Canada’s Crypto Travel Rule: Required Data and Transfer Decisions

• The required travel rule data for a virtual currency transfer is the name, address, and account number or other reference number (if any) of the person or entity who requested the transfer, plus the name, address, and account number or other reference number (if any) of the beneficiary.
• The commonly cited CAD 1,000 threshold appears nowhere in the travel rule provision itself. It is inherited from the record-keeping trigger in the Regulations, which is where a firm should look to work out whether a given transfer is in scope.
• Receiving a transfer with data missing creates a decision, and Canadian law requires that decision to be governed by written risk-based policies that specify when the firm will allow, suspend, or reject the transaction.
• Information received under the travel rule cannot be removed when the transfer is passed on, which binds intermediaries as well as the two ends of the chain.
• FINTRAC has named travel rule policies among the deficiencies in at least one published penalty notice, and its record crypto penalties rest on reporting failures that draw on the same underlying data set.

What the Canada Crypto Travel Rule Requires, and Who It Binds

The travel rule is a requirement to ensure that specified information about both parties travels with a transfer of value. In its virtual currency form, FINTRAC applies it to financial entities, money services businesses, and foreign money services businesses, which must include the travel rule information when they send virtual currency transfers and must take reasonable measures to ensure that the information is included when they receive virtual currency transfers for which a record must be kept. Casinos are covered for electronic funds transfers, and the virtual currency limb reaches the three categories above.

That scope matters more than it first appears, because a money services business is defined by activity rather than by asset class. Under the Act, an entity dealing in virtual currencies from a place of business in Canada is a money services business and must register with FINTRAC. An entity with no place of business in Canada falls into the foreign money services business category when it directs services at persons or entities in Canada and provides those services to clients in Canada. FINTRAC applied exactly that four-part test in September 2025 when it determined that Peken Global Limited, the Seychelles-incorporated operator of KuCoin, met the foreign money services business criteria and therefore had an obligation to register. The company disputed the classification and appealed to the Federal Court.

One structural difference separates the virtual currency travel rule from its fiat counterpart, and it is easy to miss. For electronic funds transfers, FINTRAC’s guidance covers international transfers and transfers within Canada sent via a SWIFT MT-103 message or its equivalent. The virtual currency limb carries no such geographic qualifier. A transfer between two Canadian platforms is treated the same way as a transfer to a counterparty in Singapore.

New Scam Prevention Course. Never make a rushed crypto decision again.

The Two Data Sets, and How They Differ From a Wire

Having established who is bound, the next question is what has to move. FINTRAC sets out the required travel rule information for virtual currency transfers as the name, address and the account number or other reference number (if any) of the person or entity who requested the transfer, described as originator information, and the name, address and the account number or other reference number (if any) of the beneficiary.

Read that against the wire transfer version and a small asymmetry emerges. For electronic funds transfers, the required set is the name, address and account number or other reference number (if any) of the person or entity who requested the transfer, the name and address of the beneficiary, and, if applicable, the beneficiary’s account number or other reference number.

The practical weight of the table sits in the reference number line. A virtual currency transfer frequently has no account number in the banking sense, and the phrase “other reference number” is what absorbs the exchange’s internal client identifier or the destination address. Firms that map only a wallet address into that field and leave the client identifier out are populating the weakest available value, which becomes visible the moment an examiner asks the firm to link a transfer back to a verified client.

Where the CAD 1,000 Threshold Actually Comes From

Almost every guide to this subject cites a CAD 1,000 threshold. Almost none explain that the figure appears nowhere in the travel rule provision. Section 124.1(1) of the Regulations prescribes the obliged parties as the financial entities, money services businesses, and foreign money services businesses that are required to keep a record in respect of a virtual currency transfer. The threshold therefore has to be read out of the record-keeping rules, and section 36 of the Regulations sets those at an amount of $1,000 or more in virtual currency transferred at the request of a person or entity, and an amount of $1,000 or more in virtual currency received for remittance to a beneficiary.

FINTRAC confirmed the same logic for the wire transfer side in a written policy interpretation, explaining that the travel rule must be read in conjunction with the record keeping requirements rather than as a standalone obligation, and that because all the prescribed sectors have record keeping requirements at CAD 1,000 or more, it is at this amount that the travel rule obligations begin to apply. The derivation runs the same way for virtual currency, where the regulatory text and the guidance point in one direction.

