Halifax, Nova Scotia, February 2019. Standing in front of a judge, a lawyer explains that a cryptocurrency exchange cannot find its customers’ money because the only person who knew where it was had died two months earlier in India. He was 30 years old and he took the keys with him.

That case, as the rest of this article would tell us, ended with an empty vault. But the system Canada runs today looks nothing like what that courtroom scene would lead you to expect. There is no crypto license to buy in Canada, no application form with that name, no certificate to frame. Crypto businesses register with the country’s financial intelligence agency instead, the application costs the applicant nothing, and the world’s largest exchange was once fined six million dollars for skipping the paperwork. What follows is how that system actually works, what it really costs to enter, and where the traps are hidden.

 

The Legend of the Frozen Wallets

The company in that courtroom was QuadrigaCX, and the deceased man was its co-founder and chief executive, Gerald Cotten. From Vancouver, Cotten had built the platform into what it advertised as Canada’s largest crypto exchange. Within weeks of his death, it was before a Nova Scotia judge seeking creditor protection, and the arithmetic it disclosed made news on several continents: CAD 215 million owed across roughly 76,000 accounts, with the bulk of it, the company said, sitting in wallets whose keys had existed only in Cotten’s head.

That version of events held for months. A founder dead at 30, a fortune sealed behind a password nobody else had, and reporters openly wondering whether he had died at all.

Then the Ontario Securities Commission spent ten months on the case and published a report that dismantled the legend. The cold wallets weren’t full. They were nearly empty. Cotten had opened trading accounts on his own exchange under aliases like «Sceptre Gerry» and «Aretwo Deetwo,» credited them with balances that didn’t correspond to any real deposits, and traded against his own customers, sustaining real losses when prices moved against him and covering the hole with new customer deposits. The regulator’s conclusion was blunt: Quadriga had operated, in effect, like a Ponzi scheme. Of the roughly CAD 169 million in losses, about CAD 115 million came from that fraudulent trading and another CAD 28 million went down on external platforms where Cotten quietly traded client assets without permission. The report also traced about CAD 24 million in client funds transferred to Cotten and his wife and documented his use of client assets to fund a lavish lifestyle. In the end, the bankruptcy trustee recovered or identified only about CAD 46 million to pay out to clients.

One detail matters more than the rest for anyone planning a crypto business today. Quadriga was never registered with any securities regulator, kept no proper books and records, and had no system of internal oversight. The report’s language on this point is worth reading directly: the lack of registration «facilitated Cotten’s ability to commit a large-scale fraud without detection.» Nobody was checking, so nothing stopped him.

Quadriga illustrates a particular kind of risk: what happens when one person controls client assets and nobody independent is watching. Canada’s anti-money-laundering rules were never going to catch that failure by themselves. They watch something else entirely: the movement of funds and the people behind them. Europe later chose a different architecture, a dedicated crypto rulebook that sorts businesses by what they do; Canada mostly sorts them by how money moves through them. This difference explains why the two frameworks feel nothing alike.

 

The Money Services Business Route

The route most crypto businesses take through Canada was assembled from parts that already existed. In 2020, the government widened an old category, the money services business, to cover anyone dealing in virtual currency. From June 1 of that year, swapping crypto for cash or for other crypto, or moving it on a client’s instruction, counted as MSB activity. A crypto desk is therefore supervised like a money transmitter, and the supervisor is FINTRAC, an intelligence agency working under a federal statute, not a market regulator.

Canada is a federation, so the country’s anti-money-laundering law is federal and FINTRAC covers the whole country. Securities regulation, on the other hand, is provincial, which means a crypto business answers to one federal agency for its money flows and to a provincial securities regulator for what its customers are actually trading. Additionally, Quebec has its own financial markets authority, the AMF, with its own registration list.

The FINTRAC registration carries headline features that read like a typo next to Europe:

Applying costs nothing. FINTRAC charges no application fee and asks for no minimum capital. Since April 2024 the agency does bill reporting entities an annual assessment to recover its supervision costs, calculated under a formula tied to reporting volumes, so the free part is the application itself.

It’s relatively quick. Four to eight months for an MSB registration, and FINTRAC only accepts complete applications.

You don’t need a Canadian company. A foreign firm can register as a Foreign MSB and serve Canadian clients directly, appointing a Canadian agent for service instead of standing up a local subsidiary from day one.

Registration renews every two years. Registrations have a lifespan; they lapse unless renewed, and material changes to the business need to land on FINTRAC’s desk within 30 days.

For comparison, Europe took the opposite route. The EU’s Markets in Crypto-Assets regulation issues a CASP licence and holding one, can mean parking EUR 50,000 to 150,000 of own funds and then waiting out an application that stretches across many months. Putting the two side by side is misleading, though. The Canadian registration settles the AML question and nothing else. It is not proof of ongoing compliance, and it is not a general permission to operate. The rest of your model may still need securities, derivatives or payments authorization on top.

