Can You Offer Crypto Services With a Canadian MSB?

Yes — you can offer a wide range of crypto services with a Canadian MSB, but not all of them. A money services business (MSB) is a business that provides services such as foreign exchange, money transfer, or dealing in virtual currency, and it registers with FINTRAC (the Financial Transactions and Reports Analysis Centre of Canada) under Canada's anti-money-laundering law. Because dealing in virtual currency — both exchanging and transferring crypto — is an MSB service, an MSB registration should allow you to provide the following services: crypto-fiat on/off ramps, OTC desks, non-custodial crypto trading, and many crypto-based payment flows.

The catch: an MSB is not a licence to do everything crypto. For instance, the moment you custody client crypto, let users hold crypto balances on your platform, trade crypto that behaves like a security, or promise yield or returns, you move into securities territory — which is much heavier and, for most fintechs, effectively off-limits. And if your flow also moves fiat for other people, you likely need a second registration under the RPAA. So the real question is not “MSB: yes or no.” It is which crypto services fit inside an MSB, and which ones trigger something more. This article maps both.

What counts as a "crypto service" under an MSB?

Under Canada's AML law, an MSB service includes dealing in virtual currency, which covers both virtual currency exchange (swapping crypto for fiat, or crypto for crypto) and virtual currency transfer (moving crypto for someone else). If your business does either — as a business, with a real Canadian connection — you almost certainly need to register as an MSB with FINTRAC and select “Virtual Currency” as a service you offer.

A few things worth being precise about:

• “Crypto services” for MSB purposes typically means a non-custodial crypto trading product, or a pay-in / payout product where crypto is collected or settled. Any of these requires “Virtual Currency” to be listed on your FINTRAC MSB registration.
• You can confirm the activities that trigger MSB registration on the FINTRAC money services businesses page.

Which crypto services can you offer with just an MSB?

Quite a few. On MSB registration alone — with no securities registration — you can generally run non-custodial crypto trading (crypto-fiat on/off ramps and OTC desks where the client controls their own wallet), non-custodial currency exchange, and crypto-based payment flows. The common thread is that you are exchanging or transferring crypto, not holding it for clients and not offering an investment return.

Typical models that live comfortably inside an MSB:

• Crypto on/off ramp — letting clients buy crypto with fiat, or sell crypto for fiat, without leaving balances on your platform.
• OTC trading desk — quoting and settling larger crypto-fiat trades on a non-custodial basis.
• Crypto payment / remittance flows — using crypto to move value, including cross-border, on behalf of clients.

One important caveat: a crypto-based pay-in or payout product that also moves electronic fiat for third parties usually needs both an MSB and an RPAA registration (covered below). A pure non-custodial exchange usually needs only the MSB.

Where an MSB stops: crypto custody and the securities line

The hard limit is custody. In crypto, custody comes down to one question: who controls the private keys? If your MSB controls the keys — or can move client crypto without the client's specific permission — regulators may treat you as custodying it. Holding client crypto pushes you into provincial securities registration (often with CIRO, the Canadian Investment Regulatory Organization), which is expensive, time-consuming to obtain, and for practical purposes off the table for most MSBs.

A common pattern we see: a founder wants an exchange where users leave their crypto on the platform, because it feels cleaner and more like an account. That single feature — custody — is what turns a manageable MSB into a securities problem.

A few rules that trip people up:

• Using a third-party custodian does not solve it if your MSB keeps access to the private keys or can independently instruct transfers. If you have that control, you are the one custodying, even if storage sits with a vendor. The custody relationship has to run directly between the end customer and the custodian.
• Enterprise wallet technology (for example, Fireblocks) is infrastructure, not a custodian. Using it does not automatically make someone else the custodian.
• Beyond custody, securities registration can also be triggered by trading crypto assets that are treated as securities (generally only large-cap assets like BTC, ETH, and SOL are likely not securities), or by offering anything that promises yield, interest, staking rewards, ROI, or passive income.
• Multi-currency e-wallets may technically brush up against securities rules too, though enforcement risk there is quite low.

Here is how this plays out in practice. Take a cross-border remittance company we'll call NovaSend, which moves money from Africa into the UK, Canada, and the US. Its customers load funds in either USDT or regular fiat, and NovaSend pays out to third parties abroad — a model that, on its own, sits inside an MSB (for the crypto leg) and an RPAA registration (for moving fiat for other people). The complication came when NovaSend wanted to add an e-wallet so users could hold balances, and to custody both the crypto and the fiat itself. The team assumed that because custody was just a feature of a payment product, it would not change their regulatory footprint. It does: custodying client crypto is exactly what can pull a business into securities territory, even when that custody is wrapped inside a payment or remittance service.

NovaSend did not have to abandon the e-wallet, though. It pursued — and ultimately secured — an exemption from securities regulators that let it offer the custodial feature. That is the kind of result that rarely happens without experienced counsel shaping both the structure and the conversation with regulators. The lesson cuts both ways: crypto custody can trigger securities registration even when it is offered purely as part of a payment service, but that is not always the end of the road — with the right structure and case, an exemption for crypto custody is sometimes within reach.

If custody or an account-like experience is core to your product, there are lighter structures worth exploring — such as self-custody wallet tooling (where the user holds the keys) or a whitelabel/sponsor arrangement — rather than taking on securities registration directly. You may also explore the possibility of getting an exemption from securities regulators. All stuff we can help with!

