Crypto Licensing in Canada: CSA, CIRO and FINTRAC

Why Operators Look at Canada

Canada gives crypto-asset businesses a regulated, rule-of-law route to the North American market under a framework that is clearer, if narrower, than the United States. The CSA applies established securities law through published staff notices rather than enforcement-by-litigation, so a platform knows in advance that facilitating trading in “crypto contracts” triggers dealer registration and CIRO membership. A defined set of platforms already holds full registration, signalling a regulator that enforces its conditions rather than a paper regime, and FINTRAC runs a mature federal anti-money-laundering layer behind it.

One concrete planning lever matters for foreign owners. Unlike the federal CBCA, which retains a 25% resident-Canadian director requirement, several provinces (British Columbia, Ontario, Alberta, Québec) impose no director-residency rule. Incorporating provincially removes a structural obstacle the federal route would impose.

Regulatory Framework

Crypto-asset trading in Canada sits under two parallel legal regimes. Securities regulation is provincial, coordinated nationally through the Canadian Securities Administrators (CSA) and enforced via the self-regulatory Canadian Investment Regulatory Organization (CIRO). Anti-money-laundering regulation is federal, administered by FINTRAC under the PCMLTFA. A platform trading crypto contracts must satisfy both.

The central legal question is whether a platform deals in securities. Under CSA Staff Notice 21-327, securities law applies unless both the underlying asset is not itself a security or derivative and the contract provides for immediate delivery. Where the platform retains custody and the client holds only a contractual claim, the arrangement is a “crypto contract” caught by securities law, and CSA Staff Notice 21-329 sets the path: register as a dealer and join CIRO. Federal AML obligations run on a separate instrument: the PCMLTFA has, since 1 June 2020, treated persons dealing in virtual currency as money services businesses, with the Travel Rule and large-transaction reporting in force from 1 June 2021. A third regime, the RPAA, can apply where a platform performs standalone retail payment functions, though securities-regulated activities are generally excluded.

Dual-Regulator Structure

Two bodies sit at the centre. The CSA member commissions, with the OSC, Québec’s AMF, and the BCSC as the load-bearing three, handle registration through a principal-regulator “passport” system. CIRO, formed in 2023 from the merger of IIROC and the MFDA, admits platforms as dealer members and supervises conduct, capital, and custody; since 1 April 2025 the OSC has delegated investment-dealer registration to it while retaining oversight. FINTRAC operates entirely separately as the AML supervisor.

Why the Regime Is So Demanding

Canada’s investor-protection-heavy framework is a direct response to failure. The 2019 collapse of QuadrigaCX, then the country’s largest exchange, left roughly 76,000 clients owed about CAD 215 million, which the OSC concluded was substantially an “old-fashioned fraud wrapped in modern technology”. The CSA responded with the enhanced Pre-Registration Undertaking terms of February 2023 (no leverage, qualified custody, a narrow stablecoin list), which prompted several global platforms to exit Canada rather than comply. More recently, the CSA confirmed it would not continue the interim restricted-dealer route, USDC and QCAD qualified as the permitted stablecoins, and Canada moved to implement the OECD Crypto-Asset Reporting Framework.

License Types and Activities Covered

Canada has no single crypto licence. A platform fits into existing registration categories by what it does: trading and dealing in crypto contracts triggers dealer registration; holding client crypto triggers qualified-custody rules; advising triggers adviser registration; and any business dealing in virtual currency triggers FINTRAC MSB registration. The categories overlap, so most platforms carry more than one.

Covered Activities

• Trading and dealing in crypto contracts: Requires registration as a restricted dealer or investment dealer and CIRO membership. This is the core CTP obligation.
• Marketplace operation: A platform matching multiple buyers’ and sellers’ orders is a marketplace under National Instrument 21-101 and needs recognition as an exchange or exemptive relief to operate as an alternative trading system.
• Custody of client crypto: Triggers the qualified-custodian and segregation rules, including the requirement to hold the majority of client crypto with an acceptable third-party custodian.
• Advising: Portfolio management or advising on crypto assets requires adviser registration.
• Dealing in virtual currency (AML): Any exchange or transfer of virtual currency requires FINTRAC MSB registration, independent of securities status. Foreign businesses directing services at Canadians register as foreign money services businesses.

Some activity stays outside registration: pure software providers that never take custody or facilitate trading; immediate-delivery spot transactions in non-security crypto assets where the client takes possession and the platform retains no custody; standalone mining and validation; and holding your own crypto for treasury purposes. Note the CSA has not exempted decentralised platforms. Where a platform offers Canadians the ability to trade crypto contracts, securities law applies regardless of how the front end is labelled, so “decentralised” framing is irrelevant to the registration analysis.

Requirements

Registration in Canada turns on three make-or-break elements: a fit-and-proper management team with a qualified Chief Compliance Officer, qualified custody of client assets, and acceptance of the enhanced investor-protection terms (no leverage, segregation, a narrow stablecoin list). Capital and local-presence requirements follow from the registration category and the incorporation choice.

