How to respond to a FINTRAC Notice of Violation

A FINTRAC Notice of Violation is not the end of the road for your MSB — but it demands an immediate, structured, and well-documented response.

How you handle the first 30 days after receiving one will determine whether the matter closes cleanly or escalates into something far more damaging. This article explains what a Notice of Violation contains, what your legal options are, how to respond effectively, and what to do to prevent the next one.

What a Notice of Violation is — and is not

FINTRAC issues a Notice of Violation when it has determined that your MSB has committed one or more violations of the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) or its regulations. The Notice formally communicates that determination and — in most cases — imposes an Administrative Monetary Penalty (AMP).

A Notice of Violation is an administrative enforcement instrument, not a criminal charge. It does not mean FINTRAC is alleging that your business laundered money or financed terrorism. It means FINTRAC has found that your compliance programme — or specific compliance actions — did not meet the statutory requirements.

The distinction matters legally, but it matters less practically. A Notice of Violation is published on FINTRAC's public website by default. Once published, it is visible to your banking partners, correspondent institutions, and potential clients.

What the Notice contains

Every Notice of Violation issued under section 73.1 of the PCMLTFA must include:

• The name of the reporting entity
• The specific violations found, with reference to the applicable PCMLTFA or regulatory provisions
• The penalty amount for each violation
• The total penalty amount
• The facts relied upon by FINTRAC in making its determination
• Your right to request a review of the decision

Reading the facts section carefully is the most important first step. FINTRAC's narrative of the violations is the document you will be responding to — either through a voluntary payment, a compliance agreement, or a formal review request.

Your three response options

Once you receive a Notice of Violation, the PCMLTFA gives you three paths forward. The deadline for election is 30 days from receipt. Missing this deadline removes options.

Option 1: Pay the penalty

You can pay the full penalty amount within 30 days. Payment is treated as admission that the violations occurred. The Notice is published, the penalty is recorded, and the matter is closed from FINTRAC's perspective. This is the right option if the facts are not meaningfully disputed, the penalty amount is proportionate, and your priority is resolving the matter quickly to protect your banking relationships.

Option 2: Enter a compliance agreement

Instead of paying the penalty, you may propose a compliance agreement — a formal commitment to specific remediation steps within defined timelines, in exchange for FINTRAC accepting a reduced penalty or deferring it. FINTRAC is not obliged to accept one, and it will not accept one that does not demonstrate a genuine and specific commitment to fix the underlying programme failures. Vague remediation promises are rejected. The agreement must specify what is being fixed, how, and by when. This is typically the right option when the violations relate to programme failures rather than individual transaction errors, and where you can demonstrate that structural remediation will address the root cause.

Option 3: Request a review before the Director

You can contest the Notice by requesting a review by the Director of FINTRAC within 30 days of receipt. The review is not a full evidentiary hearing — it is an administrative reconsideration on the papers. You submit written representations, FINTRAC responds, and the Director issues a decision. The Director can confirm the Notice, vary it (including reducing the penalty), or cancel it entirely. A review request is appropriate where you have a genuine factual or legal dispute with FINTRAC's characterisation of the violations — not simply because the penalty is large. Common grounds include: FINTRAC has misidentified the applicable regulatory provision; the facts relied upon are inaccurate; or there are mitigating circumstances that materially affect the appropriate penalty quantum.

How penalty amounts are calculated

FINTRAC calculates AMPs under a structured framework. Violations are categorised into three tiers:

Within those maximums, FINTRAC applies a base penalty that is then adjusted upward or downward based on:

• History of prior violations — a prior Notice of Violation or AMP significantly increases the penalty.
• Degree of intent or negligence — deliberate non-compliance attracts higher penalties than negligence; negligence attracts higher penalties than inadvertent error.
• Harm caused or potential harm — failures that created actual money laundering risk are penalised more heavily than administrative process failures.
• Ability to pay — FINTRAC considers the financial capacity of the entity, though this factor rarely drives material reductions.
• Self-reporting and co-operation — entities that self-identified the violation before FINTRAC's examination, or co-operated fully, may receive reduced penalties.

The 2024–2026 PCMLTFA amendments materially increased the penalty maximums that apply to reporting entities. MSBs operating under the assumption that AMP exposure is modest should reassess. The $176 million penalty against TD Bank — while a different regulatory framework — signalled a broader shift in enforcement appetite across Canadian financial regulators.

The 30-day deadline: why it cannot be missed

The 30-day response window is statutory and strictly enforced. If you do not pay, enter a compliance agreement, or request a review within 30 days of receiving the Notice, you lose the right to contest it. The penalty becomes payable as a debt to the Crown and can be recovered through the Federal Court.

What to do in the first 72 hours

• Preserve everything. Do not alter, delete, or move any records related to the violations described in the Notice. FINTRAC may have already imaged your records during the examination that generated the Notice. Any subsequent alteration creates a separate problem.
• Get specialist advice immediately. The response strategy — pay, agree, or contest — should be decided with qualified compliance counsel or an experienced AML adviser. The wrong election can foreclose options or increase your ultimate exposure.
• Identify the root cause. Before you can respond credibly, you need to understand why the violations occurred. A gap in your policies? A failure of staff to follow procedures? An outdated risk assessment? The root cause drives the remediation approach, which in turn drives your response to FINTRAC.
• Review your banking relationships. If the Notice is going to be published — which it will be unless you successfully contest it — your banking partners will likely be notified or find it themselves. Consider whether a proactive conversation with your banking compliance team is appropriate.

Responding to a compliance agreement proposal

If you elect to propose a compliance agreement, the document must be substantive. FINTRAC's published guidance makes clear that it evaluates proposals against the following criteria:

• Whether the proposed remediation steps directly address each violation cited in the Notice.
• Whether the timelines are realistic and specific.
• Whether there is evidence that the entity has already begun remediation.
• Whether the entity's compliance history suggests the agreement is likely to be honoured.

A compliance agreement that lists generic commitments — "we will update our policies" without specifying which policies, what changes, and by when — will not be accepted.

After the matter closes: preventing the next Notice

The most important work happens after the Notice is resolved. FINTRAC tracks compliance history. A second Notice of Violation, or a compliance examination that finds the same violations that generated the first Notice, attracts substantially higher penalties and — in repeat-offender patterns — registration revocation.

The remediation steps you commit to in a compliance agreement, or implement voluntarily after paying a penalty, must be genuinely implemented and documented. An examiner who returns to your file in two years will check whether the programme that was deficient at the time of the Notice has actually been fixed.

ComplyFactor works with Canadian MSBs and PSPs to respond to Notices of Violation, draft compliance agreement proposals, and implement the programme remediation that closes findings and prevents recurrence. If you have received a Notice of Violation or are aware of examination findings that may generate one, contact our team for immediate assistance.

ComplyFactor Advisory Team

ComplyFactor is a specialist AML and regulatory compliance advisory firm working exclusively with MSBs, PSPs, fintechs, and VASPs across Canada's FINTRAC framework. Our advisors hold CAMS certification and bring direct FINTRAC examination experience to every engagement.

Our services Book a consultation