MSB vs. RPAA: Which Canadian Fintech Registration(s) Do You Actually Need?

Written by Ethan Walker, JD, Fintech Associate. Reviewed by Pouya Makki, JD, Head of Fintech Practice. Last updated: September 3, 2026.

Most Canadian fintechs need two registrations, not one: an MSB registration with FINTRAC for anti-money laundering, and an RPAA registration with the Bank of Canada for operational risk and safeguarding user funds. A smaller number are also pulled into a third — securities registration with provincial regulators — usually when they custody crypto or promise a return. Which registrations apply depends on what your product actually does, so map your model against all three tests before you set a launch date or file anything.

If you are launching a payments, crypto, or fintech business in Canada, you have probably run into more than one registration and wondered which one actually applies to you. There are up to three separate registrations, run by three different regulators, doing three different jobs.

• A money services business (“MSB”) registers with the Financial Transactions and Reports Analysis Centre of Canada (“FINTRAC”), which is Canada's anti-money laundering regulator.
• A payment service provider (“PSP”) registers with the Bank of Canada under the Retail Payment Activities Act (“RPAA”), a regime built around operational risk and keeping customer money safe.
• Some crypto and custody models also trigger registration with provincial securities regulators, which is a much heavier and more expensive regime.

To keep this concrete, we'll follow one anonymized example throughout. A fintech we'll call SlateBank came to us sure it needed a single Canadian license: its product let diaspora users load funds in USDT, USDC, or fiat, spend on a stablecoin card, and remit into roughly 30 currencies. By the end of the first call, that single license had turned into three separate questions — MSB, RPAA, and a securities issue no one on the team had seen coming.

This guide covers the difference between the registrations, which regulator owns which job, whether you even need to register in Canada at all, whether one registration is enough for your model, how crypto fits in, the securities question people forget, and whether you can file for everything at the same time.

What's the difference between MSB registration and RPAA registration?

MSB registration is your anti-money laundering registration with FINTRAC under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (“PCMLTFA”). RPAA registration — the PSP registration with the Bank of Canada — is your operational risk registration under the RPAA. One regime asks whether you can spot and report dirty money. The other asks whether you run a safe, reliable payment operation and protect the funds you hold for users. Different laws, different regulators, different obligations.

Who handles AML, who handles risk, and who handles investor protection?

There are three regulators, and each one does a different job:

• FINTRAC, through your MSB registration, handles anti-money laundering.
• The Bank of Canada, through your RPAA (PSP) registration, handles operational risk and safeguarding the funds you hold for users.
• Provincial securities regulators handle investor protection, and they only get involved for certain crypto, custody, or return-promising products.

It is common to answer to more than one of these regulators for the same product, for completely different reasons. Under your MSB registration with FINTRAC, expect obligations such as:

• A written AML program, including policies, a risk assessment, and a compliance officer.
• Know-your-client checks and identity verification on the people and businesses you serve.
• Ongoing transaction monitoring, record keeping, and required reports to FINTRAC (for example, suspicious transaction reports).
• A periodic independent review of how well your AML program actually works, often every two years.

Under your RPAA registration — the PSP registration with the Bank of Canada — the focus shifts to:

• A written operational risk-management and incident-response framework.
• Safeguarding the end-user funds you hold, so users can be repaid if the business fails.
• Keeping an accurate daily ledger of the funds you are safeguarding.
• Reporting incidents and key information to the Bank of Canada, plus ongoing and annual reporting.

You can confirm the FINTRAC criteria on the FINTRAC money services businesses page and the RPAA test on the Bank of Canada's registration criteria for payment service providers.

Do you even have to register in Canada?

Not every business in the world needs to register in Canada. You only trigger MSB, RPAA, or securities registration if you have a real connection to Canada. There are three common ones:

• Incorporation in Canada. Federal or provincial incorporation is enough on its own.
• People or a physical presence in Canada. Offices, employees, or agents all count.
• Serving Canadian clients. Providing covered services to people or businesses in Canada can trigger registration, even if you are not incorporated here and have no office here.

There is one wrinkle worth understanding, called “reverse solicitation.” Reverse solicitation means a customer came to you on their own, without you marketing to them.

• For MSB registration, there is a narrow reverse-solicitation exemption. If you are not actively marketing to Canadians — no targeted ads, no “.ca” domain, not listed in Canadian business directories — you may avoid a Canadian connection even if you occasionally serve a Canadian.
• For RPAA and securities registration, there is no real reverse-solicitation exemption. If you serve Canadians at all, you may still be on the hook, even if you never marketed to them.

If you have no Canadian users and are not targeting Canada, the practical enforcement risk from all three regulators is usually much lower, because regulators have less reason to act and fewer tools to use.

Do I need both registrations, or is one enough for my model?

It depends on what you actually do. If your activity is only a classic MSB service — for example, non-custodial foreign exchange — you may only trigger MSB registration. But most modern payment models also perform retail payment functions, which pulls in the RPAA. When both tests are met, these are simply two registrations you need, side by side. SlateBank is a good example of that common case: its pay-in and payout remittance flows were classic MSB services, but because it also held and moved fiat on behalf of users, it landed squarely in the RPAA as well.

You likely trigger MSB registration with FINTRAC if you offer at least one MSB service and have a Canadian connection. MSB services include:

1. Foreign exchange dealing.
2. Remitting or transmitting funds, including pay-in and payout models.
3. Issuing or redeeming money orders, traveller's cheques, or similar instruments.
4. Dealing in virtual currency.
5. Crowdfunding platform services, armoured car services, and cheque cashing.

