Key takeaways from our webinar “Dealing with FINTRAC: navigating FINTRAC supervision and enforcement”

In this article, we highlight the top takeaways from Torys’ webinar “Dealing with FINTRAC: Navigating FINTRAC supervision and enforcement”, hosted on November 25, 2025.

1. FINTRAC’s enforcement activity has increased

FINTRAC has been stepping up its enforcement efforts this year. It has issued 26 administrative monetary penalties (AMPs) in 2025 to date (compared to 12 total in 2024), with the largest-ever AMP of $176,960,190 levied against Xeltox Enterprises Ltd. In October 2025. And more enforcement activity may be coming. Proposed legislative amendments introduced in Bill C-2 and Bill C-12 create a new AMP framework that could lead to more severe penalties (with possible increases in AMPs by a factor of 40), and there has been a rapid expansion of the categories of reporting entities regulated by FINTRAC (most recently in October 2025 for title insurers and acquirer services related to private automated banking machines).

2. Proactive measures for identifying AML compliance are crucial for mitigating the risk of FINTRAC enforcement

Reporting entities should proactively assess the AML risks inherent in their business and identify potential compliance deficiencies on an ongoing basis. Two-year effectiveness reviews and Voluntary Self-Declarations of Non-Compliance (VSDONCs) are two examples of tools available to a reporting entity to proactively correct deficiencies before they are potentially uncovered by FINTRAC. Using an experienced auditor to conduct the mandatory two-year effectiveness review has become desirable to ensuring that an AML compliance program is operating as intended and that the entity’s risk assessment is effective. Reporting entities should also consider filing VSDONCs where non-compliance issues have been identified, but should be mindful that FINTRAC’s recently amended VSDONC guidance raises some uncertainty about the ability of the disclosure to shelter the reporting entity from an AMP. Torys’ AML team can assist reporting entities in determining the appropriate circumstances to file a VSDONC. Strengthening AML policies, controls and procedures, while obtaining appropriate support from skilled compliance and legal professionals, should remain a key priority for reporting entities moving forward.

3. Advocacy is key at each stage of the FINTRAC review process

Reporting entities should not wait until FINTRAC has imposed an AMP to advocate for themselves. Every interaction with FINTRAC (including through reports, letters, and discussions) is an opportunity for a reporting entity to demonstrate that it has taken effective measures to comply with the Proceeds of Crime (Money Laundering) and Terrorist Financing Act; to clarify relevant facts; and to provide reasons why an AMP may not be necessary under the circumstances. As soon as a reporting entity becomes aware of an upcoming FINTRAC assessment, it should seek to demonstrate the soundness of its internal controls and procedures to FINTRAC. Reporting entities may have other opportunities for advocacy in subsequent stages of FINTRAC’s review, such as if the entity is given the opportunity to respond to a Findings Letter¹, if FINTRAC issues a Notice of Violation containing an AMP, and finally, if the entity decides to make representations to the Director.

4. FINTRAC’s enforcement approach may evolve

The Financial Action Task Force (FATF)’s mutual evaluation of Canada’s AML regime is underway. Any negative findings from that review could put further pressure on FINTRAC to continue to increase its enforcement efforts. We expect that FINTRAC’s ongoing issuance of AMPs may also be guided by the Federal Court’s recent decision in Norwich Real Estate Services Inc. (dba RE/MAX Kelowna) v. Financial Transactions and Reports Analysis Centre of Canada, 2024 FC 1996. The Court held that FINTRAC’s Director must independently consider each factor required by the PCMLTFA in imposing AMPs: (i) the purpose of AMPs, which is to encourage compliance, not to punish; (ii) the harm done by the violation; and (iii) the reporting entity’s history of compliance. However, this decision preceded the August 2025 changes to FINTRAC’s AMP policy, and it remains to be seen how the Director will evaluate AMPs moving forward.

For further information on the expected direction of FINTRAC’s AMPs, stay tuned for our AML Year in Review bulletin, which will be published in the coming weeks.