Folio 05 · Insights · Index Latest · 13 July 2026

Editorial · SKY7 Insights

Fintech licensing insights & regulatory guides

Licensing guides, regulatory updates and field notes from the seniors who file. Written for founders deciding which licence, which jurisdiction, and what to expect before a regulator opens the file.

Vol.
02
Issue
29
Articles
99
Authors
07

Ref · S7-INS-2026-Q3

Archive

Earlier articles

99 entries

Safeguarding end-user funds under the RPAA: the three routes

Since 8 September 2025 every registered payment service provider in Canada has had to safeguard end-user funds under s. 20(1) of the Retail Payment Activities Act: hold them in trust, or in a dedicated account backed by insurance or a guarantee. The Regulations add the mechanics most summaries skip - non-affiliated insurers, insolvency-remote proceeds, ledgering and fund-return procedures - and a buyer of a registered PSP inherits every piece of that stack on day one.

Are you a PSP under the RPAA? The five payment functions

Canada's Retail Payment Activities Act turns on a functional test: five payment functions, an incidental-activity carve-out and a map of exclusions decide who must register with the Bank of Canada before operating. Here is the definition as the statute and the Bank's own criteria read it - fintechs, marketplaces, payment facilitators and crypto platforms included - as of July 2026.

Unregistered FMSB penalties in Canada: Binance, KuCoin, the $20M cap

FINTRAC's two largest foreign-MSB penalties - Binance's $6,002,000 and KuCoin's $19,552,000 - were built by counting violations one occasion at a time, and both remain under appeal. Since 26 March 2026 the same arithmetic runs against ceilings of up to $20 million per very serious violation, or 3% of gross global revenue. Here is how the penalty mechanics actually work.

Directing services at Canada: how FINTRAC's FMSB test actually works

A company with no office in Canada becomes a foreign money services business the moment FINTRAC's four-part test catches it - and a single '.ca' domain or a Canada-aimed ad campaign can satisfy the directing-services limb on its own. There is no published client threshold and no single-client safe harbour. Here is the test as FINTRAC actually words it, and what to do if it catches you.