Canada’s anti-money laundering and anti-terrorist financing regime imposes extensive compliance obligations on businesses operating in regulated sectors.

Banks, money services businesses, foreign money services businesses, cryptocurrency companies, payment businesses, mortgage-sector participants, casinos, securities dealers, accountants, real estate businesses and other reporting entities may be subject to the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) and its regulations.

FINTRAC is responsible for supervising compliance with significant parts of this regime. Reporting entities may be required to establish compliance programs, identify clients, determine beneficial ownership, monitor business relationships, maintain records and submit prescribed transaction reports. (FINTRAC)

Substance Law assists businesses throughout Canada with anti-money laundering (AML) compliance, FINTRAC matters, MSB registration, compliance programs, risk assessments, regulatory examinations, suspicious transaction reporting issues, enforcement matters and related financial regulatory advice.

What Is Anti-Money Laundering Compliance?

Anti-money laundering compliance refers to the systems, policies and procedures businesses use to prevent, detect and report transactions that may involve proceeds of crime, terrorist financing, sanctions evasion or other financial crime.

Canada’s principal federal AML legislation is the Proceeds of Crime (Money Laundering) and Terrorist Financing Act.

The legislation creates obligations for designated businesses and professions known as reporting entities.

Depending on the sector and activity, those obligations can include:

establishing an AML compliance program;
appointing a compliance officer;
conducting a risk assessment;
maintaining written policies and procedures;
providing employee training;
conducting an effectiveness review;
verifying client identity;
determining beneficial ownership;
identifying third parties;
establishing the purpose and intended nature of business relationships;
conducting ongoing monitoring;
applying enhanced measures to higher-risk relationships;
maintaining prescribed records; and
filing transaction reports with FINTRAC.

FINTRAC states that all reporting entities must establish and implement a compliance program, which forms the basis for satisfying reporting, record-keeping, client-identification and other know-your-client obligations. (FINTRAC)

Who Is Subject to Canada’s AML Laws?

The PCMLTFA applies to specified sectors rather than every Canadian business.

Depending on the circumstances, reporting entities may include:

financial entities;
money services businesses;
foreign money services businesses;
securities dealers;
life insurance companies and representatives;
accountants and accounting firms;
real estate brokers, sales representatives and developers;
casinos;
dealers in precious metals and stones;
British Columbia notaries;
mortgage administrators, brokers and lenders;
armoured car businesses;
certain crowdfunding platforms; and
other businesses brought within the regime.

FINTRAC maintains sector-specific guidance because the precise obligations differ depending on the reporting entity. (FINTRAC)

A key first step is therefore determining whether the business is a reporting entity at all and, if so, under which category.

Money Services Businesses and AML Compliance

Money services businesses are among the sectors most closely associated with FINTRAC regulation.

A business may potentially qualify as an MSB where it provides prescribed services involving:

foreign exchange dealing;
remitting or transmitting funds;
issuing or redeeming money orders or similar negotiable instruments;
dealing in virtual currency;
certain crowdfunding platform services; or
other regulated money services.

Canadian MSBs must generally register with FINTRAC before conducting regulated activities and maintain their registration while operating.

Registration is only the beginning.

FINTRAC states that MSBs must also implement a compliance program and satisfy applicable know-your-client, transaction reporting, record-keeping and other obligations. (FINTRAC)

Substance Law assists businesses in determining whether they qualify as MSBs and developing an AML framework appropriate to their particular business model.

Foreign Money Services Businesses

Businesses located outside Canada may also fall under the Canadian AML regime.

A foreign money services business (FMSB) may be required to register with FINTRAC where it directs prescribed money services at persons or entities in Canada and satisfies the applicable statutory requirements.

Foreign businesses should not assume that the absence of a Canadian office means Canadian AML law cannot apply.

We assist foreign crypto companies, payment providers, remittance businesses and other fintech businesses in assessing their Canadian regulatory exposure and complying with applicable FMSB requirements.

