FINTRAC MSB Address Requirements: What Counts, What Doesn't, and Why It's Getting Stricter
A practical breakdown of how FINTRAC evaluates MSB addresses in 2026, what gets rejected at registration, and what to do if your business does not have a traditional office.
FINTRAC MSB Address Requirements: What Counts, What Doesn't, and Why It's Getting Stricter
FINTRAC treats your MSB address as evidence that your business is real.
As FINTRAC's enforcement posture sharpens, 86 MSB registrations were revoked in Q1 2026 alone. Compliance teams and incoming registrants are asking the same question with increasing urgency: what address can we actually use?
What FINTRAC Is Actually Evaluating
When FINTRAC reviews an MSB registration, the address is one of the first signals it reads. You need to know what the address needs to prove.
FINTRAC expects your registered address to function as a real point of contact during investigations and compliance reviews. That means someone needs to be reachable there, the space needs to be operational, and the address needs to be verifiable. As FINTRAC's own registration guidance makes clear, the regulator expects more than a mailing address from registered entities.
FINTRAC's position is clear: virtual offices, PO boxes, and shared workspaces without dedicated MSB facilities do not qualify. This is where a lot of newly registering businesses, especially international operators and lean fintechs, run into problems.
What Doesn't Count
PO Boxes
A PO box is a mail drop. FINTRAC explicitly requires that foreign MSBs appoint an Agent for Service in Canada who provides a physical Canadian address that is not a PO box. The same logic applies to domestic registrants. An address that only receives mail tells FINTRAC nothing about whether your business is operational.
Virtual Offices and Mailboxes
Virtual offices, services that provide a prestige street address, mail handling, and occasional meeting room access, are not enough. Mailboxes and virtual offices do not count as MSB locations under FINTRAC's framework. A proper rental or owned office space is required.
Coworking Spaces (with one important exception)
Generic coworking memberships, where multiple unrelated businesses share the same floor, present the same problem. Shared workspaces without dedicated MSB facilities do not qualify, because they cannot demonstrate that your business specifically occupies and operates from that address. If FINTRAC is conducting a review and arrives at the address, there is no dedicated space tied to your MSB.
What Does Count
FINTRAC is looking for an address that meets three tests.
Operational.
The office must be open and accessible during business hours. It cannot be a mailing address or an address used by dozens of unrelated tenants simultaneously.
Staffed.
Employees or representatives must be available for regulatory communications and audits. An empty room with your company name on the door is not enough. Someone needs to be reachable there.
Dedicated to your MSB.
The space is verifiably associated with your specific business. This is what distinguishes a real operational address from a shared or virtual one.
Proof of operations matters too.
Banking partners and FINTRAC both look for documents like a CRA letter, utility bills, or employment records tied to that specific address. A nil utility bill at a supposed office raises flags immediately.
The Exception: A Compliance Service Provider's Address
Here is where the nuance matters, and where the market is shifting.
A shared space can qualify if it is the address of your compliance service provider. It reflects how outsourced compliance functions operate in practice.
When an MSB engages a compliance outsourcing firm, that firm takes on defined functions under the PCMLTFA, including serving as the compliance officer, maintaining records, managing reporting obligations, and acting as the operational compliance presence for that business. The address of that firm is supposed to be the address of a regulated compliance function that FINTRAC can actually reach.
The FINTRAC MSB registration framework requires that compliance personnel be reachable and operationally present. A compliance service provider's address satisfies that requirement because it meets all three tests: it is operational, staffed, and dedicated to your MSB's compliance function.
This is exactly the type of service AML Incubator provides. AML Incubator's address functions as a proper, staffed compliance address for the MSBs it serves. If you are receiving inbound queries about address requirements, this is the conversation they need to have.
Why This Is Getting Stricter in 2026
FINTRAC is not making address requirements harder arbitrarily.
The enforcement pattern behind 2026's revocations points to a consistent issue: businesses that registered but never built real operational infrastructure.
The risk profile sharpens when the absence of a physical office is combined with no identifiable website, no compliance function, and no transaction reporting. That combination describes a non-operational entity, not a legitimately operating remote business.
FINTRAC's enforcement approach in 2026 is driven by the broader shift embedded in the March 2026 PCMLTFA amendments. Compliance program violations that were previously classified as "serious" have been elevated to "very serious," a reclassification that carries direct consequences for penalty quantum.
The signal is the same one regulators globally are sending: having rules on paper is not enough. An address that is not operationally real is a compliance program gap. FINTRAC is treating it that way.
What This Means for Incoming MSB Applicants
If you are registering a new MSB, or renewing and realizing your current address does not hold up, here is the practical position.
- A PO box will not pass.
- A virtual office or mailbox will not pass.
- A generic coworking membership where your business shares space with dozens of others will not pass.
Your options are a dedicated physical office that is staffed and operational, or a compliance service provider whose address reflects a real, functioning compliance presence tied to your MSB. Failure to meet FINTRAC's address requirements can result in registration denial or revocation.
In 2026, with revocations running at the pace they are, this is not a risk you should be taking.
How AML Incubator Can Help
AML Incubator works with MSBs, fintechs, PSPs, and crypto platforms across Canada, the US, UAE, and Australia. For businesses that need a compliant Canadian address tied to a functioning compliance program, AML Incubator’s outsourced CAMLO and compliance services provide exactly that.
AML Incubator’s services include:
If your MSB address does not meet FINTRAC's requirements, or you are not sure whether it does, book a Discovery Call.
We will review your situation, identify the gap, and tell you exactly what your registration needs.
🌐 amlincubator.com
📧 hello@amlincubator.com
