FINTRAC Administrative Monetary Penalties: Fines, Violations and Remediation

An administrative monetary penalty (AMP) is the financial enforcement tool FINTRAC uses against reporting entities found non-compliant with the PCMLTFA and its Regulations. It is an administrative measure, not automatically a criminal charge; the two are legally distinct, and FINTRAC cannot pursue both for the same instance of non-compliance. FINTRAC fines are calculated against a specific legal framework, not an arbitrary figure, and that framework changed materially on March 26, 2026.

What a specific business actually faces if FINTRAC identifies a compliance gap depends on the nature of the violation, the harm it caused, the entity's compliance history, and, since March 2026, its ability to pay and whether the violation falls before or after the legislative change. This article sets out how the AMP framework actually works, what changed and when, how FINTRAC's public enforcement record functions, and how a reporting entity can identify and remediate exposure before a deficiency becomes a penalty.

What Is a FINTRAC Administrative Monetary Penalty?

An administrative monetary penalty is a monetary sanction FINTRAC can impose on a reporting entity it has reasonable grounds to believe has violated a requirement of the PCMLTFA or its associated Regulations. FINTRAC has held this authority since December 30, 2008. The purpose of the AMP program is explicitly non-punitive: FINTRAC states its aim is to encourage a change in behaviour toward future compliance, not to punish, and the program is meant to provide a measured, proportionate response to specific instances of non-compliance.

An AMP is separate from criminal enforcement. Failure to comply with the relevant parts of the PCMLTFA can result in either an AMP or a criminal charge for a non-compliance offence, but the Act does not allow both to be pursued for the same instance of non-compliance. FINTRAC can also refer matters to law enforcement where it has reasonable grounds to suspect the information is relevant to investigating or prosecuting a non-compliance offence.

An AMP process begins with a Notice of Violation, which sets out the specific violations, the proposed penalty, and the entity's rights. ComplyFactor's guide to responding to a FINTRAC Notice of Violation covers that response process in full; this article focuses on the penalty framework itself, not the procedural steps once a Notice has already arrived.

What Can FINTRAC Issue a Penalty For?

Violations that can support an AMP are prescribed in the Proceeds of Crime (Money Laundering) and Terrorist Financing Administrative Monetary Penalties Regulations. Rather than list every statutory provision, the categories below reflect the control areas FINTRAC's own harm-done assessment guides are organized around.

AML Compliance Program Violations

Missing or deficient elements of the compliance program itself: no designated compliance officer with real authority, policies and procedures that do not reflect the actual business, no current risk assessment, no training program, or no effectiveness review completed within the required interval.

Know Your Client and Identity Verification Violations

Failures in verifying identity using a permitted method, incomplete beneficial ownership determination, or missed PEP/HIO or third-party determinations at a required trigger. See ComplyFactor's identity verification guide and beneficial ownership guide for the underlying requirements themselves.

Transaction Reporting Violations

Late, missing, or incomplete suspicious transaction reports, large cash transaction reports, large virtual currency transaction reports, or electronic funds transfer reports. This is one of the categories FINTRAC's harm-done guides treat most seriously, since a missing or defective report can directly deprive FINTRAC of financial intelligence.

Recordkeeping Violations

Records not created, not retained for the required period, or not retrievable in the format and timeframe FINTRAC's guidance expects.

MSB and FMSB Registration Violations

Operating without required registration, failing to keep registration information current, or failing to renew on schedule. Registration violations can escalate beyond an AMP into registration cancellation, which is a separate enforcement consequence from a monetary penalty.

Other PCMLTFA Compliance Violations

Additional prescribed violations exist across ministerial directive compliance, agent and mandatary oversight, and other sector-specific obligations. Which categories actually apply to a given business depends on its reporting-entity sector and activities.

Minor, Serious and Very Serious FINTRAC Violations

The Administrative Monetary Penalties Regulations classify every prescribed violation by degree of importance, and each class carries its own penalty range. For violations that occurred entirely before March 26, 2026, the classification structure is:

These are per-violation ranges. Where a reporting entity commits multiple violations, whether multiple instances of the same violation type or several different violation types, the totals can exceed a single violation's range by a wide margin; FINTRAC's own guidance is explicit that the limits above apply per violation, not as a ceiling on the total penalty in a case.

