Karsten Wenzlaff, Advisor
August 26th, 2025
Karsten Wenzlaff is a Crowdfunding and Fintech Expert from Germany. He is Secretary-General of Digit[...]
Buying a Canadian MSB and Reviewing FINTRAC RPAA and Financial Due Diligence
Nov 12, 2026
Buying a Canadian money services business starts with identifying what the buyer will acquire: a legal entity, a registration history, contracts, records and possibly an active operation. The value of that package depends on whether it supports the services the new owner intends to provide.
A FINTRAC registration entry is an important starting point. It does not establish the company’s financial condition, the quality of its compliance programme or the availability of banking relationships after an acquisition. A payment business may also need a separate assessment under the Retail Payment Activities Act, or RPAA.
For investors evaluating a Canadian MSB company for sale, due diligence should connect registration status, actual activities, transaction structure and financial evidence before the parties agree a completion timetable.
Verify the Canadian MSB registration and legal entity
Begin with the target’s exact legal name, incorporation details, registration number and current status. Match the entity in the corporate documents to the entity in FINTRAC’s Money Services Business Registry.
FINTRAC explicitly states that registration does not mean it endorses or licenses a business. It also states that it does not issue licences or certificates of registration. A sales presentation using the phrase “FINTRAC licence” should therefore be clarified against the actual registration record.
The registry distinguishes registered, expired, ceased and revoked statuses. FINTRAC says it updates the registry monthly, so record the date of the check and obtain relevant recent correspondence from the target as well. Where a renewal is being processed, review the submission evidence and the applicable status treatment.
Registration is not a complete acquisition report. The next step is to establish what the company has actually done and what the buyer intends to change.
Compare the registered business with the proposed service model
A buyer researching a Money Service Business in Canada should define the intended services before treating an existing company as a suitable launch vehicle.
Describe the customer groups, countries, currencies, delivery channels and movement of funds. For a crypto-related product, specify where conversion, custody, fiat collection and payouts occur, and which entity provides each service.
Compare that description with the target’s registration information, existing contracts and operating records. A business registered for certain activities may have little or no transaction history, while an active operator may have obligations and unresolved cases that require a detailed handover.
FINTRAC’s guidance requires registration information to be kept up to date and changes to be notified within 30 days. It also states that registration is valid for two years and must be renewed before expiry. Identify the updates and renewal work relevant to the proposed transaction.
The deal’s structure needs its own assessment. Ask Canadian counsel to determine the consequences of buying shares, purchasing assets or changing the entity through which services will be provided.
Assess RPAA scope separately from FINTRAC registration
FINTRAC registration and Bank of Canada payment-service-provider registration address different requirements. Determine the target’s position under each framework.
The Bank of Canada’s registration guidance sets out four elements: performing a payment function as a service that is not incidental to another business; undertaking the relevant retail payment activity; meeting the geographical scope; and falling outside applicable exclusions.
Its identified payment functions include maintaining an end-user account, holding end-user funds, initiating electronic funds transfers, handling payment instructions and providing clearing or settlement services. The assessment concerns the actual functions and circumstances.
See: Guide: PSP Registration with Bank of Canada (RPAA)
Ask advisers to map who performs each function in the target’s payment chain. The presence of a bank or another registered provider does not, by itself, settle the target’s own position.
For a product marketed as crypto-focused, examine its fiat payment activities as part of that assessment. Keep the conclusion and its reasoning in the transaction file, alongside any Bank of Canada application, registration or correspondence.
Check whether acquisition of control triggers PSP re-registration
For a target that is a registered PSP, the transaction timetable may depend on RPAA acquisition-of-control requirements.
The Bank of Canada’s supervisory policy explains that, where the section 24 requirement applies, the target PSP must submit a new registration application reflecting the planned acquisition and become re-registered before completion. Simply filing an application does not satisfy the requirement to be re-registered.
The acquisition-of-control assessment depends on the transaction and legal structure. Counsel should also assess the applicable exclusions and any prescribed-change rules rather than treating every purchase as identical.
Build the required process into the agreement and completion plan. Identify who prepares the application, which information the buyer must supply and what evidence will permit the parties to close.
The Bank cautions that review timing varies and should not be expected to accelerate because an application was submitted too late. Commercial deadlines should allow for that dependency.
