FINTRAC Administrative Monetary Penalties: Fines, Violations and Remediation

An administrative monetary penalty (AMP) is the financial enforcement tool FINTRAC uses against reporting entities found non-compliant with the PCMLTFA and its Regulations. It is an administrative measure, not automatically a criminal charge. The two are legally distinct, and the Act does not allow both to be pursued for the same instance of non-compliance. AMPs are set under a defined legal framework, and that framework changed on March 26, 2026.

What a specific business actually faces if FINTRAC identifies a compliance gap depends on the nature of the violation, the harm it caused, the entity's compliance history, and, since March 2026, its ability to pay and whether the violation falls before or after the legislative change. This article sets out how the AMP framework works, what changed and when, how FINTRAC's public enforcement record functions, and how a reporting entity can identify and remediate exposure before a deficiency becomes a penalty.

What Is a FINTRAC Administrative Monetary Penalty?

An administrative monetary penalty is a monetary sanction FINTRAC can impose on a reporting entity it has reasonable grounds to believe has violated a requirement of the PCMLTFA or its associated Regulations. FINTRAC has held this authority since December 30, 2008. The purpose of the AMP program is explicitly non-punitive: FINTRAC states its aim is to encourage a change in behaviour toward future compliance, not to punish, and the program is meant to provide a measured, proportionate response to specific instances of non-compliance.

An AMP is separate from criminal enforcement. Failure to comply with the relevant parts of the PCMLTFA can result in either an AMP or a criminal charge for a non-compliance offence, but the Act does not allow both to be pursued for the same instance of non-compliance. FINTRAC can also refer matters to law enforcement where it has reasonable grounds to suspect the information is relevant to investigating or prosecuting a non-compliance offence.

An AMP process begins with a Notice of Violation, which sets out the specific violations, the proposed penalty, and the entity's rights. ComplyFactor's guide to responding to a FINTRAC Notice of Violation covers that response process in full; this article covers the penalty framework and leaves the procedural steps after a Notice arrives to that guide.

What Can FINTRAC Issue a Penalty For?

Violations that can support an AMP are prescribed in the Proceeds of Crime (Money Laundering) and Terrorist Financing Administrative Monetary Penalties Regulations. Rather than list every statutory provision, the categories below reflect the control areas FINTRAC's own harm-done assessment guides are organized around.

AML Compliance Program Violations

Missing or deficient elements of the compliance program itself: no designated compliance officer with real authority, policies and procedures that do not reflect the actual business, no current risk assessment, no training program, or no effectiveness review completed within the required interval.

Know Your Client and Identity Verification Violations

Failures in verifying identity using a permitted method, incomplete beneficial ownership determination, or missed PEP/HIO or third-party determinations at a required trigger. See ComplyFactor's identity verification guide and beneficial ownership guide for the underlying requirements themselves.

Transaction Reporting Violations

Late, missing, or incomplete suspicious transaction reports, large cash transaction reports, large virtual currency transaction reports, or electronic funds transfer reports. This is one of the categories FINTRAC's harm-done guides treat most seriously, since a missing or defective report can directly deprive FINTRAC of financial intelligence.

Recordkeeping Violations

Records not created, not retained for the required period, or not retrievable in the format and timeframe FINTRAC's guidance expects.

MSB and FMSB Registration Violations

Operating without required registration, failing to keep registration information current, or failing to renew on schedule. FINTRAC can also revoke a registration on the grounds set out in the Act, which is a separate consequence from a monetary penalty.

Other PCMLTFA Compliance Violations

Additional prescribed violations exist across ministerial directive compliance, agent and mandatary oversight, and other sector-specific obligations. Which categories actually apply to a given business depends on its reporting-entity sector and activities.

Minor, Serious and Very Serious FINTRAC Violations

The Administrative Monetary Penalties Regulations classify every prescribed violation by degree of importance, and each class carries its own penalty range. For violations that occurred entirely before March 26, 2026, the classification structure is:

These are per-violation ranges. Where a reporting entity commits multiple violations, whether multiple instances of the same violation type or several different violation types, the totals can exceed a single violation's range by a wide margin; FINTRAC's own guidance is explicit that the limits above apply per violation, not as a ceiling on the total penalty in a case.

