Canadian Money Services Businesses have ongoing anti-money laundering and anti-terrorist financing obligations that extend well beyond registering with FINTRAC.
The reporting framework covers suspicious transactions, large cash and virtual currency transactions, certain international electronic funds transfers and other specific reporting events. At the same time, MSBs must maintain extensive transaction records, apply KYC and ongoing monitoring controls, implement the Travel Rule where applicable and maintain an effective AML compliance framework.
Complium supports Canadian MSBs with AML policies and controls, reporting procedures, Compliance Officer support, staff training and independent effectiveness reviews.
- AML policies and risk assessments
- FINTRAC reporting and recordkeeping readiness
- Compliance Officer support
- Two-year effectiveness reviews
- Main FINTRAC reports for Canadian MSBs
- How the 24-hour rule works
- Recordkeeping requirements below reporting thresholds
- Virtual currency and the Travel Rule
- KYC and ongoing monitoring
- The wider AML compliance framework
- Common compliance mistakes
- How Complium can support Canadian MSBs
What Reports May a Canadian MSB Need to File?
The exact reporting obligations depend on the services an MSB provides and the transactions it processes.
Some of the principal FINTRAC reports include the following.
Suspicious Transaction Reports
An MSB must submit a Suspicious Transaction Report, or STR, when it has reasonable grounds to suspect that a completed or attempted transaction is related to money laundering, terrorist activity financing or sanctions evasion.
There is no CAD 10,000 threshold for an STR. A lower-value transaction can still create a reporting obligation if the required level of suspicion is reached. FINTRAC expects the reporting entity to consider the facts, context, relevant indicators and sanctions-evasion characteristics surrounding the transaction.
Large Cash Transaction Reports
An MSB may need to file a Large Cash Transaction Report when it receives CAD 10,000 or more in cash, either in a single transaction or through transactions that meet FINTRAC’s applicable aggregation rules.
A corresponding large cash transaction record must also be maintained.
Large Virtual Currency Transaction Reports
An MSB that receives virtual currency equivalent to CAD 10,000 or more may need to file a Large Virtual Currency Transaction Report.
The obligation can arise from a single transaction or from multiple transactions that reach the threshold under the 24-hour rule.
Electronic Funds Transfer Reports
Certain international electronic funds transfers of CAD 10,000 or more must be reported to FINTRAC.
For Canadian MSBs, the rules distinguish between initiating and finally receiving an international EFT and contain specific requirements for determining when the transfer is considered international and reportable.
Listed Person or Entity Property Reports
Reporting obligations may also arise where an MSB possesses or controls property connected to a terrorist, terrorist group, listed person or entity or foreign state.
These requirements should form part of the MSB’s broader sanctions and terrorist financing controls.
The CAD 10,000 Threshold Is Not Always Transaction by Transaction
A common mistake is to assess every transaction in isolation.
FINTRAC’s 24-hour rule can require multiple transactions of the same type to be treated together where the relevant aggregation conditions are met.
The rule applies to:
- large cash transactions;
- large virtual currency transactions; and
- electronic funds transfers.
For large cash and virtual currency transactions, multiple amounts can become reportable when they total CAD 10,000 or more within a consecutive 24-hour window and meet the applicable aggregation criteria, such as being connected to the same conductor, beneficiary or third party.
This creates an operational requirement, not simply a reporting requirement.
An MSB needs systems and procedures capable of identifying related transactions across the relevant period, including where transactions occur through different channels or business locations.
Recordkeeping Obligations Can Begin Well Below CAD 10,000
A transaction does not have to generate a FINTRAC report to create a recordkeeping obligation.
This distinction is particularly important for fintech and virtual currency businesses.
Depending on the MSB’s activities, required records can include:
- copies of reports submitted to FINTRAC;
- large cash and large virtual currency transaction records;
- records relating to certain transactions of CAD 3,000 or more;
- records of remitting or transmitting CAD 1,000 or more in funds;
- electronic funds transfer records from CAD 1,000;
- virtual currency transfer records from CAD 1,000;
- foreign currency exchange transaction tickets;
- virtual currency exchange transaction tickets;
- service agreement records;
- internal memorandum records;
- transport records; and
- other activity-specific records.
FINTRAC’s MSB guidance confirms, for example, that records are required for international EFTs of CAD 1,000 or more and certain virtual currency transfers of CAD 1,000 or more, even though the principal reporting threshold for these transaction categories can be CAD 10,000.
Most relevant FINTRAC records must generally be retained for at least five years. They must also be maintained so that they can be provided to FINTRAC within 30 days of a request.
Using an external provider to maintain records does not remove the MSB’s responsibility for meeting its obligations.
Virtual Currency MSBs Have Additional Operational Requirements
Virtual currency businesses should pay particular attention to the difference between reporting thresholds and recordkeeping thresholds.
For example, records are generally required when an MSB:
- transfers virtual currency equivalent to CAD 1,000 or more; or
- receives virtual currency equivalent to CAD 1,000 or more for remittance to a beneficiary.
These records can include transaction identifiers, sending and receiving wallet addresses, account information, exchange rates and information about the client and beneficiary.
There is another important distinction for virtual currency exchanges.
FINTRAC requires a virtual currency exchange transaction ticket for every virtual currency exchange transaction, regardless of value, although additional client information requirements apply once specified thresholds are reached.
The Travel Rule
Canadian MSBs and Foreign MSBs must also apply FINTRAC’s Travel Rule to relevant electronic funds and virtual currency transfers.
