What are the key AML laws in Canada?
FINTRAC issued 35 notices of violation in 2025 to 2026, totaling more than C$247 million, against 23 notices and C$25 million the year before, according to its 2025 to 2026 results. That record predates Bill C-12's higher limits, which reach only violations after 26 March 2026. Among the AML regulations of other jurisdictions, Canada's puts report intake and firm examinations in one agency, FINTRAC.
The Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA, 2000) sets the duties. The PCMLTFR, its main regulations, set amounts, clocks and identification methods; separate regulations cover suspicious transaction reports, registration and administrative monetary penalties (AMPs). The Criminal Code makes laundering a crime (s. 462.31) and requires disclosure of terrorist property (s. 83.1). Sanctions come through the United Nations Act (UN Act), the Special Economic Measures Act (SEMA) and the Justice for Victims of Corrupt Foreign Officials Act (JVCFOA).
Two Acts assented to on 26 March 2026 changed the regulatory regime: Bill C-12, the Strengthening Canada's Immigration System and Borders Act, rebuilt the penalties, and the Budget 2025 Implementation Act added the Stablecoin Act. Federal documents write anti money laundering policy as AML/ATF, the ATF standing for anti terrorist financing, where the FATF writes AML/CFT; the Department of Finance now adds CPF for counter proliferation financing.
Who regulates AML compliance in Canada?
| Body | AML role (as of November 2026) | Legal hook |
|---|---|---|
| FINTRAC (Financial Transactions and Reports Analysis Centre of Canada) | Financial intelligence unit and AML supervisor of every reporting entity: receives reports, examines, imposes AMPs, compliance agreements and orders | PCMLTFA ss. 7, 73.1, 73.16, 73.17 |
| OSFI (Office of the Superintendent of Financial Institutions) | Prudential supervisor of federally regulated banks, insurers and trust and loan companies; not the PCMLTFA supervisor | PCMLTFA s. 40(e) (FINTRAC ensures compliance with Parts 1 and 1.1); OSFI mandate; Financial Institutions Supervisory Committee: FINTRAC's Director and CEO a member since 26 March 2026 (Bill C-12) |
| Department of Finance | AML/ATF policy; regulations under the Act are made on the Minister's recommendation | PCMLTFA s. 2.1 |
| RCMP (Royal Canadian Mounted Police) | Investigates laundering; receives terrorist property disclosures; as a police force, receives FINTRAC disclosures | Criminal Code s. 83.1; PCMLTFA s. 55(3)(a) |
| CSIS (Canadian Security Intelligence Service) | Receives terrorist property disclosures | Criminal Code s. 83.1 |
| CRA (Canada Revenue Agency) | Receives FINTRAC disclosures when a tax evasion or false refund offense is also suspected | PCMLTFA s. 55(3)(b) |
| CBSA (Canada Border Services Agency) | Receives cross border reports of currency and monetary instruments of C$10,000 or more | PCMLTFA s. 12 |
| Provincial regulators | License and supervise securities dealers, credit unions and gaming under provincial law | PCMLTFA s. 5(b), (g), (k) (entities regulated or authorized under provincial Acts; casinos under Criminal Code s. 207) |
FINTRAC holds both roles: a report filed under section 7 goes to the Centre that later examines whether it was filed on time. In 2025 to 2026 it ran 625 targeted examinations and information demands, 433 of them on MSBs, and revoked 82 MSB registrations, up from 12. When it has reasonable grounds to suspect that designated information would help a money laundering, terrorist financing or sanctions evasion case, it must pass it to the appropriate police force.
OSFI does not enforce the PCMLTFA. Since 26 March 2026, FINTRAC's Director and CEO sits on the Financial Institutions Supervisory Committee and can exchange supervisory information on federally regulated financial institutions with its other members, according to FINTRAC's modernization and changes page.
Which entities are subject to AML obligations in Canada?
PCMLTFA section 5 names the reporting entities: banks, credit unions and caisses populaires, life insurers, trust and loan companies, securities dealers, money services businesses (MSBs) and casinos run under provincial authority. Regulations made under s. 5(i) and (j) add accountants, British Columbia notaries, dealers in precious metals and stones, and real estate brokers and developers.
Money services businesses, virtual currency dealers among them, register with FINTRAC (s. 11.1). So do foreign MSBs that direct services at people in Canada and serve clients there without a place of business in Canada (s. 5(h.1)), for those Canadian services only (s. 5.1).
