AML Requirements for Crypto Exchanges in Canada (2026 Checklist)
What FINTRAC requires from crypto exchanges in 2026: registration, a compliance program, KYC at $1,000, LVCTRs at $10,000, the travel rule, monitoring and records.
Quick answer: In Canada, a crypto exchange must register with FINTRAC as a money services business (MSB) dealing in virtual currency before it serves anyone. It then needs a full AML program: a compliance officer, written policies, a risk assessment, training and a review every two years. Day to day, it must verify client identity for crypto exchanges and transfers of $1,000 or more, report crypto received in amounts of $10,000 or more (LVCTRs), report suspicious transactions of any amount, follow the travel rule on every transfer it sends, and keep records for at least five years. Trading platforms also need securities registration with the CSA and CIRO.
Who these rules apply to
These AML requirements apply to any business that offers crypto exchange (buying, selling or swapping virtual currency) or crypto transfer services to people in Canada. That includes:
- centralized crypto exchanges and brokers
- crypto ATM operators
- OTC desks
- custodial wallet and transfer services
- foreign exchanges serving Canadians, which must register as foreign MSBs
New to the terms? See what is a crypto exchange or VASP.
The key numbers at a glance
The 8 AML requirements for crypto exchanges
1. Register with FINTRAC
Register as an MSB dealing in virtual currency before you start, and renew every two years. Registration is free. See our MSB registration guide.
2. Securities registration for trading platforms
Crypto trading platforms also fall under securities law. The CSA requires them to register (through CIRO) or operate under a public pre-registration undertaking while they register.
3. Appoint a compliance officer
Name a CAMLO with real authority, time and crypto knowledge. Many exchanges use an outsourced CAMLO.
4. Document your risk assessment
Assess money laundering and terrorist financing risk across your clients, products, delivery channels, countries, and crypto-specific factors such as privacy coins, mixers and unhosted wallets. Update it whenever your business changes.
5. KYC, sanctions and PEP screening
Verify client identity for crypto exchanges and transfers of $1,000 or more, screen against sanctions lists, and check for politically exposed persons. Apply enhanced due diligence to high-risk clients. More in KYC in crypto.
6. Transaction and blockchain monitoring
Monitor trades and wallet activity for red flags: rapid in-and-out flows, links to darknet markets or sanctioned addresses, and structuring just under thresholds. Blockchain analytics tools help, but someone must review the alerts. See transaction monitoring challenges for crypto exchanges.
7. Report to FINTRAC
- STRs: suspicious transactions of any amount, as soon as practicable. See when to file an STR.
- LVCTRs: crypto received in amounts of $10,000 or more, including smaller amounts that add up within 24 hours. See our LVCTR guide.
- Travel rule: send sender and recipient details with every crypto transfer.
- Terrorist property reports and listed-person checks, where they apply.
8. Keep records, train staff and review the program
Keep client and transaction records for at least five years, train staff regularly, and get an independent effectiveness review at least every two years.
What happens if a crypto exchange gets AML wrong?
FINTRAC has been especially active with crypto businesses, including dozens of MSB registration revocations in 2026 (see FINTRAC's 2026 crypto crackdown). Since March 26, 2026, penalties can reach $20 million per very serious violation for a business, and FINTRAC publicly names businesses it penalizes. See FINTRAC penalties for MSBs.
Banks also check all of this before opening or keeping accounts for crypto businesses.
Frequently asked questions
Do crypto exchanges need to register with FINTRAC?
Yes. Any business offering crypto exchange or transfer services to people in Canada must register with FINTRAC as an MSB dealing in virtual currency, including foreign exchanges.
What is the KYC threshold for crypto in Canada?
Crypto exchanges must verify client identity for virtual currency exchanges and transfers of $1,000 or more, and for crypto received in amounts of $10,000 or more.
What is an LVCTR?
A large virtual currency transaction report. Exchanges must file one when they receive crypto worth $10,000 or more in a single transaction, or in smaller amounts that add up to $10,000 within 24 hours.
Does the travel rule apply to crypto in Canada?
Yes. MSBs must send sender and recipient information with the crypto transfers they send.
Do crypto trading platforms need more than FINTRAC registration?
Yes. They also fall under securities law and must register with the CSA through CIRO, or operate under a pre-registration undertaking while they register.
What are the penalties for crypto AML violations in Canada?
Up to $20 million per very serious violation for a business since March 26, 2026, plus public naming and possible loss of registration.
AML Incubator helps crypto exchanges register with FINTRAC, build AML programs, set up monitoring and provide outsourced compliance officers.
Get help with crypto exchange compliance
Sources: FINTRAC, MSB registration · FINTRAC, LVCTR guidance · FINTRAC, travel rule
