FINTRAC Travel Rule: requirements for Canadian regulated firms

The Travel Rule is the PCMLTFA requirement that specific information about the originator and the beneficiary of a transfer must travel with the payment along the entire chain that handles it. In Canada it is grounded in the PCMLTFA and FINTRAC regulations, and the international standard behind it is FATF Recommendation 16. It applies to the two transfer types most regulated firms now handle: international electronic funds transfers and virtual currency transfers, at CAD $1,000 and above. It is an information-flow obligation rather than a report, so the identifying data has to be transmitted on or before the transfer settles and retained on file, distinct from the separate reports that sit alongside it. The point is that the originator and beneficiary can always be identified as value moves, which is what lets an investigator, or an examiner, reconstruct who sent and received a transfer after the fact.

Three categories of reporting entity have direct Travel Rule obligations under FINTRAC. Money services businesses and foreign MSBs that initiate, receive, or transmit international electronic funds transfers are covered, as are financial entities such as banks and credit unions handling those transfers. The third category is money services businesses, including VASPs, that send or receive virtual currency transfers on behalf of a client. Payment service providers sit slightly apart: they become subject to overlapping Travel Rule-equivalent obligations through the Retail Payment Activities Act framework, and where they also qualify as MSBs, through the PCMLTFA itself. The two regimes are not identical, but their information-flow expectations converge, so a PSP that moves value generally cannot treat itself as out of scope. The common thread is that any firm initiating, transmitting, or receiving covered transfers on a client's behalf carries the obligation to make the required information travel with them.

CAD $1,000, or its equivalent in another currency. The same threshold applies to international electronic funds transfers, so both covered transfer types share the CAD $1,000 line. Two nuances matter. First, the threshold applies not only to single transactions but to multiple related transactions that aggregate to it, the 24-hour rule for combined transactions, so a series of smaller transfers cannot be used to stay below the line. Second, the CAD $1,000 Travel Rule threshold is separate from the CAD $10,000 reporting thresholds that sit alongside it, the EFT Report and the Large Virtual Currency Transaction Report. That means Travel Rule information has to be captured below the CAD $10,000 reporting threshold even when you are not filing a report. Treating the two thresholds as one is a common mistake; the information-flow obligation begins at CAD $1,000, well before any reporting obligation is triggered.

At minimum, three fields for the originator: their name, their account number or a unique transaction reference, and their address. For virtual currency transfers the address field becomes the wallet address or equivalent identifier, and the account-number obligation maps to the unique transaction reference, which is the transaction hash. The beneficiary side requires the same identifying data: name and account number or unique reference. On top of the party details, the transfer itself has to carry the amount, the currency, and the date. All of it must be transmitted on or before the transfer settles, not reconstructed afterward, and retained on file for at least five years from the date of the transfer. Capturing this minimum data set cleanly at the point of the transfer is what lets the same information later populate the EFT Report or the Large Virtual Currency Transaction Report without having to be gathered a second time.

At least five years from the date of the transfer. That retention obligation applies whether or not you filed a report on the transaction: the originator and beneficiary information, plus the transaction details, has to be kept for the full period regardless. Retention alone is not the whole standard, though. The records must also be retrievable in a reasonable time on request from FINTRAC, and in practice a reasonable time means hours to days, not weeks, and certainly not "we will need to go ask the vendor". That retrieval expectation is why storing Travel Rule data in a system you do not control, or across disconnected spreadsheets, is a real weakness even when the data technically exists. Keeping the information in a system of record you can query directly is what turns a five-year archive into records you can actually produce when an examiner asks for them within the window they expect.

The Travel Rule is an information-flow obligation, while the LVCTR and the EFTR are separate filings, each triggered at CAD $10,000 and above. The Electronic Funds Transfer Report covers international EFTs at that threshold, in or out, and the Large Virtual Currency Transaction Report covers virtual currency receipts at CAD $10,000 and above. The connection is that both reports are populated by the same originator and beneficiary fields you captured to satisfy the Travel Rule, so the Travel Rule data is effectively the spine of each report. Building that capture once, in the system of record, is what makes the reports come out clean and consistent; building it separately for each filing is what makes them come out inconsistent, which is the deficiency examiners find most often. A Suspicious Transaction Report can also draw on the same captured data, since an STR can be triggered at any value, including below the Travel Rule threshold.

Where the counterparty is an unhosted, self-custodied wallet, there is no other VASP on the far side to exchange messaging with, so the transmission half of the Travel Rule cannot be satisfied through a counterparty protocol. In that situation FINTRAC expects the regulated entity to conduct due diligence on the customer and on the destination wallet, rather than to rely on counterparty messaging that does not exist. Reliance on messaging that is not there is not an acceptable substitute for the underlying obligation to know who is sending and receiving the value. For hosted counterparties, Canada accepts compliant messaging protocols such as IVMS 101-aligned TRP, OpenVASP, and TRISA, provided the information that ends up captured matches the regulatory minimum. But the protocol is only a means of transmission; where no counterparty exists to transmit to, the obligation falls back on the firm's own diligence, and that diligence has to be documented like any other decision.