Crypto exchanges operating in Canada or serving Canadian residents must register with provincial securities regulators as restricted dealers or investment dealers. Since 2021, the Canadian Securities Administrators (CSA) has treated most crypto trading platforms as entities that trade securities or derivatives, subjecting them to the same regulatory framework as traditional broker dealers. This article examines the registration categories, operational requirements, and compliance infrastructure required to obtain and maintain a Canadian exchange license.
Registration Categories and Provincial Coordination
Canada operates under a passport system where registration in a principal regulator’s jurisdiction grants market access across participating provinces. Most crypto exchanges register in Ontario under the Ontario Securities Commission (OSC) as their principal regulator, though platforms may also use Quebec’s Autorité des marchés financiers (AMF) depending on their user base.
The two primary registration paths are restricted dealer and investment dealer. Restricted dealers face limitations on margin, leverage, and certain custody arrangements but benefit from reduced capital requirements. Investment dealers gain broader operational permissions but must maintain significantly higher capital cushions and comply with more extensive reporting obligations. Most consumer facing platforms choose restricted dealer status.
Registration is provincial, not federal. Exchanges must register in each province where they intend to serve clients. The passport system simplifies this by allowing a single principal regulator to coordinate with others, but platforms still submit notices in each jurisdiction and comply with any province specific conditions.
Capital and Custody Requirements
Registered platforms must maintain minimum capital calculated as the greater of a fixed floor (typically CAD 250,000 for restricted dealers, though this varies by regulator and business model) or a percentage of customer assets under custody. The percentage based calculation typically ranges from 3% to 10% of total customer holdings, adjusted for the platform’s custody model and insurance arrangements.
Custody rules mandate segregation of customer crypto assets from the platform’s operational holdings. Platforms must use either a qualified custodian (a registered trust company or a custodian approved by the regulator) or implement a self custody model that meets specific security standards, including cold storage for the majority of assets, multisignature controls, and independent audits.
Insurance coverage is not strictly mandated by the securities acts themselves, but regulators impose it as a condition of registration. Platforms typically must carry crime insurance and specie insurance covering both hot and cold wallet holdings. Coverage levels depend on the volume of assets in hot wallets and the platform’s transaction throughput.
Compliance Infrastructure and Reporting
Registered exchanges must implement a full securities dealer compliance program, including a designated Chief Compliance Officer (CCO), written policies for Know Your Client (KYC) and Anti Money Laundering (AML), and regular proficiency testing for staff. AML compliance follows FINTRAC requirements under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act, which overlap with but are distinct from securities registration.
KYC standards require identity verification using government issued documents, beneficial ownership disclosure for corporate accounts, and suitability assessments for clients trading leveraged products or derivatives. Platforms must maintain detailed records of client interactions, risk disclosures, and trading activity.
Reporting obligations include monthly capital calculations, quarterly financial statements, and immediate reporting of material changes such as changes in ownership, cybersecurity incidents affecting client assets, or insolvency events. Platforms must also file annual audited financial statements prepared by a qualified external auditor.
Product Restrictions and Market Conduct Rules
Registered restricted dealers face specific product limitations. They may not offer leveraged spot trading exceeding 1:1 (effectively no leverage on spot trades), and any margin or derivatives products trigger additional registration requirements or prohibitions depending on the structure. Some platforms have received exemptions to offer specific futures or perpetual contracts, but these are granted case by case and subject to enhanced disclosure and risk management conditions.
Staking, lending, and yield products present classification challenges. If a product meets the definition of a security under the Howey test equivalent in Canadian law (an investment of money in a common enterprise with an expectation of profit derived from the efforts of others), it requires a prospectus or prospectus exemption. Most platforms have withdrawn staking and lending products from Canadian users rather than navigate the prospectus process.
Listing standards require platforms to conduct reasonable due diligence on any crypto asset before making it available for trading. This includes assessing the token’s legal status, the quality of the development team, smart contract audits where applicable, and liquidity in secondary markets. Platforms must maintain a written policy explaining their listing criteria and delisting procedures.
