The MSB Recordkeeping Matrix

The duty itself is one sentence: PCMLTFA s. 6 requires every reporting entity to keep records in accordance with the regulations. For a money services business, the regulations expand that sentence into a matrix of record types, and the cleanest way to hold the matrix in your head is by trigger amount. Two records trigger at $10,000 (large cash and large virtual currency), a cluster of transfer records triggers at $1,000 (EFTs, non-EFT remittances, virtual currency transfers), cheque-cashing and money-order records trigger at $3,000, and exchange transaction tickets are required for every exchange regardless of amount.

Two mapping cautions before the detail. First, foreign MSBs carry parallel obligations — the foreign-MSB counterparts of the large cash and large virtual currency records sit at PCMLTFR ss. 34 and 35. Second, PCMLTFR s. 36.1 sometimes appears in MSB recordkeeping checklists, but it is the crowdfunding platform services record provision; include it only if crowdfunding services are actually in scope.

PCMLTFR s. 31 requires a large cash transaction record for every amount of $10,000 or more in cash received from a person or entity in a single transaction. PCMLTFR s. 32 mirrors this for virtual currency: a large virtual currency transaction record for every $10,000 or more in virtual currency received in a single transaction. Both carry the same exception — no record is required when the amount is received from a financial entity or public body, or from a person acting on behalf of a client that is one.

These records capture the same underlying data that feeds large cash and large virtual currency reporting, so most MSBs build them at intake rather than reconstructing them afterward. For virtual currency, that means capturing the transaction-level identifiers and addresses at the moment of receipt; for the exact prescribed fields of each record, check the current FINTRAC MSB record-keeping guidance rather than relying on a summary.

The EFT records sit in PCMLTFR s. 36 and follow the transfer through its lifecycle: para. (d) requires a record for every EFT of $1,000 or more the MSB initiates at a person's or entity's request; para. (e) covers sending an international EFT of $1,000 or more as an intermediary; and para. (f) covers final receipt of an international EFT of $1,000 or more. An MSB keeps a record for each role it plays in the chain — initiator, intermediary sender, or final receiver.

Value that moves by means other than an EFT is caught at the same threshold: s. 36(c.1) requires a record when the MSB transmits $1,000 or more by non-EFT means, and s. 36(c.2) when it remits $1,000 or more by non-EFT means. Virtual currency transfers follow the same logic: s. 36(g) requires a record for a transfer of $1,000 or more in virtual currency at a person's or entity's request, and s. 36(h) for receipt of $1,000 or more in virtual currency for remittance to a beneficiary.

Cheque cashing became a prescribed MSB service under PCMLTFR s. 29.1, with obligations in force April 1, 2025. Under s. 36(b.1), the MSB must keep a record when it cashes one or more cheques totalling $3,000 or more at a person's or entity's request — the date, the requester's details, the total amount, the name of the cheque issuer, and account or reference numbers. Money orders sit at the same tier: s. 36(b) requires a record where the MSB receives $3,000 or more as consideration for issuing traveller's cheques, money orders or similar negotiable instruments (with the financial-entity exception), and s. 36(c) where it redeems money orders totalling $3,000 or more.

Foreign exchange works differently, and this is a common trap: s. 36(i) requires a foreign currency exchange transaction ticket for every foreign exchange transaction, regardless of amount. The $3,000 figure appears only inside the s. 1(2) definition of the ticket — at $3,000 or more, the ticket must additionally set out the requester's name, address, nature of principal business or occupation, and (for a person) date of birth. The parallel virtual currency exchange transaction ticket under s. 36(j) is likewise required for every virtual currency exchange, with its enhanced-information threshold at $1,000.

Acquirers of private automated banking machines are written into the MSB definition itself — PCMLTFA s. 5(h)(iv.1) and (h.1)(iv.1) cover providing acquirer services in relation to a private automated banking machine — with obligations in force October 1, 2025. Related record-keeping provisions include PCMLTFR s. 33(k); for the full field list for this service line, check the current FINTRAC guidance.

Agent records deserve their own row in the matrix. The registration application must already list every agent, mandatary and branch with name, address, telephone number, services provided and relationship, and changes must be notified to FINTRAC (SOR/2007-121, s. 4 and Schedule 1, Part C). Since October 1, 2025, PCMLTFA s. 9.93 requires the MSB to obtain and review criminal-record documents for each agent — for entity agents, the CEO, president, directors and 20%-plus owners — before engagement and again within 30 days after the second anniversary of the most recent review; under PCMLTFR s. 37.1 the documents must have been issued no more than six months before the review and must be kept for five years. Note what is not prescribed: no PCMLTFA or PCMLTFR provision requires a written agency agreement as a record — the two-year effectiveness review should cover agent agreements per FINTRAC's compliance-program guidance, and the s. 37 service-agreement records concern client entities, not agents. The program documentation itself — written policies, documented risk assessment, the training program covering employees and agents, and the documented two-year effectiveness review — is required by PCMLTFR s. 156.

Retention is PCMLTFR s. 148 — a frequently miscited provision, since s. 146 is the ongoing-monitoring record requirement, not the retention rule. Under s. 148(1), records must be kept for at least five years after: the day the account they relate to is closed, for account records; the day of the last business transaction, for records such as information records and corporate documents; or the day the record was created, in any other case. That last clock is the default for MSB transaction records, so each record type should be tagged with its own retention start date rather than a single firm-wide date. Section 147 permits electronic storage, provided a paper copy can readily be produced.

The rule that makes retention operational is PCMLTFR s. 149: every record must be kept in a way that allows it to be provided to an authorized person within 30 days after a request to examine it under PCMLTFA s. 62. A record that exists but cannot be retrieved within that window fails its purpose, which is why periodic retrieval testing — pull a sample of each record type and time the retrieval — is a sensible standing control.