Short answer: People search for a "money services business licence" in Canada, but federally it is a registration. A money services business (MSB) must register with FINTRAC before it begins to operate. Quebec also licenses MSBs separately. Once registered, you run a compliance program, verify clients, keep records and report certain transactions to FINTRAC. Those duties belong to the registered business. Your platform's job is to capture the right data at the right moment and keep evidence that holds up when FINTRAC examines you.
RemitSo is white-label remittance software for licensed money transfer operators. We are a technology company, not an MSB, and nothing here is legal advice.
Is there an MSB licence in Canada?
FINTRAC's registration page says MSBs operating in Canada must register before they begin to operate. Being registered or licensed with a province or territory does not replace it. The application asks about your bank account, your compliance officer, your owners and senior management, each location, any agents, and the volume you expect for each service.
Several of those answers are operational facts your platform should be able to show: where you operate, who acts for you, and how much flows through each service. Registered MSBs appear in FINTRAC's public MSB registry, and your bank and payout partners will look you up there. FINTRAC notes that registration does not mean it endorses or licenses the business.
Provincial rules in brief. Quebec licenses money-services businesses under its own law, through Revenu Québec. If you serve clients there, that is a separate process. Ask your adviser whether any other provincial rules apply to your model.
KYC and record keeping in the platform
FINTRAC publishes guidance on when MSBs must verify identity and on the methods you can use. It also expects you to keep the client relationship under review and, in specific cases, to determine whether a third party is involved. Its record keeping guidance for MSBs sets out which records to keep, for how long, and how fast you must produce them.
What that means for the system:
- Verification with the method and evidence attached. On RemitSo, e-KYC through a connected identity provider checks the ID document, a selfie and a live face, and matches the name to the profile. Alternatively, the customer uploads proof of identity, proof of address and source of funds for manual review. Evidence is kept with every result.
- Third parties recorded, not guessed. In the cases FINTRAC sets out, you must take reasonable measures to determine whether a third party is involved. The platform should let your team flag a transfer for review and record what it determined. On RemitSo, risk rules are built from 47 ready-made indicators, and the reviewer's decision stays on the record.
- Decisions that keep their reasons. A reviewer can overrule an identity check or a risk flag, and the reason stays on the record.
- Records you can produce quickly. Clear audit trails, user access logs and exportable compliance reports mean evidence leaves the system as a usable file, not as screenshots.
Report data: electronic funds transfers, large cash and suspicious transactions
FINTRAC's reporting rules ask different questions of your data. The thresholds and timelines are on FINTRAC's pages, and your adviser will confirm which reports apply to you.
Electronic funds transfer reports (EFTRs). FINTRAC's EFT reporting guidance covers international transfers that MSBs initiate or finally receive. Its 24-hour rule asks you to treat certain transactions within a 24-hour window as one. For a platform, that means three things. Every field FINTRAC's form asks for has to be captured when the transfer happens. Transfers have to be grouped the way FINTRAC's rule describes. And you need to be able to show that every reportable transfer was reported.
Large cash transaction reports. FINTRAC's large cash guidance applies to physical cash. An online-only remitter may see little of it, but the system still needs to record how each transfer was funded and paid out, so cash is never invisible. (If you deal in virtual currency, FINTRAC has separate guidance.)
Suspicious transaction reports (STRs). FINTRAC's STR guidance centres on reasonable grounds to suspect, built from facts, context and indicators. The platform can surface the facts, hold the transfer, keep each review and its reason, and limit who sees sensitive records. Whether there are reasonable grounds to suspect is for your compliance officer to decide.
Whichever vendor you choose, ask to see a report file produced from test transfers, not a slide. On RemitSo, ask us which FINTRAC formats are available for your launch.
Sanctions and ministerial directives
Every sender, recipient and staff member on RemitSo is screened against eight sanctions lists, kept up to date, including Canada's SEMA list (see Global Affairs Canada's consolidated autonomous sanctions list). Everyone is re-screened when the lists change. A possible match holds the transfer until an officer on your team rules on it.
FINTRAC also publishes ministerial directives and transaction restrictions that can apply to transactions linked to particular jurisdictions. Your risk rules should be able to treat named countries differently, and RemitSo's rules can watch named high-risk countries alongside the 47 indicators.
Monitoring and limits
FINTRAC's compliance program requirements include a documented risk assessment, policies, training and a regular review of how well it all works. It also publishes ML/TF indicators for MSBs, which are a good test of whether your monitoring rules reflect your risk assessment.
On RemitSo:
- AML rules in dollars. Rules are set per currency, for example CAD sent from Canada, and narrowed by sending and payout country.
- Limits that ask for more as totals grow. You set "up to" amounts per transaction and over a day, week, month, 90 days or a year. Each tier names the documents the customer must provide, and above the top tier an officer has to raise the limit.
- Every change on record. Each change to a rule records who made it and when.
- Training you can prove. An optional add-on assigns courses, sends reminders and keeps a permanent record.
The rule we design to is simple: the platform flags, and your compliance team decides.
Where your data lives
Each RemitSo operator runs its own instance in its own AWS account, in the AWS region it chooses. AWS bills the operator directly, and nothing is shared with another operator. When FINTRAC, an auditor or a bank partner asks where client records are held, you can answer exactly. RemitSo is ISO 27001:2022 certified.
Checklist: rule area and what the platform should evidence
| Rule area | What the platform should be able to evidence |
|---|---|
| MSB registration | Your locations, agents and volumes per service, matching what you told FINTRAC |
| Client identification | Verification method, documents, results, reviewer decisions and reasons |
| Third parties | The third-party determination, where FINTRAC requires one, reviewed and recorded |
| EFT reporting | Every required field captured at transfer time, grouping per the 24-hour rule, a completeness check |
| Large cash | How each transfer was funded and paid out |
| Suspicious transactions | Review trail, decisions with reasons, and restricted access to sensitive records |
| Sanctions and directives | Lists screened, when they were loaded, each ruling, and rules for named countries |
| Compliance program | Rules and limits that match your policies, each change logged, training records |
| Records | Audit trails, user access logs and exportable compliance reports |
Frequently asked questions
Do I need a money services business licence in Canada?
Federally, MSBs register with FINTRAC before they begin to operate. Quebec also licenses money-services businesses through Revenu Québec. Your adviser can confirm what applies to your model.
Does RemitSo register us with FINTRAC or file reports for us?
No. Registration, your compliance program and every report stay with your business. RemitSo gives you the platform that captures the data and keeps the evidence.
Is Canada's sanctions list screened?
Yes. Canada's SEMA list is one of eight lists, kept up to date. Senders, recipients and staff are screened, and everyone is re-screened when the lists change.
Does the platform decide what is suspicious?
No. It flags and holds. A person on your team rules on every match and every held transfer, and the reason is kept with the record.
Where is our client data held?
In your own instance, in your own AWS account, in the AWS region you choose. AWS bills you directly, and nothing is shared with another operator.
For more, see RemitSo for Canadian operators, our KYC, AML and sanctions tools and our transaction monitoring rules guide. Book a demo to see a CAD transfer screened, held and ruled on by your own team.
Rules change, and FINTRAC's own pages are the authority. Treat this as a guide to what your platform should record and report, not as legal advice. Check with your compliance adviser.