Who Regulates Crypto ATMs in Canada—and Why Scammers Love Them
A practical guide from Outsmart the Scammer: understand who has authority over cryptocurrency kiosks (Bitcoin ATMs), what rules apply, and how these machines are commonly used in fraud.
A practical guide from Outsmart the Scammer: understand who has authority over cryptocurrency kiosks (Bitcoin ATMs), what rules apply, and how these machines are commonly used in fraud.
Crypto ATMs are everywhere—convenience stores, gas stations, strip malls—and they look familiar, like a regular bank machine. But they work very differently: they let someone convert cash into cryptocurrency and send it to a digital wallet within minutes. That speed and irreversibility is exactly why scammers push victims to use them. Did you know that Vancouver Island alone has over 70 of these ATM’s. This article explains the layers of oversight in Canada—federal anti-money laundering rules (FINTRAC), when provincial securities regulators can be involved, and the extra provincial licensing some jurisdictions add. Then it breaks down the common crypto ATM scam playbook and what to do if you’re targeted.
1) The main regulator: FINTRAC (federal anti-money laundering authority)
In Canada, most cryptocurrency kiosks (often called Bitcoin ATMs) fall under the federal anti-money laundering and anti-terrorist financing regime. Operators that provide virtual-currency exchange or transfer services are generally treated as money services businesses (MSBs) under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) and its regulations, and are supervised by the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC). [1]
MSB registration (before operating): If you’re in scope, you must register with FINTRAC. Registration is not an endorsement—it's a legal requirement. [2]
Compliance program: MSBs must maintain a documented compliance program (policies and procedures, risk assessment, training, and effectiveness review). [3]
Know-your-client (identity verification) and recordkeeping: MSBs must verify identity and keep prescribed records for certain transactions and activities. [1]
Reporting to FINTRAC: Including suspicious transaction reports and, where applicable, large virtual currency transaction reports (LVCTRs). [4]
Why FINTRAC cares about kiosks: FINTRAC has published risk guidance specifically on virtual currency ATMs and how they can be used to launder proceeds of crime. [5]
2) When provincial securities regulators can be involved (CSA/BCSC and the “immediate delivery” test). FINTRAC’s role is primarily anti-money laundering, not investor protection. Separately, provincial and territorial securities regulators (coordinated through the Canadian Securities Administrators, or CSA) can regulate certain crypto-asset trading activity under securities/derivatives laws. The CSA’s Staff Notice 21-327 explains that even if the underlying crypto asset is a commodity, the contractual right a customer gets through a platform can still be a security or derivative—especially where the customer does not receive “immediate delivery” to a wallet they control, or where the platform retains custody/control. [6]
3) CRA’s role: taxation guidance (not day-to-day regulation of kiosks). The Canada Revenue Agency (CRA) doesn’t “regulate” crypto ATMs as a consumer watchdog, but it does set out how crypto-asset transactions are treated for tax purposes. CRA guidance explains that crypto-assets can have income tax implications (for example, buying/selling, using crypto to pay for goods/services), and it provides GST/HST guidance for certain crypto-asset transactions. [7][8]
Practical takeaway: even if you’ve been scammed, keep any receipts, wallet addresses, text messages, and timestamps—those details matter for reporting and (if applicable) tax/recordkeeping later.
4) Provincial add-ons: Québec licensing (and B.C.’s developing regime). Québec: Québec has its own licensing regime under the Money-Services Businesses Act administered by Revenu Québec. Revenu Québec’s guidance specifically notes that operating a cryptoasset ATM can require a provincial licence (in addition to any federal FINTRAC obligations). [9]
British Columbia: B.C. has passed a Money Services Businesses Act (SBC 2023, c. 19) that creates a provincial registration/oversight framework for money services businesses. As of the current consolidation on BC Laws, the core parts of the Act are not yet in force (it comes into force by regulation). In other words: it signals coming provincial oversight, but the federal FINTRAC regime remains the primary operational requirement today. [10]
5) British Columbia: BCSC (securities) and BCFSA (market conduct) roles. In B.C., the BC Securities Commission (BCSC) administers B.C.’s securities laws. If a crypto product or arrangement offered to the public is a security/derivative (for example, because of custody/control features described by the CSA), the BCSC can have jurisdiction. The BCSC and its investor education site, InvestRight, also publish consumer warnings about crypto fraud and the risks of crypto-asset services. [11][12]
FINTRAC ≠ consumer refunds: FINTRAC is about anti-money laundering compliance, not getting victims their money back.
Securities law can apply in some crypto setups: Especially where customers don’t get immediate delivery to a wallet they control, or where an intermediary holds/control assets. [6]
Consumer education and alerts: In B.C., look to BCSC/InvestRight for plain-language warnings and scam prevention resources. [11][12]
6) Municipal authority: limited levers (business licensing and zoning). Municipalities generally don’t regulate cryptocurrency itself, but they can influence where kiosks operate through business licensing, zoning, and local bylaws (for example, rules about signage or operating conditions for machines located in retail businesses). Think of this as “where and how the machine can sit in a storefront,” not “how crypto is governed.”
