Custodial wallet / SaaS in Canada
Hosted wallet provider that holds keys on behalf of end users, often white-labeled to businesses (custody as a service).
Custodial SaaS is conditionally permitted in Canada with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- FINTRAC MSB registration under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act — mandatory for any VASP dealing in virtual currency
- Customer identification and verification (KYC) at account opening
- Record keeping (5-year minimum) for all transactions and customer identification records
- Reporting suspicious transactions to FINTRAC
- Reporting large virtual currency transactions (over CAD 10,000) to FINTRAC within prescribed timelines
- Registration completes in ~2-4 weeks with FINTRAC, but securities registration is the dominant burden
- SaaS provider (as the entity holding keys) likely bears primary AML obligations; white-label clients may also need their own FINTRAC registration if dealing in virtual currency with end users
Key Restrictions
- Qualified Canadian custodian required — must use a custodian that meets Canadian securities regulatory standards for custody of client assets (not a US or offshore custodian)
- Client asset segregation is mandatory — must hold client crypto assets in trust accounts or segregated wallets, separate from the operator's proprietary assets
- Securities registration as Restricted Dealer (provincial) or Marketplace — 6-18 month process, requires pre-registration undertaking (PRU)
- Minimum capital for Restricted Dealers: CAD 50,000–100,000; must maintain insurance and designate a CCO approved by the regulator
- Foreign platforms serving Canadians must register or face enforcement — Binance exited Canada rather than comply
- Provincial passport system: must register individually in each province/territory where business is done (CSA coordinates via passport system)
Key Risks
- Aggressive enforcement by provincial securities regulators — multiple platforms (KuCoin, Bybit, Binance) fined CAD 1M-2.5M or banned for operating without registration
- Regulatory ambiguity around whether custodial wallet SaaS constitutes 'trading' in securities — CSA Staff Notice 21-327 pushes broad interpretation
- Dual-registration risk: FINTRAC MSB (fast, low bar) + provincial securities registration (slow, high bar) must both be satisfied
- No dedicated federal crypto custody regime — relies on existing CSA custodial standards designed for traditional securities (may not fit crypto-specific operational realities)
- White-label model creates shared AML liability — unclear where oversight burden falls between SaaS provider and client
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
FINTRAC — AML/CFT, MSB registration, transaction reporting
CSA — Provincial securities regulation — crypto trading platform registration (Staff Notice 21-327)
Proceeds of Crime (Money Laundering) and Terrorist Financing Act (2000) — AML/CFT, MSB registration
CSA Staff Notice 21-327 (2020) — Crypto trading platform registration requirements — aggressive enforcement since 2021
VASP: FINTRAC MSB registration (2-4 weeks) + provincial Restricted Dealer registration via CSA (6-18 months). Foreign platforms serving Canadians must register or face enforcement. Binance exited Canada rather than comply.
CUSTODY: Qualified Canadian custodian required for registered platforms. Client asset segregation mandatory.
EXCHANGE: MSB (FINTRAC) + Restricted Dealer or Marketplace registration (provincial). Pre-registration undertakings prohibit margin trading and restrict altcoin offerings. $50K-$100K minimum capital for restricted dealers.
Securities industry professionals must register with the securities regulatory authority in each province or territory where they do business
The ultimate authority for licensing requirements rests with each provincial securities commission
The Canadian Securities Administrators (CSA) coordinate provincial regulators through a passport system
Anyone in the business of trading securities or advising clients on securities must be registered with the securities regulator in each province or territory where they do business, unless an exemption applies
Registration framework is established through National Instrument 31-103 (NI 31-103) — Registration Requirements, Exemptions and Ongoing Registrant Obligations
All registrants must maintain minimum capital and insurance based on registration category and business activities; non-IIROC firms require CAD 25,000 to CAD 100,000 depending on category
All registrants must designate a Chief Compliance Officer (CCO) approved by the regulator who must complete the Exempt Market Products Course (EMPC) or equivalent plus CCO training
CSA Staff Notice 21-327: Guidance on Securities Legislation for Crypto Asset Trading (via BCSC or CSA sites).
OSC Crypto Businesses guidance (osc.ca/en/industry/registration-and-compliance/crypto-businesses).
Canadian Securities Administrators (CSA): The umbrella organization coordinating provincial and territorial securities regulators, issuing national guidance for crypto asset trading platforms.
Ongoing Focus on Unregistered Platforms: Securities regulators continue to target platforms operating in Canada without registration. This often results in cease trading orders, financial penalties, and requirements for platforms to either register or exit the Canadian market.
Many international crypto trading platforms that previously operated without registration have entered into pre-registration undertakings (PRUs) with provincial commissions, which are formal agreements required to continue operating while pursuing registration, rather than post-hoc settlements for past non-compliance.
Bybit: In March 2023, the OSC reached a settlement with Bybit, requiring the platform to pay $2,468,982 and provide an undertaking that it would not operate in Ontario without registration.
KuCoin: In June 2022, the OSC obtained orders against KuCoin (Mechbit Technology Ltd.) permanently banning it from participating in Ontario's capital markets and requiring it to pay an administrative penalty of $1,650,000 and $99,754 for costs.
Binance: Following a pattern of non-compliance, Binance entered into an undertaking with the OSC in December 2022 to cease all operations in Ontario. Later, in May 2023, the AMF imposed an administrative monetary penalty of $2.25 million on Binance for operating an unregistered platform and offered non-compliant derivatives in Quebec.
FINTRAC website: www.fintrac-canafe.gc.ca
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — a custodial wallet/SaaS provider can operate in Canada but must register as both a FINTRAC MSB (2-4 weeks) and obtain provincial securities registration as a Restricted Dealer or Marketplace (6-18 months), use a qualified Canadian custodian, segregate client assets, and meet minimum capital (CAD 50K-100K) and CCO requirements.
Questions this verdict aims to answer
- What custody license / qualified-custodian status applies?
- What segregation, insurance, and proof-of-reserves rules apply?
- What AML obligations attach to the SaaS vs the white-label client?