DeFi Interfaces, Staking and Token Listings: Scope and Risk Questions

The PCMLTFA does not contain the words "DeFi," "staking" or "token listing." What it contains is a list of services in s. 5(h) (s. 5(h.1) for foreign businesses) that make a person or entity a money services business, which must then register with FINTRAC. The list is extended by regulation: PCMLTFR s. 29.1, for example, prescribes crowdfunding platform services and cheque-cashing services under subparagraphs 5(h)(v) and (h.1)(v). So the scope question is functional, not about what the product calls itself.

The review a founder should actually run: at any point, does the product receive, hold, exchange or transmit users' funds or virtual currency? A front-end that only displays data and routes transactions a user signs from their own wallet raises different questions than one that pools user assets, executes exchange transactions from accounts it controls, or takes custody during a lock-up. Where a design sits near the line, check the current FINTRAC guidance for money services businesses — and recheck it periodically, because the perimeter moves. Obligations for cheque-cashing businesses, factors and financing or leasing entities came into force on April 1, 2025, and acquirer services for private automated banking machines were written into the Act's MSB definition itself (PCMLTFA s. 5(h)(iv.1)) with obligations from October 1, 2025.

Once a business is an MSB, virtual currency obligations attach at exact thresholds under PCMLTFR s. 95(1): verify a person's identity on a transfer of $1,000 or more in virtual currency (s. 95(1)(d)), on a virtual currency exchange transaction of $1,000 or more (s. 95(1)(e)), and when someone is the beneficiary of a virtual currency transfer of $1,000 or more (s. 95(1)(f)). Verification uses one of the five methods in s. 105(1) — government-issued photo ID, government-source information, credit file, dual-process, or affiliate/member — five, not the commonly repeated three. Documents used must be authentic, valid and current (s. 105(5)).

Large receipts carry extra duties: s. 84 requires verifying the identity of the person or entity from which a large virtual currency amount is received, and receiving virtual currency equivalent to $10,000 or more triggers both a large virtual currency transaction record and reasonable measures to determine whether the client is acting for a third party (s. 135). Entity clients — a fund, a corporate treasury staking through your product — are verified under s. 109(1) (corporations) or s. 112(1) (other entities), and an entity service agreement creates an information record with its own third-party determination under s. 137.

A staking client transacts repeatedly — deposits, reward distributions, unstaking — so they cross the identity-verification triggers more than once. Under PCMLTFR s. 4.1(b), a business relationship forms the second time you are required to verify a client's identity; FINTRAC's guidance frames this as the second time within a five-year period, a qualifier that comes from guidance rather than the regulation text. For entity clients, an MSB forms a business relationship the moment it enters a service agreement for listed services (s. 4.1(d)).

Once the relationship exists, s. 123.1 requires ongoing monitoring keyed to your risk assessment under PCMLTFA s. 9.6(2): detecting reportable transactions, keeping client information up to date, reassessing the client's risk level, and testing whether activity is consistent with the client's profile. High-risk clients get enhanced monitoring under the s. 157 special measures. Staking actually helps here — lock-up terms and reward schedules give you a predictable expected pattern, so deviations such as a sudden unstake-and-withdraw to a fresh address, or a staking position funded by someone other than the client, are precisely what the monitoring should surface.

Large positions bring in PEP screening: an MSB must take reasonable measures to determine politically-exposed-person or head-of-international-organization status when a person requests a transfer of $100,000 or more in virtual currency or is the beneficiary of a receipt of $100,000 or more (s. 120(1)). Where the determination is positive for a politically exposed foreign person, or a high-risk domestic PEP or HIO (or their family members and close associates), you must establish the source of the funds or virtual currency and the person's source of wealth and have senior management review the transaction — within 30 days of the transaction (s. 122(9)). A common misconception puts this at 14 days; no such rule exists.

No provision prescribes a token-listing checklist. The anchor is the risk assessment the Act already requires under s. 9.6(2) — the same assessment that calibrates your ongoing monitoring. The practical test for each candidate token: can you still perform every obligation you owe while supporting it? Can your tools trace flows in this token well enough to detect reportable transactions (s. 123.1(a))? Can you value and aggregate receipts reliably enough to catch the $10,000 large-virtual-currency threshold and the $1,000 identification triggers? Anonymity-enhancing features, thin liquidity that makes valuation unstable, and opaque or unreachable issuers all degrade those capabilities — which is exactly why they are risk factors rather than mere reputational concerns.

Issuer diligence can borrow the entity-verification frame. If the issuing entity becomes a client or counterparty, verification runs through s. 109(1) and beneficial ownership through s. 138: names of all directors, names and addresses of everyone owning or controlling 25% or more, and information on ownership, control and structure, with accuracy confirmed at intake and during ongoing monitoring. If that information cannot be obtained or confirmed, s. 138(4) requires verifying the identity of the chief executive officer and applying the s. 157 special measures. Since October 1, 2025, material discrepancies against the federal individuals-with-significant-control database for CBCA corporations assessed as high risk must be reported within 30 days (s. 138.1). A token whose issuer would fail these mechanics is telling you something before the first trade settles.

Keep the records the regulations name: how each identity was verified, keyed to the method used (s. 108); third-party determination records for at least five years (s. 148(1)(c)); and PEP determination and special-measures records (s. 123). Then add two documents no section names but that make every later conversation shorter: a dated scope memo describing what the product actually does with user assets at each step, revisited whenever the product or the regulations change; and a listing memo per token recording the factors weighed, the decision, and the monitoring plan for that asset. Where a question falls outside these provisions — such as the current treatment of a specific non-custodial design — check the current FINTRAC guidance before building on an assumption.