KYC and AML for Crowdfunding Platforms in Canada: 2026 Compliance Guide

Canada's approach to crowdfunding regulation is unlike any other G7 jurisdiction. Because securities law is a provincial matter under the Constitution Act, there is no single national regulator — instead, 13 provincial and territorial commissions each hold authority within their borders, coordinating through the Canadian Securities Administrators (CSA). Layered on top of that provincial patchwork sits a federal AML regime administered by FINTRAC under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA). For crowdfunding platforms operating from Vancouver to Halifax, navigating these overlapping obligations is a central compliance challenge in 2026.

This article is provided for informational purposes only and does not constitute legal, financial, or regulatory advice. Regulatory references are accurate as of the publication date (June 2026). Consult a qualified professional for advice tailored to your specific situation.

Canadian Crowdfunding Regulation: CSA Framework and Provincial Securities Law

Securities regulation in Canada sits squarely within provincial jurisdiction. Each of the 13 provincial and territorial securities commissions administers its own securities act, though the CSA — a voluntary coordinating body — works to harmonise rules nationally. The result is a system where a crowdfunding platform technically needs to comply with every province in which it solicits investors, even when the underlying rules are nearly identical.

The flagship crowdfunding instrument at the national level is National Instrument 45-110 (Startup Crowdfunding Registration and Prospectus Exemptions), which came into force on 21 March 2021. NI 45-110 replaced a patchwork of earlier local instruments and created a more consistent framework across participating jurisdictions. Under NI 45-110, platforms must register as Funding Portals with their home-province regulator and are then able to operate in other participating provinces without additional filings.

Key parameters under NI 45-110 include:

• Issuer cap: A business may raise no more than C$1.5 million in a 12-month period using the NI 45-110 exemption.
• Retail investor cap: Each retail investor is limited to C$2,500 per individual offering and C$10,000 in aggregate across all NI 45-110 investments in a calendar year.
• Accredited investor cap: Investors who qualify as accredited investors under NI 45-106 may invest up to C$10,000 per offering without being subject to the aggregate cap.
• Offering document: Issuers must prepare a prescribed offering document and file it with the relevant regulator before the offer opens.

Québec sits in a somewhat distinct position. The Autorité des marchés financiers (AMF) applies its own version of Regulation 45-110, and platforms seeking to raise funds from Québec investors must also comply with AMF-specific disclosure requirements and may need to register separately with the AMF even if already registered in another province.

Ontario presents additional complexity. While the Ontario Securities Commission (OSC) participates in the CSA regime and adopted NI 45-110, the Ontario Securities Act imposes certain obligations that go beyond the national instrument, including heightened suitability considerations and ongoing reporting requirements for registered Funding Portals.

Canadian Crowdfunding vs EU ECSP: A Quick Comparison

One striking difference from the European model is the absence of passporting. A Funding Portal registered with the OSC in Ontario cannot automatically operate in France or Germany the way an EU-authorised ECSP platform can. Equally, a platform wishing to access all 13 Canadian jurisdictions may face varying degrees of coordination burden even within the country. For a deeper look at document-level compliance considerations, see our document compliance guide.

KYC Requirements for Canadian Investors

All crowdfunding platforms that handle investor funds in Canada are subject to FINTRAC's client identification requirements under the PCMLTFA. FINTRAC does not regulate securities portals directly as securities dealers — that remains the CSA's purview — but platforms that transmit funds or deal in virtual currency typically qualify as Money Services Businesses (MSBs) under the PCMLTFA and must register with FINTRAC accordingly.

For individual investor verification, FINTRAC's current rules require platforms to collect, at a minimum: full legal name, residential address, date of birth, nature of principal business, and a determination as to whether the client is acting on behalf of a third party.

FINTRAC accepts several methods of electronic and in-person identification:

Two-document method (in-person or document-based): The platform must obtain two pieces of acceptable government-issued ID, or one government-issued ID plus one document from an independent and reliable source (such as a utility bill or bank statement confirming address). Acceptable government-issued documents include:

• Canadian passport
• Provincial or territorial driver's licence
• Birth certificate
• Permanent Resident (PR) card
• Certificate of Indian Status

Credit file method: If a credit file has been active for at least three years in the investor's name, that file alone may satisfy the identification requirement.

Dual-process method (electronic): One reliable source confirming name and address (for example, a credit bureau or government database), combined with one reliable source confirming name and date of birth. This is the method most commonly used by online platforms.

A point that trips up many platforms: the Social Insurance Number (SIN) is not required by FINTRAC for KYC identity verification under the PCMLTFA. However, it may be necessary to collect the SIN for income tax reporting purposes under the Income Tax Act — for example, to issue T5 investment income slips to investors who earn dividends or interest from crowdfunded issuers.

When a retail investor wishes to invest above the C$2,500 per-deal cap, platforms must verify that the investor qualifies as an accredited investor under NI 45-106. This requires obtaining a signed investor certification and, for higher-value transactions, supporting evidence of net financial assets exceeding C$1 million or annual income exceeding C$200,000 (or C$300,000 combined with a spouse).

