Canada’s financial regulatory landscape is shifting in 2025, with new anti-money laundering (AML) and payments rules coming into force. Fintech companies now face updated FINTRAC requirements for Money Services Businesses (MSBs) and a new Payments Service Provider (PSP) licensing regime under the Retail Payment Activities Act (RPAA). In this article we break down the key changes – from FINTRAC’s revamped MSB registration and compliance obligations to the Bank of Canada’s new PSP registration portal – and explain what fintech founders and compliance teams must do to keep their businesses onside.
Major 2025 MSB & PSP Regulatory Changes
New AML rules for MSBs (Oct 1, 2025).
Effective October 1, 2025, FINTRAC is implementing a package of new regulations expanding its AML regime. Operators of white-label ATMs and title insurers will now be MSBs under FINTRAC, meaning they must register and maintain full AML programs. Reporting requirements are also expanding: for example, “sanctioned property” reporting obligations are being broadened under Canadian sanctions laws, with reporting due March 1, 2025 for certain entities and October 1, 2025 for others. In short, many businesses in payments and real estate will need to align with FINTRAC’s standards by late 2025.
FINTRAC registry updates.
FINTRAC now publishes a fully searchable MSB Registry, updated monthly, which can be downloaded in full. This digital registry makes it easier to verify which entities are registered. Importantly, FINTRAC’s online MSB registration portal handles all new and renewal applications, and there is no registration fee. MSB registrations are renewed every two years.
RPAA & PSP licensing (Sept 8, 2025).
Under the RPAA, the Bank of Canada has become the supervisor of retail payment activities as of September 8, 2025. Any firm that plans to operate payment services after this date must register with the Bank before that date to avoid violations. The Bank launched a PSP Connect portal for all applications and ongoing compliance. Regulated PSPs will now have duties around risk management, incident response, and safeguarding client funds (e.g., holding them in trust or segregated accounts). Annual reporting and notification of material changes are required (first annual report due by March 31, 2026). Unlicensed PSPs operating after the deadline face heavy fines and even registration revocation.
Budget 2025 and broader context.
The 2025 Federal Budget also advanced fintech initiatives, such as accelerating open banking, underscoring that Canada is modernizing its payments infrastructure alongside these regulatory reforms. These changes are part of a broader push to promote innovation while protecting consumers and the integrity of the financial system.
FINTRAC MSB Registration & Compliance Updates
FINTRAC’s recent rule changes make MSB registration and compliance more rigorous.
- Registration requirements: All MSBs (domestic and foreign) must be registered with FINTRAC. Corporations must submit their certificate of incorporation, a chart of ownership/control, and similar records showing directors and structure. Partnerships or other entities must provide their governing documents and ownership structure. Domestic MSBs must now obtain and refresh (every two years) criminal record checks for the CEO, directors, and any person holding ≥20% of the business. In practice, this means an MSB’s compliance officer or legal advisor must coordinate background checks on key personnel and significant owners as part of renewal.
- Expanded scope: Operators of private ATMs (“white-label” ATMs) and title insurance companies are now covered, requiring them to keep records, verify identities, and report suspicious transactions under the AML regime.
- Registry transparency: FINTRAC’s online MSB Registry is now updated monthly, fully searchable, and available for download. Founders can quickly check whether their entities (or agents) are listed. If you already operate as an MSB, make sure your registration is valid and your information is up-to-date in FINTRAC’s system.
Fintechs dealing in currency exchange, fund transfers, virtual currencies, or related services must revisit their MSB compliance. By October 1, 2025, ensure that you are properly registered with FINTRAC, that AML policies are robust, and that any new requirements (like criminal checks and designated compliance officers) are built into your processes.
RPAA and New PSP Licensing Requirements
In late 2025, Canada’s retail payments law will fully kick in.
- PSP definition: A Payment Service Provider (PSP) is any business that provides payment accounts or processing, clearing/settlement, or interbank funds transfers. Under RPAA, such entities must register with the Bank of Canada. Starting September 8, 2025, the Bank began enforcing these rules. Fintechs should have already considered whether their service (e.g., payment processing, e-wallet, or ATM network) triggers PSP registration. Any company planning to operate a PSP service after September 8 must apply to register promptly; operating past that date without approval is an offence.
- Registration process: Registration is done through PSP Connect, the Bank’s web portal. Prospective PSPs must first create an account in PSP Connect, then submit a detailed application. The application asks for corporate details, ownership, projected transaction volumes, and a description of how end-user funds will be safeguarded (for example, in a trust account or with an insurance policy). There is a one-time non-refundable application fee, and once paid, the Bank will review the submission, including security screening.
- Ongoing obligations: PSPs must implement robust operational risk management and cybersecurity frameworks and ensure continuous protection of client money. In practice, this means maintaining policies and controls, such as business continuity plans and incident-response procedures, akin to those of regulated banks. Each PSP must also submit an annual report (first due by March 31, 2026) on its governance and risk mitigation measures. Moreover, the Bank requires PSPs to notify it before any significant change (e.g., a change of control or a material change to how payments are offered).