AML Compliance Program Requirements

A reporting entity’s compliance program should be tailored to its actual activities and risks.

Historically, FINTRAC described five central elements of a compliance program:

appointment of a compliance officer;
written compliance policies and procedures;
a documented risk assessment;
an ongoing compliance training program; and
an effectiveness review conducted at prescribed intervals.

The legal standard has continued to evolve. Effective March 26, 2026, amendments require compliance programs to be reasonably designed, risk-based and effective, increasing the importance of ensuring that written policies correspond with the business’s actual operations. (FINTRAC)

A generic template that simply repeats statutory language may therefore be inadequate.

AML Policies and Procedures

Written AML policies and procedures should explain how the business will satisfy its legal obligations in practice.

Depending on the reporting entity, this may include procedures concerning:

customer onboarding;
identity verification;
entity verification;
beneficial ownership;
politically exposed persons and heads of international organizations;
third-party determinations;
ongoing monitoring;
high-risk customers;
transaction monitoring;
suspicious transaction escalation;
sanctions screening;
large transaction reporting;
record keeping;
travel rule compliance;
correspondent relationships;
employee training;
regulatory reporting; and
responding to FINTRAC examinations.

Policies should reflect the business’s actual technology, transaction flows, customers, products and geographic exposure.

AML Risk Assessments

A risk assessment is a central component of an effective AML program.

Businesses should assess the risk of money laundering and terrorist financing arising from factors such as:

clients and business relationships;
products and services;
delivery channels;
geographic exposure;
transaction types;
use of cash;
virtual currency;
cross-border payments;
anonymity-enhancing technologies;
intermediaries;
corporate structures; and
emerging financial-crime typologies.

The purpose is not simply to label customers “low,” “medium” or “high” risk.

The business should be able to demonstrate how identified risks influence its controls, monitoring and enhanced measures.

Know Your Client and Identity Verification

Reporting entities must verify the identity of clients in prescribed circumstances.

The exact triggers and permitted verification methods depend on the sector and transaction.

KYC procedures may involve:

identifying individuals;
confirming the existence of corporations and other entities;
collecting prescribed information;
determining who is authorized to act for an entity;
identifying beneficial owners;
identifying third parties; and
maintaining evidence of the verification method used.

FINTRAC’s guidance confirms that reporting entities must verify client identity for prescribed activities and transactions. (FINTRAC)

Businesses using automated onboarding systems should ensure that their technology actually satisfies Canadian verification requirements rather than assuming a foreign KYC product is automatically compliant.

Beneficial Ownership Requirements

Where a reporting entity is required to verify an entity, it may also have to obtain prescribed beneficial ownership information.

For corporations, this can include information regarding individuals who directly or indirectly own or control the prescribed percentage of the corporation.

Different rules may apply to trusts and other entities.

FINTRAC’s current guidance requires reporting entities to obtain beneficial ownership information when entity identification requirements are triggered. (FINTRAC)

Complex corporate structures can make this one of the more difficult areas of AML compliance.

Ongoing Monitoring

AML compliance does not end when a client successfully completes onboarding.

Reporting entities may be required to conduct ongoing monitoring of business relationships.

Depending on the circumstances, this can involve reviewing transactions to determine whether they are:

consistent with the customer’s known profile;
consistent with the stated purpose of the relationship;
unusual in size or frequency;
associated with higher-risk jurisdictions;
structured to avoid reporting thresholds; or
otherwise indicative of money laundering or terrorist financing.

Higher-risk business relationships may require enhanced measures.

Suspicious Transaction Reports

One of the most important AML obligations is the requirement to file a Suspicious Transaction Report (STR) where the applicable legal threshold is met.

A suspicious transaction does not need to involve a proven criminal offence.

The reporting entity must evaluate facts, context and relevant indicators and determine whether it has the legally required level of suspicion.

