Crypto Regulation in Canada 2026: CARF, Enforcement & the Stablecoin Act
2026 is the year Canada stopped treating crypto with kid gloves.
Four major regulatory changes are hitting the crypto industry simultaneously — and together, they fundamentally reshape what it means to operate a crypto business in this country. Whether you already hold a Money Services Business registration with FINTRAC or you are evaluating Canada as your next market, you need to understand what has changed and what it means for your business.
Here are the four pillars driving the transformation:
- CARF — the Crypto-Asset Reporting Framework went live on January 1, 2026, adding a new layer of tax reporting obligations for every crypto service provider in Canada.
- FINTRAC enforcement — the regulator revoked 47+ crypto-linked MSB registrations in Q1 2026 alone, signaling that the era of light-touch oversight is over.
- Bill C-12 — the Strong Borders Act received Royal Assent on March 26, 2026, increasing maximum AML penalties from $500,000 to $20 million per violation.
- The Stablecoin Act (Bill C-15) — Canada’s first purpose-built legal framework for stablecoins, designating the Bank of Canada as supervisor of stablecoin issuers.
This article is for crypto entrepreneurs evaluating Canada, existing MSB owners with virtual currency permissions, compliance officers, and fintech founders who need to understand the full scope of what 2026 means for crypto regulation in Canada.
Operating a crypto business in Canada? Our ready-made MSBs with all six permissions — including virtual currency dealing — are fully registered and compliant. Contact us to discuss your needs.
CARF: Canada’s Crypto Tax Reporting Framework Is Now Active
As of January 1, 2026, Canada became one of the first countries to implement the OECD’s Crypto-Asset Reporting Framework (CARF). This is a standardized international framework for the automatic exchange of crypto transaction information between tax authorities — and it applies directly to businesses holding virtual currency MSB permissions.
What CARF Is
CARF extends the existing Common Reporting Standard (CRS) into the digital-asset ecosystem. Where CRS covers traditional financial accounts, CARF covers cryptocurrencies, stablecoins, NFTs, and certain DeFi positions. It creates a global reporting standard so tax authorities can track cross-border crypto activity the same way they already track bank account holdings.
Canada implemented CARF through amendments to the Income Tax Act. The Canada Revenue Agency (CRA) is authorized to administer and enforce compliance, including conducting audits and participating in international exchanges of information.
Implementation Timeline
- August 15, 2025: Draft legislative amendments published by the Department of Finance
- September 12, 2025: Public consultation period closed
- January 1, 2026: Due diligence and data collection obligations begin — Reporting Crypto-Asset Service Providers (RCASPs) must start tracking transactions and documenting crypto asset users
- 2027: First annual XML report submissions to CRA for the 2026 calendar year
- 2027–2028: Cross-border automatic exchange of information via the OECD network begins
Who CARF Applies To
CARF applies to Reporting Crypto-Asset Service Providers (RCASPs) — a category that includes crypto exchanges, brokers, wallet providers facilitating transactions, and certain DeFi platforms. Currently, 67 jurisdictions have committed to CARF, with Canada among the early adopters.
What This Means for MSB Owners
If your MSB holds virtual currency permissions and facilitates crypto transactions, you are likely a Reporting CASP under CARF. This means new data collection requirements, TIN validation for all customers, enhanced due diligence procedures, and XML-based reporting obligations — all on top of your existing FINTRAC obligations for suspicious transaction reports (STRs) and large transaction reports.
The compliance burden has doubled. Your AML compliance program now needs to account for both FINTRAC reporting and CRA tax reporting under CARF. This is not optional — CRA has full audit authority over CARF compliance.
FINTRAC Revokes 47+ Crypto MSB Registrations in Q1 2026
The numbers tell the story. In the first quarter of 2026 alone, FINTRAC revoked 47+ MSB registrations linked to crypto and virtual currency businesses. This is not a random audit cycle — it is the most aggressive enforcement wave in FINTRAC’s history.
The Enforcement Timeline
- January 2026: 2 MSB registrations revoked
- March 6, 2026: 11 registrations revoked
- March 16–17, 2026: 22–23 registrations revoked in a single wave targeting crypto-linked MSBs
- March 24, 2026: 51 MSB registrations revoked in a single day (a broader wave that included non-crypto businesses)
According to ComplyFactor’s analysis, total 2026 revocations have already exceeded 86 MSBs as of Q1. The crypto and virtual currency sector has been disproportionately targeted, reflecting FINTRAC’s examination priorities since 2023.