What this means for consumers: even if a kiosk is in a legitimate store, that doesn’t guarantee the transaction is reversible or protected like a bank transfer.
Why crypto ATMs show up in so many scams
Crypto ATMs are a scammer’s dream because they convert cash into crypto quickly, and crypto transfers are typically irreversible. Once the money is sent to a scammer’s wallet, there’s usually no bank “chargeback,” no teller to interrupt the transaction, and no easy way to trace and recover funds before they’re moved again. Canadian reporting and investigations have repeatedly highlighted crypto ATMs as a common cash-out method in fraud targeting Canadians. [13][14][15]
How the scam usually unfolds (step-by-step):
Contact: You get a call, text, email, pop-up, or social message claiming there’s an urgent problem (fraud on your bank account, taxes owed, a compromised device, a missed delivery, a warrant, etc.).
Impersonation: The scammer pretends to be a bank, tech support, police, CRA, or another “authority.” They may use spoofed caller ID.
Isolation + urgency: They pressure you to stay on the phone and not talk to family, store staff, or your bank. They may claim you’ll be arrested or lose everything if you delay.
The crypto ATM instruction: They direct you to a nearby crypto ATM and tell you to withdraw cash and feed it into the machine.
The QR code / wallet address: They provide a QR code or address to scan, claiming it’s a “secure government” or “protected” account. It’s actually their wallet.
Money moved fast: After you send it, they move the crypto through other wallets/exchanges. Recovery becomes extremely difficult.
Common red flags (especially in ATM-based scams):
Anyone who says you must pay in crypto (or at a crypto ATM) to fix a problem is almost certainly a scammer.
Threats or extreme urgency: “Do it right now,” “stay on the phone,” “don’t tell anyone.”
QR codes sent by text/email: Scammers want you to scan and send to their wallet.
Claims that your money will be ‘protected’ by moving it to crypto: That’s not how legitimate financial institutions or government agencies work.
Imposter scripts: CRA/bank/police/tech-support impersonation is a common entry point for ATM scams. [15][14]
How to protect yourself (Canada-wide checklist):
Stop, pause, verify: If you get a scary call/message, hang up. Then contact the organization using a number you find yourself (official website, statement, or card)—not a number the caller gives you.
Know the rule: Government agencies and legitimate businesses will not demand payment via crypto ATM. For example, the CRA warns Canadians about fraud and impersonation tactics. [16]
Never scan a QR code from a stranger: Treat a QR code like a stranger asking for access to your wallet.
Bring a second person: If you’re worried something might be real, take a family member/friend to the bank or store and explain the situation before moving any money.
If you’ve already paid: Keep receipts, take photos/screenshots of the wallet address/QR code and the kiosk location, and report immediately. [17]
What to do if you already used a crypto ATM:
Call your local police right away (non-emergency unless there’s immediate danger).
Report to the Canadian Anti-Fraud Centre (CAFC) (online or by phone). CAFC collects fraud reports and shares information to support investigations. [17]
Preserve evidence: kiosk receipt, time/location, photos of the screen if possible, the wallet address/QR code, chat logs, phone numbers, and any bank withdrawal receipts.
Tell your bank what happened (especially if the scam involved unusual withdrawals or account access).
Sources
1. Justice Laws Website (Canada), Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA).
2. FINTRAC, Money Services Business Registry (registration is required; registry is public and not an endorsement).
3. FINTRAC, Compliance program requirements (guidance).
4. FINTRAC, Large Virtual Currency Transaction Reports (LVCTR) guidance.
6. Canadian Securities Administrators, Staff Notice 21-327 (Jan. 16, 2020) (guidance on when securities legislation may apply, including “immediate delivery”).
7. Canada Revenue Agency, Understanding crypto-assets and your tax obligations.
8. Canada Revenue Agency, Collecting and remitting GST/HST from crypto-asset transactions.
9. Revenu Québec, Cryptoasset services (including cryptoasset ATMs).
10. BC Laws, Money Services Businesses Act (SBC 2023, c. 19) (coming into force by regulation; check current in-force status).
11. BC Securities Commission, Crypto-assets (industry information).
12. InvestRight (BCSC), Crypto-assets: what you need to know.
13. CBC News, “Feeding Fraud: The Crypto ATM Problem” (Oct. 2025 series).
14. RCMP, warning about Bitcoin ATM scams (RCMP Alberta Gazette post).
15. U.S. Federal Trade Commission, Consumer Alert: Scammers use Bitcoin ATMs to steal your money (Sept. 2024) (useful plain-language explanation of common scam scripts).
16. Government of Canada, Scams and fraud (including CRA impersonation and common payment red flags).
17. Canadian Anti-Fraud Centre (CAFC), Report fraud and get help.