Fit-and-Proper, Local Presence and AML

The regulator assesses the integrity, competence, and financial soundness of directors, officers, the CCO, and significant shareholders, with criminal-record checks dated within six months required for 20%+ controllers and senior officers. The CCO’s crypto-specific experience is scrutinised closely; a generalist compliance hire is a frequent cause of delay. A Canadian incorporated entity is the standard vehicle, and a no-residency province removes the director-residency obstacle for foreign owners. On the AML side, the five-pillar PCMLTFA programme is mandatory the moment a business deals in virtual currency: a compliance officer, written policies, a documented risk assessment, ongoing training, and a two-yearly review, alongside the Travel Rule and Large Virtual Currency Transaction Reports for receipts of CAD 10,000 or more.

Application Process

Registration runs on two parallel tracks with very different rhythms. FINTRAC MSB registration is administrative and typically completes in one to two months. Securities registration with CIRO membership is the long pole: an operating platform files a Pre-Registration Undertaking (PRU), operationalises the enhanced terms within 90 to 120 days, and targets dealer registration within 12 months, with end-to-end timelines commonly reaching 12–24 months or more.

Stage 1 2–6 weeks

Entity Formation

Form a Canadian entity, choosing provincial incorporation (British Columbia, Ontario, Alberta, or Québec) to avoid the federal resident-director rule where the ownership is foreign.

Stage 2 4–8 weeks

FINTRAC MSB Registration

Submit the pre-registration request, provide ownership and criminal-record information, and register as an MSB or foreign MSB. Free of charge, and this track can run in parallel with everything else.

Stage 3 4–8 weeks

Pre-Application Engagement with the Principal Regulator

Identify the principal regulator under the passport system and open dialogue. An operating platform files a Pre-Registration Undertaking committing to the enhanced investor-protection terms.

Stage 4 3–6 months

Compliance and Custody Build

Stand up the five-pillar AML programme, appoint a qualified CCO, contract an acceptable third-party custodian, and prepare the bespoke policy suite. This is the most time-intensive stage and cannot be shortcut with generic templates.

Stage 5 4–9 months

Dealer Registration Filing and Review

File firm and individual registration (Form 33-109F6 and NRD filings), satisfy capital, insurance, proficiency, and custody conditions, and respond to regulator requests.

Stage 6 3–6 months, overlapping

CIRO Membership

Complete the readiness questionnaire and membership application, submit the CTP supplemental checklist, and progress through staff review and board recommendation to admission.

The documentation set spans corporate, personal, compliance, business, and technology categories, and the regulator expects bespoke, Canada-specific policies rather than adapted templates. The heaviest component is the compliance suite: the five-pillar AML programme, the risk assessment, the Travel Rule procedures, the sanctions and transaction-monitoring frameworks, and the custody and segregation policy, all of which FINTRAC examines for whether they are operational, not merely drafted.

Timeline

Two tracks run on different clocks. FINTRAC MSB registration completes in one to two months and can proceed in parallel, while full securities registration with CIRO membership runs 12–24 months or more, gated by the compliance and custody build and CIRO’s review. The Pre-Registration Undertaking lets an operating platform continue during the process while committing to the enhanced terms.

Timelines depend heavily on application completeness and business-model complexity. A platform with a clean custody arrangement, an experienced CCO, and a focused product set moves faster than one introducing novel structures. The enhanced Pre-Registration Undertaking commits the platform to a 12-month registration target, but extensions are common where the principal regulator consents.

Taxation

Canada sits in the moderate-tax band for corporations, with crypto treated as a commodity rather than legal tender. The Canada Revenue Agency taxes crypto dispositions as either capital gains or business income depending on the facts, and GST/HST can apply where goods or services are paid for in crypto.

Rates are 2025 figures and vary by province; confirm current-year rates before relying on them. Crypto-to-crypto trades are taxable barter transactions valued at fair market value in Canadian dollars, and whether gains are capital or income turns on intent and frequency. Canada also participates in the OECD Common Reporting Standard and is implementing the Crypto-Asset Reporting Framework through Income Tax Act amendments, with the rules applying from the 2026 calendar year and first exchanges of information in 2027.

Ongoing Compliance & Post-Registration

Registration creates a permanent compliance infrastructure, not a one-time clearance. A registered platform carries continuous FINTRAC reporting (Suspicious Transaction Reports, Large Virtual Currency Transaction Reports, terrorist-property reports), CSA and CIRO conduct and financial obligations including audited statements and Form 1 capital reporting, the enhanced investor-protection terms, and qualified-custody maintenance. CIRO and FINTRAC both run examinations that test whether the programme is operational, so documentation must be current and demonstrate that controls actually operate, not merely that policies exist.

Enforcement is escalating. FINTRAC issued 23 notices of violation in 2024–25, its largest annual total, and in October 2025 it imposed a penalty of approximately CAD 177 million on one virtual-currency platform, its largest ever, for unregistered operation and reporting failures. Operating a crypto-contract platform for Canadians without securities registration exposes the operator to CSA enforcement, trading bans, and penalties.

