Canada’s anti-money laundering landscape

Background

The Financial Action Task Force (FATF) has conducted a mutual evaluation of Canada’s AML and anti-terrorist financing (ATF) regime, with the final report released on September 29. FATF is the standard-setting body for measures to combat money laundering, terrorist financing, and other threats to the integrity of the global financial system; its country assessments carry substantial weight. The assessment found that, since its last mutual evaluation, Canada has taken steps to strengthen its defences against illicit finance, but should improve the effectiveness of risk-based supervision, and prioritize the investigation and prosecution of complex money laundering cases in line with the country’s risk profile.

The Canadian government had been actively preparing for the FATF evaluation. In recent years, the government has expanded the scope of the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) to implement FATF’s recommendations, broadening the categories of reporting entities to include mortgage lenders, factoring companies, cheque-cashing entities, title insurers, and entities involved in the financing or leasing of personal property. The government has also introduced sanctions evasion reporting obligations, expanded listed-person property reporting requirements, and enabled voluntary information sharing among reporting entities.

Legislative amendments

Similarly, Bill C-2, the Strong Borders Act, introduced in June 2025, proposed a wide range of changes to Canada’s AML laws, including an increase in maximum AMP amounts by a factor of approximately 40, and mandatory registration for all reporting entities (not just money services businesses). Bill C-12, the Strengthening Canada’s Immigration System and Borders Act, introduced in October 2025, was a streamlined successor to Bill C-2 that adopted the same 40-fold AMP increase. Under Bill C-12, which received Royal Assent on March 26, maximum penalties rose to $40,000 for “minor” violations, $4,000,000 for “serious” violations, and $20,000,000 for “very serious” violations. Under the new framework, FINTRAC will have the authority to consider ability to pay as part of the criteria for determining a penalty amount. A new requirement was also introduced for compliance programs to be “reasonably designed, risk-based and effective”.

It is possible that this requirement will be measured by whether FINTRAC finds any violations. If so, FINTRAC could allege that compliance programs were not reasonably designed, risk-based, and effective, thus providing further grounds on which to assess an AMP.

Bill C-12 also introduced a mandatory compliance agreement regime, under which FINTRAC’s Director may issue a compliance order if a reporting entity refuses to enter into, or fails to comply with, a compliance agreement. Penalties for contravention of a compliance order could reach the greater of $20,000,000 or 3% of an entity’s gross global revenue.

FINTRAC’s enforcement posture

In tandem with these legislative changes, FINTRAC’s enforcement posture has shifted, with the frequency and severity of AMPs increasing. In 2025/2026, FINTRAC issued 35 notices of violation—the largest annual number in the Centre’s history—for a total of more than $247 million. This included the largest fine in FINTRAC history: a $176,960,190 penalty levied against Xeltox Enterprises Ltd. in October 2025 for approximately 2,500 violations, including the failure to submit roughly 1,000 suspicious transaction reports. Xeltox Enterprises Ltd. has appealed the penalty to the Federal Court.

Reporting entities should note that FINTRAC’s revised AMP policy, introduced in August 2025, removed prior assurances that AMPs are a “last resort” and are “not issued automatically” in response to non-compliance. FINTRAC has also eliminated its previous commitment to share preliminary findings with reporting entities before finalizing them. These changes suggest a more assertive enforcement posture, underscoring the importance of proactive compliance and advocacy at every stage of the review process.

Future expectations

A number of AMPs are currently under appeal, and we expect that the Federal Court's decisions in these cases will offer meaningful commentary on FINTRAC's approach to enforcement, including under its new AMP policy.

The Federal Court has already been critical of FINTRAC’s prior approach in its 2024 decision in Norwich¹. It required FINTRAC to reassess its $156,750 penalty imposed on Norwich for failing to submit a suspicious transaction report, and held that FINTRAC’s Director had misapplied the PCMLTFA’s three statutory factors for determining an AMP: the harm caused by the violation, the entity’s compliance history, and whether the penalty was necessary to encourage compliance. FINTRAC had not independently considered the third factor, and the Court emphasized that an AMP must not exceed what is necessary to encourage compliance. It also found that the Director had not properly accounted for the fact that law enforcement was already aware of the transactions in question.

Following Norwich, FINTRAC revised its AMP policy, maintaining a two-stage assessment (a “harm done” evaluation followed by a compliance history and non-punitive adjustment). However, the revised policy notes that FINTRAC may exercise its discretion to adjust its policy, and may choose not to apply a penalty reduction based on the established criteria, particularly in cases of serious violations.

Going forward, it remains to be seen how the courts will evaluate large penalties in light of Norwich and FINTRAC’s new AMP policy.

Takeaways

Regulated entities face a more demanding AML compliance environment than at any point in Canadian history. The convergence of Canada’s FATF evaluation, new legislative proposals, a significant escalation in FINTRAC’s AMP activity, and evolving case law means that proactive measures and advocacy with FINTRAC are more important than ever. Reporting entities should proactively assess the AML risks inherent in their business, and identify potential compliance deficiencies on an ongoing basis.

Strengthening AML policies, controls, and procedures, while obtaining appropriate support from skilled compliance and legal professionals, should remain a priority.