FINTRAC MSB licence revocation: what it means and how to respond

🛡️ Facing a revocation decision, or concerned your MSB registration is at risk? ComplyFactor provides fractional CAMLO services, FINTRAC audit preparation, AML program remediation, and re-registration support for Canadian MSBs and PSPs, so your compliance posture is defensible before FINTRAC comes knocking.

What does FINTRAC MSB revocation actually mean?

FINTRAC registers money services businesses. It does not issue licences, and a registration does not mean FINTRAC endorses the business. When FINTRAC revokes an MSB registration, the business loses its registered status and can no longer lawfully carry on registered money services activities. That is a far heavier outcome than a warning or a fine.

Under the PCMLTFA, every business conducting money services activities in Canada (foreign exchange, money transfer, dealing in virtual currency, issuing or redeeming money orders and similar instruments, and crowdfunding platform services, among others) must be registered with FINTRAC. Operating without a valid registration is an offence under the Act, and a revocation removes the registration the business relied on to operate.

The legal framework: PCMLTFA revocation grounds

FINTRAC's authority to revoke comes from the PCMLTFA. The grounds set out in the Act include:

• The registrant is ineligible to be registered (section 11.11), for example because of certain convictions.
• The registrant did not answer FINTRAC's request for clarification of its application information within 30 days (section 11.17).
• The registrant contravened section 62(2) of the Act or a notice served under section 63.1 (section 11.171).
• The registrant did not report a change to the name or address of its Canadian service contact within 30 days (section 11.13(2)), in which case FINTRAC must deny or revoke the registration.

A decision to revoke must be made in writing and give reasons (section 11.18). The Act does not set out a general requirement for advance notice of an intention to revoke, and the only pre-decision window it specifies is the 30 days to answer a request for clarification. Respond to any request from FINTRAC inside that period.

Top causes of MSB registration problems

Revocation is only one of the outcomes of weak compliance. Deficiencies that FINTRAC examiners commonly document, and that can lead to penalties and registration action, include:

• Failure to maintain a compliant AML/CTF program: a compliance officer, written policies and procedures, a risk assessment, a training program and plan, and an effectiveness review at least every two years. FINTRAC tests whether your program is operational, not just documented.
• Failure to submit mandatory reports: LCTRs, EFTRs, LVCTRs, STRs and listed person or entity property reports. Systematic failure to file is one of the most direct paths to enforcement.
• Failure to conduct customer due diligence: missing identity verification at applicable thresholds (for example foreign exchange transactions of $3,000 or more), no beneficial ownership identification, absent PEP and HIO screening, no enhanced due diligence for high-risk relationships, and inadequate ongoing monitoring.
• Incomplete or outdated registration information: failing to report changes to business lines, agents, addresses or officers within the 30 days the Act allows (section 11.13).
• Failure to conduct or act on the effectiveness review: perfunctory self-reviews, or genuine reviews whose recommendations are never implemented.
• Failure to renew the registration: an MSB must renew its registration every two years (section 11.19). A registration that is not renewed expires.
• Agent and third-party failures: an MSB remains responsible for its agents' compliance, so weak agent oversight creates enforcement risk, especially in high-risk remittance corridors.

⚠️ Common mistake. Many operators assume that because they have never received a penalty or a warning letter, their compliance posture is acceptable. When FINTRAC examines you, it reviews a defined period of your activity, and accumulated gaps can appear together in one set of findings.

The revocation process: what the Act provides

Step 1: Examination or review. Compliance issues usually surface through a FINTRAC examination, a registration review or an information request. Examiners ask for documentation, speak with staff, and test transaction records against your stated policies.

Step 2: Findings and requests. If FINTRAC identifies deficiencies, it communicates them. If it asks for clarification of your registration information, you have 30 days to answer (section 11.17). A response helps only if it is substantive and backed by a real remediation plan.

Step 3: Written decision. If FINTRAC decides to revoke, it must put the decision in writing with reasons (section 11.18). The revocation is reflected in the public MSB registry.

Step 4: Review by the Director. A person or entity whose registration is revoked may apply in writing to the Director of FINTRAC for a review within 30 days after receiving the decision (section 11.3(1)). The application can include supporting information, and the Director may confirm the decision or substitute a new one. This is the main point to put your remediation evidence in front of the decision-maker.

Step 5: Appeal to the Federal Court. The Director's decision can be appealed to the Federal Court within 30 days after it is served (section 11.4(1)), or within a longer period if the Court allows. If the Director has not decided within 90 days after receiving the review application, the applicant may appeal within 30 days after that 90-day period ends (section 11.4(2)). The Act does not state that a review application or an appeal suspends a revocation, so take legal advice before acting on the assumption that it does.

Consequences of having your registration revoked

• Operational cessation: you must stop the regulated money services activities that require registration. Continuing carries legal consequences.
• Banking relationships: banks check FINTRAC's registry during due diligence, so a revoked registration can lead to account closures that are hard to reverse, even after re-registration.
• Reputational damage: the registry is public. Where a penalty accompanies the action, the violations are published alongside the entity name.
• Liability: serious non-compliance may be referred for prosecution, and officers and directors can face personal liability under the Act.
• Downstream tax and corporate complications: including GST/HST reporting tied to money services activities.