Do you also need RPAA registration?

Often, yes. The Retail Payment Activities Act (RPAA) requires registration with the Bank of Canada as a payment service provider (PSP) if you have a Canadian connection and you help clients send or receive electronic fiat funds to or from third parties. So a non-custodial crypto exchange usually needs only an MSB, but a crypto pay-in / payout product with a fiat leg usually needs both an MSB and an RPAA registration. NovaSend, the remittance company we described above, is a clean example: taking in USDT and paying out fiat to third parties across borders put it squarely in the MSB + RPAA box, long before the e-wallet and custody question ever came up.

A simplified way to think about it:

Unlike MSB, there is no meaningful reverse-solicitation exemption under the RPAA. You can review the Bank of Canada's criteria for registering payment service providers for the details.

If your flow needs both, we offer a combined MSB + RPAA registration package that also includes preparing the AML policy your MSB requires and the operational risk management framework the RPAA requires — so both filings, and the compliance documents each one depends on, are handled together.

What about stablecoins (USDT/USDC)?

Stablecoins are everywhere in crypto payment flows, and most MSBs use them without issue. Technically, Canadian securities regulators have taken the position — through staff notices, not legislation — that stablecoins like USDT and USDC may be securities. In practice, they have not enforced this against payment companies, the market keeps using stablecoins widely, and account providers rarely push back.

A useful distinction:

• Front-end use — the client or final recipient actually receives or sends the stablecoin. This is where the securities position technically bites.
• Back-end use — the stablecoin is only a behind-the-scenes tool to move fiat (for example, to settle a cross-border payment faster and cheaper than SWIFT), and neither the payor nor the beneficiary ever touches crypto. This generally is not treated as a “virtual currency” service at all.

Other practical points: USDC is generally viewed as the “safer” stablecoin from a securities regulatory lens than USDT; new legislation is expected to bring stablecoins under the Bank of Canada's purview around 2027; and our own view is that stablecoins used purely as a payment instrument may not be securities. When advising clients, we lay out the technical position and the low practical enforcement risk so they can make an informed call.

Do you need a Canadian connection to trigger registration?

You only register in Canada if you have a meaningful connection to Canada. There are three: incorporation in Canada, physical presence or people in Canada, or serving/targeting Canadian clients. Any one of them can be enough. If none apply, your practical exposure to Canadian regulators is much lower.

For MSB, a limited reverse-solicitation exemption can apply — if you are not actively marketing to Canadians (no targeted ads, no “.ca” domain, not listed in Canadian directories), you may avoid a Canadian connection even if you occasionally serve a Canadian. Note the trap: there is no real reverse-solicitation exemption for RPAA or securities registration. If you serve Canadians there, you can be caught even without marketing to them.

How long does it take — and can you buy an MSB instead?

Fresh MSB registration takes about 5–6 months when we manage the process (applicants going it alone sometimes wait 9+ months). If speed matters, you can buy a ready-made, already-registered MSB and start operating in roughly a week, because FINTRAC only needs to be notified of a change of ownership, not approve it.

Two timing notes if RPAA is also in play:

• Fresh RPAA registration currently takes roughly 2 months, and you can run the MSB and RPAA applications in tandem — so MSB is often the bottleneck.
• Buying an RPAA-registered company is different from buying an MSB: a change of control triggers re-registration that the Bank of Canada must approve first (currently about 2 weeks in practice).

Getting banked as a crypto MSB

Registration is only half the battle. You still need account providers, and many banks and fintechs treat crypto as high-risk. Some will not route crypto through their rails; some will not onboard you if you offer crypto services at all; others are comfortable as long as the crypto stays entirely outside their ecosystem. Designing a workable flow of funds around these limits is frequently the real challenge, and it is exactly what our account opening service is built to solve.

A few realities worth planning for:

• Many large Canadian banks rarely onboard MSBs, so expect to work with specialized DTIs, fintechs, and liquidity providers.
• A cross-border payout or pay-in that uses crypto only in the back-end (fiat in, fiat out) can sometimes sit with a provider that otherwise avoids crypto — because the client never touches virtual currency.
• Account providers increasingly expect real Canadian physical presence and a credible compliance function before they onboard you.

What you take on once you're registered

An MSB is the starting line, not the finish. Once registered, you must run an ongoing AML program: KYC/KYB on your clients, transaction monitoring, recordkeeping, and required reporting — including Large Virtual Currency Transaction Reports (LVCTRs) for crypto movements of CAD 10,000 or more — plus periodic independent effectiveness reviews. If you are also RPAA-registered, you take on an operational risk and safeguarding program on top of that.

Talk to us before you build

The crypto services you can offer with a Canadian MSB depend entirely on the details of your flow of funds — who holds the crypto, who touches fiat, and where your clients are. Getting the structure right before you file (or buy an MSB) is the cleanest way to avoid a surprise securities or RPAA trigger mid-launch. NovaSend is a good example: by testing its e-wallet plan against the securities rules early, it found a workable path — an exemption — instead of a post-launch dead end. If you are planning a crypto product with a Canadian angle, book a call with our team and we will pressure-test your model against every registration test. Learn more about our Canadian MSB registration service, or book a call to talk through your specific setup.

This content is for informational purposes only and does not constitute legal advice.