Classification tells you the ceiling that applies to a single violation. It does not by itself tell you the final penalty amount. That figure depends on the harm-done assessment, compliance history, and, for post-March-2026 violations, ability to pay, applied to each specific violation and then aggregated across every violation in the matter.

How FINTRAC Determines an Administrative Monetary Penalty

The Act and the Administrative Monetary Penalty Regulations set out three factors FINTRAC must take into account: the non-punitive purpose of the AMP program itself, the harm done by the violation, and the reporting entity's compliance history. FINTRAC's published policy describes a two-step calculation built on these factors, and this policy, in its current published form, applies to violations that occurred entirely before March 26, 2026.

Step one is the harm-done assessment. FINTRAC first determines whether the entity completely failed to meet a requirement or only failed in part; where a requirement was met in part, the specific nature and degree of the shortfall is assessed against its impact on the Act's objectives and FINTRAC's mandate. Where a reporting entity completely failed to meet a requirement, FINTRAC's stated approach is to typically start from the maximum amount available for that violation's classification, since complete failure is treated as the primary obstacle to the Act's objectives. Step two applies the entity's compliance history and the non-punitive purpose of the program as an adjustment to the step-one figure, including whether the same issue had already been identified as a deficiency previously.

For violations occurring since March 26, 2026, the legislative amendments add ability to pay as an additional criterion FINTRAC must consider. FINTRAC has stated it is updating its AMP policy and developing new guidance to reflect the amended framework, including an updated approach to calculating penalties, and that this work continues in consultation with reporting entities and industry stakeholders. As of the most recent official update available at the time of writing, that detailed post-2026 calculation guidance had not yet been finalized and published. This article does not assume a formula. The methodology described above is the pre-March-2026 policy, which FINTRAC has confirmed continues to govern violations that occurred entirely before that date.

What Does FINTRAC Mean by "Harm Done"?

FINTRAC defines harm as the degree to which a violation interferes with the objectives of the PCMLTFA or with FINTRAC's own ability to carry out its mandate. This is why two violations that look similar on paper, a missing document versus a missing report, are not necessarily treated the same way.

FINTRAC's harm-done guides distinguish potential harm from resulting harm. Resulting harm refers to separate violations that flow from an original one; FINTRAC's own example is a compliance program that never addresses how to report large cash transactions, where the resulting harm is the large cash transactions that then went unreported. A control failure that also prevents FINTRAC from receiving financial intelligence it would otherwise have received, a missed suspicious transaction report, for instance, sits differently in this assessment than a documentation gap that does not itself block information FINTRAC needed. FINTRAC maintains separate harm-done assessment guides for compliance program violations, large cash/EFT/casino disbursement report violations, suspicious transaction report violations, know-your-client violations, recordkeeping violations, MSB registration violations, and other compliance measures, each reflecting how harm is assessed differently depending on what the underlying control actually protects.

FINTRAC Penalties Before and After March 26, 2026

The Strengthening Canada's Immigration System and Borders Act (Bill C-12) received Royal Assent on March 26, 2026 (S.C. 2026, c. 4), and FINTRAC states that the new AMP framework came into force that day. Which framework applies to a given violation depends on when that violation occurred, not when FINTRAC examines it or issues a Notice of Violation.

Violations Before March 26, 2026

FINTRAC has confirmed it will continue to apply the existing AMP policy, penalty amounts, and processes described above to violations that occurred entirely before March 26, 2026, regardless of when the examination or enforcement action addressing them takes place.

Violations Since March 26, 2026

For violations occurring since that date, FINTRAC applies the new legislative framework. The amendments give FINTRAC authority to define prescribed violations and compliance-order violations subject to penalties, apply increased maximum penalty amounts, of up to 40 times the current limits, consider ability to pay as part of the penalty-determination criteria, require mandatory compliance agreements for prescribed violations, and introduce compliance orders as an additional enforcement tool. FINTRAC's updated AMP policy, once finalized, will set out its approach to calculating penalties, compliance agreements, and compliance orders under this framework.

What Happens When an Examination Covers Both Periods?