- Compliance failure: The Bank of Canada can issue notices of violation, levy fines (up to $10 million under RPAA), or ultimately revoke a PSP’s registration. Unregistered entities discovered in the payments system may also be publicly named and sanctioned.
PSP Registration & Compliance at a Glance
- Who must register: Any platform that maintains payment accounts for customers, processes transfers or clearances, or holds client funds beyond immediate transactions.
- Deadline: Firms in business before Sept 8, 2025 had a limited application window. Others must apply now to operate legally after that date.
- How to apply: Use the Bank of Canada’s PSP Connect portal. Create an account, fill in the registration form, and pay the fee.
- Obligations: Registered PSPs must maintain a risk and compliance program, segregate client funds (e.g., in trust/segregated accounts), and report incidents and annual results to the Bank.
- Enforcement: Operating without registration or failing to comply triggers enforcement actions (fines up to $10M, revocation).
MSB vs PSP: Differences and Overlap
It’s crucial to understand how the MSB and PSP regimes intersect. Broadly, FINTRAC’s MSB rules focus on anti-money laundering for services like currency exchange, fund transfers, and virtual currency dealing. The RPAA’s PSP rules focus on payment system safety, consumer protection, and risk management.
Notably, any PSP is automatically an MSB, but not every MSB is a PSP. In practice, if your fintech offers payment accounts, clearing, or settlement, you meet the PSP definition – and because you move money you also fall under FINTRAC’s MSB definition. Conversely, a business that only does foreign exchange or check-cashing (without offering electronic payment services) might be an MSB without ever becoming a PSP.
Because of the overlap, fintechs should map all their services against both regimes. For instance, a crypto platform that lets users store digital assets (a PSP-like service) and also exchange crypto for fiat (an MSB activity) will need to comply with both sets of rules. Cassels notes that “all persons who meet the definition of a PSP will meet the definition of an MSB” – meaning double-registration is inevitable for certain models.
In short, define your business model carefully. Determine if your product or app involves payment accounts or transfers (PSP) or currency/money services (MSB), or both. Then follow each applicable framework: register with FINTRAC and file AML reports, and register with the Bank of Canada and put in place payment-system controls. This parallel compliance can be streamlined by aligning policies (for example, one risk assessment covering both AML and PSP risk factors).
Key 2025 Deadlines & Compliance Checklist
- Sept 8, 2025: RPAA enforcement date. All PSPs operating after this date must be registered.
- Oct 1, 2025: New AML rules begin. FINTRAC’s expanded MSB requirements come into effect.
- March 31, 2026: PSP annual report due. The first annual report under RPAA must be filed for fiscal 2025–26.
- Every 2 years: MSB renewal (domestic). Domestic MSBs must renew registration with FINTRAC every two years.
- Ongoing: Compliance upkeep. Submit all required FINTRAC transaction reports and update registrations. PSPs must similarly notify the Bank if major changes occur. Monitor official communications for further guidance.
Steps for Fintechs to Stay Compliant
- Determine your status: Identify whether your business activities qualify you as an MSB under FINTRAC, a PSP under RPAA, or both.
- Register where required: MSB: register or renew through FINTRAC’s online portal. PSP: register via PSP Connect without delay.
- Build your compliance program: For MSB obligations, implement an AML compliance program – appoint a compliance officer, perform customer due diligence (including beneficial ownership checks), monitor transactions, and train staff. For PSP obligations, establish a risk management and incident response framework, including IT security, business continuity plans, and processes for safeguarding clients’ funds.
- Maintain records and reporting: MSBs must retain transaction and client records per FINTRAC rules, and continue filing STRs and LCTRs. PSPs must prepare for annual reports and incident reports to the Bank and keep all registration information current.
- Monitor regulatory updates: Regulations can evolve. Stay informed by subscribing to FINTRAC’s mailing list and the Bank of Canada’s notifications. Review official sources regularly.
- Seek expert help: Specialized firms like 7BaaS offer services in licensing, compliance program design, and connections to payment partners.
By following these steps and meeting each deadline, fintechs can avoid penalties and build trust with regulators. Early preparation is key.
How 7BaaS Can Help Fintechs
Navigating Canada’s fintech regulatory regime is complex, but you don’t have to do it alone. 7BaaS specializes in fintech licensing and compliance support. Their experts can help you determine if you need MSB or PSP registration (or both), prepare and file the necessary applications, and design a tailor-made compliance framework. Whether you need advisory guidance on regulatory strategy, help launching on new payment rails, or connections to banking partners, 7BaaS provides end-to-end assistance. From drafting policies to managing submissions, they streamline the process so you can focus on product development.
For personalized advisory or hands-on support with licensing and compliance (and to tap into 7BaaS’s fintech marketplace connections), visit 7BaaS. Their team can help accelerate your launch and ensure you meet all Canadian regulatory requirements, making your fintech’s growth journey smoother.
References
- FINTRAC – Money Services Business (MSB) Registry and Requirements, Government of Canada.
- FINTRAC – Money Services Businesses: FINTRAC’s Requirements, Government of Canada.
- Bank of Canada – Retail Payments Supervision (PSP Registration and Obligations).
- Government of Canada – Budget 2025: Consumer-Driven Banking Framework.
