FINTRAC Prepaid Payment Products: AML Rules for Canadian Issuers

A reloadable open-loop card that a customer can top up to $1,000 sits on top of a prepaid payment product account, and Canada’s financial intelligence unit gives that account the same anti-money-laundering weight as a chequing account. FINTRAC’s prepaid payment products guidance came into effect on 1 June 2021. Under the PCMLTFA and its regulations, an account connected to a prepaid payment product is a PPP account if it permits at least $1,000 to be added within 24 hours or a balance of at least $1,000 to be maintained. That threshold activates PPP-account-specific account-opening and record-keeping requirements; FINTRAC reports remain subject to their own transaction- or property-based triggers and exceptions.

The reason this matters now is that prepaid programs have moved from niche gift cards to payroll cards, expense cards, and reloadable wallets that can hold virtual currency. Each of those is a candidate for the prepaid payment product account definition, and each pulls the issuing financial entity into a reporting perimeter that many program managers still treat as a payments question rather than a PCMLTFA question. For a Canadian issuer, and for a foreign firm weighing whether to serve Canadian cardholders, the operative question is where each of those products lands in the PCMLTFA perimeter and which entity carries the obligation.

Related reading: FINTRAC requirements for Canadian financial institutions’ foreign branches and subsidiaries.

The numbers that decide whether the rules bite

Two dollar figures do most of the work here, and they are not the same figure. The first, $1,000, decides whether an account is a prepaid payment product account at all. The second, $10,000, decides when routine transactions become reportable. Reading them as one number is the most common way a prepaid program under-reports.

• Guidance in effect since 1 June 2021 (published May 2021), applicable to financial entities and to life insurance companies, brokers and agents that offer prepaid payment products to the public or maintain related prepaid payment product accounts; they are treated as financial entities for those activities.
• Prepaid payment product account trigger: an account that permits $1,000 or more to be added within a 24-hour period, or a balance of $1,000 or more to be maintained.
• Identity of the account holder: verified before the account is activated.
• Identity of an authorized user: verified before the first transaction is carried out.
• Identity of any payer of $1,000 or more into the account: verified when the transaction takes place.
• Large cash transaction report: cash received of $10,000 or more, filed within 15 calendar days.
• Large virtual currency transaction report: virtual currency received of $10,000 or more, filed within 5 working days.
• Electronic funds transfer report: international transfer of $10,000 or more, filed within 5 working days.
• Suspicious transaction report: no minimum amount, filed as soon as practicable when there are reasonable grounds to suspect money laundering, terrorist activity financing or sanctions evasion.
• Listed Person or Entity Property Report: no transaction threshold; filed immediately when the applicable terrorism or sanctions disclosure trigger is met.

How FINTRAC defines a prepaid payment product

The regulations describe a prepaid payment product as a product issued by a financial entity that lets a person or entity engage in a transaction by giving them electronic access to funds or virtual currency paid into a prepaid payment product account held with that entity in advance of the transaction. The two operative ideas are prefunding and electronic access to an account. A card that draws on a credit line or a linked chequing balance is not a prepaid payment product, because the money is not sitting in a dedicated prepaid account ahead of the spend.

The definition also carves out three product types. It excludes anything that gives access to a credit or debit account, anything issued for use only with particular merchants, and anything issued for single use in a retail rebate program. A closed-loop card that works only inside one retailer therefore falls outside the regime, as does a one-time rebate card. The definition reaches reloadable and non-reloadable products alike, provided they can be accepted in a range of places, for example by running on a widely accepted payment network.

The practical error here is treating “prepaid” and “gift card” as interchangeable. A single-merchant store card and a single-use rebate card are outside scope, but a general-purpose reloadable card on an open network is squarely inside it. Program teams that inherited a legacy gift-card exemption sometimes carry that assumption onto an open-loop product that no longer qualifies for it.

The $1,000 account test, read the way FINTRAC wrote it

A prepaid payment product account is an account connected to a prepaid payment product that permits funds or virtual currency totalling $1,000 or more to be added within a 24-hour period, or a balance of $1,000 or more to be maintained. The test is about what the account permits, not only about what a given customer happens to load. If the product design allows a $1,000 load in a day, or allows a $1,000 balance to sit on the card, the account meets the definition even for a customer who never gets near that ceiling.

