Regulation

In the ever-evolving world of digital finance, the rise of cryptocurrencies has been nothing short of a wild rollercoaster ride. From early skepticism to mainstream attention, crypto has come a long way, especially in emerging economies where traditional banking systems often leave gaps. For many people in these regions, the ability to buy Bitcoin with […]...

Smart contract exploits cost $905.4 million across 122 protocols during 2025. Cetus lost $223 million and Balancer roughly $128 million, and in both cases the broken code sat outside the scope of the audits covering those protocols. Automation is fast and partial, and the best three-tool combination in a 2025 evaluation caught 76.78% of annotated […]...

Of the four tokenization structures SEC staff mapped in January 2026, one moves the security itself. The September exemptive order makes every venue verify that a tokenized share carries the same dividend, voting, and liquidation rights as the conventional one. Swiss law lets a qualifying ledger hold the security itself under four statutory conditions, while […]...

MiCA Article 73 and FCA SYSC 8.1.8R both require an outsourcing firm to keep in-house expertise for evaluating the vendor’s work. A European CASP carries MiCA and DORA at once, and Article 73 compliance settles nothing under DORA. Supervisors can order a firm to drop a designated critical ICT provider. Washington proposed replacing the 2023 […]...

Quebec is the only one of the three provinces that licenses MSBs today: Revenu Québec issues licenses under the Money-Services Businesses Act, with police checks and 2026 to 2027 fees of $826 per service class. British Columbia’s Money Services Businesses Act received Royal Assent on 11 May 2023 but takes effect only through regulation, and […]...

Revenu Québec has issued Quebec MSB licenses since 13 September 2021, when the AMF stopped administering the Money-Services Businesses Act; the AMF now matters mainly for crypto trading platforms under securities law. Six services need a license: currency exchange, funds transfer, traveller’s cheques, money orders and bank drafts, cheque cashing, ATM operation and, since 1 […]...

A regulatory sandbox lets a crypto firm test one defined product with real customers under caps on customers, volumes and time, while a full crypto license lets it run the business commercially with no test boundaries. Sandboxes confer three legal positions: a restricted license (FCA, DFSA), a time-limited exemption (Wyoming, ASIC, the SEC’s 2026 Innovation […]...

The UK lets an unregistered crypto firm advertise to UK consumers if a “section 21 approver” authorized by the Financial Conduct Authority (FCA) signs off its ads. Firms that never apply for authorization, however, must wind down their UK crypto business before 25 October 2027. Approval rights can vanish fast, as Binance learned when the […]...

Most crypto license applications end without approval. Singapore has received close to 300 applications for a digital payment token license since 2020, and 37 firms hold one today. Many failed applications end in withdrawal. Firms often pull out once they see the regulator is likely to say no. Weak anti-money laundering controls are the problem […]...

A share sale leaves the licence inside the same legal entity, so its capital requirement carries straight through signing, completion and integration without any reset. Under MiCA, a crypto-asset service provider (CASP) must hold the higher of its Annex IV floor of €50,000, €125,000 or €150,000 and one quarter of the previous year’s fixed overheads, […]...

A fit and proper test checks that a licensed firm’s owners and senior staff are honest, competent and financially sound, and every major crypto hub runs one. Under the EU’s Markets in Crypto-Assets Regulation (MiCA), buying 10% or more of a crypto-asset service provider, or crossing 20%, 30% or 50%, triggers a regulatory review of […]...

Section 4(a)(6)(B) allows issuance only where the issuer can comply with a lawful order to seize, freeze, burn or block its tokens. Tether burns frozen balances, Circle blocks transfers without burning, and the Paxos contract behind PYUSD can wipe a frozen address. Both major issuers reserve the right to move before a court order exists, […]...

MiCA Article 5(2) hands the crypto-asset white paper obligations to any trading platform that admits a token on its own initiative. Article 15 extends civil liability to the operator and its management body, and contractual exclusions have no legal effect. Article 76 bars assets that hide holders behind an anonymization function. Gotbit’s founder forfeited around […]...

Custody appears on 194 of the roughly 330 CASP authorizations on ESMA’s register; operating a trading platform appears on twenty. The industry licensed itself as broker-dealers with wallets. Annex IV Class 1/2/3 are capital floors keyed to your highest-risk service, and Article 59 requires the authorization to name each service individually. Class 3 grants nothing […]...

Bitcoin ATM operations in Canada are strictly regulated under federal anti-money laundering laws, enforced by FINTRAC (Financial Transactions and Reports Analysis Centre of Canada). Every operator must formally register as a Money Services Business (MSB) before turning on a machine. Transactions below CAD $1,000 do not require identity verification, though operators are still required to […...

PIPEDA covers commercial activity anywhere in Canada, so a platform serving Canadians is caught whether or not it is based here, and Alberta, British Columbia and Quebec add their own statutes. Anti-money-laundering rules force crypto firms to collect and keep data that privacy rules tell them to minimise, and reconciling the two is this sector’s […]...

A crypto business falls under Canada’s Retail Payment Activities Act when it performs at least one of five defined payment functions, does so as a business activity rather than incidentally, ties that function to an electronic funds transfer made in Canadian or foreign currency, and falls inside the Act’s geographic scope without qualifying for an […]...

The required travel rule data for a virtual currency transfer is the name, address, and account number or other reference number (if any) of the person or entity who requested the transfer, plus the name, address, and account number or other reference number (if any) of the beneficiary. The commonly cited CAD 1,000 threshold appears […]...

Xeltox Enterprises, trading as Cryptomus, was a registered money services business throughout the conduct that drew a $176,960,190 FINTRAC penalty in October 2025, roughly seven times the more than $25 million FINTRAC issued across all 23 Notices of Violation in 2024-25. The penalty is under appeal in Federal Court. The public registry runs four statuses, […]...

The registered PSP being acquired files the section 24 application, and it must be re-registered before the transaction closes, which puts the closing condition in the hands of the party the buyer is negotiating against. The Bank’s 45-day window is a period to decide whether to refuse a completed application, and the Minister of Finance […]...

An AI agent in AML is a software component that executes multi-step investigative work rather than only surfacing information, and that distinction is what triggers governance obligations. The highest-value deployments today sit in high-volume, well-defined work: sanctions and politically exposed person screening, first-line alert triage, adverse media review, evidence gathering and suspicious act...

The model law says a license “is not transferable or assignable,” which is why an equity purchase preserves the licensed entity and an asset purchase leaves the buyer applying from scratch, and the MTMA contains no merger or succession provision at all, so a deal in which the licensee stops existing has no statutory answer. […]...

A registrable remittance service is an item 29 or 30 value transfer that does not involve a transfer of virtual assets, so the same designated service sends you to a different register depending only on what moved, and a business doing both flows sits on both registers. The DCE-to-VASP change took the regulated set from […]...

The Stablecoin Act received Royal Assent on 26 March 2026 and is still tagged “[Act not in force]”, with commencement left to a Governor in Council order that has not been made and Finance Canada pointing at 2027. Section 12 excludes financial institutions, and the Act borrows the Bank Act definition, which covers provincially chartered […]...