Key takeaways
- The Controlled Goods Program (CGP) separates two different addresses: the business address Public Services and Procurement Canada holds for the registrant on file, and the security-assessed site(s) where controlled goods are actually examined, possessed, or transferred.
- Eligibility runs on two tracks: the business must be incorporated in Canada or otherwise authorized to carry on business here, while the individuals behind it — the designated official, the authorized individual, and owners of 20% or more of the voting shares — must be Canadian citizens or permanent residents who pass a security assessment. The address proves where the business is established, not where controlled goods are handled.
- A virtual business address fits the registrant-and-correspondence side cleanly but never the security-assessed premises side — and being honest about that line is the whole point of this guide.
- The CGP is a federal security registration under the Defence Production Act, administered by Public Services and Procurement Canada — a regime separate from a CBSA import-export (CARM / RM) registration. Do not conflate the two.
Short answer: which address the Controlled Goods Program asks for
To register in the Controlled Goods Program (CGP), a business gives Public Services and Procurement Canada (PSPC), the department that runs the program, a business address for the registrant — the legal person who holds the registration. That address is a Canadian address that receives the program's correspondence: registration decisions, renewal notices, and security-related instructions.
But the registrant's business address is only one half of the address picture, and it is the half people focus on by mistake. The program exists because of what the registrant does with controlled goods — examine, possess, or transfer them — and every location where that happens is a security-assessed site governed by a security plan. The address on the registration record and the site where controlled goods physically sit are two different things with two different requirements.
So the practical question is not "what address do I put on the application" but "which address is the registrant's business address of record, and which locations have to be security-assessed premises — and can a virtual address fill either one?" It can fill the first cleanly. It can never fill the second. The rest of this guide is about exactly where that line falls.
The two addresses the CGP keeps apart
A registered business does not have one address in the eyes of the Controlled Goods Program. It has, at minimum, two distinct ones, and collapsing them is the single most common planning error.
| Registrant business address | Security-assessed site(s) | |
|---|---|---|
| What it is | The Canadian business address PSPC holds for the registered person | The physical location(s) where controlled goods are examined, possessed, or transferred |
| What it proves | The entity is established in Canada and can be reached | There is a real, secured place handling controlled goods under a security plan |
| PO box | Not appropriate for an established business address | Not applicable — controlled goods need real, secured premises |
| Can a virtual address fill it | Yes — a real commercial Toronto or Vancouver address in proper Canada Post Unit/# format, scanned same-day | No — a virtual address is not a security-assessed location and must never be presented as one |
| What governs it | The registration record and PSPC correspondence | The registrant's security plan and PSPC security assessment |
The left column is an address-on-file requirement. It asks for a genuine Canadian business address where the registered person is established and where program mail reliably lands. The right column is a security requirement: a place where access to controlled goods is controlled, where storage is secured, and where the people with access have been assessed. No address — virtual, leased-office, or otherwise — satisfies the right column on its own, because the right column is about physical security and assessed people, not about where the mail goes.
Who must register, and the eligibility test
The registration requirement is triggered by the activity, not by the industry label. A business needs to register in the CGP if it needs to examine, possess, or transfer controlled goods in Canada. Controlled goods are certain goods and related technology with military or national-security significance; the specific items are set out in the schedule to the Defence Production Act, which draws on Canada's Export Control List. Because that schedule is technical and is revised, the safe move is to confirm whether what you handle is a controlled good against the program's current material rather than guessing from the name of the part.
Eligibility runs on two tracks, and keeping them apart is what makes the address logic fall out:
- The business must be incorporated under federal, provincial, or territorial law, or otherwise authorized to carry on business in Canada. This is where a genuine Canadian business address matters — the registrant has to be a real business established in Canada, with a Canadian address PSPC can hold and correspond with. A company is not a "citizen," so this track is about lawful establishment in Canada, not nationality.
- The individuals behind the business — the designated official, the authorized individual, and anyone who owns 20% or more of the voting shares or interests — must be Canadian citizens or permanent residents ordinarily resident in Canada, and must consent to and pass a security assessment. (The program has separate exemption and approval routes for some people who do not meet that test, such as certain temporary workers and visitors.)