You likely trigger RPAA registration with the Bank of Canada if you perform one or more of the five payment functions as a service that is not incidental to another business, you perform them in relation to an electronic transfer of fiat money, you have a Canadian connection, and you are not otherwise excluded. The five payment functions are:

1. Providing or maintaining an account held for one or more end users.
2. Holding funds on behalf of an end user.
3. Initiating an electronic funds transfer at an end user's request.
4. Authorizing an electronic funds transfer, or transmitting, receiving, or facilitating a payment instruction.
5. Providing clearing or settlement services.

The table below is a plain-English cheat sheet for the most common models. Use it as a starting point, not a final answer, because edge cases exist.

One caveat worth checking early: the RPAA excludes certain players, such as banks, authorized foreign banks, and provincially regulated trust companies, and certain activities, including incidental activities, securities-related transactions, and internal or closed-loop transactions. If you are excluded from the RPAA, you may still need MSB registration. Mapping your product against every test before you file is the fastest way to avoid a surprise registration mid-launch. If you are unsure, our Canadian MSB registration and RPAA (PSP) registration teams can scope all of them in one pass.

Does MSB registration cover crypto, or is that separate?

This is one of the most common questions we hear. For anti-money laundering purposes, yes. Dealing in virtual currency — both exchanging it and transferring it — is an MSB service, so crypto activity is captured by your MSB registration with FINTRAC.

The RPAA works differently. It applies to electronic transfers of fiat money (or a prescribed unit), and securities-type transactions are excluded. So the crypto itself usually does not trigger the RPAA — but the fiat side of a crypto product often does. SlateBank ran straight into this: its users funded wallets and received remittances in regular money across roughly 30 currencies, so even though balances moved in USDT and USDC, those fiat legs pulled it into the RPAA.

• Example: a crypto pay-in or payout product where a customer still sends or receives regular money (a wire, an Interac e-transfer, a SEPA transfer, or a wallet top-up) is performing a retail payment function on that fiat leg. That fiat leg can pull you into the RPAA even though the other side settles in crypto.
• If you custody crypto for clients (you hold or control the private keys), or your token behaves like an investment, you are into securities territory, which is the third registration described below.

So the real RPAA question is not “do we touch crypto?” It is “does our product move regular money for users?” Our crypto AML compliance team can help you draw those lines.

What about securities registration — the third one people forget?

The third possible registration is with provincial securities regulators, sometimes reached through the Canadian Investment Regulatory Organization (“CIRO”), which is the national self-regulatory body that oversees investment dealers. This regime exists to protect investors, and it is much heavier and more expensive than MSB or RPAA registration.

You may trigger it if you:

• Custody crypto for clients, meaning you hold or control the private keys that move their crypto.
• Offer a product that promises a financial return. Words like yield, interest, staking rewards, APY, profit-sharing, dividends, or passive income are all warning signs.
• Trade crypto assets that are treated as securities. Only the largest assets, such as Bitcoin, Ether, and Solana, are generally treated as non-securities.
• Offer a multi-currency wallet. Technically this can trigger securities rules, though in practice enforcement against payment-focused providers is low.

Because this regime is so heavy, most payment-focused fintechs deliberately structure their product to stay out of it — for example, by arranging crypto custody directly between the end user and a licensed custodian, rather than holding the keys themselves. If custody or a return-earning feature is core to your product, plan for this early, because it changes both your cost and your timeline.

Example: why SlateBank's setup raised a securities issue. SlateBank's MSB and RPAA registrations were the straightforward part. The surprise was securities. Because it could instruct its wallet provider to move customer crypto without fresh client approval, it effectively controlled client assets — and that degree of control is exactly the kind of custody that pulls a product into securities territory, on top of the other two registrations.

Can I apply for these at the same time?

Yes. These are independent processes run by different regulators, so you can prepare and file them in parallel. You do not need to finish your MSB registration before you start your RPAA registration — the two can run in tandem.

There are two things to respect:

• Each regime has its own “register before you operate” line. You must be registered with FINTRAC before you offer MSB services, and registered with the Bank of Canada before you perform retail payment activities.
• The timelines are very different. As a rough guide, MSB registration takes about 3 to 4 months, while RPAA registration can take 6 to 12 months. Because you cannot go live until the required registrations are in place, the longer RPAA timeline is usually what sets your launch date.

That is what we did with SlateBank: once we confirmed it triggered all three regimes, we filed the MSB and RPAA applications together and planned the launch around the longer RPAA timeline rather than letting it quietly slip. The smart move is the same for most models — confirm which registrations you trigger, start the applications together, and plan around whichever one takes longest, so it does not quietly become the thing that delays your go-live. Our fintech licensing team does exactly this planning with founders every week.

What this means for your launch

For most Canadian payment and fintech models, the honest answer to “MSB or RPAA?” is “both, for different reasons” — and a smaller number of models also need securities registration on top.

SlateBank is that pattern in miniature: it expected one license, needed two almost as a matter of course, and got pulled into a third because of how it handled crypto custody.

The most common type of business model that only requires MSB registration is: non-custodial crypto trading and cheque cashing.

Some things to keep in mind about the 3 key regulators to watch out for:

• FINTRAC handles anti-money laundering through your MSB registration.
• The Bank of Canada handles operational risk and safeguarding through your RPAA (PSP) registration.
• Provincial securities regulators handle investor protection if you custody crypto or promise returns.

Before you commit to a launch date, confirm which of the three registrations you actually trigger, how the filings should be sequenced, and whether there are workarounds to getting registered.

If you are mapping out MSB registration, RPAA registration, or both for a Canadian launch, book a call with Renno & Co. We will confirm exactly which registrations your model triggers, flag any securities issues early, and sequence the filings around your go-live date.

Disclaimer: This content is for informational purposes only and does not constitute legal advice.