Bitcoin ATM KYC Requirements in Canada

• Bitcoin ATM operations in Canada are strictly regulated under federal anti-money laundering laws, enforced by FINTRAC (Financial Transactions and Reports Analysis Centre of Canada).
• Every operator must formally register as a Money Services Business (MSB) before turning on a machine.
• Transactions below CAD $1,000 do not require identity verification, though operators are still required to keep a transaction record.
• Purchases or sales at or above CAD $1,000 trigger strict Know-Your-Customer (KYC) rules, requiring identity verification via one of five FINTRAC-approved methods.
• Any transaction of CAD $10,000 or more, in cash or crypto, must be reported directly to FINTRAC.
• Splitting a large trade into smaller transactions will not bypass reporting requirements; all trades made within a 24-hour period by the same user are aggregated.
• Proposed federal legislation in May 2026 to outright ban crypto ATMs could soon make these regulatory rules obsolete.

What a Bitcoin ATM Does, and Why the Law Watches It

A Bitcoin ATM is a machine that swaps cash for cryptocurrency, and that swap is what puts it inside Canada’s anti money laundering rulebook. The machines look like bank cash dispensers, and they sit in convenience stores, gas stations and shopping malls. Under the law they are treated as financial businesses rather than as vending machines, so the same reporting duties that apply to a currency exchange office apply to them.

Two Directions, Two Sets of Paperwork

Most machines in Canada work in one direction, meaning you feed in banknotes and the machine sends Bitcoin to your wallet. A smaller number goes two ways, so you can also send crypto to the machine and collect cash. Each direction creates a different obligation for the operator. Taking your cash makes the operator responsible for cash reporting rules, and receiving your crypto makes the operator responsible for virtual currency reporting rules. Both directions count as a virtual currency exchange transaction, which is the legal phrase for trading one form of value for another.

Why Cash Draws Attention

Cash is the reason regulators treat these machines as higher risk than a website. When you sign up to an online exchange, the platform already has your bank details, your email and a paper trail before you trade. A machine on a shop wall starts with none of that, so identity has to be built at the moment of the transaction. Canada’s Department of Finance leaned on this point when it proposed a ban in May 2026, citing studies that put between 85 and 98 percent of crypto ATM transactions in the illicit category and an estimate from the Canadian Anti Fraud Centre that Canadians lost between 142 million and 284 million dollars in 2024 to fraud that ran through these machines. Industry groups have publicly challenged those figures, so treat them as the government’s working assumption rather than a settled measurement.

The future of finance is here. Trade crypto and more

Who Regulates Bitcoin ATMs in Canada

Two layers of government have a say, and an operator has to satisfy both before the first customer walks up. The federal layer covers the whole country and does most of the work. The provincial layer matters in Quebec and adds a licence on top.

Fintrac and the Federal Rulebook

FINTRAC is the federal agency that supervises anti money laundering compliance, and any business dealing in virtual currency has to register with it. That registration duty started on 1 June 2020 under amendments to the Proceeds of Crime (Money Laundering) and Terrorist Financing Act. The phrase “dealing in virtual currency” is broad on purpose, and it captures exchange services, transfer services and custodial wallet providers. A Bitcoin ATM operator falls squarely inside it, which makes the operator a money services business, usually shortened to MSB.

Registration is only the entry ticket, because a second wave of obligations landed on 1 June 2021. From that date operators had to verify customer identity at set thresholds, keep detailed transaction records, report large transactions, file suspicious transaction reports and pass identifying information along with crypto transfers. Those 2021 rules are the ones that produce the ID prompts you see on a machine screen today.

Quebec Adds a Licence

Quebec has required more than federal registration since 12 February 2015, when the Autorité des marchés financiers announced that businesses operating a virtual currency ATM in the province need an AMF licence under the Money Services Businesses Act. The AMF can fine a business that operates without one or revoke a licence already granted. The regulator also warns plainly that holding a licence gives customers no protection from price swings, and that money spent at these machines carries no deposit insurance.

The KYC Thresholds That Apply at the Machine

Canadian KYC at a Bitcoin ATM works as a ladder, where each dollar threshold adds a new duty on top of the one below it. Understanding the three rungs explains almost everything a machine asks you for.

Below CAD 1,000: A Record Without an ID Check

Every virtual currency exchange transaction requires a record, no matter how small it is. FINTRAC calls this a transaction ticket, and it captures details such as the date, the amount, the type of virtual currency, the exchange rate used and the wallet address involved. What changes below 1,000 dollars is identity verification, because the duty to confirm who you are only switches on at that figure. In practice a small purchase may need a phone number and nothing else.

This is the gap that critics point at most often. Speaking to Canadian media after the ban was announced, the Canadian Bitcoin Consortium argued that the threshold should drop from 1,000 dollars to zero so that every single transaction carries a verified identity. CBC’s investigation into the sector reported that most crypto ATM transactions in Canada average under 1,000 dollars, which tells you how much activity sits below the verification line.

CAD 1,000 and Above: Full Identity Verification

Once a virtual currency exchange transaction reaches 1,000 dollars, the operator has to verify your identity and record it. The record has to include your name, your address, your date of birth and your occupation. This is the point where a machine will ask you to scan a driver’s licence or passport, take a photo of your face, or answer questions that link you to an existing credit file.

A separate 1,000 dollar rule applies to virtual currency transfers, and it is usually called the travel rule. When an operator transfers crypto at your request, the name, address and account or reference number of both the sender and the receiver have to travel with the transfer. That rule also took effect on 1 June 2021. Wallets you control yourself sit outside its scope for now.