For virtual currency transfers, prescribed originator and beneficiary information must accompany outgoing transfers. When receiving a transfer that should contain Travel Rule information, the MSB must take reasonable measures to obtain missing information.
The MSB must also maintain written, risk-based procedures describing what happens where required information cannot be obtained.
The Travel Rule should therefore be built into the transaction flow and monitoring framework rather than treated as a documentation exercise after the transaction has taken place.
Effective Reporting Starts with KYC and Ongoing Monitoring
An MSB cannot identify suspicious or unusual activity effectively without understanding its clients.
The reporting framework therefore connects directly to requirements including:
- identity verification;
- beneficial ownership information;
- business relationship records;
- ongoing monitoring;
- politically exposed person and head of international organisation requirements;
- third-party determinations; and
- sufficient information about the client’s occupation or business activities.
The level of detail matters.
For example, recording an occupation simply as “manager” may provide very little information about what activity would be expected from that client. More specific information about the client’s role, industry and business can make transaction monitoring significantly more meaningful.
The objective is to create a connected process:
KYC → risk assessment → ongoing monitoring → detection → investigation → reporting → recordkeeping
Reporting Is Only One Part of the AML Compliance Framework
Every reporting entity subject to FINTRAC requirements must establish and implement a compliance program.
FINTRAC identifies five core elements:
- an appointed Compliance Officer;
- written and up-to-date policies and procedures;
- a documented business risk assessment;
- an ongoing compliance training program and training plan; and
- a plan for testing the effectiveness of the compliance program, with a review carried out at least every two years.
The risk assessment should reflect the business itself, including its customers, products, services, delivery channels, geographic exposure, technology and other relevant risks.
A generic policy template is therefore not enough.
FINTRAC’s assessment approach looks not only at whether the required documents exist, but also whether the compliance program is implemented effectively in practice.
The Two-Year Effectiveness Review
The effectiveness review must be conducted at least every two years and should test whether the MSB’s policies and procedures, risk assessment and training arrangements actually work.
The review can examine areas such as:
- whether transaction reporting procedures operate correctly;
- whether required records are being maintained;
- whether high-risk clients receive appropriate enhanced controls;
- whether the risk assessment reflects current operations;
- whether policies reflect current regulatory requirements; and
- whether employees understand and follow the procedures.
FINTRAC states that the review must test effectiveness rather than simply confirm that documents exist.
Common AML Reporting Mistakes for Canadian MSBs
Treating CAD 10,000 as the only relevant threshold
Suspicious Transaction Reports do not depend on reaching CAD 10,000, and important recordkeeping requirements can begin at lower transaction values.
Monitoring individual transactions only
Systems that look only for single transactions above CAD 10,000 may fail to identify transactions that become reportable under the 24-hour rule.
Treating reporting and recordkeeping as the same obligation
A transaction can create a recordkeeping requirement even where no FINTRAC report is required.
Failing to adapt AML controls to the actual business
Policies should reflect the company’s real products, customers, jurisdictions, transaction flows and technology.
Treating virtual currency like ordinary fiat payments
Virtual currency businesses can face specific wallet, transaction identifier, recordkeeping and Travel Rule requirements.
Assuming no reports means no compliance activity
An MSB may legitimately have a period in which no reportable transactions occur.
It should nevertheless be able to demonstrate that its systems, monitoring and escalation processes would have identified a reporting trigger if one had arisen.
How Complium Supports Canadian MSBs
Complium supports MSBs with the wider compliance framework behind FINTRAC reporting.
Our support can include:
- reviewing the business model and applicable reporting obligations;
- preparing or updating AML policies and procedures;
- developing the business risk assessment;
- designing KYC, monitoring, recordkeeping and reporting procedures;
- supporting the Compliance Officer function;
- preparing AML training;
- reviewing reporting readiness and operational controls; and
- coordinating or conducting independent effectiveness reviews where appropriate.
The objective is to connect the MSB’s written framework with the way transactions and client relationships are handled in practice.
Frequently Asked Questions
Does every transaction above CAD 10,000 need to be reported to FINTRAC?
Not necessarily. The reporting requirement depends on the type of transaction and the applicable FINTRAC rules. Large cash and large virtual currency receipts and certain international EFTs can trigger CAD 10,000 reporting requirements.
Is there a minimum threshold for a Suspicious Transaction Report?
No fixed monetary threshold applies. An STR is required when the MSB reaches reasonable grounds to suspect that a completed or attempted transaction is connected to money laundering, terrorist activity financing or sanctions evasion.
Do MSBs need to keep records for transactions below CAD 10,000?
Yes. Depending on the activity, recordkeeping requirements can begin at CAD 1,000 or CAD 3,000, and some transaction-ticket requirements apply regardless of transaction value.
How long must FINTRAC records be retained?
Many prescribed MSB records must generally be retained for at least five years. The applicable period depends on the particular record.
How often must an MSB complete an effectiveness review?
At least every two years. FINTRAC requires the review to test the effectiveness of the policies and procedures, risk assessment and ongoing training program.
Can Complium support ongoing AML compliance after MSB registration?
Yes. Complium can support AML policies, risk assessments, reporting procedures, Compliance Officer functions, training and effectiveness reviews, depending on the client’s requirements.
Complium provides legal and compliance support for Canadian MSBs, from AML framework implementation and reporting readiness to ongoing compliance and independent effectiveness reviews.
