Karsten Wenzlaff, Advisor
August 26th, 2025
MinervaAI.io | Jennifer Arnold and Charlene Sebastian | Dec 7, 2021

Canada’s innovation landscape is evolving like never before. With Payments Modernization, Open Banking, and the approval of Canada’s first crypto-asset custodian, Canadian regulators are also stepping up to the plate, ensuring protection for consumers. This means constant and rapid adjustment of regulatory frameworks to ensure regulations reflect the nuances that innovation brings, while addressing customer demand for advanced technology and simplified experiences through leveraging digital options.
That can make it hard for startups and even established organizations to keep up with the changes, let alone ensure that they have the right tools and resources to operationalize complex legislative requirements.
When it comes to compliance for FinTech, Security and Data protection often take the lion’s share of focus and can eat up a significant chunk of capital along the way. For example, the average cost of SOC 2 Type 2 compliance, a precursor for the vendor management process, ranges from $30-40K – not including the costs to get there, which can be well over $100K.
The mainstream adoption of virtual assets in the retail consumer space (e.g., cryptocurrencies, NFT’s and the like), coupled with modernized payment rails and consumer directed finance, points to a likely increase of entrants into the payments market – a historical “sweet spot” offering for startups. Along with this comes an increased focus on consumer protection while trying to balance innovation and competition.
This is the driver for the new Retail Payments Activities Act (RPAA), passed on June 29, 2021, and continued updates to the Proceeds of Crime (Anti-Money Laundering) and Terrorist Financing Regulations (PCMLTFR).
The RPAA defines the nature of a Payment Service Provider (PSP) and requires PSPs to register with the Bank of Canada who will administer and enforce the RPAA, including financial penalties for violations.
A PSP is defined as “an individual or entity that performs payment functions as a service or business activity that is not incidental to another service or business activity” and covers “any retail payment activity that is performed by a payment service provider that has a place of business in Canada…(or) performed for an end user in Canada by a payment service provider that does not have a place of business in Canada but directs retail payment activities at individuals or entities that are in Canada.”
While there are some exceptions, this aligns directly to the FINTRAC definition of a Money Services Business (MSB) including services dealing with virtual currencies. This evokes the requirement to also register with FINTRAC and directly connects a PSP to the obligations outlined in the PCMLTFR for an MSB. It’s important to note that the PCMLTFR already accounts for Money Services Businesses (MSB’s) and Virtual Asset Service Providers (VASP’s) and has for several years.
If you are unsure whether you fall under these categories, please reach out to us and we’d be happy to review the criteria together.
In short, MSB’s must set up a compliance program that consists of knowing your customer (KYC - verifying their identity) and conducting a risk assessment of your customer base to determine the level of due diligence and ongoing monitoring required. Risk assessments should be updated regularly to and in accordance with detailed FINTRAC guidance.
In addition to screening for Sanctions compliance and Politically Exposed Persons (PEP), there are multiple reporting requirements depending on the types of transactions conducted and in relation to customer risk. There are also special requirements when certain types of transactions are above a specified monetary threshold.
It depends. Factors like customer risk, volume, and velocity of transactions weigh into the costs of establishing a compliance program.
...but making sure you get it right, protects you from fines. FINTRAC actively enforces penalties for violations, and if the US and UK examples are any indicator, monetary penalties are positioned to grow. Even a small fine can cripple a smaller firm.
Trust is also a huge factor in influencing retail adoption for new entrants, especially for newer players in the crypto space. An enforcement action can have significant reputational risk, something a startup may never recover from.

What we do know is that leveraging established Regulatory as a Service tools like MinervaAI can help you deliver on your obligations and are proven to be much more effective and efficient than traditional methods alone.
Firms like MinervaAI are led by professionals with deep knowledge of the regulations, the investigations process, and the machine and deep learning expertise to “plug and play” into your existing technology and process ecosystem. AI innovations coupled with cloud scalability allows investigators to do in minutes, what would traditionally take hours and days to do.
Compliance doesn’t have to be scary or slow down customer onboarding. In fact, having an efficient and accurate risk assessment process upfront, with automated ongoing monitoring behind the scenes, ensures that your customers will be able to transact without interruption.


Jennifer Arnold, CEO and Co-Founder, MinervaAI. Chief Regulatory Nerd and financial crimes enthusiast.
Charlene Sebastian, Head of Client Success and Delivery Enablement, MinervaAI. Obsessed with Data and getting *&^% done.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |
Crowdfund Insider | | Nov 19, 2021
A review of the Securities and Exchange Commission’s (SEC) enforcement actions in this fiscal year show a growing threat posed by cryptocurrency and decentralized finance (DeFi) scammers. The year ended Sept. 30.
The SEC filed 434 new enforcement actions in FY2021, and that is a seven per cent increase over FY2020.
Overall, 697 total enforcement actions were filed, including 120 against issuers for delinquent filing and 143 “follow-on” proceedings that sought bars against people for criminal convictions, civil injunctions, or other malfeasances.
Orders for almost $2,4 billion in disgorgement fees and more than $1.4 billion in penalties, the latter a 33 per cent increase, were obtained. A total of $564 million was awarded to whistleblowers.
Among the highlights the agency cited were charging Poloniex for operating a digital asset exchange and the BitConnect platform and some top executives in an alleged $2 billion cryptocurrency scam.
They also entered into new areas like SPACs, highlighted by an action against the Stable Road Acquisition Company which alleged, among other things, a former CEO tried to obtain shares worth around $200 million.
More new territory was explored as the SEC charged individuals in decentralized finance. In August, they hit Blockchain Credit Partners with charges they offered unregistered securities which raised more than $30 million.
Then the SEC ventured in the murky areas of the dark web by charging James Roland Jones of Redondo Beach, Cal. With selling “insider tips” on the dark web. To access the dark web and obtain insider information for his own activities, Jones allegedly lied about having non-public information to exchange.
Also in the crosshairs was regulation crowdfunding. On Sept. 20 the SEC charged a trio with concocting a fraudulent plan to sell almost $2 million of unregistered securities via a pair of crowdfunding offerings.
Electronic traders were also caught. On June 29 the SEC announced Neovest, a provider of order and execution management software for electronic trading, agreed to pay $2.75 million for failing to register as a broker-dealer. It was the first such charge by the agency against an OEMS provider.
Prior to being acquired by JPMorgan Chase, Neovest engaged in order routing through its registered broker-dealer, Neovest Trading Inc. The order found that although Neovest withdrew its broker-dealer registration after it was acquired, it continued to operate the OEMS as an unregistered broker-dealer by, among other things, participating in the order-taking and order-routing process and soliciting customers and destination brokers through the firm’s website and direct outreach at industry conferences and trade shows.
“Neovest played a role in determining the routing options that were available to its customers by entering into agreements with the destination brokers,” the SEC said in a statement at the time.
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
![]() | ![]() | ![]() |
|---|---|---|
![]() | ![]() | ![]() |