FINTRAC and PCMLTFA testing requirements

What the PCMLTFA and its Regulations require

The Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA, S.C. 2000, c. 17, consolidated to 2026-07-21, checked on 2026-09-16) and its Regulations (SOR/2002-184) apply to the reporting entities in section 5 of the Act, which FINTRAC examines. Paragraph 5(h) covers money services businesses (MSBs) with a place of business in Canada, including dealers in virtual currencies. Paragraph 5(h.1) covers foreign MSBs that direct services at persons in Canada and serve clients in Canada. The rules that change test scope:

• Registration (Act ss. 11.1, 11.13, 11.19). MSBs and foreign MSBs register with FINTRAC, report changes within 30 days, and renew every two years unless a longer period is prescribed.
• Identity verification (Regulations ss. 95 and 105). An MSB verifies a person who requests an electronic funds transfer (EFT) of $1,000 or more (95(1)(b)), a virtual currency transfer or exchange of $1,000 or more (95(1)(d), (e)), or a foreign currency exchange of $3,000 or more (95(1)(c)), at the time of the transaction (105(7)(a)). Documents must be authentic, valid, and current (105(5)). FINTRAC's identification guidance says a remote process must authenticate the photo document, and viewing the document over video is not enough.
• Transaction reports (Regulations ss. 30 and 132). An MSB reports cash receipts of $10,000 or more within 15 days. International EFTs of $10,000 or more that the MSB initiates or finally receives, and virtual currency receipts of $10,000 or more, are reported within 5 working days. Amounts within 24 consecutive hours are one transaction when the MSB knows they share a condition in sections 126 to 129, such as the same requester or beneficiary. Foreign and virtual currency amounts convert at the Bank of Canada rate or, if none is published, the rate used in the ordinary course of business (s. 125). Suspicious transactions, including attempted ones, are reported at any amount (Act s. 7).
• Travel rule (Act s. 9.5; Regulations ss. 124, 124.1). SWIFT MT-103 messages or their equivalent and international EFTs carry the requester's name, address, and account or reference number, and the beneficiary's name, address, and account number if applicable. Virtual currency transfers that need a record carry the name, address, and any account or reference number of both parties. For received transfers, written risk-based policies decide whether to suspend or reject a transfer with missing information (124(4), 124.1(2)).
• Records (Regulations ss. 36, 148, 149). An MSB records EFTs and virtual currency transfers of $1,000 or more and every currency exchange (s. 36), keeps transaction records at least 5 years from creation (148(1)(c)), and can produce them within 30 days of an examination request (s. 149).
• Compliance program (Act s. 9.6; Regulations s. 156). The program has a compliance officer, written policies approved by a senior officer, a documented risk assessment, a training program and plan, and an effectiveness review plan (156(1)). A new technology is risk-assessed before it is introduced (156(2)). The review runs every two years (156(3)), and an entity reports its findings to a senior officer within 30 days (156(4)).

Since 26 March 2026 (S.C. 2026, c. 4, Bill C-12), Act subsection 9.6(1.1) requires the program to be reasonably designed, risk-based, and effective. The maximum penalty for a prescribed violation by an entity is $20,000,000, and for all violations on one notice the greater of $20,000,000 and 3% of gross global revenue (s. 73.1(2), (3)). Enrolment of other reporting entities waits for regulations (FINTRAC modernization page, modified 2026-04-13). Bank of Canada registration of payment service providers is on the RPAA page.