Crypto Platforms and Virtual Currency Dealers
Which FINTRAC registration applies, the obligations after it, which leg of an on ramp or off ramp reports, and the largest penalties.
Download the Guide
Fill in your details to unlock the PDF of Crypto Platforms and Virtual Currency Dealers.
$196 million, in under three months
Neither of the two penalties behind that figure was for laundering money. One firm was not registered with FINTRAC. The other did not file the reports it already owed. Both were set under the old penalty scale, which rose on 26 March 2026, and both are under appeal to the Federal Court.
What you owe
Registration is the first obligation, not the last
A compliance program with six parts
A compliance officer, written policies approved by a senior officer, a documented risk assessment covering money laundering, terrorist financing and sanctions evasion, ongoing training with a plan behind it, and an effectiveness review every two years.
Know your client, and keep the record for five years
A large virtual currency transaction record from $10,000, a transfer record from $1,000, and an exchange ticket for every exchange, each naming the client, the amount, the exchange rate and its source, and every address sending or receiving.
Five reports, and the 24-hour rule
Suspicious transactions, large virtual currency, large cash, electronic funds transfers, and listed person or entity property. Amounts aggregate across a consecutive 24-hour window, and missed reports are counted one by one.
The travel rule on virtual currency transfers
Name, address and reference number for both originator and beneficiary, reasonable measures to obtain anything missing, and a written risk-based policy saying when you allow, suspend or reject a transfer that arrives incomplete.
Agents, and the 1 October 2027 deadline
Since 1 October 2025, verify an agent's eligibility before engaging them, with a criminal record check issued no more than six months before you review it, then again within 30 days of each second anniversary. Agents engaged earlier must be in line by 1 October 2027.
If you serve people in Canada, the question is which registration, not whether
Exchanging funds for virtual currency, exchanging one virtual currency for another, or transferring virtual currency on a client's instruction is dealing in virtual currency. That makes you a money services business. Where your desks are decides which kind.
A place of business in Canada: money services business
Register with FINTRAC before you begin operating. A provincial licence does not replace it, and FINTRAC charges no registration fee.
No Canadian place of business: foreign money services business
If you direct services at people or entities in Canada and actually serve them, you register as a foreign money services business and carry the same obligations.
How FINTRAC decides you are directing services at Canada
Any one of these is enough on its own: marketing or advertising aimed at people in Canada, a .ca domain name, or a listing in a Canadian business directory. Weighed together, these count too: describing the service as offered in Canada, accepting Canadian dollars, supporting Canadian clients, seeking their feedback, and other businesses promoting you here.
KuCoin is the worked example. Peken Global Limited is incorporated in the Seychelles and has no office in Canada. FINTRAC determined it was a foreign money services business, and failure to register was the first of the three violations behind a penalty of $19,552,000 imposed on 28 July 2025. The penalty has been appealed to the Federal Court.
The report follows what arrives with you, not what the client buys
The large-amount reports attach to the leg where value is received by you. An off ramp reports at $10,000 every time, an on ramp only when money reaches you as cash or from abroad.
On ramp: the client buys virtual currency with Canadian dollars
Value in: an LCTR if it is cash of $10,000 or more, or an EFTR if it comes from outside Canada at $10,000 or more. A transfer inside Canada is neither. Value out: no LVCTR, because you are sending, not receiving. Travel rule information and a transfer record still apply from $1,000.
Off ramp: the client sells virtual currency back to Canadian dollars
Value in: an LVCTR at the equivalent of $10,000 or more. This is the leg Cryptomus missed 1,518 times. Value out: an EFTR if it leaves Canada at $10,000 or more. Cash paid out is not a large cash transaction report.
Swap: one virtual currency exchanged for another
No Canadian dollars move and nothing changes. The token arriving is still a receipt, so LVCTR applies at $10,000 or more, and the token going out carries travel rule information from $1,000.
A suspicious transaction report has no threshold and no direction: any leg, any amount. The 24-hour rule aggregates amounts across a consecutive 24-hour window.
What it costs
Penalties are counted per violation, and the ceiling has moved A missed report is one violation. One firm missed 1,068 suspicious transaction reports and 1,518 large virtual currency reports in July 2024 alone.
Maximum per violation for an entity. The headline figures apply FINTRAC's published increase of up to 40 times its previous limits, which are the figures beneath them, to violations from 26 March 2026. From that date a compliance agreement is mandatory in every penalty case.
The two largest crypto penalties, both set under the old scale
Also penalized: MoonPay's Seychelles entity, $536,853.35 (Nov 2025, appealed); Necosmart, $693,742.50 (Mar 2026). Neither of the two largest was for laundering money. One firm was not registered. The other did not file. Both are failures a compliance program is supposed to catch first.
How ComplyFactor helps
This is the work we do every week Money services businesses, payment service providers and fintechs are ComplyFactor's core practice. We file the reports, run the reviews and sit in the compliance officer seat.
Registration and enrolment
MSB or foreign MSB registration, kept current as your model changes, and ready for universal enrolment when it lands.
Risk assessment
Documented and defensible across clients, jurisdictions, tokens, rails and delivery channels.
Policies approved properly
Written, current, and signed off by senior management, which is a violation on its own when it is missing.
Reporting and the 24-hour rule
LVCTR, LCTR, EFTR and STR filing, and fixing the aggregation logic that quietly drops reports.
Travel rule controls
Originator and beneficiary data, reasonable measures, and the written allow, suspend or reject policy behind them.
Two-year effectiveness review
Independent review run against FINTRAC's own examination approach, against the new effective standard.
Start with a reporting gap check
We sample a month of your transaction data against what was actually filed, and tell you how many reports are missing before FINTRAC counts them for you.
contact@complyfactor.com · +1 807 806 0444
Sources: FINTRAC MSB registration, compliance program, record keeping, travel rule and reporting guidance; FINTRAC penalty notices, Sep 2025 to May 2026, and penalty policy pages. ComplyFactor Crypto On and Off Ramp Leave-Behind, current to 1 October 2026.
Book a free Canada AML consultation
Tell us about your business and we'll confirm which services you need — free, no obligation, 30 minutes.