Immediate steps when you receive a revocation decision

If you have received a decision to revoke, or a request for clarification or findings that you fear are escalating, the first days matter because the review period is only 30 days:

• Diarize the deadlines. The 30-day period to apply to the Director runs from the day you receive the decision.
• Engage qualified compliance and legal advisors immediately: people who understand the PCMLTFA enforcement framework and can document remediation.
• Preserve all documentation: do not delete, modify, or reorganize any files relating to your AML program, monitoring, or KYC.
• Conduct an emergency gap assessment: know what is broken and what you can credibly commit to fixing, and by when.
• Brief your board and senior management: revocation risk is a material business issue; document the briefing.

💡 Pro tip. Evidence that deficiencies have already been remediated is stronger than a written commitment to fix them later. An independent AML effectiveness review conducted after the examination, showing with evidence that gaps have been closed, gives the reviewer something concrete to assess.

How to respond: building your remediation case

A credible response rests on three elements, and a box-ticking exercise is easy to spot.

Acknowledge the deficiencies accurately. Do not dispute findings that are clearly documented; doing so damages your credibility across the entire package. State what was wrong, precisely, with reference to the PCMLTFA provisions engaged.

Document completed remediation. Include a revised policies manual dated after the examination, a qualified compliance officer with documented authority, an updated risk assessment, completed staff training records, transaction monitoring logs showing STR activity proportionate to risk, and an independent AML effectiveness review conducted after remediation.

Provide structural assurance. Show board-level accountability (with minutes), changes to the compliance function, a forward-looking monitoring calendar with milestones, and an ongoing external compliance advisor, such as a fractional CAMLO or MLRO, for continuity of oversight.

Re-applying for MSB registration after revocation

The PCMLTFA does not impose an automatic permanent bar on re-registration, but a new application is assessed against the eligibility rules in the Act, and FINTRAC may ask for clarification of any information in it. A strong application shows what changed since the revocation, including personnel, systems and governance.

A post-revocation application should include a full AML program prepared after the revocation, an independent review of that program before applying, an accurate account of what led to the revocation and the remedial actions taken, and fully current ownership, officer, director and agent information. You cannot lawfully carry on registered activities until you are registered again.

How to prevent revocation: a proactive framework

• Build a working AML program. Staff must understand your manual, follow it, and see it reflect your current business. Update it when your business, risks or the law change.
• Complete effectiveness reviews on schedule. The Regulations require a review at least every two years. Higher-risk segments such as crypto, remittance and high-volume FX often review more often, and an independent reviewer is FINTRAC's best practice.
• Keep your registration current. Track your own expiry date and report changes within the 30 days the Act allows. Do not rely on a reminder from FINTRAC.
• Calibrate transaction monitoring. Generic rules that generate low-quality alerts cause fatigue and missed red flags. FINTRAC assesses STR quality, timeliness and record keeping.
• Engage a qualified compliance officer or fractional CAMLO: an experienced professional engaged part-time can provide expertise that a full-time hire would cost more to provide.
• Identify your vulnerabilities before FINTRAC does: map where your program is most exposed and self-assess before commissioning a formal review.

FINTRAC's enforcement track record

FINTRAC has escalated its enforcement of the MSB sector. In its 2025-26 annual report, published on 26 October 2026, FINTRAC reported that it revoked the registrations of 82 money services businesses in fiscal year 2025-26, up from 12 the year before. It also issued 35 notices of violation in 2025-26, and more than $198 million of the penalties went to nine money services businesses.

A business with one reporting gap is a candidate for a penalty. A business with no program, no STR history and unverified KYC across its client base is a stronger candidate for registration action.

ComplyFactor's independent AML audit, compliance programme, and fractional MLRO services support businesses in this situation by preparing the independent assessment and remediation documentation that a credible review application needs.

Frequently asked questions

Can FINTRAC revoke my MSB registration without warning?

The Act does not require a general advance notice of intention to revoke. Some grounds depend on a missed deadline, such as the 30 days to answer a request for clarification, or an unreported change to the Canadian service contact. Respond to every FINTRAC communication promptly and in writing.

Can I challenge a revocation?

Yes. You may apply in writing to the Director for a review within 30 days after receiving the decision (section 11.3(1)). You can then appeal the Director's decision to the Federal Court within 30 days after it is served (section 11.4(1)).

Will my revocation be made public?

Yes. FINTRAC maintains a public MSB registry that shows revoked registrations. Where a penalty accompanies the action, the notice of violation, including the entity name, violation types and amount, is published.

Can I continue operating while I seek review or appeal?

This requires legal advice. The Act does not state that a review application or appeal suspends a revocation. Carrying on registered activities without a valid registration creates serious legal risk, so do not continue unless counsel confirms in writing that you may.

Can officers and directors of a revoked MSB face personal liability?

Yes, they can. Where compliance failures resulted from officer or director decisions, or where they knew of ongoing non-compliance and failed to act, the PCMLTFA provides for individual liability. Get legal advice if you are an officer or director in this position.

How does a PSP revocation differ from an MSB revocation?

PSPs under the RPAA are supervised and registered by the Bank of Canada, not FINTRAC. Many businesses are dually regulated. A FINTRAC revocation does not automatically trigger Bank of Canada de-registration, but the Bank may take it into account in its supervisory assessment.

What is the difference between a penalty and a revocation?

An administrative monetary penalty is a financial penalty for specific violations. A revocation ends the registration itself. They are separate tools that can be used independently or together.

Can I convert to a PSP registration to avoid the FINTRAC MSB framework?

No. The PCMLTFA and the RPAA are separate frameworks with separate obligations. Holding a PSP registration with the Bank of Canada does not exempt a business from FINTRAC MSB registration if it conducts activities meeting the PCMLTFA definition of money services. Many businesses need both.