FINTRAC's supervisory assessments look at past activity, and the applicable AMP regime depends on both the examination period and the date each individual violation occurred. FINTRAC has stated its intent to scope examination review periods so they fall entirely within one legislative framework, applying the former policy where a review period sits entirely before March 26, 2026, and the new framework where it sits entirely within the period since that date. FINTRAC has not published guidance on how a continuing violation that straddles the transition date is treated, so a matter that spans both periods should be assessed with advice.

How Much Can FINTRAC Fine a Reporting Entity?

For violations that occurred entirely before March 26, 2026, the maximums were $1,000 per minor violation, $100,000 per serious violation and, for a very serious violation, $100,000 for an individual and $500,000 for an entity. Those limits applied to each violation separately, so a notice covering several violations could carry a total above the maximum for any single violation.

For violations occurring since March 26, 2026, the penalty ranges are $1 to $40,000 for a minor violation, $1 to $4,000,000 for a serious violation and $1 to $20,000,000 for a very serious violation. The Act caps any single prescribed violation at $4,000,000 for an individual and $20,000,000 for an entity, so a very serious violation by an individual is capped at $4,000,000. FINTRAC describes the increase as up to 40 times the previous limits.

A series of minor violations on one notice is treated as a serious violation if the penalties total $400,000 or more. For all prescribed violations on one notice, the maximum is the greater of $4,000,000 and 3% of the person's gross global income in the previous year, or for an entity the greater of $20,000,000 and 3% of its gross global revenue in its previous financial year. For an entity in a group of affiliated entities, the group's revenue is used.

These are statutory ceilings, not a prediction of what any matter will be penalized at. The amount imposed depends on the harm done, compliance history and ability to pay, not on classification alone. FINTRAC has said its calculation approach for the new framework, including how ability to pay is applied, was still being finalized as of the most recent official update available at the time of writing.

Compliance Agreements and Compliance Orders Under the 2026 Framework

These are two of the enforcement tools the March 2026 amendments introduced, both distinct from an AMP itself. A compliance agreement is a formal arrangement between FINTRAC and a reporting entity; under the new framework, FINTRAC must require a compliance agreement once proceedings end for a prescribed violation occurring since March 26, 2026. A compliance order is a separate, additional enforcement tool: if the entity refuses or fails to comply with the agreement, the Director must issue one, and contravening a compliance order is a separate violation.

FINTRAC has stated that its updated policy will include guidance on how compliance agreements and compliance orders actually operate, and that this guidance was still being developed, in consultation with reporting entities and industry stakeholders, as of the most recent official update available at the time of writing. Detailed procedural questions remain subject to that pending guidance. This article does not speculate on procedures FINTRAC has not yet published.

Are FINTRAC Penalties Public?

Yes, in defined circumstances. FINTRAC must make public, as soon as feasible, the name of the reporting entity, the nature of the violation, and the penalty amount when a person is deemed to have committed a violation (including by paying the proposed penalty or not responding to the Notice of Violation) or is served with a decision finding a violation. FINTRAC's public notice page states that penalties are published where a Serious or Very Serious violation was committed, or where the total penalty is $10,000 or more. Published notices remain on FINTRAC's public website for five years.

Public notices also record current status, which is not the same as a final outcome in every case. FINTRAC's published notices distinguish paid and closed matters from those under appeal to the Federal Court, and some notices show a penalty amount that was later varied on appeal. An appealed matter is not resolved simply because FINTRAC has published the original decision, and the existence of an appeal does not itself establish that the underlying violations did not occur; it means the matter remains before the courts. Public enforcement carries a reputational dimension on top of the financial one: the notice is visible to banking partners, investors, and prospective clients for as long as it remains published.

What Recent FINTRAC Penalties Show About Compliance Risk

The examples below are drawn from FINTRAC's official public notice database and illustrate different types of compliance risk across sectors. Status reflects what FINTRAC's notice stated as of the most recent check.

Xeltox Enterprises Ltd. (operating as Cryptomus, formerly Certa Payments Ltd.): money services business

Imposed $176,960,190 on October 16, 2025, for 2,593 contraventions of the PCMLTFA across 6 types of violations. Under appeal to the Federal Court. The scale of this matter illustrates how a very high number of individual contravening instances, even under the pre-2026 per-violation maximums, can aggregate into an exceptionally large total. Penalty exposure compounds with transaction volume and repeated instances of the same control failure, as well as with the severity of any one violation.

