The Canada MSB Registry of Convenience

• Xeltox Enterprises, trading as Cryptomus, was a registered money services business throughout the conduct that drew a $176,960,190 FINTRAC penalty in October 2025, roughly seven times the more than $25 million FINTRAC issued across all 23 Notices of Violation in 2024-25. The penalty is under appeal in Federal Court.
• The public registry runs four statuses, and “suspended” is not one of them. When somebody tells you a Canadian MSB is suspended, they are describing a Quebec license, a securities order, a corporate standing problem, or nothing at all.
• FINTRAC recorded 566 expired registrations against 351 renewals in 2024-25, on a base of 2,778 registered MSBs, so expiry is an ordinary administrative event rather than a signal.
• Twelve registrations were revoked across the whole of 2024-25. Twenty-three went in a single day in March 2026, most of them crypto, and eleven of those were British Columbia companies.
• Quebec is the only province where a regulator makes a licensing decision, and it makes that decision only after the Sûreté du Québec returns a security clearance report. British Columbia passed its own statute in 2023 and BCFSA’s February 2026 service plan targets implementation in 2027/28.

Xeltox Enterprises Ltd. held a clean FINTRAC registration for the entire period covered by the largest penalty in Canadian anti-money laundering history. The British Columbia company, trading as Cryptomus and previously as Certa Payments, was assessed $176,960,190 on 16 October 2025 for a list of failures that includes 1,068 unfiled suspicious transaction reports in the single month of July 2024, involving suspected trafficking in child sexual abuse material, fraud, ransomware and sanctions evasion, plus 1,518 unreported virtual currency receipts of $10,000 or more in that same month and 7,557 breaches of the Iran Ministerial Directive between July and December 2024.

Anyone who ran the registry during that window got one word back, and the word was “Registered.” The Vancouver street address on file was, according to reporting by Brian Krebs, home to at least 76 foreign currency dealers, eight MSBs and six cryptocurrency exchanges, in a building that used to be a bank and now houses a massage therapy clinic and a co-working space where none of them were paying for services. None of that is a registry field, and none of it would have moved the status.

Xeltox has taken the penalty to Federal Court, arguing errors of law, and specifically that FINTRAC treated it as the same entity as a Panama-based company that operates the Cryptomus platform under a software license, and that it had no knowledge or control over the Iran-linked transactions FINTRAC counted against it. So the findings are contested and untested in court as of August 2026, which shapes how you cite the case and does nothing to the underlying point, since the registration status was accurate on its own terms the entire time.

The future of finance is here. Trade crypto and more

Four statuses, and none of them is “suspended”

The public registry runs Registered, Revoked, Ceased and Expired, and FINTRAC states plainly on the registry page that registration does not indicate that it endorses or licenses the business, and that it issues no licenses and no certificates of registration. Ceased means the business told FINTRAC it stopped offering prescribed services. Expired means it did not renew after two years. Revoked means FINTRAC ended the registration, which can follow ineligibility, a failure to answer a clarification request within 30 days, or a failure to respond in a timely way to a demand for information.

Nowhere in that set is “suspended,” and nowhere is “terminated,” which is why both words are worth stopping on when they turn up in a memo about a Canadian MSB. Somebody using them is describing a Quebec license, a securities order, a corporate standing problem, a Bank of Canada decision, or nothing at all, and the only way to find out which is to ask what document the word came from. The same discipline applies in the other direction, because “active” is a reasonable shorthand for Registered right up until it appears in a report where the reader assumes a regulator used it.

Expired is the status most often over-read, since the two-year clock runs from registration and the renewal has to go in before the expiry date, with FINTRAC free to send a clarification request that opens another 30-day window on top of it. A registration whose displayed expiry date has passed can still correctly read Registered while a timely renewal sits in processing, and a business whose status flipped to Expired may have been out of the registry for a day or for two years. The status field carries none of that history.

More registrations expired than were renewed

FINTRAC’s own numbers make the churn concrete, since in 2024-25 it recorded 509 new registrations and 351 renewals, against 198 cessations and 566 expirations, on a base of 2,778 registered money services businesses at 31 March 2025. FINTRAC notes that the expiry figure includes registrations that expired and were subsequently renewed, so the number does not describe 566 businesses walking away, but the ratio still tells you something useful, which is that roughly one expiry event occurred for every five live registrations in a year and that expiry is administrative weather rather than a finding.

