PCMLTFA Requirements in Canada: Compliance Guide for MSBs, PSPs and Fintechs

The Proceeds of Crime (Money Laundering) and Terrorist Financing Act, known as the PCMLTFA, is the federal law behind Canada's anti-money laundering and anti-terrorist financing regime. FINTRAC, the Financial Transactions and Reports Analysis Centre of Canada, administers it and examines reporting entities for compliance. What a specific business has to do under the PCMLTFA depends on its reporting-entity status and the activities it carries out; there is no single checklist that applies identically to every regulated business.

Canada's AML framework changed materially through 2025 and 2026: new sectors came into scope, agent and mandatary rules changed, the definition of a listed person or entity expanded, and Bill C-12 raised penalties and introduced a new compliance-program effectiveness standard, with a universal FINTRAC enrolment requirement now legislated but not yet in force. This guide sets out how the PCMLTFA's obligations fit together, what changed and when, and where to find ComplyFactor's more detailed guidance on each requirement.

What Is the PCMLTFA?

The PCMLTFA is the Proceeds of Crime (Money Laundering) and Terrorist Financing Act, the core federal statute requiring Canadian businesses in defined sectors to identify clients, assess risk, monitor activity, keep records, and report specified transactions to FINTRAC. Its purpose is to detect and deter money laundering and terrorist financing by giving FINTRAC the financial intelligence it needs to support law enforcement and national security.

The Act itself sets out the framework in broad terms; the Proceeds of Crime (Money Laundering) and Terrorist Financing Regulations (PCMLTFR) supply the operational detail: dollar thresholds, timing rules, and specific field requirements. FINTRAC's published guidance then interprets both for particular reporting-entity sectors and particular obligations. A business that reads only the Act will miss most of what governs its day-to-day compliance. The operational rules are in the Regulations and the sector-specific guidance.

Who Is Subject to the PCMLTFA in Canada?

The PCMLTFA defines reporting entities by activity, not by industry label. Current sectors include financial entities (banks, credit unions, trust and loan companies), life insurance companies, brokers and agents, securities dealers, casinos, real estate developers, brokers and sales representatives, dealers in precious metals and stones, accountants and accounting firms performing certain activities, British Columbia notaries, mortgage administrators, brokers and lenders, money services businesses (MSBs) and foreign money services businesses (FMSBs), financing or leasing entities, factors, and title insurers. Not every Canadian business falls into one of these categories. The obligation attaches to the regulated activity itself.

Businesses Added or Brought Into Scope in 2025

Financing and leasing entities and factors became PCMLTFA reporting entities on April 1, 2025, bringing equipment financing, vehicle leasing, and invoice-factoring businesses under the same compliance-program, identification, and reporting obligations that already applied to MSBs and financial entities. A further wave of changes took effect October 1, 2025, expanding and clarifying obligations across several sectors at once: title insurers were brought into scope with adjusted requirements reflecting their limited direct client contact, real estate brokers and sales representatives gained a duty to identify unrepresented parties in transactions, and reporting entities generally gained the ability to use an agent or mandatary to carry out identity verification on their behalf under a documented arrangement.

ComplyFactor's dedicated guide for this sector covers the full financing, leasing and factoring compliance checklist, including client identification triggers and reporting deadlines specific to those businesses.

PCMLTFA Requirements at a Glance

The obligations connect in a fairly linear sequence, even though a mature compliance program runs most of them continuously and in parallel. The PCMLTFA Compliance Obligations Map below shows how the pieces fit together, from first determining whether the Act applies at all through to keeping the resulting program current.

Determine reporting-entity status: identify which regulated activity, if any, the business carries out

Register where required: MSBs and FMSBs register with FINTRAC before commencing operations

Establish a compliance program: a named compliance officer, written policies, a risk assessment, training, and a periodic effectiveness review

Know and verify clients: confirm identity using a permitted method for the client type and channel

Establish business relationships: recognize when an ongoing relationship (not a one-off transaction) has formed, since this triggers additional obligations

Assess risk: rate customers, products, delivery channels, and geography, and document the reasoning

Conduct ongoing monitoring: watch activity against what is known about the client, at a frequency the risk assessment supports

Make required PEP/HIO and third-party determinations: identify politically exposed persons, heads of international organizations, and undisclosed third parties at the applicable triggers

Keep required records: client identification, transaction, and compliance-program evidence, for the retention period that applies to each record type

Submit required reports: STRs, LCTRs, LVCTRs, EFTRs, and other sector-specific reports, depending on activity

Apply sanctions and ministerial-directive controls: screen against listed persons and entities and apply any directive-specific restrictions

Test effectiveness: a documented review, at least every two years, of whether the program works

Keep regulatory information current: registration details, contacts, and policies updated as the business changes

Each of these is a separate control with its own trigger and evidence requirements, and none substitutes for another. The sections below explain how they connect, and where ComplyFactor's dedicated guidance covers the operational detail for each.