Worked Example: Registration Flow for a New Exchange
A platform planning to launch spot trading of bitcoin, ether, and several ERC20 tokens for Canadian retail clients begins by determining its principal regulator. It selects Ontario (OSC) based on its expected user concentration.
The platform engages legal counsel to prepare Form 33-109F6 (the registration application), assembles its initial compliance team, and drafts its compliance manual. It establishes a custody relationship with a qualified custodian for cold storage and implements a hot wallet solution with insurance coverage for CAD 5 million (based on expected hot wallet balances).
The platform submits its application along with background checks for all officers and directors, three years of financial projections, and evidence of CAD 300,000 in regulatory capital (above the minimum to account for its expected asset base). The OSC reviews the application over approximately 90 to 120 days, requesting clarifications on custody controls, KYC procedures, and client risk disclosures.
Upon conditional approval, the platform implements any additional requirements specified by the OSC, such as enhanced reporting on stablecoin reserves or restrictions on listing new tokens without prior notice. It then files passport notices in British Columbia, Alberta, and Quebec. Once final registration is granted, the platform onboards clients, implementing mandatory risk acknowledgment forms and suitability assessments before enabling trading.
Common Mistakes and Misconfigurations
-
Assuming federal registration suffices. Registration is provincial. Serving clients in a province without registration or a valid exemption violates securities laws in that jurisdiction.
-
Undercapitalizing custody insurance. Platforms sometimes insure only hot wallets at current balances without accounting for peak usage periods or rapid asset appreciation, leaving gaps in coverage during market volatility.
-
Misclassifying staking rewards as non securities. Many staking arrangements meet the securities definition in Canada, and offering them without a prospectus or exemption creates regulatory liability.
-
Treating OSC guidance as optional. Staff notices and guidance from the CSA carry significant weight in enforcement actions. Platforms that deviate from published guidance without documenting a strong rationale face higher scrutiny.
-
Ignoring FINTRAC obligations. AML compliance under FINTRAC is separate from securities registration. Platforms must register as money services businesses (MSBs) with FINTRAC even after obtaining securities registration.
-
Failing to maintain concurrent updates. When a platform changes custody providers, capital structure, or product offerings, it must notify all provincial regulators where it is registered, not just the principal regulator.
What to Verify Before You Rely on This
-
Current capital requirements for restricted dealers and investment dealers in your principal regulator’s jurisdiction, as these are subject to updates based on market conditions.
-
Whether your intended product set (staking, lending, derivatives, perpetuals) requires additional registration or prospectus relief beyond standard restricted dealer status.
-
The status of any exemptive relief applications relevant to your business model, as the CSA periodically issues blanket orders or amends existing exemptions.
-
Insurance market capacity for crypto custody coverage, which fluctuates with underwriter risk appetite and claims history in the sector.
-
Any new CSA staff notices or guidance relating to custody, listing standards, or conflicts of interest, particularly following significant market events or platform failures.
-
Provincial variations in registration conditions, especially in Quebec, which sometimes imposes additional requirements through AMF policy.
-
FINTRAC’s current MSB registration process and timeline, as it runs parallel to securities registration and has its own compliance obligations.
-
The availability and cost of qualified custodians willing to custody your intended asset mix, as not all custodians support all token standards or chains.
-
Recent enforcement actions or settlement agreements involving other platforms, which often reveal regulatory priorities and red lines.
-
Changes to beneficial ownership reporting thresholds or corporate client KYC standards following updates to AML regulations.
Next Steps
-
Engage Canadian securities counsel experienced in crypto exchange registration to map your business model to the appropriate registration category and identify any required exemptive relief before filing.
-
Establish relationships with qualified custodians and insurance brokers early in the process, as custody and insurance arrangements must be operational before registration is granted.
-
Build your compliance infrastructure in parallel with the application process, including hiring a qualified CCO, implementing KYC and AML systems, and drafting client agreements and risk disclosures that meet CSA standards.
Category: Crypto Regulations & Compliance
