SaaS or MSB? Where the Software Line Actually Is

"We're just software" is a product description, not a legal classification. The MSB definitions in the Proceeds of Crime (Money Laundering) and Terrorist Financing Act — s. 5(h) for domestic businesses and s. 5(h.1) for foreign businesses directing services at Canadians — attach to the services a business actually performs, such as remitting or transmitting funds. If a business is engaged in those services, registration follows under s. 11.1 regardless of what the pitch deck calls the company.

In practice this means a scope review starts from the flow of funds and the platform's role in it, not from the industry category. Two products with identical marketing language — "payment infrastructure," "orchestration," "embedded finance" — can land on opposite sides of the line depending on who holds, moves, or directs the money.

The workable version of the test is to decompose the product into functions and sort them. On one side: pure messaging, analytics, dashboards, reconciliation reports, and user interface. On the other: initiating payment instructions, controlling when and where settlement happens, holding customer funds even briefly, or providing money services directly to end users.

A platform that only formats and forwards data while a licensed processor and the merchant's own bank move the money looks different from one that can trigger a payout, redirect a settlement, or sit in the funds flow. A payroll platform that briefly holds employer funds before disbursing wages is doing something categorically different from an invoicing tool that generates payment links and hands the payer to a processor — even if both call themselves SaaS.

Payment orchestration that genuinely only routes messages between merchants and processors is a different activity from transferring money. The trap is that "we never touch funds" is a claim to verify, not an assumption to write down. The review should trace every dollar: whose account does the money enter, who can initiate or amend the instruction, who bears settlement risk, and whether the platform's contracts or API permissions let it move value.

If the platform gives payment instructions or controls settlement, software framing will not remove MSB scope. Businesses in this position typically either restructure so a registered party performs the funds-touching functions, or accept that they may need to register and build the program obligations that follow.

The same decomposition applies to physical products. A vendor that only sells or leases payment terminals — hardware, with no settlement role — is a different analysis from one that bundles processing, settlement, routing, or merchant onboarding alongside the device. The scope review should separate the box from the services attached to it.

This matters because terminal businesses rarely stay hardware-only. Adding a merchant-services layer, taking a role in settlement, or onboarding merchants onto a payments network can change the analysis even though the core product is still a device. Each added service should be re-run through the messages-versus-money sort.

FINTRAC withdrew its PI-7670 policy interpretation positions on merchant servicing and payment processing effective April 27, 2022, and confirmed the change in notices dated April 27 and July 21, 2022. Interpretation letters from that earlier era are historical context only — they are not a current basis for concluding a payments product is out of scope.

A business that classified itself years ago on the strength of an old letter is well served by re-running the analysis against the statute and FINTRAC's current MSB guidance rather than the archived position.

Businesses that do this well keep a written record: a flow-of-funds diagram naming every account the money passes through, the contracts and API permissions that show who can initiate or redirect payments, the reasoning for each function sorted as messaging or money, and the date and product version the analysis reflects. The conclusion is a documented judgment, not a one-word label.

The analysis also has a shelf life. Product changes — a new payout feature, a wallet, a settlement service — should trigger a re-run, and the regulatory perimeter itself keeps moving: armoured-car and currency-transport services came into scope on July 1, 2024, and acquirer services for private automated banking machines became a registerable obligation on October 1, 2025. When the product or the rules change, the file should change with them; where a specific case is unclear, check the current FINTRAC guidance or seek a policy interpretation.