FINTRAC Reporting and Record-Keeping Requirements for MSBs

Our mission is to help Canadian fintech companies get registered, go live, and stay compliant.

If you run a Canadian money services business (MSB) or a foreign money services business (fMSB), you file four main transaction reports with FINTRAC — suspicious transaction, large cash, large virtual currency, and electronic funds transfer reports — plus a property report for sanctioned or terrorist property. Not everything turns on a $10,000 figure, and you must keep records even when no report is due. What you file depends on the transaction and your status.

FINTRAC is Canada's financial intelligence unit and anti-money-laundering (AML) regulator. Registering as an MSB does not mean FINTRAC approves your business — it means you are listed and must follow the reporting and record-keeping rules below. This guide maps each report to its trigger and deadline, covers the records you keep even with no filing, and shows how Canadian versus foreign-client activity changes the analysis.

What changed in this 2026 update

• Replaced the old "Terrorist Property Report (TPR)" label with the current Listed Person or Entity Property Report (LPEPR).
• Corrected the threshold wording: large-value reports trigger at $10,000 or more, not "over $10,000."
• Clarified deadlines by report type and flagged that each should be confirmed against current FINTRAC guidance at publication.
• Reframed the old "top 10" list into a practical obligations-and-records guide built around real transaction flows.
• Added written clarification we obtained directly from FINTRAC on foreign-to-foreign EFTs handled by a Canadian MSB, including how to complete the reporting form.

What must Canadian MSBs and fMSBs report to FINTRAC?

You file five FINTRAC reports: a suspicious transaction report (STR), a large cash transaction report (LCTR), a large virtual currency transaction report (LVCTR), an electronic funds transfer report (EFTR), and a Listed Person or Entity Property Report (LPEPR). Each has its own trigger and deadline. Filing a report is separate from keeping records — you often must record a transaction even when no report is required.

Here is the core obligations matrix. Use it to match a transaction to the report it triggers:

Confirm each deadline against current FINTRAC reporting guidance before you rely on it. FINTRAC sets different clocks for different reports, and the thresholds above use "$10,000 or more," which includes exactly $10,000.

To see how this plays out, take a fintech we'll call Retailo — an anonymized retail payments company with several hundred customers, almost all individuals, and all based outside Canada. Retailo offers individual accounts, foreign exchange, a small crypto exchange, and cards. Its team assumed that "no Canadian customers" meant "almost nothing to report." As the sections below show, that assumption is where MSBs and fMSBs get into trouble.

When must an MSB file a Suspicious Transaction Report (STR)?

You file an STR when you have reasonable grounds to suspect a transaction is related to money laundering or terrorist financing. There is no minimum dollar amount, the duty covers attempted transactions, and suspicion is not limited to cash. You file as soon as practicable, and in any event no later than 30 days after you (or any employee) first detect the facts that create the suspicion.

Because there is no threshold, the STR is the report fintechs most often under-file. Retailo had filed only a couple of STRs across several hundred customers. That is a red flag in itself: a live payments, FX, and crypto business almost always sees some activity worth a documented suspicion review. The practical obligation is to build a review-and-escalation process so suspicions are spotted, assessed, and filed on time — see FINTRAC's guidance on reporting suspicious transactions. Good identity controls feed this process; our guide to FINTRAC client identification requirements covers the inputs.

When do large cash and virtual currency transactions trigger reporting?

An LCTR is triggered when you receive $10,000 or more in cash; an LVCTR is triggered when you receive $10,000 or more in virtual currency. Both focus on receipt, both use the $10,000-or-more threshold, and both can be reached by aggregating smaller amounts (see the 24-hour rule below). Cash is not the same as electronic funds, and "virtual currency transfer" is not the same as "virtual currency received."

