$247M in a Year: What FINTRAC's Record Penalties Mean for MSBs

On 26 October 2026, FINTRAC published its 2025–26 annual report, Safe Canadians, Secure Economy. The headline figure is a record. According to FINTRAC's announcement, it issued 35 notices of violation in the fiscal year, "up 52% from the previous year, for more than $247 million", the largest penalty amount in its history. The year before, it issued 23 notices worth about $25 million.

That makes 2025–26 a record year for FINTRAC penalties. But the total is dominated by a small number of very large cases involving virtual currency businesses, and one of them accounts for most of it. For money services businesses (MSBs), the useful lesson is not that every penalty has grown tenfold. It is that reporting failures repeated across thousands of transactions, weak compliance programs and incorrect registration status can add up to very large exposure.

This article looks at what drove the total, which sectors were penalized, and what evidence an MSB should check before FINTRAC asks for it.

How FINTRAC penalties reached a record $247 million in 2025–26

FINTRAC's 2025–26 results by the numbers give the following comparison:

A few points matter when reading these figures:

• Fiscal year, not calendar year. The figures cover FINTRAC's fiscal year, from April 2025 to March 2026.
• Issued, not collected. The totals are penalties issued. They are not the same as amounts paid, collected or upheld after appeal, and several of the largest penalties are being challenged in the Federal Court.
• Sector totals differ. The $247 million covers all reporting sectors. FINTRAC reports a separate figure for MSBs, discussed below.
• The figures show more enforcement action and larger outcomes in aggregate. They do not show that a typical MSB faces a tenfold higher penalty, or that an individual business is ten times more likely to be penalized.

A few major cases explain much of the increase

FINTRAC's public notices show how concentrated the total is. All three examples below involve virtual currency businesses.

Xeltox Enterprises Ltd. (operating as Cryptomus). According to FINTRAC's notice, the penalty was proposed on 17 July 2025, confirmed on 16 October 2025 and published on 22 October 2025. It was CAD 176,960,190, covering 2,593 contraventions across six types of violation:

• failing to report suspicious transactions on 1,068 occasions
• failing to report large virtual currency transactions on 1,518 occasions, both for transactions in July 2024
• failing to comply with the ministerial directive on Iran
• failing to keep written compliance policies and procedures up to date
• failing to assess and document money laundering and terrorist financing risks
• failing to notify FINTRAC of changes to its registration information

The company has appealed to the Federal Court.

Using rounded figures, this one penalty is about 72% of the year's total of more than $247 million.

Peken Global Limited (operating as KuCoin). FINTRAC treated this Seychelles-incorporated company as a foreign MSB. It imposed CAD 19,552,000 on 28 July 2025 and published the notice on 25 September 2025. The penalty covered:

• failing to register as a foreign MSB
• 2,952 unreported large virtual currency transactions between June 2021 and May 2024
• 33 unreported suspicious transactions

This case is also under appeal in the Federal Court.

MP Technology Services Ltd. (a MoonPay subsidiary). FINTRAC imposed CAD 536,853.35 on 20 November 2025 after a compliance examination of this foreign MSB. Its notice lists four violations:

• four unreported incoming international electronic funds transfers of $10,000 or more
• compliance policies not tailored to Canadian requirements
• a risk assessment that did not use the prescribed factors (its risk-rating method was introduced after the examination period)
• four unreported suspicious attempted transactions among 261 declined transactions

This penalty is also under appeal.

Together, the first two cases come to about $196.5 million, roughly 80% of the annual total on rounded figures. Neither result reflects a single failure. It reflects reporting failures repeated across individual transactions, combined with weak controls. Each notice describes what FINTRAC alleged, with the stated appeal status, not proven money laundering.

Which sectors received the most FINTRAC enforcement notices?

The annual report lists the most-penalized sectors by number of notices:

Separately, the report states that nine MSBs were penalized, for more than $198 million. So the report gives two MSB figures: eight in the sector count of notices, and nine in the penalty summary. FINTRAC does not explain the difference. Both figures are given here as reported.