Classification tells you the ceiling that applies to a single violation. It does not by itself tell you the final penalty amount. That figure depends on the harm-done assessment, compliance history, and, for post-March-2026 violations, ability to pay, applied to each specific violation and then aggregated across every violation in the matter.

How FINTRAC Determines an Administrative Monetary Penalty

The Act and the Administrative Monetary Penalty Regulations set out three factors FINTRAC must take into account: the non-punitive purpose of the AMP program itself, the harm done by the violation, and the reporting entity's compliance history. FINTRAC's published policy describes a two-step calculation built on these factors, and this policy, in its current published form, applies to violations that occurred entirely before March 26, 2026.

Step one is the harm-done assessment. FINTRAC first determines whether the entity completely failed to meet a requirement or only failed in part; where a requirement was met in part, the specific nature and degree of the shortfall is assessed against its impact on the Act's objectives and FINTRAC's mandate. Where a reporting entity completely failed to meet a requirement, FINTRAC's stated approach is to typically start from the maximum amount available for that violation's classification, since complete failure is treated as the primary obstacle to the Act's objectives. Step two applies the entity's compliance history and the non-punitive purpose of the program as an adjustment to the step-one figure, including whether the same issue had already been identified as a deficiency previously.

For violations occurring after March 26, 2026, the legislative amendments add ability to pay as an additional criterion FINTRAC must consider. FINTRAC has stated it is updating its AMP policy and developing new guidance to reflect the amended framework, including an updated approach to calculating penalties, and that this work continues in consultation with reporting entities and industry stakeholders. As of the most recent official update available at the time of writing, that detailed post-2026 calculation guidance had not yet been finalized and published. This article does not attempt to fill that gap with an assumed formula; where FINTRAC's current published methodology is described above, it is the pre-March-2026 policy that FINTRAC has confirmed continues to govern violations that occurred entirely before that date.

What Does FINTRAC Mean by "Harm Done"?

FINTRAC defines harm as the degree to which a violation interferes with the objectives of the PCMLTFA or with FINTRAC's own ability to carry out its mandate. This is why two violations that look similar on paper, a missing document versus a missing report, are not necessarily treated the same way.

FINTRAC's harm-done guides distinguish potential harm from resulting harm. Resulting harm refers to separate violations that flow from an original one; FINTRAC's own example is a compliance program that never addresses how to report large cash transactions, where the resulting harm is the large cash transactions that then went unreported. A control failure that also prevents FINTRAC from receiving financial intelligence it would otherwise have received, a missed suspicious transaction report, for instance, sits differently in this assessment than a documentation gap that does not itself block information FINTRAC needed. FINTRAC maintains separate harm-done assessment guides for compliance program violations, large cash/EFT/casino disbursement report violations, suspicious transaction report violations, know-your-client violations, recordkeeping violations, MSB registration violations, and other compliance measures, each reflecting how harm is assessed differently depending on what the underlying control actually protects.

FINTRAC Penalties Before and After March 26, 2026

This distinction matters more than a simple before/after summary can fully capture, and FINTRAC has been explicit that it should not be reduced to "FINTRAC fines increased in 2026." The Strengthening Canada's Immigration System and Borders Act received Royal Assent on March 26, 2026, and introduced a new AMP framework under the PCMLTFA. Which framework applies to a given violation depends on when that violation occurred, not when FINTRAC examines it or issues a Notice of Violation.

Violations Before March 26, 2026

FINTRAC has confirmed it will continue to apply the existing AMP policy, penalty amounts, and processes described above to violations that occurred entirely before March 26, 2026, regardless of when the examination or enforcement action addressing them takes place.

Violations After March 26, 2026

For violations occurring after that date, FINTRAC applies the new legislative framework. The amendments give FINTRAC authority to define prescribed violations and compliance-order violations subject to penalties, apply increased maximum penalty amounts, of up to 40 times the current limits, consider ability to pay as part of the penalty-determination criteria, require mandatory compliance agreements for prescribed violations, and introduce compliance orders as an additional enforcement tool. FINTRAC's updated AMP policy, once finalized, will set out its approach to calculating penalties, compliance agreements, and compliance orders under this framework.

What Happens When an Examination Covers Both Periods?