That design-capacity reading is where a lot of scoping goes wrong. A program that caps daily loads at $500 but allows the balance to accumulate above $1,000 still holds prepaid payment product accounts, because the balance limb of the test is satisfied on its own. Either limb is enough.

The regulations exclude a narrow set of accounts from the definition. An account counts as out of scope only where the sole parties that can add funds or virtual currency to it are a public body, or a registered charity as defined in the Income Tax Act acting for the purposes of humanitarian aid. A benefits-distribution account funded exclusively by a municipality can sit inside that exclusion. A commercial payroll or expense-card program does not, because the funding party is an ordinary business.

The issuer holds the obligations, not the corporate buyer

FINTRAC’s own worked example settles a question that program managers raise constantly. A business opens a prepaid payment product account with a financial entity, deposits $5,000, and instructs the financial entity to issue 50 prepaid cards of $100 each connected to that account. In that arrangement the financial entity, and not the business that bought the cards, is subject to the prepaid payment product requirements.

For an issuer, that means the compliance build cannot be outsourced to the corporate client’s own onboarding. The financial entity that maintains the account has to verify the identity of the account holder, verify authorized users, keep the records, and file the reports. A distribution partner or a program marketer sitting between the issuer and the cardholder does not absorb those duties by contract. The regulation attaches the obligation to the entity that maintains the account, and an examiner will look there first.

Identity verification switches on at three different moments

Subject to FINTRAC’s client-identification exceptions and the rule against unnecessary re-identification, the guidance sets three identity triggers for a prepaid payment product account. The account holder is identified before activation, an authorized user is identified before the first transaction, and a person or entity making a payment of $1,000 or more to the account is identified when the transaction takes place.

Authorized users are the trigger most often missed, because they are invisible in a straight account-opening flow. A cardholder who adds a family member, or a corporate account that issues a stack of employee cards, is creating authorized users whose identity has to be confirmed before they transact. A build that only verifies the primary account holder will pass its own onboarding test and still leave a population of unverified users transacting on the account.

The $1,000 payer trigger is worth separating from the $1,000 account trigger, because they measure different things. The account test asks whether the product permits $1,000 to load or sit. The payer test asks whether a specific inbound payment reaches $1,000, and it applies to whoever makes that payment, including a third party topping up someone else’s card.

Record keeping that an examiner can reconstruct

The prepaid regime folds into the standard record-keeping requirements for financial entities, with records specific to the account and its transactions. FINTRAC’s guidance calls for prepaid payment product account records, transaction records for the account, and the other account records a financial entity keeps as a matter of course. Identity-verification records sit alongside them.

The point that catches prepaid programs is coverage across the distribution chain. Where a card program runs through a third-party processor or a program manager, the issuing financial entity still has to be able to produce the account and transaction records for FINTRAC. A data-sharing gap between the issuer and its processor is not a defence; the obligation follows the entity that maintains the account. Teams that map their record inventory against the FINTRAC expectations for banking services to non-bank payment providers tend to find the gaps before an examination does.

The FINTRAC reports a prepaid book can generate

The $1,000 PPP-account definition does not itself trigger a report. A financial entity’s prepaid book can give rise to Suspicious Transaction Reports, Listed Person or Entity Property Reports, Large Cash Transaction Reports, Large Virtual Currency Transaction Reports and Electronic Funds Transfer Reports, each under its own trigger and exceptions.

Subject to the applicable exceptions, a Large Cash Transaction Report is required when the financial entity receives $10,000 or more in cash and is filed within 15 calendar days after the day of receipt. A Large Virtual Currency Transaction Report is required when it receives virtual currency equivalent to $10,000 or more and is filed within 5 working days after the day of receipt. An Electronic Funds Transfer Report is required when the entity initiates or finally receives a reportable international electronic funds transfer of $10,000 or more and is filed within 5 working days after the day of initiation or final receipt. A Suspicious Transaction Report has no minimum amount and is filed as soon as practicable when there are reasonable grounds to suspect money laundering, terrorist activity financing or sanctions evasion. A Listed Person or Entity Property Report must be filed immediately when the applicable disclosure trigger is met; no transaction or attempted transaction is required.