Potential indicators may include:

unusual transaction patterns;
inexplicable movement of funds;
structuring;
rapid movement through accounts;
inconsistent explanations regarding source of funds;
use of multiple unrelated parties;
unusual virtual currency activity;
transactions involving high-risk jurisdictions; or
conduct inconsistent with the client’s stated business.

Businesses should have internal procedures governing identification, escalation, documentation and filing of suspicious transactions.

Large Cash, Virtual Currency and Electronic Funds Transfer Reporting

Depending on the reporting entity and circumstances, prescribed transactions may require reports to FINTRAC.

These can include certain:

large cash transactions;
large virtual currency transactions;
international electronic funds transfers; and
casino disbursements.

Reporting entities must also consider the applicable aggregation rules where multiple transactions may need to be treated together.

Transaction monitoring systems should therefore be configured around Canadian reporting requirements rather than relying solely on foreign thresholds or rules.

Sanctions and Terrorist Property

AML programs increasingly overlap with Canadian sanctions compliance.

Reporting entities may have obligations relating to listed or sanctioned persons and entities, including requirements to identify and report certain property.

Since March 2025, FINTRAC’s mandate and reporting framework have also incorporated additional reporting relating to sanctioned property. (FINTRAC)

Businesses operating cross-border payment, crypto or financial services should therefore consider sanctions screening alongside traditional AML controls.

Politically Exposed Persons and Heads of International Organizations

Certain reporting entities must determine whether specified individuals are:

foreign politically exposed persons;
domestic politically exposed persons;
heads of international organizations; or
prescribed family members or close associates.

Where applicable, additional measures may be required, including source-of-funds or source-of-wealth inquiries and senior management review.

Businesses should ensure these procedures are proportionate and properly documented rather than relying solely on third-party screening tools.

AML Training Programs

Employees involved in regulated activities should understand both the law and the organization’s own procedures.

An AML training program may cover:

relevant legislation;
money laundering and terrorist financing concepts;
sector-specific risks;
suspicious transaction indicators;
customer identification;
sanctions;
escalation procedures;
record keeping;
internal reporting; and
consequences of non-compliance.

Training should be updated as the business, regulatory requirements and financial-crime risks evolve.

AML Effectiveness Reviews

Reporting entities must periodically review their compliance programs to determine whether they are operating effectively.

An effectiveness review should generally involve more than confirming that policies exist.

It may examine:

whether staff follow the procedures;
whether identity verification is performed correctly;
whether reports are filed on time;
whether risk ratings are properly assigned;
whether high-risk clients receive enhanced monitoring;
whether required records exist;
whether transaction-monitoring rules operate as intended; and
whether prior deficiencies have been corrected.

The resulting findings should be documented and addressed.

AML Compliance for Crypto and Virtual Currency Businesses

Crypto businesses present distinctive AML issues because of the speed, cross-border nature and pseudonymous characteristics of blockchain transactions.

Depending on the business model, compliance may involve:

FINTRAC MSB or FMSB registration;
blockchain analytics;
wallet screening;
transaction monitoring;
travel rule compliance;
large virtual currency reporting;
source-of-funds analysis;
sanctions screening;
self-hosted wallets;
stablecoins;
mixers and privacy-enhancing services; and
cross-chain activity.

A crypto compliance program should integrate traditional customer due diligence with blockchain-specific risk controls.

AML Compliance for Payment Companies and Fintech Businesses

Payment companies often operate at the intersection of several regulatory frameworks.

A business may need to determine whether it is:

an MSB under the PCMLTFA;
a payment service provider under the Retail Payment Activities Act;
both;
or outside one or both regimes.

The answer can turn on relatively subtle distinctions involving:

who receives customer funds;
whose account holds the funds;
whether the business transmits money;
whether transactions are incidental to another service;
whether the platform controls movement of funds;
whether it deals in virtual currency; and
whether another statutory exemption applies.