FINTRAC's supervisory assessments look at past activity, and the applicable AMP regime depends on both the examination period and the date each individual violation occurred. FINTRAC has stated its intent to scope examination review periods so they fall entirely within one legislative framework, applying the former policy where a review period sits entirely before March 26, 2026, and the new framework where it sits entirely on or after that date. Where a business's activity or an examination's scope genuinely straddles the transition date, the practical result is that the applicable rules are determined violation by violation rather than as a single blanket answer for the whole matter.

How Much Can FINTRAC Fine a Reporting Entity?

For violations that occurred entirely before March 26, 2026, the statutory maximums are the ones set out in the classification table above: $1,000 per minor violation, $100,000 per serious violation, and $500,000 per very serious violation for an entity ($100,000 for an individual). These are per-violation figures, and FINTRAC's public enforcement record shows total penalties well into the hundreds of thousands, and in some cases far higher, once a matter involves multiple violations or a large number of contravening instances.

For violations occurring after March 26, 2026, the legislative amendments authorize maximum penalty amounts up to 40 times the pre-amendment limits. Applied to the classification structure above, that places the post-amendment ceilings at roughly $40,000 per minor violation, $4,000,000 per serious violation, and $20,000,000 per very serious violation for an entity. These are the maximum statutory ceilings the new framework authorizes, not a prediction of what any specific matter will actually be penalized at; FINTRAC's stated calculation methodology for this new framework, including how the ability-to-pay criterion is applied in practice, was still being finalized as of the most recent official update available at the time of writing. The maximum statutory exposure and the actual imposed penalty are two different figures, determined by the harm-done, compliance-history, and (post-2026) ability-to-pay analysis described earlier, not simply by which classification a violation falls into.

Compliance Agreements and Compliance Orders Under the 2026 Framework

These are two of the enforcement tools the March 2026 amendments introduced, both distinct from an AMP itself. A compliance agreement is a formal arrangement between FINTRAC and a reporting entity; under the new framework, FINTRAC has authority to require mandatory compliance agreements for prescribed violations occurring after March 26, 2026. A compliance order is a separate, additional enforcement tool the amendments give FINTRAC authority to use.

FINTRAC has stated that its updated policy will include guidance on how compliance agreements and compliance orders actually operate, and that this guidance was still being developed, in consultation with reporting entities and industry stakeholders, as of the most recent official update available at the time of writing. Detailed procedural questions, exactly which violations will be designated as prescribed and trigger a mandatory agreement, what a compliance order can require, and how either interacts with an AMP in the same matter, remain subject to that pending guidance. This article does not speculate on procedures FINTRAC has not yet published; where a detail is not yet confirmed, that is stated directly rather than filled in.

Are FINTRAC Penalties Public?

Yes, in defined circumstances. FINTRAC must make public, as soon as feasible, the name of the reporting entity, the nature of the violation, and the penalty amount whenever a reporting entity pays a penalty issued in a Notice of Violation, neither pays nor makes representations, receives a Notice of Decision confirming a violation, enters into a compliance agreement, or fails to comply with a compliance agreement. FINTRAC's public notice page states that penalties are published where a Serious or Very Serious violation was committed, or where the total penalty is $10,000 or more. Published notices remain on FINTRAC's public website for five years.

Public notices also record current status, which is not the same as a final outcome in every case. FINTRAC's published notices distinguish paid and closed matters from those under appeal to the Federal Court, and some notices show a penalty amount that was later varied on appeal. An appealed matter is not resolved simply because FINTRAC has published the original decision, and the existence of an appeal does not itself establish that the underlying violations did not occur; it means the matter remains before the courts. Public enforcement carries a reputational dimension on top of the financial one: the notice is visible to banking partners, investors, and prospective clients for as long as it remains published.

What Recent FINTRAC Penalties Show About Compliance Risk

The examples below are drawn directly from FINTRAC's official public notice database and are included only to illustrate different types of compliance risk across sectors, not as a scoreboard. Status reflects what FINTRAC's notice stated as of the most recent check.

Xeltox Enterprises Ltd. (operating as Cryptomus, formerly Certa Payments Ltd.) — money services business

Imposed $176,960,190 on October 16, 2025, for 2,593 contraventions of the PCMLTFA across 6 types of violations. Under appeal to the Federal Court. The scale of this matter illustrates how a very high number of individual contravening instances, even under the pre-2026 per-violation maximums, can aggregate into an exceptionally large total. The lesson is structural: penalty exposure compounds with transaction volume and repeated instances of the same control failure, not just with the severity of any one violation.