Exemptions, Aggregation, and Valuation as Consequences

Three consequences follow from that derivation, and each of them trips up firms that treat CAD 1,000 as a free-standing number:

• The exemptions travel with it. Where a record is not required, the travel rule has nothing to attach to. FINTRAC confirms that when a firm transfers or receives virtual currency as compensation for validating a transaction recorded in a distributed ledger, or exchanges a nominal amount purely to validate a transfer of information, it does not need to keep the $1,000 transfer record, the receipt record, or the exchange transaction ticket.
• Aggregation works differently from reporting. The 24-hour rule that combines related transactions is a reporting mechanism, and FINTRAC applies it to large cash, large virtual currency, and electronic funds transfer reports. The CAD 1,000 record trigger is written per transaction.
• Valuation is a policy question. Because the threshold is expressed as an equivalent amount, a firm needs a documented method for converting a token amount into Canadian dollars at the time of the transaction, and that method belongs in its written procedures rather than in a developer’s head.

The Three Tiers of Data Behind a Single Transfer

The travel rule sits inside a stack of obligations that share the same underlying facts, so it helps to see all three tiers together rather than treating each as a separate project.

Two points run through that table. The first is that the CAD 1,000 tier already demands date of birth and occupation for the client, which is considerably more than the two names and two addresses the travel rule itself moves between firms. The second is that all of it must be retained for at least five years and, in FINTRAC’s words, kept in such a manner that it can be provided to the agency within 30 days of a request. A travel rule programme that captures the right fields but cannot reproduce them per transfer on request has solved the easy half of the problem.

The future of finance is here. Trade crypto and more

The Transfer Decision: Allow, Suspend, or Reject

Everything above concerns data that a firm controls. The obligation becomes genuinely operational at the point where a transfer arrives from someone else and the information is missing, which is where Canadian law asks for a decision rather than a record.

FINTRAC’s guidance is unusually direct here. A firm that receives a transfer which should include travel rule information but does not must take reasonable measures to obtain it, and those measures should be set out in its policies and procedures. The firm must also develop in writing and apply risk-based policies and procedures for determining what to do when, after taking reasonable measures, it was unable to obtain the information. Those policies must address the circumstances in which the firm will allow, suspend, or reject the transaction, and must outline any follow-up measures it will take.

Reasonable measures has a defined meaning in this context, which keeps the standard from being either impossible or empty. FINTRAC describes it as steps taken to achieve a desired outcome even where they do not produce that outcome, and gives four examples: asking the client, conducting open source searches, retrieving information already held including in non-digital formats, and consulting commercially available information. A documented attempt that fails still satisfies the requirement. An undocumented success leaves nothing on the file for an examiner to review.

The Travel Rule Decision Policy

A separate constraint applies to firms in the middle of a chain. Section 9.5 of the Act provides that information received under the travel rule cannot be removed from a transfer, which forecloses the practice of stripping fields on the way through. FINTRAC restates the point plainly, telling reporting entities that when they send an incoming or outgoing transfer after receiving it as an intermediary, they must include the information they received or obtained.

The bar for all of this rose on 26 March 2026. 

FINTRAC confirms that amendments made by the Strengthening Canada’s Immigration System and Borders Act came into force that day and require compliance programs to be reasonably designed, risk-based and effective. A travel rule decision policy that exists as a paragraph in a manual and has never governed an actual rejection now sits against an effectiveness standard as well as an existence standard.

Self-Hosted Wallets: What Canada Does and Does Not Ask For

The decision framework assumes a counterparty capable of receiving a message, which self-hosted wallets are not, and the published guidance on this point contradicts itself across vendor sites. One widely cited jurisdiction page states flatly that self-hosted wallets sit outside the scope of Canada’s travel rule. A Canadian advisory firm lists the opposite view, describing the treatment of unhosted wallet transfers as out of scope among the most common compliance failures it sees. Reading the Regulations resolves the tension, because the two claims are answering different questions.

Canada imposes no counterparty verification duty of the kind that several peer jurisdictions have written into law. Setting the major regimes side by side shows how unusual that silence is.

Jurisdiction	Transfer threshold	Self-hosted wallet treatment In crypto, one bad click is final. Learn to verify before you lose.
Canada	CAD 1,000, derived from the record-keeping trigger	No verification duty in law. Beneficiary name and address plus every sending and receiving address still recorded
European Union	EUR 0 between providers	Assessment of whether an address above EUR 1,000 is owned or controlled by the customer
United Kingdom	GBP 1,000 for certain data elements	Unhosted wallet transfer is a defined category brought into scope on its own terms
Switzerland	CHF 1,000	Proof that the client controls the destination wallet
United States	USD 3,000	The 2020 proposal covering self-hosted wallets was withdrawn in April 2024

The comparison explains the disagreement in the vendor literature. Canada has legislated no verification equivalent, which is the accurate core of the first claim.

