Security & Compliance

Built for regulators, not around them.

Money movement is a licensed activity and we treat it as one. This page states exactly where our registration stands, how funds are held, what we check before a transfer moves, and what we do with your data. If something here is unclear, that is a defect — tell us.

FINTRAC MSB
Approval Pending

Application filed. No customer funds move until it is approved.

Incorporation
ABCA · Alberta

Coynitt Canada Inc., Corporate Access No. 2027982756.

Settlement
Coinbase Base L2

Every transfer, contribution and payout is recorded on-chain.

Data residency
Canada

Identity and transaction records held in Canadian regions, encrypted at rest.

Regulatory Standing

What is registered, what is pending, and what that means today.

RegistrationWhat it coversStatus
FINTRAC MSBMoney services business registration for foreign exchange dealing and money transferring in Canada.Approval Pending
Alberta ABCACorporate registration; Coynitt Canada Inc., Corporate Access No. 2027982756.Registered
CRA business numberTax registration for the operating company (BN 796629178).Registered
Payout partnersEach local partner holds its own licence in its market; we hold due diligence on file for every one.In diligence
Provincial money transmissionReviewed per province as retail volume begins; Quebec requires separate treatment.Under review
Coynitt is not yet moving customer funds. Until FINTRAC MSB registration is approved, activity is limited to partner sandbox testing on live corridors with our own capital.
How Funds Are Held

Your balance is not our working capital.

Customer funds sit separate from company funds, reconciled daily against the on-chain ledger. We do not lend against balances, we do not earn a spread by holding your money longer, and a Round's contributions are held by its contract rather than by an organiser.

Funds in flight sit in Coynitt-controlled addresses and in smart contracts that Coynitt's systems sign for. Coynitt is not a bank and balances are not covered by CDIC deposit insurance. What protects them is segregation, daily reconciliation and a ledger that cannot be quietly edited.

Segregated

Customer balances are held apart from operating funds and reconciled to the ledger every day.

Not lent out

We do not lend, stake or invest customer balances. There is no yield product hiding inside the wallet.

Contract-held pools

Rounds contributions and Harambee funds sit in their contracts rather than in an organiser's personal account.

Not deposit insurance

Coynitt is not a bank. Balances are not CDIC insured, and we say so wherever a balance is shown.

AML & KYC Programme

One verification, then checks the user never has to think about.

The programme below is built and exercised against test transactions today. It goes live against customer transactions when our FINTRAC MSB registration is approved.

01
Identity verification

Government ID plus liveness check at signup, matched against the name on the funding account.

02
Sanctions screening

Sender, recipient and beneficiary screened against Canadian, UN, UK and US lists before a transfer routes.

03
Source of funds

Requested where amounts or patterns require it, with clear thresholds rather than arbitrary holds.

04
Transaction monitoring

Behavioural monitoring for structuring, mule patterns and corridor anomalies, reviewed by a human before any account action.

05
Reporting

Large cash, large virtual currency, EFT and suspicious transaction reports filed as Canadian law requires.

06
Record keeping

Verification records and transaction detail retained for the statutory period, then deleted on schedule.

Technical Security

Keys, contracts and the parts we deliberately keep boring.

Settlement runs on Coinbase Base L2. Contracts are written to be small and readable rather than clever, and every change to a live contract is published before it takes effect.

Coynitt does not publish the internals of its routing intelligence. Everything that touches custody, keys and settlement is documented here in full.

Settlement layerCoinbase Base L2, with transaction hashes exposed on every receipt.
Key managementHardware-backed key custody for settlement addresses, with least-privilege internal access and every signing action logged.
Contract changesLive contracts are open-source and versioned; any change is published before it takes effect.
AuditsIndependent contract review before mainnet launch; findings and fixes published.
Access controlLeast-privilege internal access, hardware 2FA required, every production action logged.
RecoveryWallet recovery by identity verification, with a cooling-off period on new payout destinations.
Your Data

Kept because the law says so, not because it is useful to us.

We hold identity documents and transaction records for the period Canadian AML law requires, encrypted at rest, in Canadian data residency. We do not sell data, we do not run advertising, and we do not share transaction detail with third parties except where a law or a lawful order requires it.

Members in the UK and EU are covered by UK GDPR and GDPR rights; Canadian members by PIPEDA. Access, correction and erasure requests go to one address and are answered inside thirty days.

What we holdIdentity documents, verification results, transaction records, device and session metadata.
Where it livesCanadian data residency, encrypted at rest and in transit.
How longFive years after the last transaction or account closure, as Canadian AML law requires.
Who sees itOur compliance function, our verification and payout partners for their part, and authorities under lawful order.
What we never doSell data, run advertising against it, or use transaction detail for anything but running and policing the service.
Your rightsAccess, correction, portability and erasure where retention law allows — answered inside thirty days.
Responsible Disclosure

Found something? We would rather hear it from you.

Report a vulnerability to security@coynitt.ca with enough detail to reproduce it. We acknowledge inside one business day, keep you updated while we fix it, and credit reporters who want the credit. No legal action against good-faith research.

Vulnerability reportssecurity@coynitt.ca
Compliance and AMLcompliance@coynitt.ca
Privacy requestsprivacy@coynitt.ca
Questions

The ones a regulator asks, and the ones a mother asks.

Can I use Coynitt today?

Not with real money. Our FINTRAC MSB registration is Approval Pending, and we are in partner sandbox testing. Waitlist members are invited as corridors open.

Is my balance insured?

No. Coynitt is not a bank and balances are not covered by CDIC. Funds are segregated, reconciled daily and recorded on-chain instead.

Why does a payment app need my ID?

Canadian law requires a money services business to verify who is sending, and sanctions screening only works against a verified name. One verification covers Transfers, Rounds and Harambee.

Do you hold cryptocurrency for me?

No. Value moves on-chain during settlement, but you hold and see Canadian dollars, and recipients receive local currency.

What happens if Coynitt shuts down?

Customer funds are held separately from operating funds specifically so they can be returned, and the on-chain ledger remains readable independently of us.

Will you freeze my transfer?

Only where law requires a hold or monitoring flags a genuine risk. You will be told there is a review, and a human reviews it — not only a model.

FINTRAC MSB · Approval Pending
Incorporated under the Alberta Business Corporations Act
Settlement recorded on Coinbase Base L2
Read the compliance detail →
Want First Access?

Be the first through the door.

Our FINTRAC MSB registration is Approval Pending, and we're running partner sandbox testing. Drop your email and we'll send you an early-access invite the day Coynitt opens — before we tell anyone else.

#BecauseLoveShouldntCostExtra