML/TF associations, prior compliance history), and renews every two years. There is currently no fee for MSB registration, domestic or foreign.
Reporting obligations
- Suspicious Transaction Reports (STRs) — within 30 days of detecting reasonable grounds to suspect ML/TF.
- Large Cash Transaction Reports (LCTRs) — within 15 days of cash transactions of $10,000 or more.
- Electronic Funds Transfer Reports (EFTRs) — within 5 business days of international EFTs of $10,000 or more.
- Large Virtual Currency Transaction Reports (LVCTRs) — within 5 business days of receiving virtual currency worth $10,000 or more.
- Terrorist Property Reports — without delay on detecting terrorist-controlled property.
Compliance requirements
Once registered, MSBs must maintain a compliance program (compliance officer, written policies, risk assessment, ongoing training, and an effectiveness review every two years), client identification procedures (transactions of $1,000+, FX of $3,000+, suspicious transactions, new account relationships), and record-keeping for a minimum of five years.
PSP registration under the Bank of Canada
What qualifies as a PSP?
Under the RPAA, a Payment Service Provider performs retail payment activities as a service or business. Retail payment activities include payment processing (authorisation, transmission, recording, settlement), clearing or settlement services, providing payment accounts, holding end-user funds, and payment initiation.
Key exemptions
The RPAA specifically exempts regulated financial institutions (banks, credit unions), closed-loop systems (usable only within a limited network), ATM cash withdrawals, internal/affiliated payment systems, designated clearing and settlement systems, and entities acting only as agents of a registered PSP.
Requirements & obligations
PSPs submit an application (corporate information, payment activities, operational details, risk-management framework), demonstrate risk-management capabilities (operational risk, incident response, business continuity, information security), and — if they hold end-user funds — establish safeguarding through a separate account, insurance/guarantee, or trust arrangement. Once registered, PSPs must report significant incidents, submit annual reports, and notify the Bank of Canada of changes in control, safeguarding methods, or cessation of activities.
Key differences between the two regimes
- Regulatory focus — MSB (FINTRAC) prevents money laundering and terrorist financing; PSP (Bank of Canada) ensures operational reliability and consumer protection.
- Scope — MSB applies to FX, money transmission, negotiable instruments, and virtual currency; PSP applies to electronic payment functions regardless of the specific financial service.
- Compliance — MSB centres on customer due diligence, transaction monitoring, and suspicious-activity reporting; PSP emphasises operational risk management, incident handling, and fund safeguarding.
When businesses need both registrations
A business will likely need both MSB and PSP registration if it facilitates money transfers electronically, holds customer funds while providing electronic payment capabilities, or operates a virtual currency exchange that enables transfers to third parties.
Example: a physical-only currency exchange needs MSB but not PSP. The same business run online with electronic transfers needs both. A merchant payment processor that doesn't hold funds likely needs PSP but not MSB. A crypto exchange with payment capabilities likely needs both.
A decision framework
Step 1 — MSB? Do you exchange currencies, transmit money, issue/redeem negotiable instruments, or deal in virtual currencies? If yes to any, MSB registration is likely required.
Step 2 — PSP? Do you process electronic payments, provide payment accounts, hold funds to make electronic transfers, or facilitate electronic fund transfers between parties? If yes to any, PSP registration is likely required unless an exemption applies.
Step 3 — Exemptions. Are you a regulated financial institution, a closed-loop system, or acting only as an agent of a registered PSP? If so, a PSP exemption may apply.
Penalties for non-compliance
MSB (FINTRAC) can impose Administrative Monetary Penalties (up to $100,000 for individuals and $500,000 for entities per violation, depending on severity), criminal penalties for serious violations, public naming of non-compliant entities, and registration refusal or revocation.
PSP (Bank of Canada) can issue compliance orders, impose administrative monetary penalties for RPAA violations, apply conditions restricting activities, and revoke registration.
How ComplyFactor can help
Working out which regime — or both — applies to your business is the hardest part, and getting it wrong is costly. ComplyFactor helps Canadian fintechs assess their activities against both frameworks, complete MSB registration and PSP registration, and build the compliance programmes each regime requires.
Contact ComplyFactor to map your registration requirements and build a compliant programme from day one.
Frequently asked questions
Is there a fee for MSB registration?
How often must registrations be renewed?
Can a business be exempt from one registration but required to obtain the other?
How do provincial regulations interact with these federal requirements?
ComplyFactor is a specialist AML and regulatory compliance advisory firm working exclusively with MSBs, PSPs, fintechs, and VASPs across Canada's FINTRAC framework. Our advisors hold CAMS certification and bring direct FINTRAC examination experience to every engagement.
