Payment Service Providers: FINTRAC and the Bank of Canada
Why payment businesses need two registrations, what each regulator expects, and what each can do when something is missed.
Download the Guide
Fill in your details to unlock the PDF of Payment Service Providers: FINTRAC and the Bank of Canada.
If you process payments for others, you answer to FINTRAC and the Bank of Canada
FINTRAC treats paying invoices and handling payments for goods and services as a money services business. The Bank of Canada treats the same work as a retail payment activity. The two registrations are separate, and each regulator enforces its own.
What you owe
Two rulebooks run side by side, and each one keeps its own clock
Register with both before the first payment
Register with FINTRAC and report any change, such as a new name or address, within 30 days. The Bank of Canada charges a flat $2,500 to apply and must register you first.
Know who pays and who is paid
Verify anyone who asks you to send $1,000 or more, and the beneficiary you pay on an international transfer of $1,000 or more.
Card payments count as transfers
A card payment you carry out for a merchant you have an agreement with follows FINTRAC's transfer rules. Report international transfers of $10,000 or more within five business days, and a suspicious transaction (STR) as soon as practicable, at any amount.
Keep end-user funds whole
Hold client funds in trust, or cover them with insurance or a guarantee, in secure and liquid assets, and record every end user's balance each day.
Report to the Bank of Canada on its clocks
A material incident within 48 hours of assessing it. A significant change at least five business days ahead. An annual report by 31 March.
Since 26 March 2026, the FINTRAC program has to work
Compliance officer, approved policies, a documented risk assessment, training and a two-year review, now reasonably designed, risk-based and effective.
Most payment businesses need two registrations, and neither one stands in for the other
FINTRAC looks at whether you move money between a payer and a payee. The Bank of Canada looks at the payment functions you perform. One service often meets both tests.
FINTRAC: money services business
Paying invoices, or handling payments for goods and services between a payer and a payee, is money transfer. Register before you begin, from Canada or abroad.
Bank of Canada: payment service provider
Performing payment functions as a business, for end users in Canada, is a retail payment activity. Register before you begin, from Canada or abroad.
Neither makes you a money services business on its own: taking payment only for your own sales, or supplying a payment terminal with no service attached.
The Bank of Canada's test: any one of five payment functions
Performing any one of these as a business, for end users in Canada, is a retail payment activity.
1. Accounts
Providing or maintaining an account for end users.
2. Holding funds
Holding an end user's funds until they are withdrawn or transferred.
3. Starting transfers
Starting an electronic funds transfer at an end user's request.
4. Authorizing transfers
Authorizing a transfer, or sending, receiving or facilitating its instructions.
5. Clearing and settlement
Providing clearing or settlement services.
XTM is the worked example. On 17 February 2026 the Bank of Canada ordered XTM Inc. to stop all retail payment activities at once. It found XTM had failed to safeguard end-user funds and let a significant shortfall build.
What it costs
FINTRAC fines what was missed. The Bank of Canada can order you to stop. Four FINTRAC penalties since December 2025, and one Bank of Canada order.
FINTRAC maximum per violation for a business: its stated 40 times increase applied to the previous limits beneath. The Bank of Canada can impose up to $1 million for a serious and $10 million for a very serious violation.
Recent enforcement on money and payment businesses
Dates are when each notice or order was published. Appeals are to the Federal Court.
How ComplyFactor helps
One firm for both regulators, working from the same file We keep the FINTRAC program and the Bank of Canada obligations on one calendar, so neither side is the one that slips.
Both registrations
FINTRAC money services business registration and renewal, and the Bank of Canada application through PSP Connect, prepared from one set of facts.
Safeguarding that reconciles
A trust, insurance or guarantee arrangement for end-user funds, with the end-of-day ledger that proves it.
Risk and incident framework
An operational risk and incident response framework, and a playbook for the 48-hour incident notice.
Merchant and payer onboarding
Identity, beneficial ownership and politically exposed person checks, sized to your merchants and payment flows.
Transfer and suspicious reporting
Electronic funds transfer and suspicious transaction reports, complete and on time, with the 24-hour rule applied.
The Bank of Canada calendar
Significant change notices five business days ahead, registration updates, and the annual report due 31 March.
Start with a two-regulator gap check
We map what you do against both registrations and both rulebooks, and tell you what is missing before either regulator asks.
contact@complyfactor.com · +1 807 806 0444
Sources: FINTRAC notice of 21 July 2022 on payment service providers; Bank of Canada reporting reminder of 29 June 2026; Retail Payment Activities Regulations, s. 48; FINTRAC penalty notices and penalty policy; Bank of Canada order to XTM Inc. ComplyFactor Payment Service Providers Leave-Behind, current to 24 September 2026.
Book a free Canada AML consultation
Tell us about your business and we'll confirm which services you need — free, no obligation, 30 minutes.