Peken Global Limited (operating as KuCoin): foreign money services business

Imposed $19,552,000 on July 28, 2025, for 3 violations, following FINTRAC's determination that the business was operating as an FMSB in Canada. Under appeal. FMSB status carries enforcement weight for foreign-domiciled platforms serving Canadian clients, wherever the business is incorporated.

VIP Realty Inc. (operating as Royal LePage Integrity Realty Inc.): real estate brokerage

Imposed $33,000 on December 1, 2025, for 1 violation. Paid in full; case closed. This is the other end of the range from the examples above: one violation, a comparatively modest penalty, and a matter resolved without an appeal. Many AMPs are not large, contested, multi-violation matters.

Birks Group Inc. (operating as Birks): dealer in precious metals and precious stones

Imposed $51,562.50 on March 11, 2026, for 3 violations. Under appeal. Dealers in precious metals and stones, real estate brokerages, banks, credit unions, casinos, securities dealers, and MSBs all appear regularly in the public notice record, so enforcement reaches well beyond MSBs and crypto platforms.

The complete, current list is maintained directly by FINTRAC at its public notice of administrative monetary penalties page.

A FINTRAC Finding Is Not Automatically an AMP

A compliance issue can move through several stages, and not every issue goes through all of them. An examination can surface an observation or a finding; FINTRAC's own policy describes several possible responses once non-compliance is identified, including taking no further action, conducting follow-up assessment activity, issuing an AMP, or disclosing information to law enforcement. A finding can also lead to a required corrective action without escalating to a formal violation and penalty at all.

Only where FINTRAC has reasonable grounds to believe a specific prescribed requirement was actually violated does the matter become a violation capable of supporting a Notice of Violation and an AMP, and even then, FINTRAC exercises judgment about whether an AMP, a compliance agreement, a compliance order, or another response is the appropriate outcome. An observation does not lead mechanically to a penalty; different facts and circumstances produce different outcomes. Correcting a deficiency before an examination surfaces it is worthwhile, since the earlier stages carry meaningfully lower consequences than a confirmed violation does.

How to Identify FINTRAC Penalty Exposure Before an Examination

Use the areas below as a review checklist. They will not guarantee that a business avoids a penalty, but they show where exposure sits before FINTRAC finds it.

Registration status and regulatory information

Confirm registration is active, current, and accurately reflects the business's actual activities and locations.

AML compliance program

Test whether written policies describe what the business does today.

Risk assessment

Confirm it is business-specific, dated, and actually drives the controls applied elsewhere in the program.

Identity verification

Sample client files to confirm the method used, and the evidence retained, match what current guidance requires.

Beneficial ownership

Confirm ownership determinations are documented with reasoning, since a name on a form is not enough.

PEP/HIO controls

Confirm determinations are made at the required triggers and that enhanced measures are visibly applied where required.

Third-party determination

Confirm the question is actually being asked and documented at applicable transactions.

Transaction reporting

Test a sample of reportable transactions against what was actually filed, and check for late or missing reports.

Recordkeeping

Confirm records can be retrieved within the retention period; a policy saying they exist is not enough.

High-risk client monitoring

Confirm enhanced monitoring is visibly different in practice for relationships rated high risk.

Agent/mandatary controls

Confirm eligibility verification and criminal record checks are current where agents or mandataries are engaged.

Training

Confirm training was delivered and that completion is evidenced.

Effectiveness review

Confirm one has been completed within the required interval and that its findings were actually addressed.

Evidence that controls operate in practice

A written policy without operational evidence is the gap FINTRAC's harm-done methodology treats as a complete failure.

What to Remediate First When Compliance Gaps Are Found

Where a review surfaces multiple gaps at once, prioritization matters. A reasonable sequence, though every situation should be assessed on its own facts:

Priority 1: Potentially ongoing regulatory breaches. A control failure that is still actively occurring (an unregistered activity, a live reporting gap) generally warrants the fastest attention, since the exposure continues to accrue.

