Is That Canadian Crypto Exchange Actually Regulated? A Developer's Verification Checklist (Plus the $30K Limit in Python)

#crypto #python #security #beginners

If you live in Canada and use a crypto app, there's a good chance its website says "licensed" or "compliant" somewhere near the footer. Those words can mean very different things. Some platforms are registered with securities regulators and supervised on how they hold client assets. Others only have an anti-money-laundering registration, which says nothing about custody.

As developers we already know this pattern: a badge in a README isn't the same as a passing test. This post treats "is this exchange regulated?" as a verification problem, and ends with a small Python model of the $30,000 purchase limit that registered Canadian platforms enforce.

For the full, up-to-date list of registered platforms and what each label means, see this guide to regulated crypto exchanges in Canada and how to check one.

Two registrations that look alike but aren't

Canada has no single national securities regulator. Each province runs its own, and they coordinate through the Canadian Securities Administrators (CSA). When a platform holds your coins and you only hold a claim on them, regulators treat that as a securities matter, so the platform has to register as a dealer.

There's a second, separate registration with FINTRAC, Canada's financial intelligence agency, as a money services business. That one is about anti-money-laundering checks and KYC. It doesn't mean anyone is reviewing how customer coins are stored.

So "registered" is ambiguous until you know which registry. If you're building anything that routes users or funds to an exchange, that distinction belongs in your design notes.

The status labels, decoded

On provincial lists you'll mostly see two categories:

Restricted dealer: an interim category. The platform can only do what its specific terms and conditions allow.
Investment dealer: the same category traditional brokerages use, with membership in CIRO, the national self-regulatory body, and its capital, audit and conduct rules.

Since 2024 the direction of travel has been for crypto platforms to move toward investment dealer status. Both labels mean a regulator has looked at the business. Neither means your crypto is insured.

Verification as a checklist, not a vibe

Here's the process, written the way I'd write a runbook:

Resolve the legal entity. The brand name isn't what gets registered. Look in the terms of service for the operating company.
Query the source of truth. Search that entity on the CSA's list of authorized crypto trading platforms or its National Registration Search, then check your own province's page. Never trust a "regulated" badge on the company's own site.
Check for province scope. Registration is granted province by province. A platform can be fine in Ontario and absent elsewhere.
Search the warnings lists. Regulators publish investor alerts about unregistered firms. A match there is a hard stop.
Diff the offering against the rules. If an app offers high-leverage derivatives to Canadian retail users, that's a strong signal it isn't on the registered list.

Lists also drift. The NutshellCrypto guide points out a platform shown as an investment dealer on one provincial page and a restricted dealer on another. Treat any cached copy as stale and re-check the live page.

Modeling the $30,000 limit in Python

Registered platforms apply an investment limit for many retail clients: a net maximum of $30,000 CAD over 12 months on coins outside a "specified" set. Bitcoin, Ether, Bitcoin Cash, Litecoin and approved stablecoins are excluded, and sales count back toward your room. Provinces and platforms apply it a bit differently, so treat this as a simplified model, not your platform's exact formula.

from datetime import date, timedelta

LIMIT_CAD = 30_000
EXEMPT = {"BTC", "ETH", "BCH", "LTC", "USDC"}  # check your platform's own list

trades = [  # (date, asset, side, CAD amount)
    (date(2026, 1, 10), "SOL", "buy", 12_000),
    (date(2026, 3, 2), "BTC", "buy", 25_000),   # exempt, doesn't count
    (date(2026, 5, 20), "LINK", "buy", 15_000),
    (date(2026, 7, 1), "SOL", "sell", 4_000),   # sales free up room
]

def remaining_room(trades, today):
    start = today - timedelta(days=365)
    net = 0
    for d, asset, side, cad in trades:
        if asset in EXEMPT or not (start < d <= today):
            continue
        net += cad if side == "buy" else -cad
    return LIMIT_CAD - max(net, 0)

print(remaining_room(trades, date(2026, 10, 26)))  # 7000
print(remaining_room(trades, date(2027, 1, 15)))   # SOL buy aged out -> 19000

The interesting part is the rolling window: room comes back as old buys age past 12 months. If you're reconciling your own exports, this also explains why a purchase that was blocked last month might go through today.

What registration doesn't cover

Crypto held at a member firm isn't eligible for CIPF coverage (cash and crypto funds can be, the coins themselves can't).
Deposit insurance doesn't cover crypto either.
No regulator stops a coin from dropping 50%, and a transfer to the wrong address usually can't be reversed.

That's why many people keep only what they actively trade on any exchange and move long-term holdings to a wallet they control.

Takeaways

"Licensed" is meaningless until you know which registry it refers to.
Verify the legal entity on the CSA and provincial lists, not the company's site.
Registration is per province, and lists change often.
The $30,000 limit is a rolling 12-month net figure on non-specified coins.
Registration reduces some risks but doesn't insure your crypto.

Read the full guide on NutshellCrypto

This is educational content, not financial or legal advice.

This post was written with AI assistance.

DEV Community