Peken Global Limited (operating as KuCoin) — foreign money services business

Imposed $19,552,000 on July 28, 2025, for 3 violations, following FINTRAC's determination that the business was operating as an FMSB in Canada. Under appeal. This illustrates that FMSB determination and registration status carry real enforcement weight for foreign-domiciled platforms serving Canadian clients, independent of where the business is incorporated.

VIP Realty Inc. (operating as Royal LePage Integrity Realty Inc.) — real estate brokerage

Imposed $33,000 on December 1, 2025, for 1 violation. Paid in full; case closed. This sits at the other end of the spectrum from the examples above: a single violation, a comparatively modest penalty, and a matter resolved without an appeal. It is a useful reminder that not every AMP is a large, contested, multi-violation matter.

Birks Group Inc. (operating as Birks) — dealer in precious metals and precious stones

Imposed $51,562.50 on March 11, 2026, for 3 violations. Under appeal. Included to show that sector diversity in FINTRAC's enforcement record is real; dealers in precious metals and stones, along with real estate brokerages, banks, credit unions, casinos, securities dealers, and MSBs, all appear regularly in the public notice record, not only MSBs and crypto platforms.

The complete, current list is maintained directly by FINTRAC at its public notice of administrative monetary penalties page.

A FINTRAC Finding Is Not Automatically an AMP

It helps to separate the stages a compliance issue can move through, without assuming every issue automatically progresses through all of them. An examination can surface an observation or a finding; FINTRAC's own policy describes several possible responses once non-compliance is identified, including taking no further action, conducting follow-up assessment activity, issuing an AMP, or disclosing information to law enforcement. A finding can also lead to a required corrective action without escalating to a formal violation and penalty at all.

Only where FINTRAC has reasonable grounds to believe a specific prescribed requirement was actually violated does the matter become a violation capable of supporting a Notice of Violation and an AMP, and even then, FINTRAC exercises judgment about whether an AMP, a compliance agreement, a compliance order, or another response is the appropriate outcome. There is no guaranteed, mechanical ladder from observation to penalty; different facts and circumstances produce different outcomes. The practical implication is that identifying and correcting a deficiency early, before an examination surfaces it, is a genuine opportunity, not just a formality, since the earlier stages of this progression carry meaningfully lower consequences than a confirmed violation does.

How to Identify FINTRAC Penalty Exposure Before an Examination

The areas below form a practical review framework. None of this guarantees a business will avoid a penalty; it is a structured way to find out where exposure actually sits before FINTRAC does.

Registration status and regulatory information

Confirm registration is active, current, and accurately reflects the business's actual activities and locations.

AML compliance program

Test whether written policies describe what the business actually does, not an idealized or superseded version.

Risk assessment

Confirm it is business-specific, dated, and actually drives the controls applied elsewhere in the program.

Identity verification

Sample client files to confirm the method used, and the evidence retained, match what current guidance requires.

Beneficial ownership

Confirm ownership determinations are documented with reasoning, not just a name on a form.

PEP/HIO controls

Confirm determinations are made at the required triggers and that enhanced measures are visibly applied where required.

Third-party determination

Confirm the question is actually being asked and documented at applicable transactions, not assumed away.

Transaction reporting

Test a sample of reportable transactions against what was actually filed, and check for late or missing reports.

Recordkeeping

Confirm records can actually be retrieved within the retention period, not just that a policy says they exist.

High-risk client monitoring

Confirm enhanced monitoring is visibly different in practice for relationships rated high risk.

Agent/mandatary controls

Confirm eligibility verification and criminal record checks are current where agents or mandataries are engaged.

Training

Confirm training was actually delivered and completion is evidenced, not just scheduled.

Effectiveness review

Confirm one has been completed within the required interval and that its findings were actually addressed.

Evidence that controls operate in practice

The most important line: written policy without operational evidence is exactly the gap FINTRAC's harm-done methodology treats as a complete failure.

What to Remediate First When Compliance Gaps Are Found

Where a review surfaces multiple gaps at once, prioritization matters. A reasonable sequence, though every situation should be assessed on its own facts:

Priority 1: Potentially ongoing regulatory breaches. A control failure that is still actively occurring (an unregistered activity, a live reporting gap) generally warrants the fastest attention, since the exposure continues to accrue.

