How a High-Risk Canadian MSB Got Banked — With a Compliant Safeguarding Account

Our mission is to help Canadian fintech companies get registered, go live, and stay compliant.

A Canadian money services business — we will call it Corriva to keep them anonymous — was registered as an MSB (money services business) with FINTRAC (Canada's anti-money-laundering regulator) and as a payment service provider (PSP) under the Retail Payment Activities Act (RPAA). Its problem was not registration. It was banking: Corriva's payment flows connected to Venezuela — the reference country used here to protect the client's identity — and provider after provider said no. We ran the account search, insisted on complete honesty with every provider, and landed an account structured to safeguard end-user funds the compliant way.

The client: a registered MSB serving a Venezuela-linked payment corridor

Corriva is a Canadian MSB that moves money for businesses whose payments ultimately connect to Venezuela. Venezuela is the reference country for this anonymized story, not a disclosure of the client's actual payment destination. One important detail: Corriva does not onboard customers located in Venezuela. For example, a Canadian customer pays a supplier in Spain for goods that the supplier ships to Venezuela. Corriva handles the payment to the supplier’s bank account outside Venezuela—not a payment into Venezuela. The connection is the goods’ destination: neither the customer nor the payment recipient is based in Venezuela.

On paper, Corriva had already done the hard regulatory work. It held MSB registration with FINTRAC and PSP registration under the RPAA with the Bank of Canada — and if you are weighing which registrations you need, here is the difference between MSB and RPAA registration. Corriva also planned to offer an e-wallet, meaning it would hold customer balances as part of its product.

The challenge: registered, but still unbanked

Registration did not solve Corriva's real blocker. Being an MSB with payment flows linked to Venezuela made most account providers nervous, and a lot of companies in this position quietly downplay the risk to get onboarded. That can work for a few weeks — until the provider understands what is really moving through the account and freezes or closes it.

Corriva wanted to do the opposite and be upfront. We agreed, and advised full disclosure to every provider we approached. An account you win by hiding the risk is an account you will eventually lose, usually at the worst possible moment.

Why safeguarding made this harder

Corriva did not just need an account. It needed one that could legally hold customer money. Because it planned to hold end-user funds through its e-wallet, it had to safeguard those funds under the RPAA — and not every account can do that. See our breakdown of the RPAA safeguarding requirements for end-user funds for the full picture.

Once an MSB that is also an RPAA-registered PSP starts safeguarding client funds, extra rules kick in about the type of account, who provides it, and how it is structured — typically an appropriate account plus a trust or legal structure, a per-user ledger, and regular reconciliation. So we were not shopping for "a bank account." We were shopping for an account we could defensibly treat as RPAA-compliant for safeguarding.

Concept breakdown of the RPAA safeguarding account an MSB and PSP needs: what it is, examples, the key rules that govern it, and the main risks.

What we did: 11+ providers, and one honest "no"

We ran a structured search and stayed willing to walk away from the wrong fit. In total, we approached more than 11 banks and account providers for Corriva. Many only made it through early conversations before closing the door, and several pulled out the moment they heard about the Venezuela connection.

One provider was actually willing to proceed — but we declined, because the account it offered would not have produced a compliant safeguarding structure. A willing provider is not the same as the right provider. For the broader playbook on opening up a bank account with your MSB, see our guide on how to open a bank account for a Canadian MSB.

Eventually we found a provider that was comfortable with the Venezuela-linked payment corridor and offered an account structure we could work with. We negotiated changes to its contract to make the arrangement more RPAA-compliant, and got it over the line with a provider Corriva had already built trust with.

The outcome: banked, with a defensible safeguarding structure

Corriva ended up with an account that fits both its business and its regulatory obligations. We structured it with a non-bank intermediary (e.g. an EMI or PI would constitute an “intermediary”) in a way that supports a defensible position that the arrangement complies with RPAA safeguarding requirements. We had to review and amend the provider’s contracts to ensure we have a strong defensible position with the Bank of Canada (who oversees RPAA regulations)! Luckily, the provider was open to playing ball and agreed to tweak their contract and flow.

Lessons for other high-risk fintechs

The biggest takeaway is that honesty is a strategy, not a liability. A payment corridor linked to Venezuela narrows your options, but it does not close them — with enough applications and a clear story, you can usually find a provider whose risk appetite fits. Providers vary enormously in tolerance, process, and price, and some will even adjust their offering to help you meet a regulatory need.

Checklist of five lessons from helping a high-risk Canadian MSB get banked: be upfront, treat banking as its own workstream, run many applications, walk away from the wrong yes, and match the account to safeguarding needs.

A few practical points for any fintech in a similar spot:

• Banking is often the hardest part of going live, not the registration. We work with a network of banks and account providers and can help you find the right fit — see our bank and account-provider onboarding support.
• Do not assume registration equals banking, and do not assume a Canadian shell is enough. Many account providers — and FINTRAC itself — expect a genuine Canadian presence and a working AML program before they will deal with you.
• If you need both registrations, our combined MSB and RPAA registration service also prepares the AML policy you need as an MSB and the operational risk management framework you need under the RPAA.

If your business handles payments linked to Venezuela or another higher-risk market, or you need to safeguard customer funds, book a call so we can map your payment flow, pin down your safeguarding needs, and target the providers most likely to say yes — before you start applying.

This content is for informational purposes only and does not constitute legal advice.