FINTRAC's 2025-26 annual report: $247 million in penalties, and the curve has only started

What did FINTRAC report for 2025-26?

FINTRAC's 2025-26 annual report covers the fiscal year ended March 31, 2026. On enforcement, the headline figures are:

• 35 notices of violation for more than $247 million, up 52% in number from 23 the year before.
• Nine MSBs penalized for more than $198 million combined.
• 82 MSB registrations revoked, up from 12 in the previous year, and 23 new registration applications denied.
• 625 targeted examinations and information demands, including 433 directed at MSBs, plus 89 full-scope examinations, within 4,874 assessment and monitoring activities in total.
• 31 disclosures of non-compliance to law enforcement, 28 of them involving MSBs.

The rise in revocations drew national attention, with the National Post reporting a nearly 600% increase in registrations stripped from money services businesses. For an MSB, revocation is more consequential than most penalties: without registration, the business cannot operate in Canada.

How does 2025-26 compare with previous years?

The five-year series in the report shows a regulator that had been building momentum for two years before the step change:

The count of penalties has climbed steadily since 2022-23. The amount jumped because of size: a single penalty accounts for most of the year's total. Strip it out and 2025-26 still totals about $70 million, nearly three times the prior year. Both the frequency and the severity of enforcement are rising at once.

What was the $176 million penalty?

In October 2025, FINTRAC imposed a penalty of $176,960,190 on Xeltox Enterprises Ltd., operating as Cryptomus, the largest in its history. As reported at the time, FINTRAC found that the firm failed to submit 1,068 suspicious transaction reports where it had reasonable grounds to suspect money laundering or terrorist financing, with suspected links to child sexual abuse material, fraud, ransomware payments and sanctions evasion. It also failed to report 7,557 transactions originating from Iran between July 1 and December 31, 2024, which a ministerial directive required it to treat as high risk and report.

The Iran findings are a screening failure as much as a reporting one. A ministerial directive under the PCMLTFA tells reporting entities to apply specific measures to transactions connected to a named jurisdiction. Meeting it depends on identifying those transactions reliably in the first place, which is a matching problem on originator and beneficiary data, location signals and counterparty information. A program that cannot isolate the transactions cannot report them.

Other virtual currency platforms were penalized in the same year, including Peken Global Limited, operating as KuCoin, for $19,552,000, and MP Technology Services Ltd., operating as MoonPay, for $536,853.35. Our analysis of the MSB enforcement data sets out the violation patterns that recur across these files.

Why will the next penalties be larger?

Bill C-12, the Strengthening Canada's Immigration System and Borders Act, received Royal Assent on March 26, 2026. It raised maximum administrative monetary penalties under the PCMLTFA by up to 40 times and gave FINTRAC the power to issue compliance orders. Failure to comply with an order can lead to a penalty of up to $30 million or 3% of the business's global revenue.

FINTRAC has said the new penalty amounts apply to violations that occur after March 26, 2026, and that violations that occurred entirely before that date continue under the previous policy. In other words, the record $247 million year was calculated almost entirely under the old ceilings. The penalties issued in the coming years will increasingly reflect conduct after Royal Assent, priced under the new ones. Our guides to the March 2026 AMP increase and Bill C-12 and FINTRAC compliance cover the new ceilings in detail.

Where is FINTRAC focusing?

By count, financial entities received the most notices of violation in 2025-26, followed by MSBs, casinos and real estate. By value, MSBs dominated. Examination effort points the same way: 433 of the 625 targeted examinations and information demands were directed at MSBs. The number of registered MSBs also grew, from 2,778 to 3,396 by March 31, 2026, which means more firms entering a sector where the supervisor is looking hardest.

The sanctions dimension is explicit. FINTRAC published a special bulletin in July 2025 on financial activity associated with evasion of counter-proliferation sanctions, and the largest penalty of the year cited suspected sanctions evasion and unreported transactions from a directive jurisdiction. Sanctions screening, ministerial directive controls and suspicious transaction reporting are being examined together.

What should compliance leaders do now?

The enforcement record points to a short list of controls that examiners test first and penalize most expensively.

• Prove that screening finds what it should. Test sanctions and directive-jurisdiction screening on your own data, with known matches and near misses, and keep the results. An examiner asks for evidence that the control works, not a description of it. Our guide to what sanctions screening is and how it works covers the components examiners read.
• Connect screening to reporting. The largest penalty of the year turned on transactions that should have been identified and reported. Every screening hit and every directive-jurisdiction transaction needs a documented path to a disposition and, where required, a report to FINTRAC.
• Keep the decision record. Each alert closed should show what was compared, which identifiers supported or contradicted the match, and who decided. That record is what holds up in an examination.
• Reduce alert noise without reducing coverage. When analysts work through thousands of near-identical alerts, true matches get missed through fatigue. Entity resolution and better data cut false positives while keeping every list in scope.
• Re-price your exposure. Run your last examination findings against the new ceilings. For most firms, the result changes the cost-benefit of remediation.

How our screening platform supports a defensible program

Our screening engine checks customers, businesses and payment parties in real time against OFAC, Canada, EU, UK, Australia and APAC sanctions regimes, including comprehensively sanctioned geographies, plus PEP and adverse media data. Agentic entity resolution collapses duplicate matches into one scored identity with a plain-language reason, and every decision is retained as audit-ready case history, with material decisions kept under human review. It is designed to deliver a significant reduction in false positives, so analysts spend their time on true exposure. See sanctions screening software and API for the product view.

FAQ