CheckFile's verification engine supports over 3,200 document types across 32 jurisdictions, enabling Canadian platforms to automate the dual-process verification workflow while maintaining FINTRAC-compliant records of the verification method used.

KYB: Verifying Business Issuers

Crowdfunding platforms must also verify the identity of issuers — the companies seeking to raise capital. Unlike the EU, which has centralised business registers in most member states, Canada's corporate registration system is fragmented across federal and provincial levels.

Federal companies incorporated under the Canada Business Corporations Act (CBCA) are registered with Corporations Canada (corporationscanada.ic.gc.ca). The federal registry provides certificates of incorporation and current officer/director information.

Provincially incorporated companies are registered with the relevant provincial registry — for example:

• Ontario Business Registry (Ontario)
• Registraire des entreprises (Québec)
• BC Registries and Online Services (British Columbia)
• Alberta Corporate Registry

Every business operating in Canada (incorporated or not) should have a Business Number (BN) issued by the Canada Revenue Agency (CRA). The BN is a 9-digit identifier used across federal programs, analogous in function to a UK company number or an EU VAT number. Platforms performing KYB checks should confirm the BN and match it against the issuer's certificate of incorporation from the relevant registry.

On beneficial ownership: Canada's position changed significantly following Bill C-42 (2023), which created a federal public beneficial ownership registry for private corporations under the CBCA. This registry, which came into effect in 2024, requires disclosure of individuals who hold 25% or more of shares or voting rights (or who exercise significant control) in federally incorporated companies. It is publicly searchable and provides platforms with a valuable verification tool for CBCA-incorporated issuers.

Provincially incorporated issuers remain subject to provincial rules, which vary considerably. British Columbia has maintained a beneficial ownership register since 2020. Ontario and Québec have made progress on beneficial ownership transparency but as of mid-2026 have not established registries with the same level of public accessibility as BC or the federal registry. Platforms should document their KYB methodology clearly and obtain self-certified beneficial ownership declarations from issuers where registry data is incomplete.

For integrated KYB workflows, see CheckFile's verification solutions.

AML: PCMLTFA, FINTRAC, and Suspicious Transaction Reports

The Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) is the cornerstone of Canada's AML framework. Administered federally, the PCMLTFA applies to a range of "reporting entities" — including MSBs, securities dealers, and, increasingly, platforms that facilitate fund flows between investors and issuers.

Who must register with FINTRAC? Crowdfunding platforms that transmit funds — for example, by holding investor funds in trust accounts, processing payments, or converting currencies — typically meet the definition of an MSB under the PCMLTFA. MSBs must register with FINTRAC at fintrac.gc.ca before commencing operations or within 30 days of becoming a reporting entity. Failure to register is a criminal offence.

AML programme requirements: FINTRAC requires all reporting entities to maintain a written AML/CTF compliance programme that includes:

• Written compliance policies and procedures
• An appointed Chief Compliance Officer (CCO) responsible for the programme
• Ongoing employee training
• A risk assessment of the platform's products, clients, and geographies
• Independent testing of the programme at least every two years (more frequently for higher-risk entities)

Sanctions screening: Crowdfunding platforms must screen investors and issuers against the OSFI Consolidated List of Sanctions maintained by the Office of the Superintendent of Financial Institutions. For platforms with US-connected transactions or US investors, OFAC (Office of Foreign Assets Control) screening may also be required.

Suspicious Transaction Reports (STRs): When a platform has reasonable grounds to suspect that a transaction is related to money laundering or terrorist activity financing, an STR must be filed with FINTRAC. The key rules:

• No minimum dollar threshold — even a C$1 transaction can trigger an STR obligation
• Standard STR deadline: within 30 days of the transaction date (or attempted date)
• Terrorist financing suspicion: STR must be filed within 3 business days

Large Cash Transaction Reports (LCTRs): Any cash transaction — or series of transactions within a single 24-hour period — of C$10,000 or more must be reported to FINTRAC, regardless of suspicion.

FINTRAC publishes detailed guidance for MSBs and other reporting entities at fintrac.gc.ca.

PIPEDA and Canadian Data Privacy

Privacy obligations for Canadian crowdfunding platforms span both federal and provincial legislation, creating a multi-layer compliance environment that rivals the complexity of the AML framework.

PIPEDA (Personal Information Protection and Electronic Documents Act) is the federal private-sector privacy law. It applies to organisations that collect, use, or disclose personal information in the course of commercial activity. For crowdfunding platforms, this means investor KYC data, identity documents, financial records, and correspondence are all governed by PIPEDA unless provincial legislation applies instead.

