Money-services businesses (MSBs) must maintain and update the following records and registers:

• a register of the transactions they have conducted containing, among other things, the basic customer identification information and the information shown under the heading "Information that has to be recorded in the registers" below;
• the records needed to identify their sources of liquidity;
• an accounting register containing a balance sheet and an income statement;
• a register of accounts and bank reconciliation reports;
• a record containing the name, home address and telephone number, and duties of each of its officers, directors, partners and employees;
• a record containing the originals of all documents sent to Revenu Québec;
• a record containing information that will allow the MSB to verify the identity of co-contracting parties related to money-services activities;
• any other record or register prescribed by regulation.

Information that has to be recorded in the registers

The following information has to be recorded in the transaction registers:

• the date, time, amount and nature of a transaction;
• the currency and payment method for a currency exchange transaction;
• a comment on how an amount was received (in cash or another form) for a transaction involving the issue of a traveller's cheque, money order or bank draft;
• the name of the issuer, for a transaction involving the redemption of a traveller's cheque, a money order or a bank draft;
• the funds transfer instructions and the recipient's name for a funds transfer transaction of $1,000 or more;
• the following information for a transaction made through a cryptoasset automated teller machine (cryptoasset ATM):
  • the type of legal tender and the type of cryptoasset involved in the transaction,
  • the method of payment used for the transaction,
  • the rates of exchange used for the transaction and their source, if applicable,
  • the number of each bank account or cryptoasset portfolio affected by the transaction,
  • the type of bank account or cryptoasset portfolio and the name of its holder,
  • the reference numbers related to the transaction,
  • the identifiers involved in the transaction, including the sending address and the receiving address.

Where records and registers must be kept

All records and registers must be kept in Québec and be readily available to Revenu Québec. If an MSB's head office is situated outside Québec, the information the records and registers contain must be available at an establishment of the MSB in Québec or in any other place designated by Revenu Québec. The MSB must provide technical assistance to facilitate inspection of the information.

The records and registers must be maintained in such a manner so as to allow auditing.

The MSB must adopt effective means to ensure the protection of personal information, whether the information is kept on paper or electronically.

Ensuring information security

Below are suggestions for good security practices:

• Prevent the theft or loss of information on paper:
  • Lock filing cabinets that contain sensitive information.
  • Limit access to staff members authorized to conduct financial transactions.
  • Install an alarm system or a surveillance camera.
• Prevent data loss and reduce exposure to IT risk:
  • Update software and antiviruses.
  • Regularly change passwords on devices and in software.
  • Install an automatic computer locking system.
• Secure the Internet and Wi-Fi access.
• Make frequent backup copies of data and save them in a secure location.

Retention of information

The MSB must keep its customer information for six years after the information was gathered.

If the money-services business has ceased its activities, we may ask you to turn its files, books and registers over to us for disposal.

Secure destruction

The MSB can destroy the information it has on file following the six-year mandatory preservation period.

The MSB has to use an effective, secure method to destroy the information. Effective, secure destruction methods include: 

• shredding;
• data destruction software;
• chemical data destruction;
• magnetic data destruction (for example, a demagnetizer for hard drives).