Armored car businesses joined on 1 July 2024; mortgage administrators, brokers and lenders on 11 October 2024; factors, cheque cashers and financing or leasing entities on 1 April 2025; title insurers and acquirers of private automated banking machines on 1 October 2025.
What are the AML requirements for Canada's real estate and casino sectors?
Real estate brokers, sales representatives and developers verify clients and report suspicious and large cash transactions. Since 1 October 2025, brokers and sales representatives also verify the identity of an unrepresented party, keep an information record and make the third party determination. Real estate drew 29 of FINTRAC's 89 full scope examinations in 2025 to 2026. Casinos run under Criminal Code s. 207 (PCMLTFA s. 5(k) to (k.3)) also report disbursements of C$10,000 or more, the 24 hour rule included, within 15 days.
What does an AML compliance program in Canada require?
PCMLTFR section 156 builds the program from five parts:
- A compliance officer (a). One named person owns the program.
- Written policies (b). Kept current; in an entity, approved by a senior officer.
- A documented risk assessment (c), (2). Clients, products, channels, geography, affiliates of financial entities, and new technology before launch.
- Ongoing training (d), (e). A written program and a delivery plan for any staff or agents.
- An effectiveness review (f), (3), (4). Every two years by an internal or external auditor, or by the firm if it has none; an entity reports to a senior officer within 30 days.
Since 26 March 2026 the program must also be reasonably designed, risk based and effective (PCMLTFA s. 9.6(1.1)). The table below sets twelve duties, from customer due diligence to training, beside their sections; its last column names the control complead, formerly Sanction Scanner, offers for each.
| Obligation | Legal basis (in force, November 2026) | What a Canadian program must do | How complead does it |
|---|---|---|---|
| Compliance program | PCMLTFA s. 9.6; PCMLTFR s. 156 | Officer, written policies, documented risk assessment, training and a review every two years; reasonably designed, risk based and effective. | Rules, thresholds and each change to them carry a version, a who, what, when and why record, and a one click rollback. |
| Know your client (KYC) | PCMLTFR s. 105 and the sector sections | Verify identity by a prescribed method, such as government issued photo ID, at the time s. 105(7) sets: for an account, before its first transaction other than an initial deposit; for a transaction at a reporting or record line, at the time of the transaction. | A customer's onboarding, screening and monitoring results add up to one risk score. |
| Beneficial ownership | PCMLTFR s. 138, s. 138.1 | Obtain directors and owners of 25 percent or more and take reasonable measures to confirm them; for a CBCA corporation rated high risk, consult the federal registry and report a material discrepancy to the CBCA Director within 30 days unless resolved in that time. | KYB and UBO verification follows ownership up through parent entities to the natural persons at the top; whether a structure is acceptable remains your compliance function's call. |
| PEPs and HIOs | PCMLTFA s. 9.3; PCMLTFR s. 2(2) | In the prescribed cases, determine foreign PEP, domestic PEP and HIO status, family members and close associates included; measures always for foreign PEPs, for the others when risk is high. | A PEP hit counts toward the customer's single score; a named reviewer makes the call and the record keeps the name. |
| Ongoing monitoring and special measures | PCMLTFA s. 9.6(3); PCMLTFR s. 123.1, s. 157 | Monitor business relationships periodically on a risk basis, keep client and ownership data current, and take special measures when risk is high or in prescribed cases. | API triggers switch monitoring on or off for each name, so names that no longer matter drop out. |
| Suspicious transaction report (STR) | PCMLTFA s. 7, s. 8; STR Regulations s. 9(2) | Report completed or attempted transactions with reasonable grounds to suspect laundering, terrorist financing or sanctions evasion, as soon as practicable after the measures that establish them; no floor; no disclosure meant to prejudice an investigation. | Case management includes reporting support, and each alert names its rule and the signals it matched. |
| Terrorist and listed property | PCMLTFA s. 7.1; Criminal Code s. 83.1 | Report to FINTRAC when a Criminal Code s. 83.1, UN Act, SEMA or JVCFOA disclosure applies; disclose to the RCMP or CSIS without delay. | Customer names are screened against sanctions lists, and every search is logged, no match results included. |
| Large cash and virtual currency reports (LCTRs, LVCTRs) | PCMLTFR s. 126, s. 129, s. 132 | Report C$10,000 or more received in one transaction, or in several within 24 consecutive hours that the firm knows share a client or beneficiary; cash within 15 days, virtual currency within five working days. | The 24 hour line becomes a no code rule of conditions and thresholds, tested first against 30, 60 or 90 days of real history. |