Priority 2: Missed or inaccurate regulatory reporting. Late, missing, or incorrect STR, LCTR, LVCTR, or EFTR filings sit close behind, given how heavily FINTRAC's harm-done framework weighs interference with the reports it actually relies on.

Priority 3: KYC, client-risk, and control failures. Identity verification, beneficial ownership, PEP/HIO, and third-party determination gaps that affect current or ongoing client relationships.

Priority 4: Documentation that does not match actual operations. Policies describing a process the business does not actually follow, since this is precisely the gap between design and implementation FINTRAC's post-2026 effectiveness standard tests directly.

Priority 5: Governance, training, and evidence gaps. Missing training records, an overdue effectiveness review, or thin documentation of decisions that were, in substance, made correctly.

Where a gap amounts to actual non-compliance already identified internally, FINTRAC's guidance on voluntary self-declaration of non-compliance may be relevant; FINTRAC has stated it strongly encourages entities to declare non-compliance they discover themselves. Whether self-declaration is the right step in a specific situation depends on the facts, and should be decided against current FINTRAC guidance and, where appropriate, legal advice. This article does not provide legal advice and does not recommend self-reporting as a default response.

What to Do If You Already Received a FINTRAC Notice of Violation

If a Notice of Violation has already been issued, the response deadlines and rights described in this article's general discussion of the AMP process are time-sensitive: representations to FINTRAC's Director and CEO must generally be made within 30 days of receiving the Notice. For the complete response procedure, see ComplyFactor's dedicated guide, how to respond to a FINTRAC Notice of Violation.

How FINTRAC Penalty Risk Connects to the 2026 Effectiveness Standard

Since March 2026, FINTRAC examines compliance programs against a standard that asks whether a program is reasonably designed, risk-based, and effective in practice, in addition to whether it exists on paper. A program that looks complete in its written policies but cannot demonstrate that its controls actually operate is exactly the kind of gap the harm-done methodology treats as a more serious failure, since it points to a program that is not functioning as intended instead of one missed step. For the complete detail behind this standard, see ComplyFactor's guide to FINTRAC's 2026 effectiveness standard.

FINTRAC Penalty Prevention and Remediation Checklist

Is the reporting entity correctly registered, with current and accurate FINTRAC information?

Does the compliance program's written policy actually match current operations?

Is the risk assessment current, business-specific, and evidence-based?

Are identity verification controls operating as written?

Are beneficial ownership determinations documented with clear reasoning?

Are PEP/HIO determinations made at the correct triggers, with enhanced measures visibly applied?

Is third-party determination actually performed and documented at applicable transactions?

Are reporting thresholds automated or otherwise reliably controlled, rather than dependent on manual judgment alone?

Are late, missing, or rejected reports investigated and corrected?

Are STR escalation decisions, including decisions not to file, documented with reasoning?

Are records actually retrievable within the required retention period?

Are agents and mandataries monitored, with eligibility and criminal record checks current where applicable?

Has staff training been completed and evidenced, with role-specific content?

Has the effectiveness review identified findings that remain unresolved?

Can management demonstrate, with evidence, that corrective action was actually taken?

How ComplyFactor Supports FINTRAC Remediation

Where exposure is genuinely unknown, an independent AML effectiveness review tests the program the way a FINTRAC examiner would and identifies gaps before FINTRAC does. Where specific findings or deficiencies have already surfaced, whether from an internal review, a prior examination, or a notice already received, FINTRAC compliance remediation support helps correct them and build a defensible response. Where the underlying program itself is outdated or was never built to reflect the current effectiveness standard, AML compliance program remediation rebuilds it from the business outward. And where a business has no internal owner to keep any of this current between reviews, fractional compliance officer support provides that ongoing function. None of these services prevents or cancels a FINTRAC penalty. They narrow the gap between what a compliance program claims and what it can demonstrate, which is the gap FINTRAC's own harm-done and effectiveness assessments are built to find.

Frequently Asked Questions

What is a FINTRAC administrative monetary penalty?