Registration and Regulatory Status Under the PCMLTFA

MSB and FMSB Registration

Money services businesses and foreign money services businesses must register with FINTRAC before commencing operations, and renew that registration every two years without exception. Registration is separate from having an active compliance program. A registered MSB with no working AML program is still non-compliant, and an unregistered business conducting MSB activity is operating illegally however good its internal controls are. For the full registration process, documents, and timelines, see ComplyFactor's MSB registration guidance.

Do All Reporting Entities Register With FINTRAC?

Not under the framework currently in force. Historically, formal FINTRAC registration has applied specifically to MSBs and FMSBs; other reporting entity sectors (real estate brokers, accountants, dealers in precious metals, and others) are subject to the PCMLTFA's obligations without a parallel MSB-style registration step.

That will change, but it has not yet. Bill C-12, which received Royal Assent on March 26, 2026, legislates a universal FINTRAC enrolment requirement that will apply to all reporting entities subject to the PCMLTFA, not just MSBs and FMSBs. This enrolment framework is legislated but not yet in force: its coming-into-force date is tied to regulations still to be published in the Canada Gazette, Part II. Businesses that are already registered MSBs or FMSBs face no immediate change from this specific amendment; businesses in other reporting-entity sectors that are not currently registered anywhere should treat this as a near-term compliance item to plan for. There is nothing to act on today.

The PCMLTFA Compliance Program Requirement

Every reporting entity must maintain a written compliance program covering five elements: a designated compliance officer with real authority, written policies and procedures that reflect the actual business, a documented risk assessment, an ongoing training program for relevant staff, and a documented effectiveness review conducted at least once every two years, by an internal or external auditor or by the entity itself if it has no auditor.

Since March 2026, FINTRAC applies a stricter three-part standard when it examines that program: is it reasonably designed for the business's actual risks, is it risk-based (do controls scale with the ratings in the risk assessment), and is it effective in practice, meaning the program produces evidence of active compliance and does not exist only on paper. This effectiveness standard, and what changed operationally because of it, is covered in full in ComplyFactor's dedicated article.

For the complete post-Bill C-12 effectiveness standard, including the before-and-after penalty comparison, see ComplyFactor's Bill C-12 and the new FINTRAC effectiveness standard article.

For the full five-pillar build, deliverables, and process, see ComplyFactor's PCMLTFA AML compliance program service.

Know Your Client Requirements Under the PCMLTFA

"Know your client" is a set of separate, connected controls, each answering a different question. Confusing them, or assuming one satisfies another, is one of the most common gaps FINTRAC finds during examinations.

Identity Verification

Confirms that a client, person or entity, is who or what they claim to be, using one of the permitted methods for that client type. The exact trigger and timing depend on the reporting entity's sector and the transaction involved. ComplyFactor's FINTRAC identity verification guide (once published) will cover the full method set, remote-verification rules, and MSB-specific triggers in detail.

Beneficial Ownership

Identifies the individuals who ultimately own or control a corporate or other entity client, separately from confirming the entity itself exists. See ComplyFactor's beneficial ownership verification guide for the full requirement, including the Corporations Canada discrepancy-reporting process introduced in October 2025.

Third-Party Determinations

Establishes whether someone other than the client is instructing or benefiting from a transaction. See ComplyFactor's FINTRAC third-party determination guide for the full question workflow and worked examples.

PEP and HIO Determinations

Identifies whether a client, or a family member or close associate of one, is a politically exposed person or a head of an international organization, which then determines whether enhanced measures and senior management review apply. ComplyFactor's guide to politically exposed persons in Canada (once published) covers the domestic, foreign, and HIO categories in full.

Business Relationships and Ongoing Monitoring

A business relationship is what forms once a client conducts more than an isolated transaction, and it is the trigger for several ongoing obligations: periodic reassessment of PEP/HIO status, keeping client identification information current, and monitoring activity against what is known about the client at a frequency the risk assessment supports. Ongoing monitoring keeps the KYC controls above accurate as a relationship continues, and it is where a change in a client's risk profile is supposed to surface.

