When Does a Business Need an MSB Registration or a VASP Licence? FINTRAC, FinCEN, MiCA and VARA Compared

The need for a registration or licence depends on what the business does for its clients and where those clients are, and it does not depend on where the company is incorporated. Exchanging crypto for funds for clients, transferring crypto on their behalf, or holding it for them triggers a regime in all four places covered here: FINTRAC registration as a money services business in Canada, FinCEN registration as a money transmitter in the United States, authorisation as a crypto-asset service provider (CASP) under MiCA in the EU, and a VARA licence in Dubai. In the US and the EU, software that clients run themselves can sit outside, with exceptions.

"VASP" is the FATF term and the one most people search for. Canada and the US speak of money services businesses (MSBs), the EU of CASPs, and Dubai of virtual asset activities. This guide starts from the activity, because the activity decides which of these words applies. Since 1 July 2026 Estonia no longer has a VASP licence of its own: the Estonian FIU cancelled the legacy licences, and crypto-asset services in Estonia need a MiCA authorisation.

This guide covers services to clients. Issuing a token or stablecoin and running a payment-processing business fall under further rules and need their own review. For issuers these include the MiCA white-paper rules and the MiCA rules for asset-referenced tokens and e-money tokens in the EU, and in the US the GENIUS Act (Public Law 119-27, signed 18 July 2025) for payment stablecoin issuers. For payment processing, FINTRAC's notice of 21 July 2022 states that entities providing invoice payment services or payment services for goods and services are engaged in the business of remitting or transmitting funds, or dealing in virtual currency, and the notice excepts an entity that solely accepts a payment for goods or services it supplied to its own customer. A Canadian payment service provider can also need a Bank of Canada registration, described in the Canada MSB cost and timeline guide.

Last verified 2 October 2026 on the regulators' own pages and the legal texts listed under Sources. The cost and timing of the Canadian route are in Canada MSB cost and timeline.

Not sure which regime applies to your product? We map each activity of the business to the regimes it touches and say which registration or licence is needed first. MSB and fintech licensing → · Book a paid 30-minute consultation (USD 99, credited to the project)

Which activity triggers which regime

Canada and the United States

The EU and Dubai

Where the business sits in relation to the client

Each regime looks at where the service is directed, and a foreign company can fall inside.

• Canada. A foreign money services business has no place of business in Canada, provides a listed service directed at persons or entities in Canada, and provides it to clients in Canada. It registers with FINTRAC before it begins to operate. FINTRAC states that a business registered or licensed in a province must still register with FINTRAC.
• United States. FinCEN's rule defines an MSB as a person wherever located doing business, wholly or in substantial part, within the United States. FinCEN's 2019 guidance says the requirements apply equally to foreign-located CVC money transmitters doing business in whole or in substantial part in the United States, even without a physical presence there.
• EU. MiCA Article 59 bars anyone from providing crypto-asset services within the Union unless authorised. A third-country firm that deals with a client who initiates the service at the client's own exclusive initiative falls outside Article 59. Soliciting clients or prospective clients in the Union, through any channel, removes that protection, and a contract clause or disclaimer does not change this (Article 61).
• Dubai. VARA states that a business must hold a licence before it begins operations in or from the Emirate of Dubai, whether it offers the activity to residents of the Emirate or to global customers. Its scope runs across Dubai's free zones and mainland and excludes the Dubai International Financial Centre.

Canada: FINTRAC registration and the Quebec licence

FINTRAC lists eight services that require registration: foreign exchange dealing; remitting or transmitting funds; issuing or redeeming money orders and similar instruments; dealing in virtual currency, which covers both exchange and transfer; crowdfunding platform services; armoured car services; cheque cashing; and acquirer services for private automated banking machines. A 2022 FINTRAC notice states that crowdfunding platforms and certain payment service providers are covered as money services businesses or foreign money services businesses.

The Regulations define a virtual currency exchange transaction as an exchange, at the request of another person or entity, of virtual currency for funds, funds for virtual currency, or one virtual currency for another. Virtual currency is a digital representation of value used for payment or investment that is not fiat currency and can be readily exchanged for funds or for another virtual currency.

In Quebec the Money-Services Businesses Act adds a licence issued by Revenu Québec for money services provided for payment, with a cryptoasset ATM licence in place from 1 April 2025. Revenu Québec interprets "funds transfer" broadly, and an online platform where users buy, sell or exchange cryptoassets and transfer legal tender needs a funds transfer licence. Fees and timelines are in the Canada MSB cost and timeline guide.