The regulatory analysis should therefore occur before designing the payment architecture where possible.

FINTRAC Compliance Examinations

FINTRAC conducts examinations to assess whether reporting entities comply with the PCMLTFA and associated regulations.

An examination may involve requests for:

compliance policies;
risk assessments;
training materials;
effectiveness reviews;
customer files;
transaction records;
reporting records;
beneficial ownership documentation;
suspicious transaction analyzes;
corporate records; and
information regarding technology and internal controls.

Businesses should respond carefully and accurately.

Inconsistent documents, outdated policies or procedures that do not reflect actual practices can create additional regulatory concerns.

Responding to FINTRAC Deficiencies

FINTRAC may identify deficiencies following an examination.

Businesses should evaluate:

the legal basis for the finding;
whether the factual assumptions are accurate;
whether corrective action can be implemented;
whether historical transactions need review;
whether reports must be amended or filed;
whether internal controls failed;
whether employees require retraining; and
whether the deficiency could lead to enforcement.

A prompt and well-documented remediation plan can be important in demonstrating future compliance.

FINTRAC Administrative Monetary Penalties

FINTRAC may impose administrative monetary penalties (AMPs) for prescribed violations.

The penalty framework was substantially increased in 2026.

For violations occurring on or after March 26, 2026, prescribed violations can carry significantly higher maximum penalties than under the previous regime. FINTRAC has also been updating its AMP policy and enforcement guidance following the legislative reforms. (FINTRAC)

FINTRAC publicly identifies persons and entities that have been subjected to administrative monetary penalties, with public notices generally remaining available for five years. (FINTRAC)

The reputational impact of enforcement may therefore be significant in addition to the financial penalty itself.

FINTRAC Enforcement and Appeals

A FINTRAC enforcement matter may raise issues concerning:

whether a violation actually occurred;
the classification of the violation;
calculation of the penalty;
the regulatory history of the business;
corrective action;
procedural fairness;
interpretation of FINTRAC guidance;
statutory deadlines; and
available review or appeal mechanisms.

Businesses should obtain legal advice early when facing a Notice of Violation or other significant enforcement action.

AML Issues in Corporate Transactions

AML compliance can also become important during:

mergers and acquisitions;
financing transactions;
investments;
business sales;
corporate restructurings; and
changes of control.

A buyer acquiring an MSB, fintech or other reporting entity should assess the target’s historical AML compliance.

Potential diligence issues include:

FINTRAC registration;
overdue renewals;
unresolved examination findings;
deficient compliance programs;
missing STRs or other regulatory reports;
ineffective KYC systems;
beneficial ownership deficiencies; and
past administrative monetary penalties.

AML liabilities discovered after closing can materially affect the value of an acquisition.

Designing AML Compliance Into a New Business

AML compliance is easier when built into the business before launch.

Businesses should consider regulatory requirements while developing:

onboarding flows;
payment architecture;
account structures;
transaction monitoring;
customer databases;
reporting systems;
compliance staffing;
terms of service;
third-party integrations; and
internal escalation procedures.

Retrofitting an established platform after discovering it is subject to FINTRAC regulation can be significantly more expensive.

Our Anti-Money Laundering Legal Services

Substance Law assists clients with a broad range of AML and FINTRAC matters, including:

determining whether a business is a FINTRAC reporting entity;
MSB and FMSB classification;
FINTRAC registration and renewal;
AML compliance program development;
AML policy and procedure drafting;
compliance officer requirements;
AML risk assessments;
KYC procedures;
beneficial ownership procedures;
ongoing monitoring frameworks;
transaction monitoring;
suspicious transaction reporting;
large transaction reporting;
sanctions compliance;
PEP and HIO procedures;
record-keeping requirements;
AML employee training;
effectiveness reviews;
third-party compliance arrangements;
fintech and payment regulatory analysis;
cryptocurrency and virtual currency compliance;
FINTRAC examination preparation;
responses to FINTRAC findings;
remediation plans;
Notices of Violation;
administrative monetary penalties; and
regulatory enforcement matters.