Risk Assessment and High-Risk Clients

The PCMLTFA's risk-based approach starts with a business-wide risk assessment covering customer types, products and services, delivery channels, and geography, and it is this assessment that decides how much scrutiny individual relationships receive. A client, product, or transaction rated high risk triggers specific, higher obligations: enhanced due diligence at onboarding, enhanced ongoing monitoring for the life of the relationship, and, for certain PEP and HIO categories, mandatory senior management review.

Some high-risk treatment is automatic under the Act itself, such as the mandatory high-risk classification for foreign PEPs and their family members or close associates, regardless of what a business's own risk assessment concludes. Other high-risk determinations are risk-based, meaning the reporting entity's own documented assessment decides the outcome. A program that treats every client identically, or that cannot show the reasoning behind a risk rating, will not satisfy the effectiveness standard FINTRAC now applies.

What Must Be Reported to FINTRAC?

Reporting obligations depend on sector and activity. No reporting entity files every report type, and assuming otherwise wastes effort in the wrong place. The reports that apply most broadly are set out below.

Suspicious Transaction Reports

Required whenever a reporting entity has reasonable grounds to suspect a transaction, completed or attempted, is related to money laundering or terrorist financing, regardless of dollar amount. See ComplyFactor's FINTRAC Suspicious Transaction Report narrative guide for how to write a defensible narrative once that threshold is reached.

Large Cash Transaction Reports

Required when a reporting entity receives $10,000 CAD or more in cash in a single transaction, or an aggregated set of cash transactions within a consecutive 24-hour window. See ComplyFactor's FINTRAC Large Cash Transaction Report guide for the full threshold, timing, and form-structure detail.

Large Virtual Currency Transaction Reports

Required when a reporting entity receives virtual currency equivalent to $10,000 CAD or more in a single transaction, following the same aggregation logic as large cash transactions but reported on a separate form specific to virtual currency, since cash and virtual currency are never combined to reach a single threshold.

Electronic Funds Transfer Reports

Required for qualifying international electronic funds transfers of $10,000 CAD or more, whether initiated or finally received, again subject to 24-hour aggregation. Domestic transfers within Canada do not trigger this report regardless of amount.

Listed Person or Entity Property Reports and Terrorist Property Reporting

A separate obligation from the threshold and suspicion-based reports above: all reporting entities must report property they know is owned or controlled by a listed terrorist group or a person or entity subject to specified sanctions-related orders, and must do so immediately, with no multi-day filing window.

Other Sector-Specific Reporting Requirements

Certain sectors carry reporting obligations that do not apply generally, such as casino disbursement reporting for casinos. Whether a given reporting entity has an obligation beyond the reports above depends on its specific regulated activity.

For the aggregation logic that governs when multiple smaller transactions must be combined into one report, see ComplyFactor's FINTRAC 24-hour rule guide, which applies across cash, EFT, and virtual currency reporting.

PCMLTFA Recordkeeping Requirements

Reporting entities keep several distinct categories of records, and the retention period is not the same for every category, so a compliance policy should not use a single blanket rule. Client identification records, transaction records, business relationship records, beneficial ownership records, PEP/HIO determination records, third-party determination records, copies of reports filed with FINTRAC, and evidence of the compliance program itself (risk assessments, training records, effectiveness review reports) are all retained, but the applicable retention period and the specific content required differ by record type and by sector-specific guidance. A compliance program should map each record category to its own retention rule instead of assuming one figure covers everything the business keeps.

Sanctions, Listed Persons and Ministerial Directives

These are related but legally distinct controls, and treating them as interchangeable creates gaps. AML/ATF obligations under the PCMLTFA (client identification, monitoring, STR filing) exist to detect and report suspected money laundering and terrorist financing generally. Listed-person or entity property reporting is a separate, narrower obligation: reporting entities must report property they know is owned or controlled by specified terrorist groups or sanctioned persons and entities, and the definition of a listed person or entity itself was expanded in 2025, first from March 1, 2025 to capture persons and entities subject to United Nations Act orders, and again from October 1, 2025 to capture persons and entities subject to Special Economic Measures Act orders and persons subject to orders under the Justice for Victims of Corrupt Foreign Officials Act (the Magnitsky Law).

Ministerial directives are a further, distinct tool: the Minister can direct reporting entities to apply specified enhanced measures, restrictions, or reporting requirements in relation to transactions connected to a particular foreign jurisdiction or entity of concern, which makes them a geographic countermeasure and not a general obligation. These directives apply in addition to a reporting entity's standard PCMLTFA obligations, and a compliance program needs a process for tracking which directives are currently active and what each one specifically requires.

