What Is FINTRAC? Reporting Duties and 2026 Penalties

What is FINTRAC? The Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) is Canada's financial intelligence unit and its anti-money laundering and anti-terrorist financing supervisor. It receives reports from banks, money services businesses, real estate brokers, casinos, securities dealers and the other businesses covered by the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA), checks that those businesses comply, and passes financial intelligence to police and national security agencies.

For a business owner or executive, the useful question is narrower: does the Act apply to us, what must we report, and what happens if we get it wrong? The answer to the last part changed in 2026. The Strengthening Canada's Immigration System and Borders Act (Bill C-12) received Royal Assent on March 26, 2026 and raised the maximum penalties under the PCMLTFA sharply. This guide explains FINTRAC's role, the businesses it supervises, the reports they file, the compliance program they must run and the penalty rules as they stand in October 2026, with a short comparison to the US system for companies that operate on both sides of the border.

Quick answer

FINTRAC is Canada's financial intelligence unit and anti-money laundering supervisor. Businesses covered by the PCMLTFA, such as banks, money services businesses, real estate brokers, casinos and securities dealers, must run a compliance program, verify clients, keep records and report suspicious transactions and certain transactions of $10,000 or more. Maximum penalties rose sharply on March 26, 2026.

What does FINTRAC do?

FINTRAC has two jobs. The first is supervision: according to its own mandate page, it ensures that businesses subject to the PCMLTFA and its Regulations comply with them. The second is intelligence: it analyzes the reports those businesses file and, when it has reasonable grounds to suspect the information would be relevant to investigating money laundering, terrorist activity financing or threats to the security of Canada, it discloses designated information to the agencies the Act lists. FINTRAC names the recipients as the RCMP, provincial and municipal police, CSIS, the Canada Revenue Agency, Immigration, Refugees and Citizenship Canada and foreign financial intelligence units with which it has an information-sharing agreement.

FINTRAC is headquartered in Ottawa, with regional offices in Montréal, Toronto and Vancouver, and it reports to the Minister of Finance. It acts at arm's length from the police. Its 2024 to 2025 annual report states that FINTRAC does not have direct access to the bank accounts of Canadians; it receives information from businesses only as the Act specifies. Its mandate page adds that a financial transaction report is kept for ten years and must be destroyed if it was never disclosed.

The FINTRAC annual report for 2024 to 2025 gives a sense of scale. FINTRAC generated 6,236 financial intelligence disclosure packages based on 2,730 unique disclosures, carried out more than 1,300 assessment activities, completed 294 formal examinations (the most examined sectors were money services businesses, dealers in precious metals and precious stones, and credit unions), issued 23 Notices of Violation worth more than $25 million, and referred 32 cases of non-compliance to law enforcement, up from 14 the year before.

Since 2024, the suspicious transaction duty in section 7 of the Act also covers transactions that may relate to a sanctions evasion offence. That links FINTRAC reporting directly to Canadian sanctions screening, which our guide to the Canada sanctions list and its permits covers in detail.

Which businesses must report to FINTRAC?

The Act does not apply to every business in Canada. Section 5 of the Proceeds of Crime (Money Laundering) and Terrorist Financing Act lists the persons and entities it covers, and the Regulations add prescribed businesses and professions. In summary, the Act reaches:

• Financial entities: banks and authorized foreign banks, credit unions and caisses populaires, and trust and loan companies.
• Life insurance: life insurance companies regulated federally or provincially.
• Securities: persons and entities authorized under provincial law to deal in securities or to provide portfolio management or investment advice.
• Money services businesses: businesses in Canada that deal in foreign exchange, remit or transmit funds, issue or redeem money orders and similar instruments, transport currency, deal in virtual currencies or provide acquirer services for private automated banking machines.
• Foreign money services businesses: businesses with no place of business in Canada that provide those services to clients in Canada and direct them at people or entities in Canada.
• Casinos: provincial lottery corporations and certain organizations that run casinos.
• Prescribed sectors: businesses named in the Regulations. FINTRAC's mandate page names real estate brokers and sales representatives, its public penalty notices include accounting firms and dealers in precious metals and precious stones, and factors have been covered since April 1, 2025.

Two details matter in practice. First, employees of these businesses are themselves covered for suspicious transaction reporting under paragraph 5(m). Second, section 10.1 provides that the suspicious transaction and section 9 reporting duties do not apply to legal counsel or legal firms when they are providing legal services.

Money services businesses, including foreign ones, carry an extra duty: section 11.1 requires them to register with FINTRAC, and knowingly carrying on an activity without being registered is an offence under section 77.4. Bill C-12 also adds a new requirement for most other reporting entities to enrol with FINTRAC, but the Justice Laws consolidation of the Act, current to September 21, 2026, still lists the enrolment provisions as amendments not yet in force. A business should watch for the date FINTRAC announces.