| Electronic funds transfer reports (EFTRs) | PCMLTFR s. 127, s. 128, s. 132(1) | Report international EFTs of C$10,000 or more, sent or received, 24 hour rule included, within five working days. | Rules can be scoped by product, segment or jurisdiction, so cross border transfers keep their own thresholds. |
| Travel rule | PCMLTFA s. 9.5; PCMLTFR s. 124, s. 124.1 | Financial entities, MSBs and, for EFTs, casinos that must keep a record of the transfer send and check payer and beneficiary details on prescribed EFTs and virtual currency transfers; written policies for transfers that arrive incomplete. | Both parties to a payment are screened through the API during processing. |
| Record keeping | PCMLTFR s. 148 | Keep records at least five years: account records from the day the account closes, information and entity records from the last business transaction, and all other records from the day they were created. | Each screening search is stored with the searcher, the search term, the time and the result. |
| Training | PCMLTFR s. 156(1)(d), (e) | A written, ongoing training program for employees, agents and others acting for the firm, with a documented delivery plan. | The firm owns its training; alerts that record their rule and matched signals give it its own cases to teach from. |
What are Canada's customer due diligence (CDD) and enhanced due diligence (EDD) requirements?
Picture an MSB onboarding a company 30 percent owned by a provincial premier who left office in 2023. The MSB records that owner and takes reasonable measures to confirm the record (PCMLTFR s. 138). If the former premier became a client in their own name, the MSB would check PEP status (PCMLTFR s. 120(3)); a domestic PEP until 2028, five years after leaving office (s. 2(2)), gets the PEP measures when rated high risk (PCMLTFA s. 9.3(2.1)).
- Ultimate beneficial owner. For a CBCA corporation rated high risk, the firm consults the federal registry and reports a material discrepancy to the CBCA Director within 30 days unless resolved by then (s. 138.1, since 1 October 2025); spelling slips, a service address against a home address and registry exemptions do not count (s. 138.1(3)).
- PEPs. A foreign PEP stays one for life, since the definition says "holds or has held"; a domestic PEP or head of an international organization (HIO), for five years.
- Enhanced due diligence. Canada calls it special measures: written policies for enhanced identity checks and more frequent updates and monitoring when risk is high or in the prescribed circumstances (PCMLTFA s. 9.6(3); PCMLTFR s. 157).
What are the reporting obligations under Canadian AML law?
Most Canadian reports turn on C$10,000 and a 24 hour window. The window catches structuring: a firm that knows several deposits come from the same person adds them up. Picture a client who deposits C$4,000 in cash three times within 24 consecutive hours. The firm treats them as one C$12,000 transaction and files a large cash transaction report within 15 days (PCMLTFR ss. 126, 132(3)).
A suspicious transaction report, Canada's name for a SAR, has no floor and covers attempted transactions (PCMLTFA s. 7). Disclosing an STR is an offense only when done with intent to prejudice a criminal investigation, whether or not one has begun (s. 8). Property reports have covered UN Act measures since 1 March 2025 and SEMA and JVCFOA measures since 1 October 2025.
| Report | Trigger (C$, in force November 2026) | Deadline | Basis |
|---|---|---|---|
| STR | Reasonable grounds to suspect laundering, terrorist financing or sanctions evasion; attempts included; no floor; legal counsel providing legal services excepted | As soon as practicable after the measures that establish the grounds | PCMLTFA ss. 7, 10.1; STR Regulations s. 9(2) |
| Terrorist or listed property report | Property of a terrorist group or listed person under the Criminal Code, UN Act, SEMA or JVCFOA | To FINTRAC; to the RCMP or CSIS without delay | PCMLTFA s. 7.1; Criminal Code s. 83.1 |
| Large cash transaction report (LCTR) | C$10,000 or more in cash, one transaction or several within 24 hours | 15 days | PCMLTFR ss. 126, 132(3) |
| Large virtual currency transaction report (LVCTR) | C$10,000 or more in virtual currency, same 24 hour rule | Five working days | PCMLTFR ss. 129, 132(2) |
| Electronic funds transfer report (EFTR) | International EFT of C$10,000 or more, sent or received, 24 hour rule | Five working days | PCMLTFR ss. 127, 128, 132(1) |
| Casino disbursement report | Disbursements of C$10,000 or more, 24 hour rule | 15 days | PCMLTFR ss. 71, 130, 132(3) |
| Cross border currency report | Import or export of currency or monetary instruments of C$10,000 or more | At the border, to the CBSA | PCMLTFA s. 12; SOR/2002-412 s. 2 |
How is virtual asset regulation evolving in Canada?