 

What You Actually Have to Build

FINTRAC doesn’t just want a form. It wants a living compliance program, and it examines registrants to confirm it. Open the handbook and the same items keep reappearing: someone senior has to own compliance outright, with a direct line to the top; the policies on paper have to resemble the business as it actually runs; the risks of the whole operation get assessed, and each client gets scored against that backdrop; people are identified when prescribed activities occur, whether individuals through KYC or companies through KYB and their real owners; politically exposed persons and sanctioned parties get caught by screening; staff keep learning; and every second year, someone independent checks whether any of it actually works.

Then there’s reporting, and it answers two different questions. Thresholds look after themselves. A client’s crypto lands in your custody, it’s worth CAD 10,000 or more, or smaller amounts that add up to that within a single 24-hour stretch, and a large virtual currency transaction report follows; cross-border electronic transfers at the same CAD 10,000 level get their own paperwork. Suspicion is different, because it requires judgment: once reasonable grounds exist to suspect that a completed or attempted transaction touches money laundering or terrorist financing, a suspicious transaction report goes out, as soon as practicable after the groundwork has been done. One more piece, in force since June 2021: the travel rule. Crypto transfers leave carrying the originator’s and beneficiary’s name, address and account reference, and a receiver who deletes that information commits an offence of its own.

Here’s how an ordinary Tuesday goes. A client pays bitcoin worth CAD 18,000 into the platform’s wallet. That receipt clears the threshold, so it produces a large virtual currency transaction report on a fixed deadline. Separately, suppose the customer’s wallet history shows funds flowing from a mixing service and their answers about source of wealth are vague. Individually, none of that proves anything. FINTRAC’s own guidance says as much: an indicator is a prompt to look, never a verdict on its own, and the reporting bar, reasonable grounds to suspect, demands more than a feeling. So, the file gets investigated and documented, and if the picture holds up, a suspicious transaction report goes out. This is the routine of a Canadian MSB, and it is exactly what FINTRAC examiners look for.

Skip all of that and the consequences arrive on their own. Working unregistered is an offence on its own, and the fines compound. Binance found out the hard way. In 2024 FINTRAC hit it with CAD 6,002,000, split across two findings. One: it kept serving Canadians without ever completing registration as a Foreign MSB, even after being given deadline after deadline. The second finding ran to 5,902 counts. From June 2021 to July 2023, on each of those occasions, crypto worth CAD 10,000 or more arrived on the platform and no large-transaction report followed, not one (FINTRAC). And FINTRAC caught all of it without the company’s help. The blockchain records the receipts permanently; FINTRAC’s analysts read them directly. The company had by then already exited Canada, September 2023 by FINTRAC’s dating. The fine arrived anyway. Leaving the country, it turns out, does not close the file.

 

The Second Gatekeeper: Your Bank

There’s a commercial layer on top of the legal one. Canada’s banking sector is unusually concentrated: a handful of large national banks dominate, and for a crypto business that concentration is a problem, because if the big institutions don’t want you as a client, there aren’t many places to go.

Those banks run their own due diligence. Notably, banking and payment partners increasingly incorporate compliance reviews into their own due diligence, and that depending on the institution and the business’s risk profile, a partner may request an updated independent review on a six-month or annual basis. A company can be properly registered with FINTRAC and still unable to move money because its file doesn’t satisfy a bank. That is why the independent effectiveness review is worth treating as a banking product, not just a regulatory box.

 

When Securities Regulators Get Involved

Securities law asks a separate set of questions, and FINTRAC registration answers none of them. What exactly is the customer getting when they click buy? What rights does the contract give them? Whose hands hold the coins between order and settlement? Those are the tests.

Run three businesses through them. A swap service where clients send coins from personal wallets and the matched asset comes straight back to them: nobody is holding anything for anyone, and the analysis stays simple. The venue gets harder. Once deposits rest on the platform and users are trading contracts, leveraged ones included, the operation begins to look like securities or derivatives dealing, and the provincial commissions want it registered. Adding fiat on-ramps complicates things further: customer money held or moved at users’ instruction can pull in the payments rulebook too. Names won’t rescue you. «OTC desk» on a pitch deck, «non-custodial» on the homepage; the four tests decide, and the time to settle them is while the structure is still on the drawing board.

Nor is the analysis ever finished. Suppose an exchange has operated on immediate delivery from the start: pay, receive, withdraw to your own wallet, over and over, year after year. Then the founders introduce balances, purely as a convenience, so customers need not withdraw after every trade. That one feature puts every question back on the table. Who holds the assets now? What happens if the platform cannot deliver them? What have the terms of service promised about segregation? Can transaction monitoring still see the whole picture once value moves onto an internal ledger? Will the bank behind the fiat rails accept a custody model it has never seen? Each answer decides whether the business has walked out of the AML perimeter and into securities territory, payments territory, or both at once.

