How to Pass Bank/EMI Onboarding with a Canadian MSB: Anatomy of a Successful Case

A Canadian MSB (FINTRAC) opens doors to banks and payment providers—if you package your model, risks, and documentation correctly. Below is a clear framework: narrative structure, full document checklist, typical red flags, and ready-to-use compliance Q&A copy.

Core of onboarding: a short, crystal-clear Narrative

Your “story for the bank” must be equally understandable to legal, risk, and engineering teams. Focus on the essentials:

Explain in 6 points

Who are you? Canadian MSB, FINTRAC number, registration date, Virtual Currency enabled.
What do you do? Concrete services (OTC, wallets/custody, B2B payments, etc.).
For whom? Client geographies, B2B/B2C, excluded jurisdictions and risk segments.
Sources of funds? Typical scenarios, limits, currencies/tokens.
How do you mitigate risk? AML/KYC policies, monitoring, on-chain analytics, sanctions/PEP screening.
What do you integrate with? KYC providers, analytics, liquidity, reporting flows.

Short Narrative template

We are a Canadian MSB registered with FINTRAC (No. XXXXX). Our scope includes dealing in virtual currency and FX.
We provide B2B OTC and wallet custody for corporate clients in [regions], excluding [sanctioned/blocked].
Funds originate from corporate bank/EMI accounts and are reconciled daily. We apply KYC (KYB for corporates), sanctions/PEP screening, blockchain analytics, and event-based monitoring. Reporting follows FINTRAC guidelines. Key providers: [KYC], [Chain analytics], [Liquidity].

Complete document pack (what banks/EMIs typically ask for)

Block	Documents	Notes
Legal	MSB registration (FINTRAC), corporate documents, shareholder/member register, key agreements	Include your MSB ID and link to the public registry
Governance	MLRO/Compliance Officer appointments, role matrix, board minutes	Fit & proper evidence for key persons; CVs and references
AML/KYC	AML/CFT policy, KYC/KYB, risk assessment, sanctions/PEP, monitoring procedures, SAR/STR	Show event triggers, thresholds, escalation and reporting
Technology	Architecture description, custody/keys, logging/audit, BCP/DR, infosec	Who holds keys, segregation of funds, recovery controls
Business model	Flow maps (fiat/crypto), contract stack, pricing/limits	On/off-ramp scenarios; counterparty at each stage
Client-side	Onboarding forms, UX screenshots, Terms, Privacy, Risk disclosures	Show interface and built-in controls

Flow maps and risk controls

What to draw on the map

On-ramp/off-ramp: sender/recipient, which providers move the funds.
Where KYC/KYB, sanctions/PEP, and on-chain analytics occur.
Who holds custody, how segregation and limits are enforced.
Where reporting is generated (incl. FINTRAC); which events trigger alerts.

Controls banks like to see

Client risk scoring + enhanced due diligence for high-risk.
Sanctions/PEP at onboarding and periodically/event-based.
On-chain heuristics: mixers, sanctioned addresses, tumblers, darknet tags.
Limits: per client/transaction/day + manual escalation.
BCP/DR, logging, least-privilege access control.

Top mistakes and how to avoid them

Red flags

Vague model: unclear services and client geographies.
No Virtual Currency in the MSB scope or mismatch with services.
“Empty” AML/KYC policies with no real triggers or procedures.
Inconsistencies: one story to the bank, another on your website.
Unstated token/geography risks; sanctions/PEP done “for show”.

Fixes

Align Narrative + flow map; sync your contract stack.
Update the MSB record and activity scope; attach evidence.
Add risk matrix, on-chain scenarios, escalation & reporting.
Synchronize FAQ/site/contracts with your bank application.
Show excluded countries/segments, limits, and offboarding process.

Ready answers to common compliance questions

Source of funds (SoF) & wealth

Client funds derive from corporate revenues and equity contributions. We request documentary evidence, perform KYB/KYC, and apply sanctions/PEP screening. For crypto proceeds we use blockchain analytics (risk scores, address clustering) and escalate per our SAR/STR policy.

Geographies & exclusions

We operate in [regions]. We exclude sanctioned jurisdictions and higher-risk countries per our AML risk mapping. We block IPs and payment routes accordingly and review geographies quarterly.

Transaction monitoring

We apply event-based and periodic monitoring: velocity checks, large exposure alerts, chain-risk scores, and counterparty screening. Thresholds and escalation are defined in our Monitoring SOP.

Custody & keys

Custody uses [self-custody/provider] with segregated accounts and multi-signature controls. Access is role-based (least privilege). Backups and recovery are covered by our BCP/DR plan.

Process steps & timing

Model diagnostics (30–45 min): objectives, markets, tokens, risks.

Document pack: Narrative, AML/KYC, flow maps, agreements, UX.

Provider selection: bank/EMI matched to your risk & geography.

Submission & Q&A: respond to requests, close gaps.

Opening & pilot: limits, monitoring, reporting, fine-tuning.

Actual timing depends on the model, geographies, and provider feedback. We deliver a realistic plan and support through to account opening.

FAQ

Does an MSB guarantee account opening?

The decision is always with the bank/EMI. Our job is to package your model and documents so the risk team sees a manageable risk profile.

Can we operate crypto-only (no fiat)?

Yes—under the Virtual Currency scope with a solid risk framework. Clearly describe on/off-ramp and reporting.

Do we need local licenses outside Canada?

If you publicly target residents of a given country (e.g., the UAE), you’ll need a local authorization or a licensed VASP partner.

What most often derails an application?

Inconsistent narrative vs. documents, weak AML procedures, unclear geographies/tokens, and lack of defined limits and escalation.

Contacts

Address:

Estonia, Tallinn · Liivalaia 1a, 10155

Phone:

+372 560 70 001

Email:

DecentrAtty@gmail.com

Contact Us Today