A monetary sanction FINTRAC can impose on a reporting entity it has reasonable grounds to believe violated the PCMLTFA or its Regulations. It is an administrative measure intended to encourage compliance, not a criminal charge, and cannot be pursued alongside a criminal charge for the same non-compliance.

What can FINTRAC issue fines for?

Prescribed violations across compliance program requirements, know-your-client and identity verification failures, transaction reporting failures, recordkeeping failures, MSB/FMSB registration failures, and other PCMLTFA compliance measures, depending on the reporting entity's sector.

What is the difference between a minor, serious and very serious violation?

These are the three classifications the Administrative Monetary Penalties Regulations assign to prescribed violations, each with its own penalty range. Classification sets the ceiling for a single violation; it does not by itself determine the final penalty, which depends on harm done, compliance history, and (for violations since March 26, 2026) ability to pay.

How much can FINTRAC fine a business?

Since March 26, 2026: up to $40,000 (minor), $4,000,000 (serious), and $20,000,000 for an entity or $4,000,000 for an individual (very serious), per violation. For violations entirely before that date: up to $1,000 (minor), $100,000 (serious), and $500,000 for an entity or $100,000 for an individual (very serious). Totals on one notice can exceed the maximum for a single violation.

Did FINTRAC penalties increase in 2026?

The maximum statutory penalty ceilings increased substantially for violations occurring since March 26, 2026, under Bill C-12. Violations that occurred entirely before that date continue to be assessed under the previous framework and amounts, so the applicable ceiling depends on when the violation occurred, not when it is examined.

How does FINTRAC calculate an AMP?

Under the pre-March-2026 policy, which continues to apply to violations occurring entirely before that date, FINTRAC assesses harm done (starting from the maximum for a complete failure, or a severity-based amount for partial failure), then adjusts for compliance history under the program's non-punitive purpose. FINTRAC has stated its calculation approach for the post-2026 framework, including how ability to pay applies, was still being finalized as of the most recent official update available at the time of writing.

Are FINTRAC penalties made public?

Yes, where a Serious or Very Serious violation was committed, or the total penalty is $10,000 or more. FINTRAC publishes the entity's name, the nature of the violation, and the penalty amount, and the notice remains public for five years, updated to reflect status such as paid, appealed, or varied on appeal.

Can a FINTRAC penalty be appealed or reviewed?

Yes. A reporting entity can make written representations to FINTRAC's Director and CEO within 30 days of a Notice of Violation. For serious and very serious violations, it can appeal the Director's decision to the Federal Court within 30 days after the notice of decision is served. An appealed matter remains open, not resolved, until the court process concludes.

Is every FINTRAC examination finding a violation?

No. FINTRAC's response to identified non-compliance ranges from no further action, to follow-up assessment, to an AMP, to a law-enforcement referral, and a finding can lead to required corrective action without becoming a formal violation. Only confirmed violations, where FINTRAC has reasonable grounds to believe a specific requirement was breached, can support a Notice of Violation.

What is a FINTRAC compliance agreement?

A formal arrangement between FINTRAC and a reporting entity, which the framework in force since March 26, 2026 makes mandatory for prescribed violations. Detailed guidance on how compliance agreements operate in practice was still being developed by FINTRAC as of the most recent official update available at the time of writing.

How can a business reduce future FINTRAC penalty exposure?

By testing whether compliance controls operate as written instead of assuming documentation equals compliance, and by remediating confirmed gaps in priority order, starting with any ongoing breach, before an examination surfaces them. An independent effectiveness review is the most direct way to find out where exposure currently sits.

Reducing FINTRAC Enforcement Exposure Before It Becomes a Penalty

FINTRAC's penalty framework is evidence-driven at every stage: how a violation is classified, how harm is assessed, how compliance history is weighed, and, for violations since March 26, 2026, how ability to pay factors in. A gap between what a compliance program says and what it actually does is what turns an examination finding into a penalty. The March 2026 framework raised the statutory ceiling and added mandatory compliance agreements and compliance orders. Early, evidenced remediation still puts a business in a better position than a confirmed violation.

Testing your controls before FINTRAC does is the way to find out where your exposure sits. ComplyFactor's Canadian AML advisory team can review your program against current FINTRAC expectations and help prioritize what to fix first.