What reports must a reporting entity file?

A reporting entity files a suspicious transaction report whatever the amount, and most other reports start at $10,000. The table summarizes the main FINTRAC reporting requirements and their deadlines.

Report	Trigger	Deadline
Suspicious transaction	Reasonable grounds to suspect, any amount	As soon as practicable
Large cash transaction	$10,000 or more in cash	15 days
Electronic funds transfer	$10,000+ into or out of Canada	5 working days
Large virtual currency	$10,000 or more received	5 working days
Casino disbursement	$10,000 or more paid out	15 days

The $10,000 thresholds are aggregated under what FINTRAC calls the 24-hour rule: two or more transactions that together reach $10,000 within 24 consecutive hours must be reported when the business knows they were conducted by or on behalf of the same person or entity, or are for the same beneficiary. Section 125 of the Regulations converts amounts in a foreign currency or a virtual currency into Canadian dollars using the published exchange rate, so the thresholds are Canadian-dollar amounts.

The suspicious transaction report has no dollar floor. FINTRAC's suspicious transaction reporting guidance explains that "as soon as practicable" means the report must be treated as a priority once the business has completed the measures that let it reach reasonable grounds to suspect, and that a longer delay calls for a better explanation. Section 8 of the Act forbids disclosing that a suspicious transaction report has been or will be made, or its contents, with the intent to prejudice a criminal investigation. Section 10 protects anyone who reports in good faith from criminal and civil proceedings.

Records count as much as reports. Section 148 of the Regulations requires most records to be kept for at least five years, and section 149 requires them to be produced to FINTRAC within 30 days of a request.

Figure 1 shows how lopsided the volume is. In the 2024 to 2025 fiscal year FINTRAC received 61,170,154 electronic funds transfer reports, 2,898,347 large cash transaction reports, 633,882 suspicious transaction reports, 263,568 casino disbursement reports and 137,105 large virtual currency transaction reports, according to Annex A of its annual report. Suspicious transaction reports barely moved from 631,137 the year before, while electronic funds transfer reports rose from 41,587,294. The same annex records 10,270 cross-border currency and seizure reports, which travellers file with the Canada Border Services Agency when they carry $10,000 or more across the border and which the CBSA forwards to FINTRAC.

What does a FINTRAC compliance program require?

Every reporting entity must establish and implement a compliance program under subsection 9.6(1) of the Act, and the Act requires that program to be reasonably designed, risk-based and effective. Section 156 of the Proceeds of Crime (Money Laundering) and Terrorist Financing Regulations and FINTRAC's compliance program guidance set out the elements:

• Compliance officer: a person responsible for implementing the program. A sole proprietor can take the role personally.
• Written policies and procedures: kept up to date and, for an entity, approved by a senior officer.
• Risk assessment: a documented assessment of money laundering and terrorist financing risk, looking at clients, products, delivery channels and geography.
• Training program: a written, ongoing compliance training program for employees and agents.
• Training plan: a documented plan for delivering that training.
• Two-year effectiveness review: a review of the program every two years, carried out by an internal or external auditor or by the business itself if it has no auditor. An entity must report the findings in writing to a senior officer within 30 days of completing the review.

FINTRAC's guidance stresses that naming a compliance officer does not satisfy the requirement by itself; the officer needs real authority, resources and knowledge of the business and its sector's risks. For larger businesses, FINTRAC suggests as a best practice that the officer should not be directly involved in receiving, transferring or paying funds. Our guide to compliance officer responsibilities in the US and Canada looks at how that role is structured on both sides of the border.

When a business finds a gap itself, FINTRAC's Voluntary Self-declaration of Non-compliance gives it a way to report the problem. FINTRAC's annual report describes the mechanism as promoting open dialogue "without the threat of a penalty" so that problems can be fixed quickly, and it counts work on these declarations among its assessment activities.

What changed for FINTRAC penalties in 2026?

Before March 26, 2026, the maximum administrative monetary penalty for a single violation was $100,000 for a person and $500,000 for an entity. Section 73.1 of the Act, as amended by Bill C-12, now sets the maximum for a prescribed violation at $4,000,000 for a person and $20,000,000 for an entity. Both are 40 times the old limits (calculated: $20,000,000 divided by $500,000, and $4,000,000 divided by $100,000), which matches FINTRAC's own description of the change.

