Most companies that apply for FINTRAC MSB registration assume the hard part is the paperwork. In practice, the hard part is what the paperwork reveals — specifically, the gaps in your compliance program that FINTRAC’s reviewers are trained to find.

Registration refusals and post-registration enforcement actions share a common thread: the applicant had a compliance program in name but not in substance. This guide breaks down what FINTRAC actually looks for, why applications stall or get rejected, and how to fix the most common deficiencies before you submit.

Who Actually Needs to Register as an MSB with FINTRAC

Under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA), you must register with FINTRAC as a Money Services Business if you provide any of the following services:

• Foreign exchange dealing
• Remitting or transmitting funds
• Issuing or redeeming money orders, traveller’s cheques, or similar instruments
• Dealing in virtual currency — buying, selling, transferring, or exchanging it
• Operating a crowdfunding platform that handles payments

The 2019 amendments to the PCMLTFA added two categories that catch many companies off guard: foreign MSBs that direct services at customers in Canada must also register, regardless of where they’re incorporated. If you’re a cryptocurrency exchange, a payment processor, or a wallet provider with Canadian users, registration is not optional.

What FINTRAC Actually Reviews in Your Application

FINTRAC MSB registration is not a licensing process — FINTRAC does not evaluate your business model or approve your product. What it reviews is your AML/ATF compliance program, specifically whether it meets the five mandatory components under the PCMLTFA:

1. Designated Compliance Officer — a named individual (not a committee, not a role) with documented authority and AML knowledge
2. Written Policies and Procedures — specific to your business activities, not a generic template
3. Risk Assessment — a documented assessment of your ML/TF exposure by client type, product, geography, and delivery channel
4. Ongoing Training Program — a structured curriculum for all relevant staff, with records
5. Effectiveness Review — an independent review of your compliance program, conducted at least every two years

FINTRAC reviewers are looking for evidence that these components are operational, not aspirational. A policies document that hasn’t been tailored to your business — or a risk assessment that lists generic threats without analyzing your actual client base — will be flagged.

The Four Deficiencies That Kill Most Applications

Based on common patterns in FINTRAC enforcement actions and MSB registration reviews, the most frequent deficiencies are:

• Generic or borrowed compliance documentation. Templates downloaded from the internet or repurposed from a different business type rarely reflect the specific ML/TF risks of your actual operations. FINTRAC expects policies that reference your products, your client onboarding flow, and your transaction types.
• No genuine risk assessment. A risk assessment is not a list of risk categories — it is a scored, documented analysis that explains why your risk is low, medium, or high across specific dimensions, and what controls you’ve implemented in response. One-page summaries rarely pass review.
• Compliance officer without documented authority. The designated compliance officer must have actual authority to implement the compliance program. “Our CEO handles compliance” without formal delegation and evidence of AML knowledge will not satisfy the requirement.
• Missing transaction monitoring procedures. For virtual currency MSBs especially, FINTRAC expects documented procedures for detecting suspicious transactions — thresholds, triggers, escalation paths, and Suspicious Transaction Report (STR) filing procedures.

Timelines and What to Expect After Submission

FINTRAC does not publish a guaranteed processing timeline for MSB registration applications. In practice, straightforward applications with a complete compliance program are typically acknowledged within a few weeks. Applications that require clarification — or where FINTRAC identifies material gaps — can take significantly longer, with FINTRAC sending written questions or requests for additional documentation.

There is no formal appeals process for a refused registration, but an applicant can reapply once the identified deficiencies are corrected. The clock on your legal obligation to register, however, does not pause while you iterate — you are required to register before you begin providing MSB services, not after.

Before You Submit: A Practical Self-Check

Before filing your FINTRAC MSB registration, work through this checklist:

• Have you named a specific compliance officer (not a team), documented their authority, and confirmed their AML knowledge?
• Are your written policies and procedures tailored to your specific products and services — not a generic MSB template?
• Does your risk assessment score and document risk by client type, product, geography, and delivery channel, with corresponding controls?
• Do you have a training log showing what AML training staff have completed, and when?
• Have you documented your transaction monitoring triggers, STR filing procedures, and record-keeping timelines (seven years under PCMLTFA)?
• If you’re a virtual currency business: have you addressed Travel Rule obligations in your procedures?
• If you’re a foreign MSB: have you confirmed which Canadian customers you serve and structured your registration accordingly?

If any of these items require more than a short answer, that’s where to focus before submitting. Working with an experienced AML & regulatory compliance services provider to review your program before submission is considerably less expensive than dealing with a rejection, a re-registration process, or — worse — a FINTRAC examination finding that your registration was obtained on the basis of an incomplete program.

What Happens If You Operate Without Registration

Operating as an unregistered MSB is a criminal offence under the PCMLTFA. FINTRAC can refer cases to the Attorney General of Canada for prosecution, and penalties include fines and imprisonment. FINTRAC also publishes administrative monetary penalty (AMP) notices — by name — on its public website, which carries significant consequences for business relationships, banking access, and reputation.

For fintech companies and digital asset businesses, the practical impact of a public FINTRAC enforcement notice is often more damaging than the penalty itself: correspondent banks, payment processors, and institutional counterparties routinely screen for FINTRAC enforcement history before onboarding.

The cost of getting MSB registration right the first time is a fraction of the cost of getting it wrong.

Need guidance? Reach out to our team — no pressure, no jargon.