Banking

Banking is the most underestimated obstacle for crypto businesses in Canada. The major domestic deposit-taking institutions are cautious toward virtual-currency businesses, and de-risking is common. Securities registration and FINTRAC registration materially improve bankability but do not guarantee an account, and operators routinely rely on specialised institutions and payment partners.

Crypto-asset businesses in Canada typically work with a mix of specialised North American banking partners, regulated payment processors, and multi-currency platforms rather than the largest retail banks. The QuadrigaCX episode, in which a major bank froze a payment processor’s accounts and left roughly CAD 26 million inaccessible, illustrates how quickly banking can become the binding constraint. Registered, well-governed platforms with clean AML programmes present the strongest case, but onboarding remains selective and timelines are unpredictable. The common mistake is leaving banking to the end of the project, after registration is secured.

FATF Status & International Standing

Canada is a founding member of the Financial Action Task Force and is not subject to any FATF monitoring or grey-listing as of June 2026. Its AML regime under the PCMLTFA is mature, and FINTRAC is an established financial-intelligence unit. For crypto operators, the practical implication is strong international standing and straightforward correspondent relationships, subject to the usual sector-specific banking caution.

EU Market Access

A Canadian registration confers no MiCA passporting rights, and MiCA contains no third-country equivalence regime. MiCA Article 61 permits third-country firms to serve EU clients only when the client initiates contact entirely on their own initiative. ESMA’s guidelines, applicable from 27 April 2025, interpret this restrictively: any EU-targeted marketing, EU-language website content, geo-targeted advertising, app-store availability, or use of EU-based influencers constitutes solicitation that voids the exemption. The exemption is built for isolated contacts, not systematic EU market access. If EU clients are part of your plan, an EU member-state CASP authorisation is the only route that delivers passporting.

Advantages and Limitations

Credibility and regulatory clarity come at the cost of time, expense, and product flexibility. Operators gain a respected North American regulated base but must accept investor-protection terms that rule out leverage and most stablecoins, alongside a registration process measured in years.

• Rule-of-law credibility. A respected, stable regulatory environment that institutional counterparties and banks recognise.
• Regulatory clarity. Published CSA guidance defines when registration is required, unlike the US enforcement-driven approach.
• Operating registered market. A defined set of platforms holds full registration, signalling a functional, enforceable regime.
• No FATF concerns. A founding FATF member with no monitoring status, supporting clean international relationships.
• Provincial incorporation flexibility. No-residency-rule provinces (BC, Ontario, Alberta, Québec) remove a structural obstacle for foreign owners.
• Fast, free federal AML registration. FINTRAC MSB registration completes in one to two months at no fee.
• × No leverage or margin permitted. The enhanced terms prohibit credit and leverage to any client.
• × Narrow stablecoin list. Only issuer-undertaken stablecoins (USDC, QCAD) are tradable on registered platforms.
• × Long registration. Full registration runs 12–24+ months and represents a substantial first-year commitment of capital, fees, and specialist work.
• × Banking friction. De-risking by major banks is common, so banking should be pursued in parallel rather than left to the end.
• × No EU passporting. A Canadian registration confers no EU market access; operators targeting EU clients need a separate EU CASP authorisation.
• × Multi-regulator coordination. Securities, AML, and possibly payments regulators apply at once.

How Canada Compares

Canada’s natural comparators are Australia and Hong Kong, two Anglophone tier-1 regulated peers, with Panama as a lighter-touch alternative; Estonia is the EU cross-tier reference for operators weighing EU passporting against North American credibility. Against this field, Canada matches the tier-1 peers on institutional credibility but takes a longer registration path with tighter product terms; Panama wins on speed and territorial tax at the price of regulator-issued standing.

For operators whose priority is serving the North American market under a recognised regime, Canada is the natural choice. Those seeking the lowest barrier to entry tend to look at lighter-touch jurisdictions, while operators wanting EU market access should consider an EU member-state CASP authorisation such as Estonia rather than any non-EU registration. This is exactly the kind of trade-off Tomberg & Partners helps operators work through: we deliver crypto licensing and formation in the jurisdictions we serve, and we will tell you plainly when Canada is or is not the right base for your model.

Frequently Asked Questions

Banking & Payments

A company and a licence still need a bank account

Banking is one of our three core services. We help high-risk and regulated businesses open the bank and payment accounts that others refuse: we work directly with EU EMIs, payment institutions and crypto-aware banks, confirm appetite before you apply, and make the introduction. Take it with your company and licence, or on its own.

Explore banking & payments →

Related

• Crypto Licensing: the jurisdictions where we deliver
• Company Formation: incorporate the right vehicle for a regulated crypto business
• Reverse Solicitation Under MiCA: serving EU clients from outside the EU
• Crypto Exchange Solutions: end-to-end setup for trading platforms