FINTRAC Fines & Penalties for MSBs (2026)

Our mission is to help Canadian fintech companies get registered, go live, and stay compliant.

Yes — FINTRAC can fine your money services business, and the numbers are not small. Most fines are administrative monetary penalties ("AMPs"), civil penalties for breaking Canada's anti-money laundering ("AML") rules. Under the framework that applies to older conduct, penalties run from $1–$1,000 per minor violation up to $500,000 per very serious violation for a company. Because they apply per violation, a single examination routinely produces a six- or seven-figure total. A 2026 law raised these ceilings sharply.

FINTRAC (the Financial Transactions and Reports Analysis Centre of Canada) is Canada's AML regulator. A money services business ("MSB") is a business that deals in money transfers, foreign exchange, virtual currency, or similar services, and most must register with FINTRAC. This guide explains how much FINTRAC can fine you, what changed in 2026, which violations trigger penalties, recent MSB cases, and what to do if you get a notice.

In this article

FINTRAC fines and penalties for MSBs: the short answer
What changed to FINTRAC penalties on March 26, 2026?
How much can FINTRAC fine an MSB?
Common FINTRAC violations that lead to MSB fines
Recent FINTRAC fines imposed on Canadian MSBs
What happens after a FINTRAC notice of violation?
FINTRAC fines versus losing your MSB registration
Canadian presence, AML, and banking: the hidden hurdles
How can an MSB reduce FINTRAC enforcement exposure?
FAQ about FINTRAC fines

FINTRAC fines and penalties for MSBs: the short answer

Yes, FINTRAC can fine your MSB. Most fines are AMPs — civil penalties for breaching the Proceeds of Crime (Money Laundering) and Terrorist Financing Act. They are separate from criminal charges and from losing your registration. The amount depends on how serious each violation is and how many you committed, so one examination can produce a penalty in the hundreds of thousands or more.

There are three different consequences people often lump together as "penalties":

Monetary penalties (AMPs): civil fines FINTRAC imposes after a compliance examination.
Criminal non-compliance offences: charges prosecuted in court. FINTRAC cannot pursue both a criminal charge and an AMP for the same instance of non-compliance.
Registration consequences: FINTRAC can revoke or refuse your MSB registration, which is not a fine but can stop you operating.

You can see every AMP FINTRAC has imposed on its public penalties register, and read the official rules on the penalties for non-compliance page.

What changed to FINTRAC penalties on March 26, 2026?

This is the big 2026 update. On March 26, 2026, Bill C-12 (the Strengthening Canada's Immigration System and Borders Act) came into force and created a new penalty framework. For violations that happen on or after that date, FINTRAC can impose much larger fines and use new enforcement tools. Violations that occurred entirely before that date still use the old amounts and process.

The main changes for conduct on or after March 26, 2026 are:

Maximum penalty amounts increased — up to 40 times the previous limits.
FINTRAC can now consider your ability to pay when setting an amount.
Compliance agreements now apply in all cases where FINTRAC imposes a penalty.
Compliance orders are available as a new enforcement tool.

FINTRAC is still finalising its updated policy and guidance (its transition guidance was last updated May 6, 2026), so some implementation detail is still developing. The practical point for you: which rules apply turns on when the violation happened, not when the penalty is announced. Do not assume the old maximums still protect you for anything you do today.

How much can FINTRAC fine an MSB?

Under the framework that applies to pre–March 26, 2026 conduct, the AMP Regulations sort violations into three classes, each with its own per-violation range. The ranges below are per violation, and multiple violations add up — so the total can far exceed any single limit.

FINTRAC administrative monetary penalty ranges for conduct before March 26, 2026Violation classPenalty range (pre–March 26, 2026 conduct)Minor$1 to $1,000 per violationSerious$1 to $100,000 per violationVery serious$1 to $100,000 per violation (individual); $1 to $500,000 per violation (company)

FINTRAC sets the amount using three criteria: the purpose is to encourage compliance, not punish; the harm done by the violation; and your compliance history. For conduct on or after March 26, 2026, treat these numbers as a floor, not a ceiling — the new framework allows maximums up to 40 times higher. If you want the detailed step-by-step calculation, notice, and appeal mechanics, see our FINTRAC administrative monetary penalties explainer.

Common FINTRAC violations that lead to MSB fines

Most MSB penalties come from a short list of recurring problems, not exotic ones. If you fix these, you remove most of your exposure.

Failing to report suspicious transactions (STRs) when you had reasonable grounds to suspect money laundering or terrorist financing.
Missing or late reporting of other prescribed transactions, such as large virtual currency, large cash, or electronic funds transfer reports where they apply to your model.
A weak or incomplete AML compliance program — missing or outdated policies and procedures, and a risk assessment that does not cover your real risks.
Documented controls you do not actually follow — for example, enhanced due diligence steps that exist on paper but are skipped in practice.
Know-your-client and record-keeping gaps found during an examination.

FINTRAC's 2026 penalty on Necosmart (13010431 Canada Inc.), an Edmonton MSB, shows how these stack: five violations covering unreported suspicious transactions, inadequate policies and procedures, enhanced measures that were documented but not carried out, a deficient risk assessment, and 94 record-keeping errors. An independent AML effectiveness review or audit is the usual way to catch these before FINTRAC does.