Twelve registrations were revoked across the whole of that same year, which is the baseline the 2026 numbers have to be read against. In March 2026 FINTRAC revoked 23 in a single day, overwhelmingly crypto businesses, with Finance Minister François-Philippe Champagne describing the sweep as a significant acceleration and promising to maintain the momentum against cryptocurrency MSBs and crypto ATMs. Investigative reporting on that batch found eleven British Columbia companies among them, several clustered at a Richmond address in the same complex once used by the underground bank Silver International, with directors drawn from Spain, the Czech Republic, Estonia, Georgia, Latvia, Cyprus, Ukraine, Moldova and Russia.

So a status pulled in February 2026 and a status pulled in April 2026 could differ for reasons that have nothing to do with anything the counterparty did in between, and FINTRAC’s standing list of businesses with revoked registration was itself first published in March 2026. Any file that records a status without recording the retrieval date is asserting something it cannot support, and the registry itself refreshes monthly rather than live.

The services field is an election the registrant made once

What the registry publishes about activity is whatever the registrant selected, drawn from the categories FINTRAC lists in its MSB guidance, meaning foreign exchange dealing, remitting or transmitting funds, issuing or redeeming money orders and traveler’s checks, dealing in virtual currency, crowdfunding platform services, armored car services and check cashing. Registrants must keep that information current and tell FINTRAC within 30 days when it changes. Xeltox was penalized in part for failing to do exactly that, four times during the examination period, which means the registry entry a diligence team would have relied on was itself one of the contraventions.

Reading the services field against the website is the cheap test and it produces two kinds of exception, of which only one is interesting. A business advertising virtual currency exchange with no corresponding registry entry is worth a question, though the innocent explanations are numerous enough that it settles nothing on its own, since the activity may sit in a different group entity, may have started after the last registry refresh, or may be delivered under an agency arrangement. A business whose registry entry covers services its public materials never mention is the more useful signal, because scope elections are made once and rarely trimmed, and a dormant virtual currency election on a check casher is a line of questioning rather than an answer.

New Scam Prevention Course. Never make a rushed crypto decision again.

Neither test touches volume, counterparties, corridors or clients, and none of that is public anywhere in Canada. FINTRAC’s own public-facing guidance tells people to verify the name, number and status in the registry and then adds that registration indicates only that the business fulfilled a legal requirement, and that FINTRAC does not regulate money services businesses beyond the framework of the Act, which is the regulator marking the outer limit of what its own database proves.

Quebec is the only province where a regulator makes a decision

Revenu Québec administers the provincial regime and issues licenses in six categories, being currency exchange, funds transfer, the issue or redemption of traveler’s checks, money orders or bank drafts, check cashing, the operation of ATMs, and the operation of cryptoasset ATMs. What separates it from the federal process is the gate, because Revenu Québec decides only after receiving security clearance reports from the Sûreté du Québec for the business and for each person associated with it, and the licensing decision turns on what those reports say.

FINTRAC does run background checks, and its registration process requires a criminal record check issued no more than six months before the application for each person who directly or indirectly owns or controls 20% or more of the entity. The difference is what the regulator does with the document, because federal registration is a filing that must be accepted once the requirements are met, while a Quebec license is a discretionary grant that a provincial police force feeds into. That distinction is the reason a Quebec permit is worth more as evidence of vetting than a FINTRAC number, and the reason its absence tells you less than people assume.

Revenu Québec’s public register can be searched by business name or license number, by address, or by the ATM number Revenu Québec assigns, and it carries a caution most users skip past, which is that an authorized money-services business may not be listed and that anyone who cannot find one should contact the department. An empty Quebec search is therefore “no record located in the public register on this date, subject to confirmation,” and writing it up as “unlicensed in Quebec” is an overstatement the regulator has pre-emptively warned against. The other Quebec trap is vintage, since the Autorité des marchés financiers ran the original regime and older law firm commentary still says so, which makes an AMF-era citation useless as evidence of anything current.

British Columbia has had the statute since 2023 and is targeting 2027/28

Everywhere outside Quebec, the provincial question is really a corporate registration question plus whatever activity-specific regime applies, and British Columbia is the jurisdiction where that is about to stop being true. The province passed a dedicated Money Services Businesses Act in 2023, and BCFSA announced at the time that it would take on the sector, putting the population at roughly 578 businesses operating in the province and stating that the registration deadline was still to be determined.