What Changed Under the PCMLTFA in 2025 and 2026?

For the complete detail behind the effectiveness standard and penalty changes, see ComplyFactor's Bill C-12 and the new FINTRAC effectiveness standard article.

PCMLTFA Requirements for MSBs and FMSBs

MSBs and FMSBs carry the PCMLTFA's requirements across a defined set of current activities: foreign exchange dealing, remitting or transmitting funds, issuing or redeeming money orders, traveller's cheques or similar negotiable instruments, dealing in virtual currency, crowdfunding platform services, cheque cashing, armoured car (transport) services, and acting as an acquirer for private automated banking machines. Each activity has its own client-identification and reporting triggers, not one uniform rule, which is why generic checklists often miss obligations for MSBs.

For remittance and foreign exchange controls specifically, see ComplyFactor's currency exchange and remittance MSB compliance guide. For the registration process itself, see ComplyFactor's MSB registration service.

PCMLTFA and PSPs: When FINTRAC and RPAA Overlap

The PCMLTFA/FINTRAC regime and the Retail Payment Activities Act (RPAA), overseen by the Bank of Canada, are separate federal frameworks with different purposes. RPAA registration is an operational and prudential regime focused on payment safety and soundness. It is not an AML regime, and it does not, by itself, make a payment service provider a PCMLTFA reporting entity.

Many PSPs are also FINTRAC reporting entities because their activities, such as electronic funds transfers, foreign exchange dealing or remittance, independently meet the PCMLTFA's definition of a regulated activity. PSP registration is not what makes them reporting entities. A business can be registered under RPAA and have no PCMLTFA reporting-entity obligations, or be a PCMLTFA reporting entity with no RPAA obligation, or be both at once. Registering with one regulator never satisfies the other framework's requirements.

For a full comparison of the two regimes, including when a business needs one, the other, or both, see ComplyFactor's MSB vs PSP licences in Canada guide. For the RPAA registration process specifically, see ComplyFactor's PSP registration service.

What Happens if a Business Does Not Comply With the PCMLTFA?

FINTRAC enforces the PCMLTFA primarily through compliance examinations, which test both whether a program is reasonably designed and whether it works in practice. Where an examination identifies deficiencies, FINTRAC can require corrective action, and non-compliance can result in administrative monetary penalties (AMPs). Since 26 March 2026 the penalty ranges are $1 to $40,000 for a minor violation, $1 to $4,000,000 for a serious violation and $1 to $20,000,000 for a very serious violation. The Act caps any single prescribed violation at $4,000,000 for an individual and $20,000,000 for an entity, and caps all violations on one notice at the greater of $20,000,000 and 3% of gross global revenue for an entity. Violations that occurred entirely before that date remain under the previous maximums of $1,000, $100,000 and, for a very serious violation, $100,000 for an individual and $500,000 for an entity. In serious cases, FINTRAC can also move to revoke an MSB's registration outright, and criminal offences exist under the Act for the most serious categories of non-compliance, separate from the administrative penalty regime.

For a practical breakdown of what an examiner checks and how to prepare, see ComplyFactor's FINTRAC examination readiness checklist.

PCMLTFA Compliance Checklist for Canadian Businesses

Have we confirmed our current reporting-entity status against the activities we carry out?

Have all applicable registrations (MSB/FMSB with FINTRAC, PSP with the Bank of Canada if relevant) been completed and kept current?

Does our AML compliance program reflect our actual business, not a generic template?

Is our risk assessment business-specific, documented, and reviewed on a defined cycle?

Are current identity-verification triggers mapped to our actual transaction types and channels?

Are beneficial ownership procedures operating for entity clients, including the Corporations Canada discrepancy check where it applies?

Are PEP/HIO determination controls implemented at the correct business-relationship and transaction triggers?

Are third-party determinations configured for the transactions that require them?

Are current reporting thresholds (STR, LCTR, LVCTR, EFTR) built into our systems, not left to manual judgment alone?

Can suspicious activity be escalated and filed as an STR without unnecessary delay?

Are record-retention requirements mapped by record type instead of assumed to be a single universal period?

Are high-risk relationships subject to visibly different, enhanced ongoing monitoring?

Are active sanctions, listed-person, and ministerial-directive obligations incorporated into onboarding and monitoring?

Are staff and agents trained against our actual current procedures, not a superseded version?