A crypto trading platform serving Canadian clients also deals with the securities regulators. On 6 August 2024 the Canadian Securities Administrators (CSA) and the Canadian Investment Regulatory Organization (CIRO) stated that a crypto trading platform that facilitates trading in crypto assets that are securities or derivatives, or in instruments or contracts based on such crypto assets, is expected to register as an investment dealer and become a CIRO member, and that CSA members do not intend to continue the interim approach of time-limited restricted-dealer registration. Revenu Québec's own cryptoasset page adds that these activities may also be subject to other federal or provincial legislation and points to the Autorité des marchés financiers. FINTRAC registration covers the anti-money-laundering regime and does not replace the securities-law step. Whether a given token is a security is a question for counsel.

United States: FinCEN registration and the state layer

FinCEN's 2013 guidance states that an administrator or exchanger of convertible virtual currency that accepts and transmits it, or buys or sells it for any reason, is a money transmitter. A user who obtains convertible virtual currency to purchase real or virtual goods or services is not an MSB. FinCEN's 2019 guidance applies the same test to business models:

• Hosted wallet providers are account-based money transmitters that receive, store and transmit CVC for their accountholders.
• Unhosted wallet software for a person's own transactions is not money transmission. A multiple-signature wallet provider that restricts itself to creating un-hosted wallets is not a money transmitter, and one that also provides hosted wallet services is.
• CVC kiosks. An owner-operator who accepts currency and transmits the equivalent value in CVC, or the reverse, is a money transmitter.
• DApps that accept and transmit value fall under the same rules as the other models.

A money services business registers with FinCEN within 180 days after it is established and renews every two years. FinCEN registration is a federal registration and gives no state licence. Money transmitters are licensed state by state, and New York runs a separate regime: under 23 NYCRR 200.3(a), no person may engage in virtual currency business activity involving New York or New York residents without a licence from the superintendent (the BitLicense). 18 U.S.C. § 1960 punishes knowingly conducting, controlling, managing, supervising, directing or owning all or part of an unlicensed money transmitting business with a fine or up to 5 years in prison, and it defines the offence to include a business that operates without a state licence where state law requires one, or that fails to register under 31 U.S.C. § 5330. The text applies whether or not the defendant knew that the operation had to be licensed.

EU: MiCA authorisation

Under MiCA Article 59(1), a person may provide crypto-asset services within the Union only if it is a legal person or undertaking authorised as a CASP, or a credit institution, central securities depository, investment firm, market operator, electronic money institution, UCITS management company or alternative investment fund manager allowed to provide them under Article 60. The ten crypto-asset services in Article 3(1)(16) are custody and administration, operating a trading platform, exchange for funds, exchange for other crypto-assets, execution of orders, placing, reception and transmission of orders, advice, portfolio management, and transfer services on behalf of clients.

Three limits matter in practice:

• A CASP has its registered office in a Member State where it carries out at least part of its services, its place of effective management in the Union, and at least one director resident in the Union (Article 59(2)).
• Services provided in a fully decentralised manner without any intermediary fall outside the Regulation (recital 22).
• Providers that operated lawfully before 30 December 2024 could continue until 1 July 2026 or until their authorisation was granted or refused, whichever came first (Article 143(3)). In Estonia that period ended on 1 July 2026; Finantsinspektsioon states that from then only companies holding a MiCA authorisation may provide crypto-asset services there, and the FIU cancelled the legacy virtual currency service licences.

Dubai: VARA

VARA licenses virtual asset activities: advisory, broker-dealer, custody, exchange, lending and borrowing, management and investment, transfer and settlement, and issuance. Custody services must be provided by a separate legal entity: VARA states that a virtual asset custodian must be set up as a distinct legal entity with a standalone licence. The Schedule 1 definitions are activity-based. Exchange services include a conversion between virtual assets and fiat currency or among virtual assets, and transfer and settlement means the transmission or transfer of virtual assets from one entity to another or to another wallet, address or location. The DIFC and ADGM have their own regulators and sit outside this guide.

Five questions before a launch

1. What does the business do for the client? Exchange, transfer, hold, or advise. The table above turns each answer into a regime.
2. Where are the clients? A service directed at clients in a country brings that country's regime, whatever the company's seat.
3. Does the business ever control the client's assets or keys? Control moves a wallet from software into a regulated service in the US and the EU.
4. Are the clients approaching you, or are you approaching them? In the EU, solicitation ends the exclusive-initiative exception.
5. Which regime takes longest? The route that is longest to authorise sets the launch date. Our planning ranges: 3 to 4 months for an MSB track, 6 to 12 months for EMI, VASP and CASP authorisations.