The 24-hour rule applies separately to each $10,000 report type within the reporting entity’s static 24-hour window. For large cash and large virtual currency receipts, transactions are aggregated when they were conducted by the same person or entity, conducted on behalf of the same third party, or are for the same beneficiary. For initiated international electronic funds transfers, the tests are the same requestor, the same third party or the same beneficiary; for finally received international electronic funds transfers, the tests are the same requestor or the same beneficiary. Split top-ups aggregate only where the underlying transactions are of the same reportable type and meet the relevant linkage test. For firms that also run cross-border transfers, our explainer on the FATF travel rule and Recommendation 16 covers the payer and payee information that rides alongside these transfers.

Virtual currency inside a prepaid account

The prepaid definition explicitly reaches accounts that hold virtual currency, not only fiat funds. That single word changes the reporting surface of a program that lets cardholders load or hold crypto. The large virtual currency transaction report applies to virtual currency received of $10,000 or more, and the virtual-currency record-keeping requirements come with it.

A crypto-enabled prepaid product does not automatically create two parallel reporting streams. A virtual-currency exchange requires a virtual-currency exchange transaction ticket, and virtual-currency transfer or receipt records apply at their specific $1,000 thresholds. A Large Virtual Currency Transaction Report is triggered only when the financial entity receives virtual currency equivalent to $10,000 or more in a single transaction or under the 24-hour rule, subject to the applicable exceptions. Converting fiat to virtual currency does not by itself trigger both a fiat report and a virtual-currency report. Programs weighing how virtual assets flow through their accounts can read our note on the FATF approach to stablecoins and unhosted wallets for the wider standard-setting context.

Business relationship, monitoring, beneficial ownership and PEPs

Opening a prepaid payment product account brings the relationship-based obligations that account-based reporting entities carry. The guidance points to business relationship requirements, ongoing monitoring, beneficial ownership determination, and the politically-exposed-persons process that applies to account-based sectors. These are not one-time onboarding checks; ongoing monitoring runs for the life of the relationship.

Where the financial entity is required to verify an entity account holder’s identity, it must obtain and take reasonable measures to confirm the prescribed beneficial ownership information. For a corporation, that includes all directors, the names and addresses of individuals who directly or indirectly own or control at least 25% of the shares, and information establishing the ownership, control and structure. Beneficial ownership accuracy is revisited through ongoing monitoring, and separate PEP and HIO determinations apply to relevant persons, including prepaid-account authorized users, subject to the applicable exceptions.

Cross-border firms: settle the FMSB question before the prepaid one

A foreign payment institution that wants Canadian cardholders usually asks the wrong first question. The prepaid regime described here attaches to financial entities, because a prepaid payment product is defined as a product issued by a financial entity. Prepaid-product issuance is a financial-entity function, separate from the money services business activity categories. A firm that provides qualifying money-services activities from a place of business in Canada may be a money services business. A firm with no place of business in Canada is a foreign money services business only where it directs qualifying services at persons or entities in Canada and provides those services to clients in Canada.

That distinction sets the registration path. Both money services businesses and foreign money services businesses have to register with FINTRAC before they operate, and registration is required even if the firm is licensed provincially. The statutory money services business activities are foreign exchange dealing; remitting or transmitting funds; transporting currency, money orders, traveller’s cheques or other similar negotiable instruments; issuing or redeeming money orders, traveller’s cheques or other similar negotiable instruments; dealing in virtual currencies; providing acquirer services in relation to a private automated banking machine; and prescribed services. The current prescribed services are crowdfunding platform services and cheque-cashing services. A cross-border firm should map its actual activities to those categories first, and only then ask whether it is issuing prepaid payment products as a financial entity.

One more regime sits next to FINTRAC’s and is easy to conflate with it. The Bank of Canada’s supervision of payment service providers under the Retail Payment Activities Act came into effect on 8 September 2025, with a public registry of registered providers. That is a payments-operational and funds-safeguarding regime run by the central bank, and it is separate from FINTRAC’s AML registration and reporting. A foreign firm can face a FINTRAC obligation, a Retail Payment Activities Act obligation, or both, and clearing one does not clear the other. Firms comparing this to the European e-money model can see how the perimeter is drawn there in our guide to PSD3 payment institutions and electronic money in Luxembourg.