The Record-Keeping Obligation

The record-keeping obligation, however, makes no distinction based on who or what is at the far end. A firm transferring CAD 1,000 or more in virtual currency at a client’s request must record the name and address of each beneficiary along with every sending and receiving address, and a withdrawal to a client’s own self-custody wallet meets that description.

FINTRAC’s reporting guidance works through scenarios involving unhosted wallets directly, including one in which a platform applies reasonable measures and establishes that the client sent virtual currency from their own unhosted wallet and is therefore the conductor of the transaction. The obligation shifts from passing a message to knowing and documenting who controls the address, which is a different engineering problem solved with signed messages or test transfers rather than a travel rule protocol.

How the Travel Rule Surfaces in FINTRAC Enforcement

Firms tend to calibrate compliance effort to enforcement risk, so it is worth being precise about how this obligation has actually appeared in penalty notices rather than describing enforcement in general terms.

The travel rule has been named directly. In a public notice dated 5 February 2026, FINTRAC set out a penalty of $224,235 against Commerciale I.C. – Pacific Inc., a Montréal money services business, imposed on 2 September 2025 for five violations. The notice states that the firm’s written policies and procedures were not fully developed, with incomplete and missing requirements in critical areas such as business relationships, ongoing monitoring, politically exposed persons and heads of international organizations, transaction reporting policies and procedures, the 24-hour rule, the travel rule, and Ministerial Directives.

The firm has appealed to the Federal Court. That case concerned a wire transfer business rather than a crypto platform, which is precisely why it is instructive: the policy obligation sits in one instrument covering both transfer types, and the deficiency FINTRAC identified was the absence of a written policy rather than a mishandled transaction.

The Largest Crypto Penalties

The larger crypto penalties have rested on reporting failures that draw on the same data. FINTRAC’s record penalty of $176,960,190 was imposed on Xeltox Enterprises Ltd., operating as Cryptomus, on 16 October 2025 and announced on 22 October 2025, covering failures that included 1,068 missing suspicious transaction reports and 1,518 unreported receipts of $10,000 or more in virtual currency, all within the period 1 July to 31 July 2024. Two months later FINTRAC imposed $536,853.35 on MP Technology Services Ltd., a subsidiary of MoonPay Inc. and a Seychelles-incorporated foreign money services business, on 20 November 2025 for four violations, a case in which declined transactions that should have been reported were flagged for direct or indirect exposure to darknet marketplaces, sanctioned entities, and child sexual abuse material. Both firms have appealed.

Read together, those files describe a supervisory pattern. The headline violations are reporting failures, and the reports in question are assembled from originator and beneficiary information, transaction identifiers, and addresses. That is the travel rule data set. A firm that captures it thinly tends to appear in a penalty notice for the reports it could not build, which makes travel rule capture the upstream control that determines whether the downstream filings are possible at all.

Registration status is being enforced alongside all of this. Canadian coverage in March 2026 reported that FINTRAC had revoked roughly 50 money services business registrations during the year to that point, with the substantial majority tied to crypto firms. Any obligation described in this article applies only to registered firms in the first place, which makes registration the load-bearing element of the whole structure.

Buy bitcoin and stocks. Signup to Coinbase today

What Changes Next for Canada’S Crypto Travel Rule

The Canadian rules described here are stable in the short term, and two developments will reshape them over a longer horizon.

The international standard has already moved. FATF adopted a substantially revised Recommendation 16, retitled payment transparency, at its June 2025 plenary, and the changes come into effect by the end of 2030. FATF opened a consultation on draft implementation guidance on 24 June 2026, with responses due by 21 August 2026. Canadian firms have years before any of that reaches the Regulations, and the direction of travel points toward more structured data and stronger expectations on the receiving institution.

The domestic perimeter is widening at the same time. The Budget 2025 Implementation Act received Royal Assent on 26 March 2026 and includes a Stablecoin Act under which, in FINTRAC’s description, stablecoin issuers will be required to register with FINTRAC as money services businesses dealing in virtual currency, with the Bank of Canada maintaining a public registry of issuers. Those obligations take effect through regulations still to be published. A separate universal enrolment requirement, also awaiting regulations, will bring businesses that are not currently required to register into an enrolment relationship with FINTRAC.