The securities side has real teeth. The year 2022 broke the industry’s confidence, FTX above all, and Canada’s provincial securities commissions, acting jointly as the Canadian Securities Administrators, responded with conditions rather than a ban. From February 2023, any trading platform serving Canadians without registration had 30 days to sign an enhanced undertaking. The terms were stark: margin and leverage off the menu for Canadian clients, client assets held and segregated more strictly, and stablecoins plus the platform’s own tokens frozen out unless a regulator signed off in writing. Refusal had a price too: off-board every Canadian user and leave.

Binance, at that point the biggest exchange on the planet, read those terms and concluded that Canada no longer made sense for it, exiting in May 2023. Those that stayed accepted registration, and today’s registers carry the names: Coinbase Canada, Kraken, Coinsquare, Crypto.com, Netcoins, NDAX, Newton and Wealthsimple. The interim regime itself has since been wound up, since August 2024, a new platform applies straight to CIRO, the national self-regulatory body, and still registers province by province where it operates.

 

The Quebec Twist

Quebec deserves a separate paragraph, because a business can do everything right federally and still trip there. The AMF maintains its own list of registered crypto trading platforms and has taken enforcement seriously. In 2023, after a case brought by the AMF, a tribunal fined the operators of XT.com CAD 2 million and ordered the platform blocked for Quebec users, ruling that it had acted as an unregistered securities and derivatives dealer. The AMF’s position is that its laws apply from the moment a platform is accessible from Quebec, wherever it is located. On top of that, if your Quebec customers can pay in cash, Revenu Quebec enforces the money services business rules for that activity. Anyone building a national footprint needs a plan for both.

 

If You Touch Fiat Payments

The third regime arrived recently. It’s called the Retail Payment Activities Act, and the Bank of Canada polices it. Who does it capture? Anyone performing payment functions for ordinary end users, so holding balances for them, executing transfers on their behalf, that family of services, with banks and similar institutions carved out. The registration window swung open in November 2024, and walking through it cost CAD 2,500.

 

Tax: Boring, Deliberately

Canada has no special crypto tax. The Canada Revenue Agency treats crypto as a commodity, so profits are taxed either as capital gains or business income under the ordinary rules, and paying a vendor in crypto is treated as a barter transaction. The absence of a bespoke regime is a feature: there’s no crypto-specific tax return to design around, but there’s also no special treatment to hope for.

One development worth planning for is the OECD’s Crypto-Asset Reporting Framework, which would bring crypto businesses’ user data into automatic international exchange between tax authorities. Canada’s implementing bill, C-31, is currently before a House of Commons committee; as drafted it would apply to calendar years from 2027, with the first annual filings proposed to fall due by early May 2028, and it is not yet law. In practice this would mean self-certifications from users, new due diligence, and a new annual reporting build. Whether it would get launched in 2027 or later, the direction is already set.

 

The Real Price Tag

The application is free; the program behind it is not. It’s worth being concrete with clearly labelled illustrations using our own fees.

Take a straightforward exchange or OTC business that stays on the AML side. What would EUR 15,000 buy you with PROTEGRA? The groundwork: policies written, both the enterprise-wide risk assessment and the method for scoring clients, onboarding and KYC/KYB forms, transaction monitoring procedures, and a hand to hold through FINTRAC registration. Leadership is a separate question. A fractional CAMLO, a part-time Chief Anti-Money Laundering Officer, runs EUR 4,000 a month at the advertised starting rate, so a year of it lands near EUR 48,000. Add both lines and year one comes to roughly EUR 63,000. Payment businesses pay a further EUR 13,500 for the RPAA package, since that rulebook needs its own build. And the independent effectiveness review, priced between EUR 9,000 and 15,000 depending on scope and sample sizes, arrives on its own schedule, when the two-year clock runs out or a banking partner demands a fresh one, so it stays out of the first-year math unless a client pulls it forward. Anything ad hoc is billed by the hour, EUR 250 to 350.

None of these are compulsory as a bundle; pick what fits. The point of the arithmetic is actually narrower: in Canada you don’t pay the government much for the privilege of applying, you pay to build the thing the regulator inspects.

 

The Takeaway

Canada’s crypto framework is an overlapping set of regimes rather than a single crypto statute, and the registration at its centre is free to apply for. What isn’t free is the program behind it, and the penalty for treating the registration as the finish line rather than the starting point is a fine measured in millions, as the largest exchange on earth discovered.

For a company that takes compliance seriously from day one, Canada is one of the more accessible major markets. For one looking for a shortcut, it has a habit of getting expensive later.

If you’re weighing Canada against other jurisdictions, PROTEGRA can help you work out which regime applies to your model before you commit to a structure.

 

Sources: