Does a Payment Processor Need to Register with FINTRAC?

Nothing in Canadian AML law turns on the words "payment processor," "PSP," or "payfac." Those are payments-industry labels. The legal category is money services business, defined by activity: under PCMLTFA s. 5(h), a business that remits or transmits funds (among other listed services) is an MSB, and under s. 5(h.1) a foreign business directing those services at persons in Canada is a foreign MSB. If the definition is met, registration with FINTRAC is required under s. 11.1 before operating.

This is why two companies that both describe themselves as processors can land on opposite sides of the line. One passes card authorization messages between a merchant's acquirer and the network without ever touching money. Another receives customer funds into its own account and later settles to the merchant. Same label, different funds-flows, potentially different registration outcomes.

The questions that matter are operational. Who holds the funds at any point between payer and payee — and in whose account, under whose name? Who controls settlement: its timing, its destination, whether it can be held back or redirected? Who receives payment instructions from the payer, and who forwards them onward? What do the payer terms and the merchant agreement actually say about the service being provided?

"We just facilitate checkout" does not resolve any of these. A checkout provider that never touches funds and never controls settlement is in a genuinely different position from one whose operating account sits in the middle of the flow. A payroll platform that briefly holds employer funds before paying employees out is moving money on instruction, whatever its marketing says. The analysis is done arrangement by arrangement, reading the contracts against the actual movement of money.

For years, many processors relied on FINTRAC's policy interpretation PI-7670 and related positions about merchant servicing and payment processing. FINTRAC withdrew those positions effective April 27, 2022, and confirmed the change in notices dated April 27 and July 21, 2022. Anything built on the old interpretations should be treated as historical context only.

A business whose scope memo predates April 2022, or that cites PI-7670 as its reason for not registering, typically re-runs the analysis against the current MSB guidance and the statutory definitions. The conclusion may or may not change — but the authority it rests on must.

Card, EFT, and bank transfer are delivery mechanisms, not legal categories. The same service can be in scope on one rail and out of scope on another — or in scope on both — because what matters is the funds-flow and who controls it, not the pipe the money travels through. Comparing your product to a competitor's "because we both use EFT" is not an analysis.

The point cuts both ways. Sending value to a beneficiary over card rails — a push-to-card payout to a family member abroad, for instance — can still be remitting or transmitting funds. The card network in the middle does not convert a remittance into something else. Businesses that assumed card rails placed them outside MSB analysis are often the ones most surprised by the funds-flow review.

MSB scope is not static. Cheque-cashing services and crowdfunding platform services are prescribed MSB services under PCMLTFR s. 29.1. Transporting currency or negotiable instruments (armoured car services) became a reporting-entity obligation on July 1, 2024, and acquirer services for private automated banking machines became a registerable MSB/FMSB activity on October 1, 2025. A scope conclusion reached a few years ago can be overtaken by amendments even if the business itself has not changed.

The practical habit is to revisit the analysis when the product changes, when the contracts change, and when the regulations change — and to check the current FINTRAC guidance rather than relying on remembered positions.

Whatever the conclusion, write it down. A useful scope memo names the parties, attaches or summarizes the payer terms and merchant agreements, diagrams the funds-flow account by account, states who controls settlement and who handles instructions, cites the provisions and guidance relied on, and is dated — so that when guidance or the product changes, there is a baseline to reassess against.

If the conclusion is that the business is an MSB, registration under PCMLTFA s. 11.1 is the beginning, not the end: registered businesses must maintain a compliance program under PCMLTFA s. 9.6 and PCMLTFR ss. 156–157, including a designated compliance officer, policies and procedures, a risk assessment, training, and a two-year effectiveness review.