Why a registry check belongs in your due diligence
Any business that deals in foreign exchange, transfers funds or deals in virtual currency for clients in Canada must be registered with FINTRAC as a money services business. Foreign businesses that direct those services at people in Canada must register as foreign MSBs. FINTRAC keeps a public registry so that anyone can check.
A registry check protects you in two ways. First, it confirms that the provider has at least entered the regulatory system: it has disclosed its owners and management to FINTRAC, it runs a compliance programme and it is subject to examination. Second, it guards against impersonation. Fraudsters sometimes borrow the name, logo or registration number of a genuine firm. Matching the details you have been given against the registry is a quick way to spot that.
Your own bank, auditors and counterparties may also ask how you selected your payment provider. A dated screenshot or saved copy of the registry entry, kept on your vendor file, is simple evidence that you looked.
Step 1: gather the details from the provider
Before searching, collect what the provider has told you about itself. You will need:
- The full legal name of the entity you will contract with, as shown on the agreement or terms of business.
- Any trading or brand names it uses on its website and in correspondence.
- Its FINTRAC MSB registration number. A registered provider should give this without hesitation.
- Its registered or head office address.
- Its website address and the email domain it uses.
- A list of the services it will provide to you, for example foreign exchange, outbound wires, collections or digital asset conversion.
Write these down from the provider's own documents, not from a search engine result. The point of the exercise is to compare what you were told against an independent source.
Step 2: search the registry
The registry search is available on FINTRAC's website. You can search by name or by registration number. A few practical tips:
- Search by registration number first. It gives a single, exact result and removes doubt about similar names.
- Then search by legal name, and separately by each trading name, to see whether the same business appears and whether other entities use similar names.
- If a name search returns nothing, try a shorter version. Suffixes such as Inc., Ltd. or Corporation, and punctuation, can affect results.
- Open the full entry for the result. The summary line does not show everything.
Save or print the entry with the date. Registry information changes over time, so a record of what it showed on the day you checked is more useful than a note that says you looked.
Step 3: confirm the name matches
The legal name on the registry should match the legal name on your contract exactly. This sounds obvious, but mismatches are common and worth resolving.
A typical example: a group operates under one brand, and the registered MSB is one company within the group. The contract, however, names a different group company, perhaps one incorporated in another country. In that case the entity you are dealing with may not be the one that is registered. Ask the provider to explain. There may be a sound reason, for instance a separate entity that provides software while the registered company handles funds, but you should understand which entity receives and sends your money.
Check operating names too. If the provider markets itself under a brand that does not appear anywhere on its registry entry, ask why. Registered MSBs are expected to keep their operating names up to date with FINTRAC.
Step 4: check the registration number and status
Confirm that the registration number on the registry is the same number the provider gave you. If someone quotes a number that belongs to a different business, treat the relationship as a serious concern until it is explained.
Then look at the status. The entry shows whether the business is currently registered or whether its registration has expired, been revoked or ceased. Only a current registration is acceptable for a provider you plan to use. The exact wording on the registry may differ, but the main non-current statuses are broadly as follows.
- Expired usually means that the business did not renew. MSB registration must be renewed every two years, and a lapsed registration means the business should not be offering MSB services.
- Revoked means that FINTRAC withdrew the registration. That can happen for several reasons, including ineligibility, false information or failure to respond to FINTRAC.
- Ceased generally indicates that the business told FINTRAC it stopped carrying on MSB activities.
Note the registration and expiry dates where shown, and diarise a recheck for a date after the next renewal is due.
Step 5: compare the activities
Each registry entry lists the MSB activities the business is registered for. Compare these with the services you will actually use.
For example, if a provider will convert your US dollars into euros and then wire the euros to suppliers, it should be registered for foreign exchange dealing and for money transferring. If it will also convert fiat currency to a stablecoin and send it to your wallet, it should be registered for dealing in virtual currencies.
A gap between the services and the registered activities is a red flag. It may be an administrative error, but it may also mean that the business is carrying on an activity it has not disclosed to FINTRAC. Ask the provider to explain, and ask when it will update its registration if the gap is genuine.
The registry entry may also show whether the business is a foreign MSB, and may list agents or branches. Where a provider uses agents, confirm whether you will be dealing with the registered business directly or through one of them.
Step 6: check the address and website
The address on the registry should match the address the provider gives you and the address on its contract. A business with a head office in one city on the registry and a different city on its letterhead may simply have moved without updating its registration, which is itself a compliance lapse. It may also be a sign that the website you are looking at is not run by the registered business.
Compare the website and email domain with the registry entry. Impersonation schemes often use a domain that differs from the real one by a single letter, a hyphen or a different ending. If the registry lists a website, use that address rather than a link sent to you by email, and check that the contact details on the real site match the ones you have been using.
If anything does not match, call the provider using contact details taken from the registry or its genuine website, not the details in the message you are trying to check.
Checks that go beyond the registry
The registry confirms registration. It does not tell you how a business is run, whether it is financially sound or whether it is the right fit. Sensible further checks include:
- A corporate registry search confirming that the legal entity exists, is active and has the directors you expect.
- Confirmation that bank details for paying the provider are in the provider's own legal name. Instructions to pay a different company, or a private individual, need a clear explanation.
- A search of FINTRAC's published administrative monetary penalties to see whether the business has been penalised.
- Questions about how the provider holds client funds while a transaction is in progress and which banks it uses.
- A look at the provider's terms: which law governs them, which entity you contract with and how complaints are handled.
Keep a record and recheck
A registry check is a snapshot. A provider that was registered when you onboarded may later let its registration lapse, change its activities or have its registration revoked. Build a simple routine around it:
- Save the registry entry, with the date, on your vendor file at the start of the relationship.
- Recheck at least once a year, and after the provider's two-yearly renewal date has passed.
- Recheck whenever something changes on the provider's side, such as a new legal entity on invoices, new bank details or a new brand name.
- Note who carried out the check and what they compared, so that the next person can repeat it.
For a business that pays large sums through one provider, this routine takes very little time and gives its finance team and auditors a clear trail. It also means that if the provider's status changes, you find out from a scheduled check rather than from a payment that goes wrong.
Warning signs of an unregistered provider
Some patterns should make you stop and check more carefully before sending any money:
- The provider will not give a registration number, or gives one that does not appear on the registry.
- It describes itself as licensed or approved by FINTRAC in vague terms but never refers to MSB registration.
- It asks you to pay into a personal account, or into the account of an unrelated company, without a written explanation.
- Its onboarding asks for almost nothing: no identification, no ownership information, no questions about the purpose of payments. A registered MSB must ask these things.
- It offers rates that look far better than the market with no explanation of how it can afford them.
- It pushes you to act quickly, for example by saying a rate or opportunity will vanish within the hour.
- Its contact is only through messaging apps, with no company address, phone number or named staff.
Any one of these may have an innocent explanation. Several together are a strong reason to walk away.
Before you act
This article is general information to help you check a provider. It is not legal advice, and a registry check is only one part of proper vendor due diligence.
The same checks apply to any provider you are assessing, including CCYFX PAY INC. If anything you find does not match what you have been told, please contact us using the details on this website.