Priority 2: Missed or inaccurate regulatory reporting. Late, missing, or incorrect STR, LCTR, LVCTR, or EFTR filings sit close behind, given how heavily FINTRAC's harm-done framework weighs interference with the reports it actually relies on.

Priority 3: KYC, client-risk, and control failures. Identity verification, beneficial ownership, PEP/HIO, and third-party determination gaps that affect current or ongoing client relationships.

Priority 4: Documentation that does not match actual operations. Policies describing a process the business does not actually follow, since this is precisely the gap between design and implementation FINTRAC's post-2026 effectiveness standard tests directly.

Priority 5: Governance, training, and evidence gaps. Missing training records, an overdue effectiveness review, or thin documentation of decisions that were, in substance, made correctly.

Where a gap amounts to actual non-compliance already identified internally, FINTRAC's guidance on voluntary self-declaration of non-compliance may be relevant; FINTRAC has stated it strongly encourages entities to declare non-compliance they discover themselves. Whether self-declaration is the right step in a specific situation depends on the facts, and this is a decision that should be made against current FINTRAC guidance and, where appropriate, legal advice, not applied automatically. This article does not provide legal advice and does not recommend self-reporting as a default response.

What to Do If You Already Received a FINTRAC Notice of Violation

If a Notice of Violation has already been issued, the response deadlines and rights described in this article's general discussion of the AMP process are time-sensitive: representations to FINTRAC's Director and CEO must generally be made within 30 days of receiving the Notice. This is not the article to work from for that response. See ComplyFactor's dedicated guide, how to respond to a FINTRAC Notice of Violation, for the complete response procedure.

How FINTRAC Penalty Risk Connects to the 2026 Effectiveness Standard

Since March 2026, FINTRAC examines compliance programs against a standard that asks not just whether a program exists on paper, but whether it is reasonably designed, risk-based, and effective in practice. A program that looks complete in its written policies but cannot demonstrate that its controls actually operate is exactly the kind of gap the harm-done methodology treats as a more serious failure, since it reflects a program not functioning as intended rather than a single missed step. For the complete detail behind this standard, see ComplyFactor's guide to FINTRAC's 2026 effectiveness standard; this article's point is narrower: an ineffective program is not just an examination finding, it is the condition that turns findings into penalties.

FINTRAC Penalty Prevention and Remediation Checklist

Is the reporting entity correctly registered, with current and accurate FINTRAC information?

Does the compliance program's written policy actually match current operations?

Is the risk assessment current, business-specific, and evidence-based?

Are identity verification controls operating as written, not just documented?

Are beneficial ownership determinations documented with clear reasoning?

Are PEP/HIO determinations made at the correct triggers, with enhanced measures visibly applied?

Is third-party determination actually performed and documented at applicable transactions?

Are reporting thresholds automated or otherwise reliably controlled, rather than dependent on manual judgment alone?

Are late, missing, or rejected reports investigated and corrected, not just noted?

Are STR escalation decisions, including decisions not to file, documented with reasoning?

Are records actually retrievable within the required retention period, not just retained somewhere?

Are agents and mandataries monitored, with eligibility and criminal record checks current where applicable?

Has staff training been completed and evidenced, with role-specific content?

Has the effectiveness review identified findings that remain unresolved?

Can management demonstrate, with evidence, that corrective action was actually taken?

How ComplyFactor Supports FINTRAC Remediation

Where exposure is genuinely unknown, an independent AML effectiveness review tests the program the way a FINTRAC examiner would and identifies gaps before FINTRAC does. Where specific findings or deficiencies have already surfaced, whether from an internal review, a prior examination, or a notice already received, FINTRAC compliance remediation support helps correct them and build a defensible response. Where the underlying program itself is outdated or was never built to reflect the current effectiveness standard, AML compliance program remediation rebuilds it from the business outward. And where a business has no internal owner to keep any of this current between reviews, fractional compliance officer support provides that ongoing function. None of these services prevent or cancel a FINTRAC penalty; what they do is reduce the gap between what a compliance program claims and what it can actually demonstrate, which is the gap FINTRAC's own harm-done and effectiveness assessments are built to find.

Frequently Asked Questions

What is a FINTRAC administrative monetary penalty?