Work With an Anti-Money Laundering Lawyer in Canada

Canada’s AML framework is becoming broader, more complex and more enforcement-focused.

The regulatory reforms that took effect in 2026 reinforce that reporting entities are expected not merely to possess compliance documents, but to maintain programs that are genuinely risk-based and effective. (FINTRAC)

Substance Law assists Canadian and international businesses with designing, implementing and defending AML compliance programs under the PCMLTFA and related financial regulatory regimes.

Whether you are launching an MSB, building a fintech platform, reviewing an existing AML program or responding to FINTRAC enforcement, obtaining legal advice early can help reduce regulatory risk and create a compliance framework that reflects how the business actually operates.

Frequently Asked Questions About Anti-Money Laundering Law in Canada

What is Canada’s main anti-money laundering law?

Canada’s principal federal AML legislation is the Proceeds of Crime (Money Laundering) and Terrorist Financing Act, together with its associated regulations.

What is FINTRAC?

FINTRAC is Canada’s financial intelligence unit and the federal regulator responsible for supervising compliance with significant obligations under the PCMLTFA.

Who needs an AML compliance program?

Businesses and professionals classified as reporting entities under the PCMLTFA generally must establish and implement a compliance program.

What are the main components of an AML compliance program?

An AML program generally includes a compliance officer, written policies and procedures, a risk assessment, training and periodic effectiveness reviews, together with the operational systems necessary to satisfy KYC, reporting and record-keeping requirements.

Did AML compliance requirements change in 2026?

Yes. Amendments effective March 26, 2026 require compliance programs to be reasonably designed, risk-based and effective, among other changes to Canada’s AML framework. (FINTRAC)

Do money services businesses need FINTRAC registration?

Canadian MSBs and qualifying foreign MSBs generally must register with FINTRAC before providing regulated money services to which the registration requirement applies.

Does FINTRAC registration mean a business is compliant?

No. Registration is only one obligation. An MSB must also maintain an AML compliance program and satisfy applicable KYC, reporting, record-keeping and other requirements.

Do crypto businesses have AML obligations in Canada?

Many do. Businesses dealing in virtual currency or transferring virtual currency may qualify as MSBs or FMSBs and become subject to FINTRAC requirements.

What is a suspicious transaction report?

An STR is a report submitted to FINTRAC when a reporting entity reaches the statutory threshold for suspecting that a transaction or attempted transaction is related to money laundering, terrorist financing or another reportable financial crime concern.

Do businesses need to identify beneficial owners?

Reporting entities may be required to obtain and verify prescribed beneficial ownership information when dealing with corporations, trusts and other entities.

Can FINTRAC inspect a business?

Yes. FINTRAC conducts compliance examinations and can request records and information to assess whether a reporting entity is meeting its statutory obligations.

Can FINTRAC issue fines?

Yes. FINTRAC can impose administrative monetary penalties for prescribed violations. The maximum penalties available under Canada’s AML regime increased substantially in 2026.

Are FINTRAC penalties public?

Yes. FINTRAC publishes notices identifying persons and entities that have received administrative monetary penalties, and those notices generally remain available on its website for five years. (FINTRAC)

Can a lawyer help with a FINTRAC examination?

Yes. Legal counsel can assist with preparing for an examination, reviewing requests for information, assessing potential deficiencies, responding to FINTRAC and developing remediation strategies.

Can Substance Law prepare an AML compliance program?

Yes. Substance Law assists MSBs, fintech companies, crypto businesses and other reporting entities with AML compliance programs, risk assessments, policies, KYC procedures, training, effectiveness reviews and FINTRAC regulatory matters.

Anti-Money Laundering (AML) Legal Services for Canadian Businesses