Frequently Asked Questions

Does a low-value gift card make my program a prepaid payment product issuer under FINTRAC?

Not on its own. A card issued for use only with particular merchants, or issued for single use in a retail rebate program, is excluded from the prepaid payment product definition. The regime reaches general-purpose products that give electronic access to a prefunded account and can be accepted across a range of locations, and it engages only where the connected account can load or hold $1,000 or more.

Is the $1,000 figure a reporting threshold?

No. The $1,000 figure is a scoping and identity test. It decides whether an account is a prepaid payment product account and when a payer’s identity must be verified. The reporting thresholds are separate: $10,000 for large cash, large virtual currency and international electronic funds transfer reports, and no minimum amount for a suspicious transaction report.

Who has to verify authorized users?

The financial entity that maintains the prepaid payment product account. Subject to the applicable client-identification exceptions and any valid prior identification, the financial entity must verify an authorized user’s identity before the first transaction is carried out.

If a business buys 50 cards from us, does the business report?

No. FINTRAC’s example is explicit that where a business opens a prepaid account and instructs the financial entity to issue cards connected to it, the financial entity, not the business, is subject to the prepaid payment product requirements. The obligation follows the entity that maintains the account.

What changes if the prepaid account can hold virtual currency?

Virtual-currency obligations depend on the transaction performed. Virtual-currency exchange transaction records apply to exchanges, virtual-currency transfer or receipt records apply at their specific $1,000 thresholds, and a Large Virtual Currency Transaction Report applies only when the financial entity receives virtual currency equivalent to $10,000 or more in a single transaction or under the 24-hour rule, subject to the applicable exceptions. A crypto-enabled prepaid product does not automatically run two parallel report streams.

We are a foreign fintech with no Canadian office. Which FINTRAC status applies?

It depends on the activity. A prepaid payment product is, by definition, issued by a financial entity. A firm without a place of business in Canada is a foreign money services business only if it directs at least one qualifying service listed in paragraph 5(h.1) of the PCMLTFA at persons or entities in Canada and provides that service to clients in Canada. Those services include foreign exchange dealing; remitting or transmitting funds; transporting currency or specified negotiable instruments; issuing or redeeming specified negotiable instruments; dealing in virtual currencies; private-ATM acquirer services; and prescribed services. If it meets that test, it must register with FINTRAC before operating.

How does the 24-hour rule affect prepaid top-ups?

The rule is applied by report type within the reporting entity’s static 24-hour window. Large cash and large virtual currency receipts aggregate by the same conductor, third party or beneficiary. Initiated international electronic funds transfers aggregate by the same requestor, third party or beneficiary, while finally received international electronic funds transfers aggregate by the same requestor or beneficiary. Split top-ups are reportable only when the underlying transactions are of the same reportable type and meet the relevant linkage test.

Related Articles

• FINTRAC Requirements for Foreign Branches and Subsidiaries: how Canada’s AML reach extends to the overseas arms of Canadian financial institutions.
• Wolfsberg Guidance on Banking Services to Non-Bank Payment Providers: what correspondent-banking AML frameworks must cover when the client is a payment firm.
• FATF Travel Rule and Recommendation 16: the payer and payee information required to accompany cross-border transfers.
• FATF on Stablecoins and Unhosted Wallets: the AML/CFT expectations shaping how virtual assets move through regulated products.
• PSD3 and Electronic Money in Luxembourg: how the European framework scopes payment institutions and e-money for comparison.