Provincial privacy laws in three provinces are deemed "substantially similar" to PIPEDA and replace it for activities within those provinces:

• Québec: Law 25 (Loi modernisant des dispositions législatives en matière de protection des renseignements personnels) — enacted in stages from 2022 to 2023, Law 25 is considerably stricter than PIPEDA. It introduces mandatory privacy impact assessments (PIAs) for high-risk processing, explicit consent requirements, data minimisation obligations, and the right to data portability and deletion. Platforms with Québec investors must comply with Law 25's requirements, which are administered by the Commission d'accès à l'information (CAI).
• Alberta: Personal Information Protection Act (PIPA Alberta)
• British Columbia: Personal Information Protection Act (PIPA BC)

The Office of the Privacy Commissioner (OPC) enforces PIPEDA at the federal level. Platforms operating in Québec must also coordinate with the CAI.

On the horizon: Bill C-27 (Consumer Privacy Protection Act / CPPA) proposes to replace PIPEDA with a modernised federal framework that would align Canada more closely with international standards, including GDPR-like accountability and transparency obligations. As of mid-2026, Bill C-27 is progressing through Parliament; platforms should monitor its passage as it will require updates to privacy programmes once enacted.

Data retention: Under the PCMLTFA, platforms must retain client identification records and transaction records for five years after the last business transaction. PIPEDA's general principle is that personal information should not be retained longer than necessary for the stated purpose — creating a tension that platforms must resolve through careful retention policy design.

Biometric data: For platforms using facial recognition or biometric liveness checks during onboarding, provincial laws — particularly Law 25 in Québec and PIPA in BC — impose specific requirements: explicit informed consent, a clearly stated purpose, and robust security measures. These requirements apply even when using a third-party provider.

For CheckFile's approach to data security and privacy compliance, see our security page. For pricing options tailored to fintech platforms, visit our pricing page.

Automating KYC/AML Compliance for Canadian Crowdfunding Platforms

Manual KYC verification is both slow and error-prone at scale. A platform processing hundreds of investor applications per week cannot sustain a paper-based or spreadsheet-driven approach while meeting FINTRAC's record-keeping and verification timeliness requirements.

CheckFile's API enables Canadian crowdfunding platforms to automate the dual-process and credit-file verification workflows required by FINTRAC, with built-in support for over 3,200 document types across 32 jurisdictions — critical for platforms with international investors. The API delivers structured verification outputs that map directly to FINTRAC record-keeping fields, reducing the manual effort required to maintain compliant records.

For sector-specific due diligence considerations beyond the standard investor checks, see our due diligence checklist by sector.

Frequently Asked Questions

How does a crowdfunding platform register under NI 45-110 in Canada?

Funding portals operating under NI 45-110 must complete the registration process with the provincial securities regulator in their home province — for example, the OSC in Ontario or the AMF in Québec. The registration requires a Form 4 filing (Individual Registration), a Form 2 filing (Firm Registration), a written AML/KYC program, and evidence of compliance with FINTRAC requirements if the platform handles investor funds. The CSA coordinates to enable portals registered in one jurisdiction to operate in participating provinces without additional registration.

What KYC documents does FINTRAC require from individual investors on a crowdfunding platform?

For identity verification, FINTRAC accepts the "dual-process method" for electronic identification: one reliable source confirming name and address (e.g. a government database or credit bureau), and another confirming name and date of birth. Alternatively, the "credit file method" uses an active credit file of at least 3 years. For in-person or document-based verification, two pieces of government-issued ID (Canadian passport, provincial driver's licence, birth certificate, PR card) or one ID plus a second reliable source document are required. SIN collection is not required under FINTRAC but may be needed for tax (T5) reporting.

What is the investment limit for a retail investor under NI 45-110?

Under National Instrument 45-110, a retail (non-accredited) investor may invest a maximum of C$2,500 per offering and C$10,000 in aggregate across all NI 45-110 crowdfunding investments per calendar year. Accredited investors (net financial assets >C$1M, or income >C$200,000 individually or C$300,000 combined) may invest up to C$25,000 per offering under the same instrument, and are not subject to the C$10,000 aggregate. Platforms must obtain investor certifications and maintain records.

When must a Canadian crowdfunding platform file a Suspicious Transaction Report (STR) with FINTRAC?

An STR must be filed with FINTRAC within 30 days of the transaction date (or attempted date) when the platform has reasonable grounds to suspect that the transaction is related to money laundering or terrorist activity financing. There is no minimum dollar threshold for STRs. If there are reasonable grounds to believe a completed transaction is related to terrorist financing specifically, the report must be filed within 3 business days. FINTRAC also requires Large Cash Transaction Reports (LCTRs) for any cash transactions of C$10,000 or more within a single 24-hour period.

Does Canada have a beneficial ownership registry like the EU?

Yes, as of 2024. The federal government implemented a public beneficial ownership registry for private corporations incorporated under the Canada Business Corporations Act (CBCA) following Bill C-42 (2023). This covers federally incorporated companies and requires disclosure of individuals with 25%+ equity or significant control. Provincially incorporated companies are subject to provincial rules, which vary — British Columbia has had a beneficial ownership registry since 2020; other provinces are progressing with similar legislation. Platforms performing KYB should search both the federal CBCA registry and provincial equivalents.

---

Regulatory information in this article is based on rules in force as of June 2026. Check FINTRAC and CSA regularly for updates to crowdfunding and AML rules.