Has program effectiveness been reviewed within the required two-year interval?

Can we produce complete evidence, for a sample of files, of every control above during a FINTRAC examination?

How ComplyFactor Supports PCMLTFA Compliance

Where a business needs its AML program built or rebuilt to reflect the current effectiveness standard, ComplyFactor's AML compliance program service covers the full five-pillar framework from risk assessment through governance. Where a business needs ongoing, day-to-day ownership of the program beyond a one-time build, a fractional compliance officer engagement provides that function without a full-time hire. Where the question is whether an existing program holds up, an independent AML audit tests it against current FINTRAC expectations and satisfies the biennial effectiveness-review requirement directly. Where deficiencies have already surfaced, whether through an internal review or a FINTRAC examination, AML advisory support helps correct them and prepare a defensible response. And for businesses that are not yet registered, MSB registration and PSP registration support covers the registration process itself, under whichever framework, or both, applies to the business.

Frequently Asked Questions

What does PCMLTFA stand for?

The Proceeds of Crime (Money Laundering) and Terrorist Financing Act, Canada's core federal AML/ATF statute.

What is the purpose of the PCMLTFA?

To detect and deter money laundering and terrorist financing by requiring defined reporting entities to identify clients, assess and manage risk, monitor activity, keep records, and report specified transactions to FINTRAC.

Who must comply with the PCMLTFA in Canada?

Businesses carrying out activities the Act defines as reporting-entity activities, including financial entities, MSBs and FMSBs, securities dealers, casinos, real estate brokers and developers, life insurance companies, dealers in precious metals and stones, accountants performing certain activities, mortgage professionals, financing/leasing entities, factors, and title insurers, among others.

Is FINTRAC the regulator under the PCMLTFA?

Yes. FINTRAC (the Financial Transactions and Reports Analysis Centre of Canada) administers the PCMLTFA, receives reports, and conducts compliance examinations.

Do all PCMLTFA reporting entities need to register with FINTRAC?

Not currently. Formal registration applies specifically to MSBs and FMSBs today. A universal enrolment requirement for all reporting entities has been legislated under Bill C-12 but is not yet in force.

What are the main PCMLTFA compliance requirements?

A written compliance program (compliance officer, policies, risk assessment, training, effectiveness review), client identification and verification, business relationship and ongoing monitoring obligations, PEP/HIO and third-party determinations, required transaction reporting, and recordkeeping.

What records must reporting entities keep?

Client identification, transaction, business relationship, beneficial ownership, PEP/HIO determination, and third-party determination records, plus copies of reports filed and compliance-program evidence, each with its own retention period instead of one universal rule.

What transactions must be reported to FINTRAC?

Depending on sector and activity: suspicious transactions (any amount, suspicion-based), large cash transactions of $10,000 or more, large virtual currency transactions of $10,000 or more equivalent, qualifying international electronic funds transfers of $10,000 or more, and listed-person or terrorist property, reported immediately when identified.

How often must an AML compliance program be reviewed?

The program must be reviewed to test its effectiveness at least once every two years, with the review documented and its findings reported to a senior officer in writing within 30 days after it is completed. This is in addition to ongoing internal monitoring of whether the program is working.

Does the PCMLTFA apply to PSPs?

Not automatically because of RPAA registration alone. A PSP becomes a PCMLTFA reporting entity where its actual activities, such as electronic funds transfers or foreign exchange dealing, independently meet the Act's definition of a regulated activity.

What changed under the PCMLTFA in 2026?

Bill C-12 received Royal Assent on March 26, 2026, introducing a stricter three-part compliance-program effectiveness standard, substantially higher administrative monetary penalties, and a universal FINTRAC enrolment requirement for all reporting entities that is legislated but not yet in force.

Keeping Your PCMLTFA Compliance Framework Current

A defensible PCMLTFA framework connects every piece: confirmed reporting-entity status and registration, a compliance program built for the actual business instead of copied from a template, KYC controls (identity verification, beneficial ownership, third-party determination, PEP/HIO screening) that work together instead of being assumed to cover each other, a risk assessment that drives enhanced measures where required, reporting thresholds built into systems instead of left to memory, records mapped to their correct retention periods, and ongoing monitoring that catches changes in a client's risk profile. Effectiveness testing, at least every two years, is what confirms all of it still works together.

Canada's AML framework changed quickly through 2025 and 2026, and universal enrolment is still to come. If your current program has not been tested against the requirements set out on this page, ComplyFactor's Canadian AML advisory team can review it before FINTRAC does.