Recent FINTRAC fines imposed on Canadian MSBs

These are real, MSB-only penalties from FINTRAC's public register — not totals that mix in banks, casinos, or real estate. All reflect the pre–March 26, 2026 framework, and the date shown is when the penalty was imposed. An imposition date just after March 26, 2026 (like Necosmart's) does not mean the newer, higher maximums applied; the conduct was reviewed under the old rules.

Examples of FINTRAC penalties imposed on money services businessesMSB (as named by FINTRAC)PenaltyViolationsDate imposed / statusXeltox Enterprises Ltd. (Cryptomus), B.C.$176,960,1902,593 contraventions, 6 violation typesOct 16, 2025; appealedPeken Global Ltd. (KuCoin), foreign MSB$19,552,0003 violationsJul 28, 2025; appealed13010431 Canada Inc. (Necosmart), Edmonton$693,742.505 violationsMar 27, 2026MP Technology Services Ltd. (MoonPay), foreign MSB$536,853.354 violationsNov 20, 2025; appealedCrystal Currency Exchange Inc., Burnaby$348,067.509 violationsMar 5, 2025; appealedJuba Express Inc., Toronto$67,1505 violationsAug 29, 2025; appealed

Two takeaways. First, amounts range from tens of thousands to over $176 million, so "small MSB" is no protection. Second, many penalties are under appeal, so a published figure is the amount imposed, not always the amount finally paid. You can confirm any case on the FINTRAC public register.

What happens after a FINTRAC notice of violation?

An AMP does not arrive out of nowhere. It follows a set process, and you have rights at each step. Acting quickly matters, because the key deadlines are short.

Notice of violation: FINTRAC serves a notice listing the violations, the penalty amount, and the reasons.
Your response within 30 days: you can pay, or make written representations to FINTRAC's Director and CEO on the violations, the amount, or both.
Notice of decision: the Director and CEO decide on the balance of probabilities and may confirm, reduce, or cancel the penalty.
Appeal within 30 days: you can appeal a notice of decision to the Federal Court of Canada.

If you do nothing within 30 days, the violations are upheld and a notice of penalty is issued. FINTRAC must also make the penalty public. For the full procedure, see our FINTRAC AMP explainer.

FINTRAC fines versus losing your MSB registration

These are not the same thing. A fine is a monetary penalty for AML breaches. Losing your registration — revocation — means you are no longer registered to operate, and continuing MSB activity without a valid registration is itself an enforcement risk. You can face a registration problem without ever receiving a fine.

Take a fintech we'll call Northgate — an anonymized small MSB that ran all its banking and clients in a few overseas markets and kept only a registered Canadian address. A routine address-confirmation letter went to a previous owner's email, Northgate never saw it, and FINTRAC revoked the registration. No fine was issued. The real exposure was different: whether the company could legally keep operating while it appealed. If registration or revocation is your concern, our MSB registration services address exactly this.

Canadian presence, AML, and banking: the hidden hurdles

Fines are only part of the picture. In practice, two things trip up MSBs with offshore roots. First, FINTRAC generally expects a genuine Canadian physical presence, and many banks and account providers expect the same plus a working AML program before they will open or keep an account. Second, banking is often the hardest part of going live — getting registered is only half the battle, and payment rails can take longer to secure than the registration itself. If you are weighing Canadian presence, AML readiness, or banking access, book a call so we can map your options before you commit.

How can an MSB reduce FINTRAC enforcement exposure?

You cannot control FINTRAC, but you can control what an examination finds. The goal is simple: make sure your documented controls match what you actually do.

Report suspicious transactions on time, with a documented process for spotting and escalating indicators.
Keep your risk assessment and AML policies current and tailored to your real operations, not a generic template.
Actually perform the enhanced due diligence you have written down, and keep evidence you did.
Get an independent AML effectiveness review and fix findings before FINTRAC examines you.
If you lack an in-house compliance team, use fractional AML compliance support to run reporting and monitoring properly.

If you have had an examination, a notice, or just want to pressure-test your program, book a call and we'll review your setup.

FAQ about FINTRAC fines

How much can FINTRAC fine an MSB?

For pre–March 26, 2026 conduct, penalties run from $1–$1,000 per minor violation up to $500,000 per very serious violation for a company, and they add up across violations. For conduct on or after March 26, 2026, maximums can be up to 40 times higher. Published MSB penalties range from under $25,000 to over $176 million.

Is failing to file a suspicious transaction report a fineable violation?

Yes. Failing to report transactions you had reasonable grounds to suspect were linked to money laundering or terrorist financing is treated as a very serious violation. In the Necosmart case, four unreported suspicious transactions were the single most serious part of a $693,742.50 penalty.

Is the penalty limit per violation or a total cap?

The ranges are per violation. There is no single overall cap, so several violations in one examination combine into a much larger total — which is how MSB penalties reach six and seven figures.

Can I keep operating if my registration is revoked?

Revocation is not a fine, but operating MSB activity without a valid registration is its own enforcement risk. As the anonymized Northgate situation showed, a simple missed letter can cost you your registration, and the urgent question becomes whether you can legally keep operating while you appeal. Get advice before you continue trading.

What is the difference between a criminal penalty and an AMP?

An AMP is a civil penalty FINTRAC imposes to encourage compliance. A criminal non-compliance offence is prosecuted in court. FINTRAC cannot pursue both for the same instance of non-compliance.

This content is for informational purposes only and does not constitute legal advice.