Three years later it is still to be determined. BCFSA’s service plan published in February 2026 treats 2026/27 as the year implementation readiness gets completed, with the Act implemented according to plan in 2027/28 and the regime monitored and strengthened in 2028/29, all of it qualified as subject to government direction. The operative provisions were not in force as of August 2026, so a British Columbia MSB needs no provincial registration today, and any diligence conclusion written about BC has a shelf life measured against that service plan rather than against the file.

That timing sits awkwardly against the fact that BC companies dominated the March 2026 revocation batch and that Xeltox was a BC corporation, which is the sort of gap between where the risk concentrates and where the licensing sits that tends to get closed eventually. Anyone writing a Canada-wide MSB position should date the BC row and diary it, because the moment the Act commences the correct answer for hundreds of businesses flips from “no provincial registration required” to “registered or operating unlawfully.”

The Bank of Canada runs the other federal registry

Payments firms carry a second federal registration that has nothing to do with anti-money laundering, and the two get collapsed constantly. The Bank of Canada took on retail payments supervision on 8 September 2025 and publishes registered payment service providers on a rolling basis as national security screenings complete, alongside a list of applicants still under review and a separate list of refused or revoked registrations. The Bank says in the same breath as FINTRAC that it does not endorse or license registered PSPs, which by now should read as a house style across Canadian financial registries.

Absence from the PSP registry means two opposite things depending on one date. An applicant that filed during the transition window before 8 September 2025 can keep performing retail payment activities while its review runs, and is expected to be meeting operational risk and end-user fund safeguarding obligations in the meantime, while an applicant that filed after that date must have a registration decision in hand before performing retail payment activities at all. So a payments company missing from the registry is either lawfully waiting in a very long queue or operating in breach, and the only way to tell is to establish when it applied.

Buy bitcoin and stocks. Signup to Coinbase today

The refusal reasons are the underused signal, and as of 23 March 2026, on McCarthy Tétrault’s count, 32 applications had been refused or revoked, of which 16 involved businesses that ceased retail payment activities or fell outside RPAA scope, eight were declined because the retail payment activity was incidental to crypto or digital asset issuance and exchange, and two were subsidiaries of Canadian banks covered by an exemption. Those eight are the ones to notice, because a crypto business that assumed it needed both registrations and was told it needed only one has a live perimeter question underneath it that nobody outside the company has seen.

The corporation number is the most useful field in the record

Incorporation jurisdiction, incorporation number and incorporation date are all registry fields, and they are the most useful thing in the record precisely because they are the ones that let you leave it. Name matching alone is unsafe in this sector, since operating names change, similar brands proliferate, and an agent can advertise a principal’s brand without being the registrant, and FINTRAC is explicit that a person offering MSB services strictly as an agent or mandatary is not the entity that registers.

From the corporation number, federal entities open up further than provincial ones. Corporations Canada has published individuals with significant control since the filing requirement took effect on 22 January 2024, exposing full legal name, the period of significant control, a description of the control and an address, with one hard constraint, which is that you cannot search by the name of an individual and have to come at it through a corporation you already know about. Quebec’s enterprise register publishes declared ultimate beneficiaries and is the strongest public ownership source in the country for entities that fall inside it. Most other provinces publish directors and officers and stop there, which is where the common error creeps in, because a director list is not a shareholder list and treating it as one produces an ownership conclusion the record never supported.

Where the public trail ends, the substitute is documentary rather than another database, meaning a current share register, the corporation’s own register of individuals with significant control, an organizational chart, and a walk up through every corporate shareholder to a natural person. That work is what would have surfaced the Xeltox structure, since the dispute in its appeal turns on which entity operated the platform and under what license, and no Canadian registry field renders a relationship of that kind.

Agents never appear in the registry, and since October 2025 the MSB owns their checks

A principal registers and its agents do not, which means a network of storefronts, kiosks and white-label partners can sit behind a single registry row while the public record says nothing about any of them. FINTRAC closed part of that gap on 1 October 2025 by pushing the diligence onto the principal, requiring an MSB to verify an agent’s eligibility before engaging it and again within 30 days after every second anniversary, and to obtain criminal record checks for an entity agent’s chief executive officer, president, directors and anyone owning or controlling at least 20% of the entity, with the records issued within the preceding six months and retained for five years. MSBs that already had agents in place before that date have until 1 October 2027 to complete their first round.

