FINTRAC is fining money services businesses more often and for far larger amounts. This guide explains what the recent penalties were for, what changed in 2026 and the practical steps that keep an MSB on the right side of its obligations.
Complium reviews your compliance programme against FINTRAC's requirements and helps you close the gaps before an examination finds them.
- Policies, procedures and risk assessment
- Reporting processes and training
- Two-year effectiveness review
How much can FINTRAC fine an MSB?
Since 26 March 2026, a single very serious violation can cost an MSB up to $20 million. The change came with Bill C-12, which amended the Proceeds of Crime (Money Laundering) and Terrorist Financing Act and, in FINTRAC's words, increased its penalties "by up to 40 times".
The Administrative Monetary Penalties Regulations set three ranges per violation:
| Type of violation | Range before March 2026 | Range since March 2026 |
|---|---|---|
| Minor | $1 to $1,000 | $1 to $40,000 |
| Serious | $1 to $100,000 | $1 to $4,000,000 |
| Very serious | $1 to $500,000 | $1 to $20,000,000 |
Each unreported transaction or missing record can count as a separate violation, so totals grow quickly. One penalty in 2025 covered more than 2,500 individual contraventions.
FINTRAC can now also issue compliance orders, which it must make public. Not complying with an order can lead to a penalty of up to $30 million or 3% of global revenue, whichever is greater.
The new rules also require a compliance programme to be reasonably designed, risk-based and effective. A programme that exists only as a document no longer meets the standard. See FINTRAC's summary of the legislative changes.
What have MSBs been fined for?
FINTRAC publishes every penalty in its public notices of administrative monetary penalties, including the business's name. The notices published since early 2025 show a clear pattern across MSBs of every size, from large crypto platforms to small currency exchange offices.
| Type of business | Penalty (CAD) | Main violations |
|---|---|---|
| Virtual currency platform | $176,960,190 | 1,068 suspicious transactions not reported (including links to darknet markets, ransomware and sanctions evasion), Iran ministerial directive not followed, weak policies and risk assessment, 1,518 large virtual currency transactions not reported |
| Foreign virtual currency exchange | $19,552,000 | Not registered with FINTRAC as a foreign MSB, 2,952 large virtual currency transactions and 33 suspicious transactions not reported |
| Virtual currency MSB | $693,742.50 | Suspicious transactions not reported, enhanced measures for high-risk clients not applied in practice, weak policies and risk assessment, record-keeping gaps |
| Foreign payments and crypto business | $536,853.35 | Incoming international transfers of $10,000 or more not reported, suspicious attempted transactions not reported, weak policies and risk assessment |
| Currency exchange | $348,067.50 | No compliance officer appointed, suspicious and large cash transactions not reported, transfers not reported, training not documented, two-year review not done |
| Money transfer business | $224,235 | Transfer reports filed late, Iran ministerial directive reports not filed, incomplete policies and risk assessment |
| Currency exchange | $70,537.50 | Records not provided when FINTRAC asked for them, gaps in all parts of the compliance programme |
| Money transfer business | $67,150 | Incomplete transfer and cash reports, registration change not reported |
| Currency exchange | $24,750 | Registration not updated after a change of legal name and address |
Several of these businesses have appealed to the Federal Court, so some amounts may still change. The pattern is the useful part: almost every case combines a reporting failure with a compliance programme that did not work in practice.
Which mistakes lead to most penalties?
Not reporting suspicious transactions
A suspicious transaction report has no minimum amount and must be submitted as soon as practicable. It also covers attempted transactions: declining a suspicious payment does not remove the duty to report it. Missed suspicious transaction reports are classed as very serious violations and appear in nearly all of the larger penalties in the table above.
Late or incomplete transaction reports
Electronic funds transfers of $10,000 or more must be reported within five working days, and several smaller transactions within 24 hours can add up to a reportable amount under the 24-hour rule. Reports filed late or with missing fields are violations in their own right.
A compliance programme that is not applied
Weak written policies and an incomplete risk assessment appear in almost every case. In one case the business had no compliance officer at all. In another, the policies required enhanced measures for high-risk clients, but staff did not carry them out. FINTRAC checks how the programme works in practice.