What INNOVA does and what it costs

INNOVA prepares the licence or registration file, the AML programme and the bank file. The client holds the licence and runs the business. We do not hold, exchange or transfer client funds or crypto-assets.

The price lines are the published "from" figures on INNOVA pricing and the service pages. Government fees, third-party costs and regulator invoices are separate lines in the quote.

FAQ

Next steps

Describe the product in a few lines: who the clients are, what the business does with their money or crypto, and where the team sits. We return the list of regimes that apply and the order of the filings. MSB and fintech licensing → · Contact us

Related: Canada MSB cost and timeline, Crypto licensing in 2026, Choosing a jurisdiction for fintech or crypto.

Sources (checked 2 October 2026):

• FINTRAC, Money services businesses (MSBs): fintrac-canafe.canada.ca/msb-esm/msb-eng (page modified 1 October 2025)
• FINTRAC, Check to see if you need to register as a money services business: fintrac-canafe.canada.ca/msb-esm/questions/2-eng
• FINTRAC, Guidance glossary: fintrac-canafe.canada.ca/guidance-directives/glossary-glossaire/1-eng
• FINTRAC, Crowdfunding platforms and certain payment service providers must register with FINTRAC, notice of 21 July 2022: fintrac-canafe.canada.ca/notices-avis/2022-07-21-eng
• Proceeds of Crime (Money Laundering) and Terrorist Financing Regulations, SOR/2002-184, section 1: laws-lois.justice.gc.ca/eng/regulations/SOR-2002-184
• Revenu Québec, Cryptoasset services; Obligations of an operator of a money-services business: revenuquebec.ca/en/businesses/sector-specific-measures/money-services-businesses-msbs/
• FinCEN, Application of FinCEN's Regulations to Persons Administering, Exchanging, or Using Virtual Currencies, FIN-2013-G001 (18 March 2013): fincen.gov
• FinCEN, Application of FinCEN's Regulations to Certain Business Models Involving Convertible Virtual Currencies, FIN-2019-G001 (9 May 2019): fincen.gov/system/files/2019-05/FinCEN Guidance CVC FINAL 508.pdf
• FinCEN, Money services business registration: fincen.gov/money-services-business-msb-registration
• 18 U.S.C. § 1960: law.cornell.edu/uscode/text/18/1960
• New York Department of Financial Services, Virtual currency businesses (BitLicense, 23 NYCRR Part 200): dfs.ny.gov/virtual_currency_businesses
• US Attorney's Office, Southern District of New York, press release of 6 August 2025: justice.gov/usao-sdny/pr/founder-tornado-cash-crypto-mixing-service-convicted-knowingly-transmitting-criminal
• US Department of Justice, remarks of the Criminal Division head, 21 August 2025: justice.gov/opa/speech/acting-assistant-attorney-general-matthew-r-galeotti-delivers-remarks-american
• GENIUS Act, Public Law 119-27: govinfo.gov/app/details/PLAW-119publ27; White House fact sheet of 18 July 2025: whitehouse.gov/fact-sheets/2025/07/fact-sheet-president-donald-j-trump-signs-genius-act-into-law
• CSA, CSA and CIRO expect crypto trading platforms to prioritize applications for investment dealer registration and CIRO membership, 6 August 2024: securities-administrators.ca/news/csa-and-ciro-expect-crypto-trading-platforms-to-prioritize-applications-for-investment-dealer-registration-and-ciro-membership
• Bank of Canada, Frequently asked questions about retail payments supervision (August 2026): bankofcanada.ca/2026/08/frequently-asked-questions-about-retail-payments-supervision
• Regulation (EU) 2023/1114 (MiCA), Titles II to IV, Articles 2, 3, 48, 59, 61 and 143 and recital 22: eur-lex.europa.eu/eli/reg/2023/1114/oj
• Finantsinspektsioon, The transitional period for providers of crypto asset services is ending, 30 June 2026: fi.ee/en/news/transitional-period-providers-crypto-asset-services-ending
• VARA, Licensed activities; VARA Rulebook, Schedule 1, VA activities: vara.ae/en/licenses-and-register/licensed-activities, rulebooks.vara.ae/rulebook/schedule-1-va-activities

For information only; checked against the sources above on 2 October 2026. Whether a particular product falls inside a regime is a question of fact decided by the regulator, and the regimes change. This guide covers FINTRAC, FinCEN, MiCA and VARA, and does not cover state and provincial regimes beyond Quebec, DIFC, ADGM, issuer and stablecoin regimes in detail, or securities and derivatives law beyond the pointer above.