Read together, the security side reaches the people, not just the company name on the door — and the security assessment is the part that takes the program out of "fill in an address field" territory and into vetted-people-and-premises territory.
The official requirements, application steps, and definitions live on Public Services and Procurement Canada's Controlled Goods Program pages, and they are updated periodically — treat them as the source of record, not a memorised checklist.
The Designated Official and the security plan — why physical premises are unavoidable
This is the heart of the program, and the reason a registration cannot be run from a desk and a mailbox alone.
Every business registered in the CGP must appoint a Designated Official (DO) — the person responsible for the registrant's security obligations. Among those obligations, the registrant must develop and maintain a security plan: a documented set of measures covering how controlled goods are stored, who has access to them, how visitors and employees are assessed before they are given access, and how security breaches are recorded and reported. The Designated Official is also central to the security assessments of the people who will examine, possess, or transfer controlled goods.
Put those pieces together and the physical reality is inescapable. A security plan has to describe a real location: a place with controlled access, secure storage, and a perimeter that can actually be secured. The security assessment evaluates real individuals tied to that location. Neither of those attaches to an address that exists only to receive mail. A mailbox cannot store a controlled good, cannot restrict access to it, and cannot be the subject of a meaningful physical-security plan. The instant controlled goods are physically present, the program expects a site that has been assessed and secured — full stop.
This is the same honest limit that shows up across Canada's location-bound regimes, and it is worth naming because over-promising here causes real problems. A licensed motor vehicle dealer needs a real, inspectable place of business that a registry can attend; a vaping manufacturer needs a real premises where excise stamps are physically applied. The CGP belongs in that family: the registrant's business address is one thing, and the secured location where regulated activity physically happens is another. A virtual business address answers the first. It was never built to answer the second, and anyone telling you otherwise is setting you up for a problem at the assessment stage.
Where a virtual business address actually fits
Here is the distinction laid out directly, because getting it right is the difference between a clean registration and a misframed one.
A commercial virtual business address — built around real downtown Toronto and Vancouver properties, issued in proper Canada Post Unit/# format, and scanned the same day — fits the registrant-and-correspondence side:
- It is a genuine Canadian business address for a business conducting business in Canada, not a PO box and not a mailbox number dressed up as a suite — so it can serve as the registered person's business address of record.
- It receives PSPC correspondence about the registration, renewals, and security instructions, scanned promptly so a time-sensitive program notice is not sitting unread.
- It keeps the registrant's business address consistent with the rest of the corporate file — the same Canadian street address can sit on the incorporation record and the CRA Business Number record, so the entity's identity is coherent across federal systems. (For the underlying mechanics of that identifier, see Do Canadian small businesses need a Business Number?.)
- It does this without putting a residential address on a federal security file — a real concern for a founder running an early-stage operation from home.
What it cannot do is fill the security-assessed-premises side. If your operation examines, possesses, or transfers controlled goods, those locations are real, secured sites under your security plan, identified and assessed through the program — not a correspondence address. We would rather say that plainly than let an applicant over-rely on a mailing address and run into the security assessment unprepared. The clean way to plan it: use the commercial address for the registrant's business-address and correspondence requirement, and treat each location that actually handles controlled goods as a separate, physical, security-assessed line item.
Because the program does not publish a one-size-fits-all list of acceptable address formats for every situation, confirm your specific setup with the Controlled Goods Program when you apply, and follow the current guidance on canada.ca rather than an older summary.