Virtual currency dealers, called virtual asset service providers (VASPs) elsewhere, are MSBs (PCMLTFA s. 5(h)(iv)). FINTRAC treated Peken Global Limited (KuCoin), a Seychelles company, as a foreign MSB operating in Canada and imposed C$19,552,000 on 28 July 2025; the firm has appealed.
The travel rule covers prescribed EFTs and the virtual currency transfers a firm must record. Payer and beneficiary names, addresses and account or reference numbers travel with the transfer, and the receiver applies written risk based policies when they are missing (PCMLTFA s. 9.5; PCMLTFR ss. 124, 124.1). Sector record rules start at C$1,000. The Stablecoin Act will make stablecoin issuers register with FINTRAC as MSBs once its regulations are published.
What are the penalties for AML noncompliance in Canada?
| Offense | Basis | Maximum (in force, November 2026) |
|---|---|---|
| Failing to file an STR or a terrorist or listed property report | PCMLTFA s. 75 | C$20 million and 5 years on indictment; C$10 million and 2 years less a day on summary conviction; an employee who reported to a superior is not convicted |
| Tipping off with intent to prejudice an investigation | PCMLTFA ss. 8, 76 | C$2.5 million and 2 years on indictment; C$1 million and 1 year on summary conviction |
| Failing to file a large cash, EFT or other section 9 report | PCMLTFA s. 77 | C$10 million on summary conviction |
| Knowingly breaching program, record keeping, identity, registration, travel rule and other listed duties | PCMLTFA s. 74 | C$5 million and 5 years on indictment; C$2.5 million and 2 years less a day on summary conviction |
| Laundering: dealing with property or proceeds with intent to conceal or convert them, knowing, believing or reckless that they came from a designated offense | Criminal Code s. 462.31 | 10 years on indictment, or summary conviction; 14 years when done for the benefit of, at the direction of or in association with a criminal organization |
| Administrative penalties (AMP Regulations s. 5; PCMLTFA s. 73.1) | Violations before 26 March 2026 | Violations on or after 26 March 2026 |
|---|---|---|
| Minor violation | Up to C$1,000 (former s. 5) | Up to C$40,000 |
| Serious violation | Up to C$100,000 | Up to C$4 million |
| Very serious violation | Up to C$500,000 (entity); C$100,000 (person) (former s. 73.1(2)) | Up to C$20 million (entity); C$4 million (person) (s. 73.1(2)) |
| Cap per notice of violation | None (Cryptomus: C$176,960,190 in one penalty) | Greater of C$20 million and 3% of gross global revenue in the prior financial year, the group's revenue for an affiliated entity (entity); greater of C$4 million and 3% of gross global income in the prior year (person) (s. 73.1(3), (4)) |
| Ability to pay | Not a criterion (former s. 73.11) | A criterion (s. 73.11(c)) |
| Compliance history | A criterion (AMP Regulations s. 6) | A criterion (s. 6) |
| Compliance agreement | FINTRAC's choice: offered with the notice of violation for half the penalty (former s. 73.13(2)(b)) | Required for every prescribed violation once proceedings end (s. 73.16) |
| Compliance order | Did not exist | Made and published if the firm refuses the agreement or misses its deadline (s. 73.17) |
| Breach of a compliance order | Did not exist | Greater of C$30 million and 3% of gross global revenue in the prior financial year, the group's revenue for an affiliated entity (entity); greater of C$5 million and 3% of gross global income in the prior year (person) (s. 73.18(2), (3)) |
| The six program items of PCMLTFR s. 156 | Serious (former schedule) | Very serious, as is the new s. 9.6(1.1) duty (schedule) |
Offenses go to court; violations are not offenses (s. 73.23), FINTRAC imposes them as AMPs, and due diligence is a defense (s. 73.24). An act pursued as one cannot then be pursued as the other (s. 73.12). Unless a regulation fixes the amount, a penalty weighs the aim of encouraging compliance rather than punishing, the harm done, ability to pay and compliance history (s. 73.11; AMP Regulations s. 6).