Why Crypto MSBs Were Targeted
FINTRAC’s examination data consistently shows that the virtual currency and crypto sector has higher deficiency rates than the broader MSB population. Common grounds for revocation include:
- Failure to respond to FINTRAC information requests — the most common trigger. FINTRAC can revoke registration if a business does not answer clarification requests within 30 days.
- Failure to update business details — name changes, address changes, or changes to authorized persons that were never reported.
- Inadequate compliance programs — programs that existed on paper but were not reasonably designed, risk-based, or effective.
- Missing suspicious transaction reports — Cryptomus received a $126 million penalty for omitting 1,068 STRs. This is the cost of failing to report.
- Registration failures — KuCoin was fined $14 million for operating without proper registration.
What Comes Next
These Q1 2026 revocations are the enforcement output of FINTRAC’s 2023–2024 examination cycle. The examinations conducted in 2025–2026 will produce the next enforcement wave — expected in 2027. If your compliance program is not examination-ready today, the clock is already ticking.
The lesson is clear: a registered MSB is only as valuable as its compliance program. A ready-made MSB from Canada-MSB.com comes with a complete compliance program already in place — built to survive FINTRAC examination. We also provide ongoing AML support to keep your program current as regulatory expectations evolve.
If you are buying an MSB, understanding what happens after the purchase and avoiding the common mistakes buyers make is essential in this enforcement environment.
Bill C-12: AML Penalties Jump from $500K to $20 Million
On March 26, 2026, the Strong Borders Act (Bill C-12) received Royal Assent, ushering in the most significant overhaul of Canada’s AML penalty regime since the PCMLTFA was enacted. The headline: maximum penalties for a single violation have increased 40-fold.
The New Penalty Structure
| Violation Level | Old Maximum | New Maximum |
|---|---|---|
| Minor violations | $1,000 | $40,000 |
| Serious violations | $100,000 | $4,000,000 |
| Very serious violations | $500,000 | $20,000,000 |
For entities, the aggregate cap on penalties issued on a single notice of violation is now the greater of $20 million or 3% of gross global revenue from the prior financial year.
These are not theoretical maximums. FINTRAC has already demonstrated willingness to impose substantial penalties — the $126 million Cryptomus penalty and $14 million KuCoin fine both predate Bill C-12’s enhanced regime.
New Provisions Under Bill C-12
Beyond the penalty increases, Bill C-12 introduces several structural changes:
- Compliance program standard codified: The PCMLTFA now explicitly requires that compliance programs be “reasonably designed, risk-based and effective.” Failure to meet this standard is classified as a very serious violation — exposing your business to the $20 million maximum.
- Universal enrolment requirement: All reporting entities must now enrol with FINTRAC. MSBs that are already registered are exempt from separate enrolment, but other reporting entities (real estate brokers, accountants, dealers in precious metals) now face mandatory enrolment.
- Expanded examination powers: FINTRAC can now examine records of any person or entity it “believes on reasonable grounds” to be a reporting entity — even before formal registration or enrolment.
- Agent due diligence offence: It is now an offence for an MSB to knowingly fail to conduct due diligence before engaging agents or mandataries for regulated activities in Canada.
- Public disclosure mandate: FINTRAC can now publish enforcement actions, meaning penalties and compliance failures become public record.
What This Means for Crypto MSBs
The penalty escalation makes compliance program deficiencies existentially dangerous. A single serious violation — such as a material gap in your STR filing process — can now cost $4 million. For crypto MSBs, which already face higher deficiency rates than other MSB categories, this is a direct financial threat.
Our ready-made MSBs come with compliance programs designed to meet FINTRAC’s current expectations and the new “reasonably designed, risk-based and effective” standard under Bill C-12. See our FINTRAC registration guide, MSB requirements page, and AML compliance guide for details on what a compliant MSB looks like.
Canada’s Stablecoin Act: A New Regulatory Layer for Crypto Businesses
Also on March 26, 2026, Bill C-15 (the Budget Implementation Act, 2025, No. 1) received Royal Assent — creating the Stablecoin Act, Canada’s first purpose-built legal framework specifically targeting a crypto asset class. This is a milestone. For the first time, a specific type of digital asset has its own dedicated regulatory regime in Canada.
What the Stablecoin Act Does
The Act designates the Bank of Canada as the supervisor of stablecoin issuers. It applies specifically to fiat-backed stablecoins issued by non-financial institutions in Canada. Banks and credit unions already regulated under the Bank Act are excluded.