Key Takeaways

• The FINTRAC prepaid payment products guidance has been in effect since 1 June 2021 and applies to financial entities and to life insurance companies, brokers and agents that offer prepaid payment products to the public or maintain related prepaid payment product accounts.
• An account is a prepaid payment product account once it permits $1,000 or more to load within 24 hours or a $1,000 balance to be maintained; either limb is enough, and the test turns on what the product permits.
• Subject to the applicable client-identification exceptions and any valid prior identification, identity verification applies to the account holder before activation, an authorized user before the first transaction, and a person or entity making a payment of $1,000 or more when the payment is made.
• The issuing financial entity holds the obligations even when a business buys and distributes the cards.
• The $1,000 PPP-account threshold does not trigger a report. Subject to applicable exceptions, the transaction thresholds are $10,000 for large cash, large virtual currency and reportable international electronic funds transfers, while suspicious transaction reports have no minimum amount and Listed Person or Entity Property Reports are property-triggered and filed immediately.
• The 24-hour rule aggregates transactions of the same report type within the reporting entity’s static 24-hour window when the report-specific linkage test is met; a split top-up is not automatically reportable unless its underlying transactions meet those conditions.
• Virtual-currency functionality adds transaction-specific record-keeping and, where the receipt threshold is met, Large Virtual Currency Transaction Reporting; holding virtual currency does not itself create a parallel report stream.
• Cross-border firms should confirm their money services business or foreign money services business status, and any Retail Payment Activities Act registration, before assuming the prepaid regime applies.

Sources and References

• FINTRAC, Prepaid payment products and prepaid payment product accounts: fintrac-canafe.canada.ca/guidance-directives/prepaid-prepaye/1-eng
• FINTRAC, When to verify the identity of persons and entities – Financial entities: fintrac-canafe.canada.ca/guidance-directives/client-clientele/client/fin-eng
• FINTRAC, Reporting large cash transactions to FINTRAC: fintrac-canafe.canada.ca/guidance-directives/transaction-operation/lctr-doie/lctr-doie-eng
• FINTRAC, Reporting large virtual currency transactions to FINTRAC: fintrac-canafe.canada.ca/guidance-directives/transaction-operation/lvctr/lvctr-eng
• FINTRAC, Reporting electronic funds transfers to FINTRAC: fintrac-canafe.canada.ca/guidance-directives/transaction-operation/eft-dt/eft-dt-eng
• FINTRAC, Reporting suspicious transactions to FINTRAC: fintrac-canafe.canada.ca/guidance-directives/transaction-operation/str-dod/str-dod-eng
• FINTRAC, Reporting listed person or entity property to FINTRAC: fintrac-canafe.canada.ca/guidance-directives/transaction-operation/Guide5/5-eng
• FINTRAC, Reporting transactions to FINTRAC: The 24-hour rule: fintrac-canafe.canada.ca/guidance-directives/transaction-operation/24hour/1-eng
• FINTRAC, Record keeping requirements for financial entities: fintrac-canafe.canada.ca/guidance-directives/recordkeeping-document/record/fin-eng
• FINTRAC, Money services businesses (MSBs): fintrac-canafe.canada.ca/msb-esm/msb-eng
• Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA), s. 5(h) and 5(h.1) (money services business activities): laws-lois.justice.gc.ca/eng/acts/P-24.501
• Proceeds of Crime (Money Laundering) and Terrorist Financing Regulations, SOR/2002-184 (definitions in s. 1(2)): laws-lois.justice.gc.ca/eng/regulations/SOR-2002-184
• Bank of Canada, Payment service providers now under supervision (Retail Payment Activities Act, 8 September 2025): bankofcanada.ca/2025/09/payment-service-providers-are-now-under-supervision-registry-to-follow

Where a prepaid book meets the PCMLTFA

The cleanest way to scope a prepaid program is to run it through FINTRAC’s two questions in order. First, does the product give electronic access to a prefunded account that can load or hold $1,000, and is it something other than a single-merchant or single-use rebate card? If yes, it is a prepaid payment product account and the PPP-account identification and record-keeping obligations apply to the financial entity, subject to the applicable exceptions; reportability is assessed separately under each report’s own trigger. Second, for a cross-border firm, does the underlying activity fall within any of the services listed in paragraphs 5(h) or 5(h.1) of the PCMLTFA, including money transfer, foreign exchange, virtual-currency dealing, specified negotiable-instrument activities, currency or negotiable-instrument transportation, private-ATM acquirer services or prescribed services? If so, the money services business or foreign money services business path must be assessed separately. Answer those before building the controls, and the reporting obligations fall out in the right place rather than surfacing in an examination.

Disclaimer: The information on RegReportingDesk.com is for educational and informational purposes only. It does not constitute legal, regulatory, tax, or compliance advice. Always consult your compliance officer, legal counsel, or the relevant supervisory authority for guidance specific to your institution.