Ignoring ministerial directives
Two penalties included failures to follow the ministerial directive on transactions involving Iran, which requires every transaction originating from or bound for Iran, regardless of amount, to be treated as high risk and reported to FINTRAC. Onboarding checks and transaction monitoring both need to screen for links to Iran.
Registration details out of date
Changes to registration information must be reported within 30 days. Three businesses were penalised for missing this deadline, and for one of them it was the only violation.
Serving Canada without registering
A business without a place of business in Canada that directs money services at Canadian clients must register as a foreign MSB before it starts. Operating without registration led to one of the largest penalties in the list.
Why do MSBs lose their registration?
In 2025-26 FINTRAC revoked the registrations of 82 money services businesses, up from 12 the year before. According to its 2025-26 annual report, the revocations were for not responding to clarification requests or demands for information.
FINTRAC gives a business 30 days to answer a clarification request. Losing a registration means the business must stop offering money services until it registers again, and banks and payment partners check the public registry. A monitored compliance mailbox and a named person responsible for FINTRAC correspondence prevent most of these cases.
How can an MSB avoid a penalty?
The compliance programme requirements are the same for every MSB. These steps address the gaps found in the recent penalties.
1. Appoint a compliance officer with real authority
The compliance officer needs the time, resources and access to management to run the programme. For smaller MSBs, an outsourced compliance officer can fill the role.
2. Write procedures that match how the business works
Policies should describe your actual products, clients and transaction flows. Test whether staff follow them, especially the enhanced measures required for high-risk clients.
3. Keep the risk assessment current
Document your risks by client, product, geography and delivery channel, and update the assessment when the business changes.
4. Make suspicious transaction reporting routine
Set clear escalation steps, include attempted and declined transactions, and keep a record of every decision not to report.
5. Check reporting deadlines and completeness
Track every report against its deadline, including large cash, large virtual currency and electronic funds transfer reports. Sample completed reports regularly for missing fields.
6. Train staff and document it
An ongoing, written training programme must reach everyone who deals with clients or processes transactions, including new staff.
7. Run the two-year effectiveness review
The review must take place at least every two years and test whether the programme works. An independent effectiveness review often finds the same issues FINTRAC would.
8. Keep registration and correspondence in order
Report changes within 30 days, answer clarification requests on time and keep records ready to provide within 30 days of a request.
Our guide to Canadian MSB AML reporting requirements sets out each report, the amount that triggers it and the deadline for filing.
How Complium can support your MSB
Complium works with Canadian and Foreign MSBs on the parts of the compliance programme where the recent penalties were found. We can review your programme before an examination, take on the compliance officer role, train your staff and carry out the two-year effectiveness review. Start with our Canadian compliance services or tell us about your business.
Frequently Asked Questions
Does FINTRAC publish the names of penalised MSBs?
Yes. FINTRAC publishes a public notice for each penalty with the business's name, the amount and the violations. A penalty therefore also affects relationships with banks and payment partners.
What is the maximum FINTRAC penalty for an MSB?
Since March 2026, up to $20 million for a single very serious violation committed by an entity. Ignoring a compliance order can lead to a higher penalty: up to $30 million or 3% of global revenue.
Can an MSB be penalised without any money laundering taking place?
Yes. Penalties are for failing to meet obligations, such as missing reports, weak procedures or out-of-date registration details. Proof of money laundering is not required.
Can a FINTRAC penalty be appealed?
Yes. A business can make representations to FINTRAC before a penalty is confirmed and can appeal a final decision to the Federal Court. Several recent MSB penalties are under appeal.
Do suspicious attempted transactions have to be reported?
Yes. A suspicious transaction report is required even if the transaction was declined or never completed. Failing to report attempted transactions was part of a recent penalty.
How often must an MSB review its compliance programme?
At least every two years, through a documented effectiveness review. The policies, risk assessment and training should also be updated whenever the business or the rules change.
Talk to Complium's compliance team about a review of your programme, reporting and registration before FINTRAC looks at them.