The $198 million is the MSB share of the $247 million total. The report gives no dollar figures for other sectors, so none are given here.

How individual FINTRAC penalties are classified and calculated is a separate topic, covered in our penalties explainer.

What the enforcement record reveals about recurring MSB compliance failures

The three notices above are examples, not a statistically representative sample of all 35 notices. They do show recurring weak points that any MSB can test itself against.

• Suspicious transaction reports. Missed STRs appear in all three cases. They include reports on attempted transactions the business declined, which is a reminder that turning a customer away does not end the reporting question.
• Large virtual currency transaction reports. In the Cryptomus and KuCoin cases, more than 4,400 unreported large virtual currency transactions were identified between them. Where a report is missed every time a threshold transaction occurs, the number of violations grows with transaction volume.
• Registration. KuCoin's penalty included failing to register as a foreign MSB, and Cryptomus's included failing to report changes to its registration information. Registration status and registration details are both obligations.
• Policies and risk assessments. Two of the three notices cite policies that were out of date or not tailored to Canada, and risk assessments that did not reflect the business or the prescribed factors.
• Implementation evidence. MoonPay's risk-rating method was introduced only after the examination period. The controls in force during that period are the ones that count.
• Ministerial directives. The Cryptomus notice includes a breach of the directive on Iran. A ministerial directive applies to every transaction it covers, not only to customer due diligence.

The annual report also shows that MSBs were a major focus of supervision. FINTRAC carried out 625 targeted examinations and information demands, 433 of them involving MSBs, within 4,874 assessment and monitoring activities in total.

What does this mean for Canadian MSBs and foreign MSBs?

For Canadian remittance, foreign exchange and virtual currency businesses, the practical risk is the volume of individual transaction reports, not the headline number. A gap in automated reporting or STR escalation can create violations at the same rate as the business processes transactions.

For foreign MSBs, two of the three examples involve companies incorporated outside Canada. Foreign incorporation does not remove FINTRAC obligations when a business has no place of business in Canada but directs and provides covered services to clients in Canada. Founders operating from the UAE, India, Cyprus, Germany, Turkey or Ukraine should confirm their Canadian classification based on their actual services and marketing. Not every foreign fintech with Canadian users is an FMSB, but those that are have the same reporting and compliance program obligations as Canadian MSBs. Where classification is unclear, the MSB and FMSB registration analysis should come first.

Registration itself is not an endorsement. FINTRAC states that registration does not mean it endorses or licenses a business, and a registered MSB can still be penalized for failures in reporting and program effectiveness.

The legal framework is also changing. Amendments that received Royal Assent on 26 March 2026 significantly raised maximum penalties and introduced new tools, including compliance agreements and compliance orders. Those changes did not produce the 2025–26 total. The largest penalties above were imposed in 2025, before the amendments. The effect of the changes on future enforcement is covered in our penalties explainer.

Six evidence checks an MSB should perform before FINTRAC examines it

The checks below are practical tests of controls that FINTRAC's notices have found lacking. How many cases to sample and how often to test are for the business to decide based on its risk and volume. The law does not set them.

For the last check, an external reviewer is not mandatory in every case. Many MSBs still use an independent AML effectiveness review to test whether controls work in practice, not just whether they are documented.

The practical takeaway for MSB compliance leaders

FINTRAC's record 2025–26 total is mostly the result of a few exceptional cases, not a tenfold increase in typical penalties. For MSBs, three messages stand out:

• Reporting failures repeated across many transactions can turn an operational gap into a very large penalty.
• Being registered, in Canada or as a foreign MSB, says nothing about whether controls work.
• What counts in an examination is evidence that controls operated during the period under review.

If your MSB wants to test its reporting, registration and program controls against the gaps identified in FINTRAC's 2025–26 enforcement results, ComplyFactor's AML advisory services in Canada can provide a focused gap assessment and remediation plan. No review can guarantee a particular examination outcome.