FINTRAC describes the new maximums as up to 40 times the former limits on its penalty changes page. After a prescribed violation, a compliance agreement is now mandatory. A firm that does not sign within six months, or a longer period FINTRAC allows, is deemed to refuse (s. 73.16(4)); the Director then makes a compliance order and publishes it (s. 73.17).
Recent FINTRAC enforcement
FINTRAC's public notices put the largest penalty in its history at C$176,960,190. It was imposed on 16 October 2025 on Xeltox Enterprises Ltd., operating as Cryptomus, an MSB incorporated in British Columbia, for 2,593 contraventions across six types of violations. According to FINTRAC's results page, the firm did not file STRs where there were reasonable grounds to suspect trafficking in child sexual abuse material, fraud, ransomware payments and sanctions evasion.
| Firm | Imposed | Penalty | Status (FINTRAC notices, read 4 November 2026) |
|---|---|---|---|
| Xeltox Enterprises (Cryptomus), MSB | 16 October 2025 | C$176,960,190 | Appealed |
| Peken Global (KuCoin), foreign MSB | 28 July 2025 | C$19,552,000 | Appealed |
| TD Bank | 9 April 2024 | C$9,185,000 | Paid |
| Royal Bank of Canada | 3 November 2023 | C$7,475,000 | Paid |
| Exchange Bank of Canada | 5 November 2024 | C$2,457,750, varied to C$1,027,975 | Federal Court confirmed the violations on 18 December 2025; closed |
| Caisse populaire acadienne (UNI Financial Cooperation), federally regulated credit union | 23 July 2026 | C$676,500 | Paid |
Which recent AML developments in Canada are in force, and which are pending?
- 1 April 2025. Factors, cheque cashers and financing or leasing entities join.
- 1 October 2025. Ownership discrepancy reports, title insurers, banking machine acquirers, the unrepresented party rules and tighter MSB registration.
- 26 March 2026. Bill C-12 and the Budget 2025 Implementation Act receive Royal Assent; the new penalties and the s. 9.6(1.1) test apply.
- 17 to 19 June 2026. The FATF plenary adopts the joint FATF and Asia/Pacific Group (APG) mutual evaluation of Canada, which tests the regime against the FATF Recommendations.
- 29 September 2026. The Minister of Finance says the report upgraded Canada to "the best outcome category available" and names room to improve in supervision, beneficial ownership transparency, investigations, prosecutions and asset recovery; FINTRAC says the evaluation found its financial intelligence substantially effective in supporting investigations.
Pending: universal enrolment, enacted by Bill C-12 but not in force, will make businesses not already required to register enroll with FINTRAC once regulations appear in the Canada Gazette, Part II. Bill C-2, the Strong Borders Act, would bar certain persons or entities from accepting cash payments, donations or deposits of C$10,000 or more, and certain entities from taking third party cash deposits; it is still at second reading. The Minister's statement says the Financial Crimes Agency "will enhance" enforcement but gives no start date.
How can screening and monitoring help with AML compliance in Canada?
A FINTRAC examiner reads the trail: the list each customer was checked against, the rule behind each alert, and who closed it on what date. complead, an AI native platform for AML, KYC and fraud, keeps those records as the work happens; Sanction Scanner, the screening product, is part of complead.
Customer names run through client screening and ongoing monitoring, with fuzzy matching thresholds set per list type or single list; it checks 3,500+ sanctions, PEP and watchlists from 220+ jurisdictions, refreshed every 15 minutes.
Suppose a Canadian MSB, for illustration, runs its 24 hour C$10,000 aggregation in transaction monitoring as a no code rule. Agents close routine cases with evidence, a narrative and a work log attached; the compliance officer takes the rest, and the case record names who decided.
For your next examination, the date that decides the rules is the start of the review period. FINTRAC scopes each period to fall entirely before 26 March 2026 or on or after it, and only a later period brings the new limits and mandatory compliance agreements.
The 2026 PDF. The guide is complete on this page. The 16 page PDF, requested through the form beside it, adds two working pages: fourteen program checks with the section behind each, then a decision record for each suspicious transaction and an illustrative sheet of Canadian customer risk factors.