Key Requirements for Stablecoin Issuers
- Registration with the Bank of Canada — mandatory for all non-financial institution issuers of fiat-backed stablecoins
- 1:1 reserve backing — reserves must be held in the referenced fiat currency or prescribed high-quality liquid assets
- Segregated custody — reserves must be segregated and held by a qualified custodian, separate from the issuer’s operating funds
- Redemption at par on demand — holders must be able to redeem their stablecoins for the referenced fiat currency at face value
- Governance and risk management — issuers must maintain data security standards, corporate governance frameworks, financial health standards, and recovery and resolution plans
Implementation Timeline
While the legislation received Royal Assent in March 2026, the framework is expected to become fully active in 2027. The Department of Finance Canada, working with the Bank of Canada, will spend the next 12–18 months developing the detailed regulations. Draft regulations will be published in the Canada Gazette for public consultation before being finalized.
What This Means for MSB Owners
If your crypto MSB plans to issue fiat-backed stablecoins, you will need a third registration: FINTRAC MSB registration + potentially RPAA registration with the Bank of Canada + stablecoin issuer registration under the Stablecoin Act. The regulatory stack for crypto businesses in Canada is growing.
If your MSB deals in or exchanges stablecoins but does not issue them, the Stablecoin Act does not directly require you to register — but you still need FINTRAC MSB registration and potentially RPAA registration depending on your payment activities.
Our compliance consulting services can help you navigate the interaction between FINTRAC, RPAA, and the incoming stablecoin regime. See also our RPAA 2026 update and payment services permission guide for related regulatory context.
CSA Crypto Platform Licensing: No More Interim Registrations
While FINTRAC governs money services businesses and the Bank of Canada supervises payment service providers and (soon) stablecoin issuers, the Canadian Securities Administrators (CSA) regulate crypto trading platforms (CTPs) that trade securities and derivatives. This is a separate regulatory track — and it has also tightened significantly.
What Changed
Previously, the CSA allowed crypto trading platforms to operate under interim arrangements: a platform could obtain a “pre-registration undertaking” (PRU) and operate as a restricted dealer for a time-limited period (generally two years) while working toward full registration.
As of August 6, 2024, the CSA discontinued accepting new PRUs. New crypto trading platforms that wish to operate in Canada must now apply directly to the Canadian Investment Regulatory Organization (CIRO) for full investment dealer registration and CIRO membership. There is no more interim path.
Several platforms received amended decisions in early 2026 as part of the transition — including Coinbase Canada (April 1, 2026) and Newton Crypto (March 25, 2026).
The Key Distinction for MSB Owners
CSA/CIRO registration and FINTRAC MSB registration are separate regulatory tracks that serve different purposes:
- FINTRAC MSB registration is required for businesses that deal in virtual currencies, transfer money, exchange foreign currencies, issue money orders, provide payment services, or engage in crowdfunding. This is governed by the PCMLTFA.
- CSA/CIRO registration is required for crypto trading platforms that trade securities or derivatives. This is governed by provincial securities legislation.
Most crypto businesses need both. A crypto exchange, for example, needs FINTRAC MSB registration to deal in virtual currencies AND CSA/CIRO registration to operate a trading platform for crypto securities.
We provide the FINTRAC MSB side of the equation. Get your ready-made MSB with virtual currency permissions and focus your time and resources on the CSA/CIRO application process. For more detail on how these two regulatory tracks interact, see our guides on crypto exchange licensing in Canada and virtual currency MSBs.
The 2026 Crypto Regulatory Stack — What MSB Owners Must Do
Step back and look at the full picture. The regulatory landscape for crypto businesses in Canada now includes up to four separate regulatory tracks, plus a new tax reporting obligation:
- FINTRAC MSB registration — mandatory for all virtual currency dealers under the PCMLTFA. Non-negotiable. This is the baseline.
- CSA/CIRO registration — required if your platform trades crypto securities or derivatives. No more interim arrangements.
- RPAA registration — required if your business performs retail payment functions. Supervised by the Bank of Canada under the Retail Payment Activities Act.
- Stablecoin issuer registration — required if you issue fiat-backed stablecoins. Bank of Canada supervision, coming into force in 2027.
- CARF tax reporting — CRA-administered crypto transaction reporting, effective January 1, 2026.
This is the most complex regulatory environment for crypto businesses anywhere in the G7. And the penalties for non-compliance have never been higher.
Your Action Items
If you currently own or operate a crypto MSB in Canada, here is what you need to do now:
1. Review your compliance program against Bill C-12’s new standard. Your program must now be “reasonably designed, risk-based and effective” — this is the explicit statutory language. A compliance program that was adequate under the old $500,000 penalty cap may be unacceptable when a single serious violation can cost $4 million.