The CGP is not a CBSA import-export registration
This is the confusion worth heading off, because both involve "goods" and "registration" and both ask for a business address — but they are entirely separate regimes run by different parts of the federal government.
| Controlled Goods Program | Import-export (CBSA) | |
|---|---|---|
| Run by | Public Services and Procurement Canada | Canada Border Services Agency (with the CRA for the program account) |
| Legal basis | Defence Production Act and the Controlled Goods Regulations | Customs Act and related CBSA framework |
| What it controls | Security access to controlled goods inside Canada | Commercial movement of goods across the border, duties, and taxes |
| The registration | CGP registration plus a security assessment | An RM program account on your Business Number, and registration in the CARM Client Portal |
| Turns on | A security plan, a Designated Official, and assessed people and premises | A consistent Canadian business address across the RM account and CARM portal |
A business can be in both — for example, a Canadian firm that imports a strategic component (a CBSA / CARM matter) and also examines or stores it as a controlled good (a CGP matter). But registering in one does not register you in the other, and the address that satisfies a CBSA import-export record is not what satisfies a CGP security assessment. If your question is really about importing and exporting commercial goods, duties, and the customs paperwork, that is a different article: see the import-export business address guide for the RM account and CARM Client Portal side.
One more note for anyone arriving from a US defence-trade compliance background: do not assume that framework transfers. Canada runs its own program under the Defence Production Act, administered by Public Services and Procurement Canada, with its own definitions, its own registration, and its own security assessment. The concepts do not map one-to-one, and treating a foreign regime as interchangeable with the CGP produces incorrect assumptions. Confirm Canadian requirements against the Controlled Goods Program's primary material.
FAQ
Can a virtual business address satisfy the Controlled Goods Program's address requirement?
For the registrant's business-address-on-file, yes — a real commercial virtual address in proper Canada Post Unit/# format is a genuine Canadian business address, not a PO box, so it can serve as the registered person's business address of record and as the place PSPC correspondence reliably reaches you. What it cannot do is serve as a location where controlled goods are examined, possessed, or transferred. Those are security-assessed sites under your security plan, and a mailing address cannot stand in for one. Use the virtual address for the registrant and correspondence requirement, and plan each controlled-goods location separately. Always confirm your setup with the Controlled Goods Program and the current guidance on canada.ca.
Who has to register in the Controlled Goods Program in Canada?
A business needs to register if it needs to examine, possess, or transfer controlled goods in Canada — goods with military or national-security significance set out in the schedule to the Defence Production Act. To register, the business must be incorporated in Canada or otherwise authorized to carry on business here, and the individuals behind it — the designated official, the authorized individual, and owners of 20% or more of the voting shares — must be Canadian citizens or permanent residents who pass a security assessment. The business must also appoint a Designated Official responsible for its security plan. Whether a specific part or technology is a controlled good is a technical question, so confirm it against the program's current material rather than assuming from the product name.
Is Controlled Goods Program registration the same as an import-export registration?
No. The Controlled Goods Program is a security registration run by Public Services and Procurement Canada under the Defence Production Act, focused on access to controlled goods inside Canada. An import-export registration is a Canada Border Services Agency matter — an RM program account on your Business Number plus registration in the CARM Client Portal — focused on moving commercial goods across the border and accounting for duties and taxes. A business can need both, but they are separate registrations with separate requirements, and the address that works for one does not automatically satisfy the other.
Bottom line
Controlled Goods Program registration has a precise two-part address story, and most of the confusion comes from blurring it. On one side is the registrant's business address — the Canadian business address PSPC holds for the registered person and where program correspondence lands. A commercial business address can satisfy that cleanly. On the other side are the security-assessed sites — the real, secured locations where controlled goods are examined, possessed, or transferred, governed by a security plan and tied to assessed people. No address, virtual or otherwise, substitutes for those.
A commercial virtual business address in Toronto or Vancouver — issued in proper Canada Post Unit/# format from a real downtown property, scanned same-day, and stable across moves — fits the establishment-and-correspondence side of a CGP registration and keeps a residential address off a federal security file. What it will never be is a security-assessed premises, and we say that plainly because the honesty is worth more than the upsell.
If your Canadian business needs a real business address in Toronto or Vancouver for its registration record and CRA Business Number, reserve an Auteur address — both are real, Canadian-owned downtown properties in proper Canada Post unit format, scanned same-day. If your operation also moves goods across the border, the customs and CRA program-account picture is walked through in our import-export business address guide. And for founders comparing this to another special federal registration that turns heavily on a qualifying address — a structurally similar but legally separate regime — see how the FINTRAC money services business rule works.