That turns the agent file into a live diligence request rather than a public search, and one with a testable answer, because the records either exist with dates on them or they do not. An MSB running a large agent network that cannot produce the verification and criminal record check documentation is telling you something about its control environment, and it is telling you now rather than in October 2027 when the transition ends.

Foreign money services businesses are the mirror image of the same problem, in that an FMSB has no place of business in Canada and still has to register when it directs and provides services to clients here, with FINTRAC clear that the obligations rest on the foreign business rather than on its Canadian representative for service. Failure to register as an FMSB is what cost Binance $6,002,000 in May 2024 and what sat at the top of the violation list when Peken Global, operating KuCoin, drew $19,552,000 in July 2025. A foreign platform serving Canadian users with no registry entry sits inside the regime and in breach of it, and the blank search result is the symptom rather than the answer.

Bill C-12 repriced the whole exercise on 26 March 2026

Every number in a Canadian MSB risk memo written before spring 2026 is now understated. Bill C-12 received royal assent on 26 March 2026 and FINTRAC’s maximum penalties rose by as much as 40 times, with prescribed violations now reaching $4 million for an individual and $20 million for an entity against previous ceilings of $100,000 and $500,000, and contravention of a compliance order reaching the greater of $5 million or 3% of income for an individual and the greater of $30 million or 3% of gross revenue for an entity. Certain compliance program failures moved up from serious to very serious, ability to pay became an explicit criterion, compliance agreements became mandatory after prescribed violations, and a refusal to enter one produces a compliance order that FINTRAC must publicize.

FINTRAC has said it will apply the old policy to violations occurring entirely before that date and the new framework to violations on or after it, and will scope examinations so they fall within one regime. The transition line explains why the Necosmart penalty of $693,742.50, imposed on 27 March 2026 on an Edmonton MSB for reporting, policy, risk assessment and virtual currency recordkeeping failures, priced off the old rules despite landing a day after the new ones took effect. Conduct still running today gets no such treatment, and a lookback that straddles 26 March 2026 has two price lists in it.

In crypto, one bad click is final. Learn to verify before you lose.

Two further changes are drafted and waiting on the Governor in Council. Universal enrollment will require reporting entities that are not currently required to register to enroll with FINTRAC, and stablecoin issuers will be deemed to be dealing in virtual currency and required to register as MSBs. When those land, the population inside the registry grows and the meaning of a registry hit shifts again, since a great many businesses will hold a record for the first time without anything about their operations having changed.

What a defensible Canadian MSB file contains

The registry search belongs at the start of the work and produces four things worth keeping, which are the legal entity behind the brand, the corporation number that lets you leave the registry, the exact status word with the date it was retrieved, and the services election to reconcile against everything else. FINTRAC issued 23 Notices of Violation totaling more than $25 million across the whole of 2024-25, and one penalty in the following year came to seven times that, which is a reasonable measure of how quickly the enforcement baseline is moving and how little a status field carries. Money services businesses were also the most examined sector in that year, out of 294 formal examinations, and FINTRAC made 32 non-compliance disclosures to law enforcement, more than double the prior year and the most it has ever made, so the sector is being looked at harder than the public record shows.

Everything after that is separate evidence answering separate questions, so the home-jurisdiction registrar establishes whether the entity legally exists and where, Revenu Québec establishes whether it holds a Quebec license (with an empty result written up as an empty result), and the British Columbia commencement question gets rechecked every time rather than carried forward from the last file. Where the entity is also a PSP and is missing from the Bank of Canada registry, the fact worth establishing is when it applied. Ownership comes from filings and share registers rather than director lists, the agent position comes from the verification records themselves, and the state of the compliance program comes from FINTRAC examination correspondence, effectiveness reviews and remediation material the business agrees to hand over, none of which is public and all of which is the only evidence that speaks to whether the program works.

A file that ends at “Registered” has established that a business submitted a form and that FINTRAC did not reject it. Xeltox cleared that bar for years.

See more: Compare Canada licensed companies for sale