The per-violation figure is not the only cap. For all the violations on one notice taken together, the maximum is the greater of $20,000,000 and 3% of the entity's gross global revenue in the previous financial year, or for a person the greater of $4,000,000 and 3% of gross global income. If the entity belongs to an affiliated group, the group's gross global revenue is used. The amendments also create compliance orders: breaching one is a separate violation, with a maximum of the greater of $30,000,000 and 3% of gross global revenue for an entity, or the greater of $5,000,000 and 3% of gross global income for a person.

FINTRAC's page on the penalty changes, last modified May 6, 2026, says the new framework also lets it consider ability to pay, requires mandatory compliance agreements for prescribed violations and adds compliance orders as an enforcement tool. Timing matters here. Violations that occurred entirely before March 26, 2026 stay under the old policy and penalty amounts, violations after that date fall under the new framework, and FINTRAC says it will scope each examination so that its review period falls within one framework or the other. As of that page, FINTRAC was still updating its penalty policy and guidance for the new rules.

What are the criminal penalties under the PCMLTFA?

FINTRAC can also refer serious non-compliance to law enforcement. Its penalties page notes that criminal charges and an administrative penalty cannot both be used for the same instance of non-compliance. The main offences in Part 5 of the Act, with the fines as amended in 2026, are:

• Failing to report a suspicious transaction (section 75): up to $10,000,000 and two years less a day on summary conviction, or $20,000,000 and five years on indictment. Before the 2026 amendments the fines were $1,000,000 and $2,000,000.
• Disclosing a suspicious transaction report to prejudice an investigation (section 76): up to $1,000,000 and one year, or $2,500,000 and two years on indictment.
• Failing to file prescribed reports such as large cash and electronic funds transfer reports (section 77): a fine of up to $10,000,000 on summary conviction.
• Knowingly breaching record-keeping, identification, compliance program and other listed duties (section 74): up to $2,500,000 and two years less a day, or $5,000,000 and five years on indictment.
• Structuring transactions to avoid a report (section 77.3): up to $1,000,000 and two years less a day, or $2,500,000 and five years on indictment.
• Retaliating against an employee for meeting a duty under the Act (section 77.2): up to $1,000,000 and one year, or $2,500,000 and five years on indictment.

Executives should read section 78 closely. When a business commits an offence under the Act, any officer, director or agent who directed, authorized, assented to, acquiesced in or participated in it is a party to the offence and liable to the same punishment, whether or not the business itself is prosecuted. For the reporting offences in sections 75 and 77, section 79 lets a business avoid conviction if it shows it exercised due diligence to prevent the offence, which is one more reason to keep the compliance program documented.

These PCMLTFA offences are separate from money laundering itself. Section 462.31 of the Criminal Code makes it an offence to deal with property or proceeds with intent to conceal or convert them, knowing or believing, or being reckless as to whether, they came from a designated offence. The maximum is ten years on indictment, or 14 years when the offence is committed for a criminal organization. Allegations of that kind belong with white collar defence counsel, and our guide to fraud charges in Canada explains how related prosecutions proceed.

FINTRAC must publish every administrative penalty it imposes, and its public notices of administrative monetary penalties show how large recent penalties have been. All four below were imposed under the rules in force before March 26, 2026.

Business	Penalty	Imposed	Status
Toronto-Dominion Bank	$9,185,000	April 9, 2024	Paid, closed
Exchange Bank of Canada	$2,457,750	Nov. 5, 2024	Varied to $1,027,975
Peken Global (KuCoin)	$19,552,000	July 28, 2025	Appealed
Xeltox Enterprises (Cryptomus)	$176,960,190	Oct. 16, 2025	Appealed

The notices give the detail behind each row. The Toronto-Dominion Bank penalty was for five administrative violations, and FINTRAC states that it was not imposed for criminal money laundering or terrorist financing offences. The Federal Court confirmed the Exchange Bank of Canada violations on December 18, 2025 and varied the amount. Peken Global and Xeltox Enterprises have appealed to the Federal Court; the Xeltox penalty covered 2,593 contraventions across six types of violation.

How does FINTRAC compare with FinCEN in the US?

Companies operating in both countries deal with two separate regimes that look similar but differ in thresholds and timing. In the United States, reports under the Bank Secrecy Act regulations in Title 31 of the Code of Federal Regulations go to FinCEN, the Financial Crimes Enforcement Network.

Point	Canada	United States
Reports go to	FINTRAC	FinCEN
Cash report	$10,000 or more	More than $10,000
Suspicious report floor	None	Banks: $5,000
Suspicious report timing	As soon as practicable	Banks: 30 calendar days
Money services businesses	Register with FINTRAC	Register with FinCEN

Under 31 CFR 1010.311, a US financial institution other than a casino reports currency transactions of more than $10,000. Under 31 CFR 1020.320, a bank files a suspicious activity report for transactions involving or aggregating at least $5,000, no later than 30 calendar days after it first detects the facts, with a possible extension to 60 days if no suspect has been identified. Under 31 CFR 1022.380, money services businesses register with FinCEN. Canada sets no dollar floor for suspicious transaction reports and uses "as soon as practicable" instead of a fixed number of days.