This is a distinct process from updating FINTRAC information. Keep the two workstreams visible, with separate owners and completion evidence.
Review compliance effectiveness and unresolved work
A compliance manual shows intended procedures. An acquisition review also needs evidence of how the programme has operated.
FINTRAC’s compliance-programme guidance requires an effectiveness review at least every two years. The review tests the relevant programme elements, including policies and procedures, risk assessment and training. Request the review plan, results, findings and documented follow-up.
Then assess the records behind the programme through an appropriately controlled diligence process. Relevant requests may include:
- Appointment and responsibilities of the compliance officer.
- Current policies, risk assessment and training records.
- Evidence that customer checks and ongoing review procedures are implemented.
- Outstanding findings, remediation work and relevant regulatory correspondence.
- Records demonstrating how staff resolve cases and retain decision histories.
Sensitive reports and investigations need legally appropriate disclosure arrangements. Do not assume that every record can be freely copied into a buyer’s data room.
For a dormant company, establish which processes must be activated or updated before customers can be served. For an active business, identify the cases and responsibilities that will remain open at completion.
Translate the findings into resources: staff time, external assistance, system work and the effect on launch readiness.
Reconcile revenue client balances and liabilities
Financial due diligence should explain what the business earns, what it owes and which cash is available to support operations.
Separate the value of customer transactions from earned revenue. Reconcile fees and conversion income to accounting records and provider statements, with clear treatment of refunds, reversals and other adjustments.
For an active target, examine customer balances and pending transactions alongside the corresponding assets and provider records. Investigate differences before agreeing the completion position.
Useful questions include:
- Revenue quality: Which customers and services generate income, and how concentrated is that income?
- Direct costs: Which provider charges, transaction costs and manual processes are needed to earn it?
- Outstanding liabilities: What tax, supplier, customer or contractual obligations remain?
- Restricted amounts: Which deposits, reserves or prefunded balances cannot freely finance operations?
- Post-completion cash needs: What funding is required for remediation, staffing and the proposed product?
An illustrative target could report growing payment volume while retaining little contribution after provider charges and staff handling. The buyer needs the supporting records to understand the economics.
Customer funds should not be counted as unrestricted acquisition funding. Establish the applicable treatment of balances and liabilities with the transaction’s financial and legal advisers.
Confirm partner continuity and control over the technology
Bank accounts and integrations are valuable only within the conditions under which they can be used.
Review material bank, payment, custody, software and outsourced-service contracts. Identify notification, consent, due-diligence and termination provisions relevant to ownership, management or business-model changes.
Obtain the necessary partner assessment for the intended customer groups and flows. Keep a technical integration, an active contract and acceptance of the new business model as separate items in the diligence record.
Technology handover should cover:
- Rights to use the software and any custom development.
- Hosting, domains, administrative access and relevant credentials.
- Customer and transaction data, export formats and supporting documentation.
- Reconciliation records and responsibility for unresolved items.
- Ongoing support, maintenance and third-party subscriptions.
Ask the future operating team to demonstrate a representative transaction and an exception. Their ability to locate the relevant records can reveal whether the buyer will inherit a usable process or significant reconstruction work.
Tie the acquisition decision to documented closing conditions
The diligence outcome should be a decision supported by evidence and a plan for unresolved dependencies.
Before signing, establish the target’s identity, registration position, service scope, financial condition and material partner dependencies. Identify the regulatory and contractual processes that affect completion.
Before closing, refresh evidence that could have changed. Confirm required registration outcomes, agreed partner actions, access deliverables, financial adjustments and ownership of open work.
Ask transaction counsel to address material findings through suitable agreement terms. Depending on the issue, this may involve pre-completion actions, warranties, indemnities, transition assistance or another negotiated mechanism.
Keep the operating budget connected to the timetable. A delay in a required registration process or partner decision can extend fixed costs while postponing revenue. Model that scenario before committing the full acquisition budget.
A Canadian MSB acquisition becomes easier to assess when its legal status, operating evidence and financial position are reviewed together. The objective is to know what the buyer can continue, what must change and what needs to be resolved before capital and control pass.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, artificial intelligence, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
 |  |  |
|---|---|---|
 |  |  |
Leave a Reply