2. Implement CARF data collection procedures. If your MSB qualifies as a Reporting CASP, you should already be collecting customer identification data, validating TINs, and tracking all reportable crypto transactions. Your first XML report to CRA is due in 2027 for 2026 transactions.
3. Confirm your RPAA obligations. If your crypto business facilitates fiat payment functions — not just virtual currency dealing — you may need dual FINTRAC + Bank of Canada registration. Do not assume your MSB registration alone covers all your activities.
4. Monitor stablecoin framework development. If your business model involves issuing Canadian-dollar stablecoins, start preparing now. The detailed regulations will be published for consultation in 2026–2027, with the framework active by 2027.
5. Maintain FINTRAC examination readiness. The 2025–2026 examination cycle results will drive the next enforcement wave. If an examiner contacts you, respond within 30 days — failure to respond is the single most common reason for registration revocation.
The Fastest Path Into the Market
The regulatory complexity is real — but it does not have to be your problem. Buy a ready-made MSB with all six FINTRAC permission categories already active, including virtual currency dealing. Add RPAA registration if your activities include retail payment functions. We handle ongoing AML compliance so you can focus on building your business.
Ready to operate a compliant crypto business in Canada? Contact us — WhatsApp, Telegram, email, or book a consultation. We will match you with the right MSB for your business model.
Frequently Asked Questions — Crypto Regulation in Canada 2026
Do I need an MSB registration to run a crypto business in Canada?
Yes. Any business dealing in virtual currencies in Canada — including crypto exchanges, OTC desks, Bitcoin ATM operators, and crypto payment processors — must register as a Money Services Business with FINTRAC. This is a federal requirement under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA). There is no minimum transaction threshold. If you deal in virtual currency as a business, you must register. See our FINTRAC registration guide for the full process.
What is CARF and does it affect my crypto MSB?
CARF (Crypto-Asset Reporting Framework) is the OECD’s global standard for crypto tax reporting. Canada implemented CARF effective January 1, 2026. If your MSB qualifies as a Reporting Crypto-Asset Service Provider (RCASP), you must collect customer identification data, validate tax identification numbers, track all reportable transactions, and file annual XML reports with the CRA starting in 2027 for the 2026 calendar year. This is in addition to — not a replacement for — your FINTRAC reporting obligations.
Why did FINTRAC revoke so many crypto MSB registrations in 2026?
FINTRAC revoked 47+ crypto-linked MSB registrations in Q1 2026 as the enforcement result of examinations conducted in 2023–2024. Common reasons include failure to respond to information requests within 30 days, inadequate compliance programs, missing suspicious transaction reports, and failure to update registered business details. The crypto and virtual currency sector has consistently shown higher compliance deficiency rates than other MSB categories since FINTRAC began prioritizing the sector in 2023.
What are the new AML penalties under Bill C-12?
Bill C-12 (Royal Assent March 26, 2026) increased PCMLTFA administrative penalties dramatically. Minor violations now carry a maximum penalty of $40,000 (previously $1,000). Serious violations carry a maximum of $4 million (previously $100,000). Very serious violations carry a maximum of $20 million (previously $500,000). For entities, aggregate penalties on a single notice of violation can reach the greater of $20 million or 3% of gross global revenue from the prior financial year.
Does the Stablecoin Act affect my crypto MSB?
The Stablecoin Act (enacted through Bill C-15, Royal Assent March 26, 2026) requires non-financial institution issuers of fiat-backed stablecoins to register with the Bank of Canada. The detailed regulatory framework is expected to come into force in 2027. If your MSB issues stablecoins, you will need this registration in addition to your FINTRAC MSB registration. If you only deal in or exchange stablecoins but do not issue them, the Act does not directly require you to register with the Bank of Canada — though you still need FINTRAC MSB registration and potentially RPAA registration.
Can I buy a ready-made MSB with virtual currency permissions?
Yes. All of our ready-made MSBs come with all six FINTRAC permission categories, including virtual currency dealing. The MSB is already registered, the compliance program is in place, and you can begin operations immediately after ownership transfer. For businesses that also need retail payment capabilities, we offer MSBs with active RPAA registration. Contact us to discuss which entity matches your business model.
Published [DATE]. Last updated [DATE].
This article is for informational purposes only and does not constitute legal advice. Regulatory requirements may change. Consult with a qualified legal professional for advice specific to your situation.