New York adds a state layer for the institutions its Department of Financial Services regulates. Under 3 NYCRR Part 504, as the Department of Financial Services explains, regulated institutions must maintain programs to monitor and filter transactions for potential Bank Secrecy Act and anti-money laundering violations and file an annual certification by April 15 covering the prior calendar year.

The cross-border point that catches companies most often is the foreign money services business rule. A US payments, remittance or crypto company with no office in Canada can still be a reporting entity under paragraph 5(h.1) if it directs its services at people in Canada and serves Canadian clients. FINTRAC's public notices include penalties against two Seychelles-incorporated companies it determined to be foreign money services businesses operating in Canada.

Frequently asked questions

What is FINTRAC in simple terms?

FINTRAC is the federal agency that collects and analyzes financial transaction reports from Canadian businesses and supervises their anti-money laundering compliance. It is Canada's financial intelligence unit. When it has reasonable grounds to suspect that information is relevant to a money laundering, terrorist financing or national security investigation, it discloses that information to the police and other agencies named in the PCMLTFA.

Does FINTRAC apply to my business if it is not a bank?

It can. The PCMLTFA covers far more than banks: credit unions, life insurers, securities dealers, money services businesses, casinos, and prescribed sectors such as real estate brokers, accountants, dealers in precious metals and precious stones and, since April 1, 2025, factors. A business outside those categories is not a reporting entity, although the banks and other reporting entities it deals with still have their own client identification duties under the Act.

Is there a minimum amount for a suspicious transaction report?

No. FINTRAC's guidance states that there is no monetary threshold for reporting a suspicious transaction. The test is whether there are reasonable grounds to suspect that a completed or attempted transaction relates to a money laundering, terrorist activity financing or sanctions evasion offence. The report must be filed as soon as practicable once the business has reached that threshold.

Can FINTRAC see my bank account?

Not directly. FINTRAC's 2024 to 2025 annual report states that it does not have direct access to the bank accounts or other financial information of Canadians. It receives only the reports that businesses must file under the Act, plus voluntary information, and it can disclose intelligence only to the recipients and in the circumstances the Act sets out.

Can directors and officers be personally liable under the PCMLTFA?

Yes. Section 78 of the Act makes any officer, director or agent who directed, authorized, assented to, acquiesced in or participated in an offence by the business a party to that offence, liable to the same punishment. That applies whether or not the business itself is prosecuted or convicted, so compliance failures can become a personal matter for senior management.

Do the higher 2026 penalties apply to past violations?

No. FINTRAC states that violations which occurred entirely before March 26, 2026 remain subject to its existing penalty policy and penalty amounts, while violations after that date fall under the new framework introduced by Bill C-12. FINTRAC scopes each examination so that its review period falls entirely within one framework, which keeps the expectations applied to a business consistent.

Does a US company with Canadian customers have to deal with FINTRAC?

It may. A business with no place of business in Canada is a foreign money services business under paragraph 5(h.1) of the PCMLTFA if it provides services such as remitting funds, foreign exchange or dealing in virtual currencies to clients in Canada and directs those services at people or entities in Canada. Section 11.1 requires such a business to register with FINTRAC, and it must meet the Act's other obligations.

Conclusion

So what is FINTRAC, in practice? It sits at the centre of Canadian anti-money laundering law, and it is two things at once: the agency that turns business reports into financial intelligence, and the supervisor that checks whether those businesses meet the PCMLTFA. If your business falls within section 5, the core duties are clear: a documented, risk-based compliance program, client verification, five-year record keeping, timely reports, and registration for money services businesses. What changed in 2026 is the cost of getting it wrong, with administrative penalties up to 40 times higher and criminal fines up to ten times higher for failing to report suspicious transactions. Businesses that last reviewed their program before March 26, 2026 have good reason to review it again.

How Mayo Law can help

Mayo Law is a cross-border firm with offices in Toronto and New York. Joseph Mayo is licensed in Ontario and New York, and we advise businesses on whether the PCMLTFA applies to them, on building and reviewing compliance programs, and on how FINTRAC obligations sit alongside FinCEN and New York requirements. Our compliance practice works with companies on regulatory risk in both countries, and our white collar practice assists executives and businesses facing investigations.

Disclaimer

This article is for general information only and is not legal advice. Reading it does not create a solicitor-client or attorney-client relationship. Laws, penalties and FINTRAC guidance change; confirm the current position for your situation before acting. Mayo Law provides legal services in Ontario and New York.