A monetary sanction FINTRAC can impose on a reporting entity it has reasonable grounds to believe violated the PCMLTFA or its Regulations. It is an administrative measure intended to encourage compliance, not a criminal charge, and cannot be pursued alongside a criminal charge for the same non-compliance.

What can FINTRAC issue fines for?

Prescribed violations across compliance program requirements, know-your-client and identity verification failures, transaction reporting failures, recordkeeping failures, MSB/FMSB registration failures, and other PCMLTFA compliance measures, depending on the reporting entity's sector.

What is the difference between a minor, serious and very serious violation?

These are the three classifications the Administrative Monetary Penalties Regulations assign to prescribed violations, each with its own penalty range. Classification sets the ceiling for a single violation; it does not by itself determine the final penalty, which depends on harm done, compliance history, and (for post-March-2026 violations) ability to pay.

How much can FINTRAC fine a business?

For violations entirely before March 26, 2026: up to $1,000 (minor), $100,000 (serious), or $500,000 for an entity/$100,000 for an individual (very serious), per violation, with totals able to exceed these ranges where multiple violations are involved. For violations after that date, maximum penalty amounts rise to up to 40 times these limits under the new legislative framework.

Did FINTRAC penalties increase in 2026?

The maximum statutory penalty ceilings increased substantially for violations occurring after March 26, 2026, under Bill C-12. Violations that occurred entirely before that date continue to be assessed under the previous framework and amounts, so the applicable ceiling depends on when the violation occurred, not when it is examined.

How does FINTRAC calculate an AMP?

Under the pre-March-2026 policy, which continues to apply to violations occurring entirely before that date, FINTRAC assesses harm done (starting from the maximum for a complete failure, or a severity-based amount for partial failure), then adjusts for compliance history under the program's non-punitive purpose. FINTRAC has stated its calculation approach for the post-2026 framework, including how ability to pay applies, was still being finalized as of the most recent official update available at the time of writing.

Are FINTRAC penalties made public?

Yes, where a Serious or Very Serious violation was committed, or the total penalty is $10,000 or more. FINTRAC publishes the entity's name, the nature of the violation, and the penalty amount, and the notice remains public for five years, updated to reflect status such as paid, appealed, or varied on appeal.

Can a FINTRAC penalty be appealed or reviewed?

Yes. A reporting entity can make written representations to FINTRAC's Director and CEO within 30 days of a Notice of Violation, and can appeal a resulting Notice of Decision to the Federal Court within 30 days of receiving it. An appealed matter remains open, not resolved, until the court process concludes.

Is every FINTRAC examination finding a violation?

No. FINTRAC's response to identified non-compliance ranges from no further action, to follow-up assessment, to an AMP, to a law-enforcement referral, and a finding can lead to required corrective action without becoming a formal violation. Only confirmed violations, where FINTRAC has reasonable grounds to believe a specific requirement was breached, can support a Notice of Violation.

What is a FINTRAC compliance agreement?

A formal arrangement between FINTRAC and a reporting entity, which the post-March-2026 framework makes mandatory for prescribed violations. Detailed guidance on how compliance agreements operate in practice was still being developed by FINTRAC as of the most recent official update available at the time of writing.

How can a business reduce future FINTRAC penalty exposure?

By testing whether compliance controls actually operate as written, not just assuming documentation equals compliance, and by remediating confirmed gaps in priority order, starting with any ongoing breach, before an examination surfaces them. An independent effectiveness review is the most direct way to find out where exposure currently sits.

Reducing FINTRAC Enforcement Exposure Before It Becomes a Penalty

FINTRAC's penalty framework is evidence-driven at every stage: how a violation is classified, how harm is assessed, how compliance history is weighed, and, for violations after March 26, 2026, how ability to pay factors in. None of that changes the more basic point: a gap between what a compliance program says and what it actually does is what turns an examination finding into a penalty. The March 2026 framework raised the statutory ceiling and added new tools, mandatory compliance agreements and compliance orders, but it did not change the underlying logic that early, evidenced remediation sits in a fundamentally different position than a confirmed violation.

Testing your controls before FINTRAC does is the only way to know, rather than assume, where your exposure actually sits. ComplyFactor's Canadian AML advisory team can review your program against current FINTRAC expectations and help prioritize what to fix first.