← Regulations / Canada / Operating Models / Custodial SaaS

Custodial wallet / SaaS in Canada

Hosted wallet provider that holds keys on behalf of end users, often white-labeled to businesses (custody as a service).

Conditional AI-Generated · Unreviewed

Custodial SaaS is conditionally permitted in Canada with a local entity, subject to AML obligations and high licensing burden.

Verdict Details

Permitted
conditional
Local entity required
Yes
Licensing burden
High
Last updated
2026-07-13

AML Obligations

  • FINTRAC MSB registration under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act — mandatory for any VASP dealing in virtual currency
  • Customer identification and verification (KYC) at account opening
  • Record keeping (5-year minimum) for all transactions and customer identification records
  • Reporting suspicious transactions to FINTRAC
  • Reporting large virtual currency transactions (over CAD 10,000) to FINTRAC within prescribed timelines
  • Registration completes in ~2-4 weeks with FINTRAC, but securities registration is the dominant burden
  • SaaS provider (as the entity holding keys) likely bears primary AML obligations; white-label clients may also need their own FINTRAC registration if dealing in virtual currency with end users

Key Restrictions

  • Qualified Canadian custodian required — must use a custodian that meets Canadian securities regulatory standards for custody of client assets (not a US or offshore custodian)
  • Client asset segregation is mandatory — must hold client crypto assets in trust accounts or segregated wallets, separate from the operator's proprietary assets
  • Securities registration as Restricted Dealer (provincial) or Marketplace — 6-18 month process, requires pre-registration undertaking (PRU)
  • Minimum capital for Restricted Dealers: CAD 50,000–100,000; must maintain insurance and designate a CCO approved by the regulator
  • Foreign platforms serving Canadians must register or face enforcement — Binance exited Canada rather than comply
  • Provincial passport system: must register individually in each province/territory where business is done (CSA coordinates via passport system)

Key Risks

  • Aggressive enforcement by provincial securities regulators — multiple platforms (KuCoin, Bybit, Binance) fined CAD 1M-2.5M or banned for operating without registration
  • Regulatory ambiguity around whether custodial wallet SaaS constitutes 'trading' in securities — CSA Staff Notice 21-327 pushes broad interpretation
  • Dual-registration risk: FINTRAC MSB (fast, low bar) + provincial securities registration (slow, high bar) must both be satisfied
  • No dedicated federal crypto custody regime — relies on existing CSA custodial standards designed for traditional securities (may not fit crypto-specific operational realities)
  • White-label model creates shared AML liability — unclear where oversight burden falls between SaaS provider and client

Evidence

This verdict synthesizes the following facts. Each fact links to its primary source(s).

licensing 80% confidence

FINTRAC — AML/CFT, MSB registration, transaction reporting

licensing 82% confidence

CSA — Provincial securities regulation — crypto trading platform registration (Staff Notice 21-327)

licensing 20% confidence

Proceeds of Crime (Money Laundering) and Terrorist Financing Act (2000) — AML/CFT, MSB registration

licensing 20% confidence

CSA Staff Notice 21-327 (2020) — Crypto trading platform registration requirements — aggressive enforcement since 2021

licensing 20% confidence

VASP: FINTRAC MSB registration (2-4 weeks) + provincial Restricted Dealer registration via CSA (6-18 months). Foreign platforms serving Canadians must register or face enforcement. Binance exited Canada rather than comply.

licensing 20% confidence

CUSTODY: Qualified Canadian custodian required for registered platforms. Client asset segregation mandatory.

licensing 20% confidence

EXCHANGE: MSB (FINTRAC) + Restricted Dealer or Marketplace registration (provincial). Pre-registration undertakings prohibit margin trading and restrict altcoin offerings. $50K-$100K minimum capital for restricted dealers.

licensing 20% confidence

Securities industry professionals must register with the securities regulatory authority in each province or territory where they do business

licensing 20% confidence

The ultimate authority for licensing requirements rests with each provincial securities commission

licensing 20% confidence

The Canadian Securities Administrators (CSA) coordinate provincial regulators through a passport system

licensing 20% confidence

Anyone in the business of trading securities or advising clients on securities must be registered with the securities regulator in each province or territory where they do business, unless an exemption applies

licensing 20% confidence

Registration framework is established through National Instrument 31-103 (NI 31-103) — Registration Requirements, Exemptions and Ongoing Registrant Obligations

licensing 20% confidence

All registrants must maintain minimum capital and insurance based on registration category and business activities; non-IIROC firms require CAD 25,000 to CAD 100,000 depending on category

licensing 20% confidence

All registrants must designate a Chief Compliance Officer (CCO) approved by the regulator who must complete the Exempt Market Products Course (EMPC) or equivalent plus CCO training

licensing 20% confidence

CSA Staff Notice 21-327: Guidance on Securities Legislation for Crypto Asset Trading (via BCSC or CSA sites).

licensing 20% confidence

OSC Crypto Businesses guidance (osc.ca/en/industry/registration-and-compliance/crypto-businesses).

licensing 20% confidence

Canadian Securities Administrators (CSA): The umbrella organization coordinating provincial and territorial securities regulators, issuing national guidance for crypto asset trading platforms.

enforcement 83% confidence

Ongoing Focus on Unregistered Platforms: Securities regulators continue to target platforms operating in Canada without registration. This often results in cease trading orders, financial penalties, and requirements for platforms to either register or exit the Canadian market.

enforcement 90% confidence

Many international crypto trading platforms that previously operated without registration have entered into pre-registration undertakings (PRUs) with provincial commissions, which are formal agreements required to continue operating while pursuing registration, rather than post-hoc settlements for past non-compliance.

enforcement 95% confidence

Bybit: In March 2023, the OSC reached a settlement with Bybit, requiring the platform to pay $2,468,982 and provide an undertaking that it would not operate in Ontario without registration.

enforcement 95% confidence

KuCoin: In June 2022, the OSC obtained orders against KuCoin (Mechbit Technology Ltd.) permanently banning it from participating in Ontario's capital markets and requiring it to pay an administrative penalty of $1,650,000 and $99,754 for costs.

enforcement 95% confidence

Binance: Following a pattern of non-compliance, Binance entered into an undertaking with the OSC in December 2022 to cease all operations in Ontario. Later, in May 2023, the AMF imposed an administrative monetary penalty of $2.25 million on Binance for operating an unregistered platform and offered non-compliant derivatives in Quebec.

aml 20% confidence

FINTRAC website: www.fintrac-canafe.gc.ca

Verdict Attribution

Source:
AI-Generated · Unreviewed
AI synthesized:
2026-07-13 (deepseek-chat)
Last updated:
2026-07-13
Confidence:
medium

This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.

Conditional — a custodial wallet/SaaS provider can operate in Canada but must register as both a FINTRAC MSB (2-4 weeks) and obtain provincial securities registration as a Restricted Dealer or Marketplace (6-18 months), use a qualified Canadian custodian, segregate client assets, and meet minimum capital (CAD 50K-100K) and CCO requirements.

Questions this verdict aims to answer

  • What custody license / qualified-custodian status applies?
  • What segregation, insurance, and proof-of-reserves rules apply?
  • What AML obligations attach to the SaaS vs the white-label client?