New Scam Prevention Course. Never make a rushed crypto decision again.

CAD 10,000 and Above: A Report Goes to FINTRAC

At 10,000 dollars the operator stops merely recording and starts reporting. Handing over 10,000 dollars or more in cash in a single transaction triggers a Large Cash Transaction Report, which has to reach FINTRAC within 15 calendar days. Sending 10,000 dollars or more worth of crypto to a two way machine triggers a Large Virtual Currency Transaction Report. Both reports carry a heavy amount of detail, including your identity, the source of the funds, the wallet addresses on each side and every reference number attached to the trade.

The 24 Hour Rule Closes the Obvious Loophole

Splitting a large amount into several smaller ones is the first idea most people have when they read a threshold, and Canadian rules already answer it. Under the 24 hour rule, an operator has to add up two or more transactions that fall inside a rolling 24 hour window and report them together once they reach 10,000 dollars. Transactions are grouped by who conducted them, who received the value, or which third party they were carried out for. The rule applies to large cash reports and to large virtual currency reports alike, so nine separate 1,500 dollar purchases in one afternoon produce the same report as one 13,500 dollar purchase.

How Operators Verify Who You Are

Canadian law names the acceptable ways to prove identity, so an operator cannot invent its own standard. FINTRAC sets out five methods, and a machine will normally rely on the first or the third.

The government issued photo identification method uses a valid, current document from a federal, provincial or territorial government that shows your name, your photo and a unique number. Because you are standing at a machine rather than in front of a person, the operator needs technology that authenticates the document, for example by checking its security features or by matching a selfie against the photo.

The credit file method checks your name, address and date of birth against a Canadian credit bureau file that has existed for at least three years and draws on more than one source. The dual process method combines two pieces of information from two different reliable sources, such as your name and address from one and your date of birth from another. The remaining two methods let an operator rely on verification already performed by an affiliate or by another reporting entity under a written agreement.

What Happens to Your Information Afterwards

Records created at a Bitcoin ATM have to be kept for at least five years from the day they were made. That covers the transaction tickets, the identity records and the reports filed with FINTRAC. Operators also have to run a compliance programme around all of this, which means written policies approved by senior management, a named compliance officer, a documented risk assessment, staff training and an effectiveness review every two years.

The Duties You Never See on Screen

Behind the machine sits a set of obligations that produce no prompt at all, and they matter because they shape how operators behave. Suspicious transaction reporting is the most important of them. If an operator has reasonable grounds to suspect that a transaction relates to money laundering or terrorist financing, it has to file a report, and there is no dollar threshold attached. A 200 dollar purchase can trigger one.

Operators also have to watch for politically exposed persons, meaning people who hold or held senior public office, along with their close relatives and associates. For virtual currency activity that determination attaches to transactions of 100,000 dollars or more, and a match brings extra approval steps and closer ongoing monitoring.

What Happens When an Operator Gets It Wrong

Enforcement in Canada has moved quickly since 2025, and the numbers involved changed the risk calculation for the whole sector. On 16 October 2025 FINTRAC imposed a penalty of 176,960,190 dollars on Xeltox Enterprises Ltd., operating as Cryptomus. The findings included a failure to file suspicious transaction reports on 1,068 occasions and a failure to report 1,518 virtual currency transactions of 10,000 dollars or more, all during a two month window in 2024. FINTRAC described the case as unprecedented for Canada’s virtual currency sector.

In crypto, one bad click is final. Learn to verify before you lose.

The penalty framework then became harsher.

For violations committed after 26 March 2026, FINTRAC can apply maximum penalty amounts up to 40 times the previous limits, and it gained two new enforcement tools in the form of compliance agreements and compliance orders. FINTRAC has also been removing operators from the register, since a registration can be revoked for failing to respond to information requests, failing to meet eligibility conditions or failing to keep records current. Losing MSB registration ends the business, because operating without it is illegal.

The Proposed Ban and What It Would Change

Every rule above describes a system that Ottawa now wants to replace with a prohibition. In the Spring Economic Update presented in May 2026, the federal government proposed to ban crypto ATMs in order to shut down what it called a primary method for scammers to defraud victims and for criminals to place cash proceeds of crime. The update said the details would come in legislation expected to be tabled shortly, and it paired the proposal with 17.9 million dollars in new funding for FINTRAC and 352.7 million dollars over five years for a new Financial Crimes Agency.

Two things are worth holding onto here. The first is that a proposal in an economic update carries no legal force until a bill passes Parliament, so the KYC thresholds described in this article remain the live rules for now. The second is that the machines kept spreading while the proposal was being debated, and CBC’s reporting put Canada at roughly 91 crypto ATMs per million people, a higher density than any other country. That combination of growth and political pressure is why compliance costs in the sector have climbed sharply through 2026.

What This Means If You Use a Bitcoin ATM

For an ordinary customer the practical picture is simple. Expect to give a phone number for small purchases, expect a scan of government photo identification once you cross 1,000 dollars, and expect a formal report to be filed above 10,000 dollars. On top of that, expect the machine to remember you, since your records sit with the operator for five years. Fees will be far above an exchange, because CBC found typical crypto ATM fees running between 15 and 30 percent against 4 to 5 percent on regulated platforms.

One warning deserves its own sentence. If anyone contacts you and instructs you to take cash to a Bitcoin ATM, for any reason at all, stop and call your bank or the police. Government agencies, courts, utility companies and legitimate businesses never ask for payment through a crypto machine, and this pattern is the single most common way Canadians lose money to these machines.