This distinction caught Retailo. It had no cash transactions tied to Canada, so it filed no LCTRs — and wrongly read that as "no large-value reporting applies to us." But it did receive virtual currency above the threshold through its small crypto exchange. Receiving $10,000 or more in virtual currency can trigger an LVCTR regardless of where the customer sits, so the geography of the customer does not switch the obligation off. FINTRAC's large virtual currency transaction reporting guidance sets out the data fields and timing.

When must an MSB file an Electronic Funds Transfer Report (EFTR)?

You file an EFTR when you initiate or finally receive a reportable international electronic funds transfer of $10,000 CAD or more, including where the applicable 24-hour aggregation rule reaches that threshold. An EFT concerns the electronic transmission of instructions to transfer funds, not just where the money physically moves. For a Canadian MSB, reporting can apply even when both customers and all accounts involved are outside Canada. The reporting deadline is generally within five business days.

Can a transfer between two foreign countries require an EFTR?

Yes. We put this exact question directly to FINTRAC in writing, describing a Canadian-incorporated, FINTRAC-registered MSB that receives GBP from a UK client into an account with a non-Canadian payment service provider, converts it to EUR, and sends it to a recipient's Portuguese bank account. Neither customer lives in Canada, and no funds enter or leave a Canadian account.

In its May 25, 2026 email response, FINTRAC's MSB Supervision Unit confirmed that the transaction is reportable if it meets or exceeds $10,000 CAD. FINTRAC explained that the Canadian MSB itself provides the Canadian connection: it receives the client's instructions to make an international transfer. The funds do not have to cross Canada's border or land in a Canadian account for that transfer to be reportable.

For a business like Retailo, the practical lesson is simple: do not exclude a transfer from EFTR reporting just because the sender, recipient, and accounts are all abroad. Identify which entity initiates or finally receives the transfer instructions and apply the rules for that entity. FINTRAC's response addressed a Canadian MSB; do not automatically extend that conclusion to every fMSB arrangement. Check the applicable rules in FINTRAC's electronic funds transfer reporting guidance.

What if FINTRAC's reporting form seems to require a Canadian account?

We sent FINTRAC follow-up questions about this too. In its June 3, 2026 response, FINTRAC explained how to complete the form for the UK-to-Portugal example:

• For “Is the requester moving funds into or out of Canada?”, FINTRAC said the reporting entity can select “Out of Canada.” It explained that the field is really asking whether the funds originated outside Canada. The wording does not mean the funds must actually leave a Canadian account.
• If your MSB initiates the transfer but is not the final receiver, enter the actual receiver through “Subject Reference,” using “Person Name and Address” or “Entity Name and Address,” as applicable. FINTRAC explained that the reporting entity's location dropdown is only mandatory where the reporting entity is the receiver.

These instructions came directly from FINTRAC after we submitted the transaction example and follow-up questions. They address that scenario and the reporting form at the time; if your facts differ or the form changes, confirm the correct treatment rather than treating a confusing field as an exemption.

How does FINTRAC's 24-hour rule work?

The 24-hour rule stops businesses from avoiding a report by splitting one large transaction into several smaller ones. If you make two or more transactions of the same reportable type that each sit below $10,000 but together reach $10,000 or more within a 24-hour window — to or from the same person or entity as prescribed — you treat them as a single reportable transaction.

A worked example: a customer sends your MSB four virtual currency payments of $3,000 each over the same day. Individually, none hits the threshold. Together they total $12,000, so the 24-hour aggregation rule can require an LVCTR. The rule applies separately to cash, virtual currency, and EFTs, and the exact party-relationship and aggregation mechanics differ by report type — confirm them against current FINTRAC guidance rather than assuming one rule fits all three.

What records must you keep, even when no FINTRAC report is filed?

Reporting and record-keeping are separate obligations. You keep records of many transactions that never generate a report, so your file can be reconstructed if FINTRAC examines you or a bank asks during diligence. At a high level, the records most MSBs need include:

• Copies of every report you file (STR, LCTR, LVCTR, EFTR, LPEPR).
• Large cash and virtual currency receipt records, at $10,000 or more.
• Electronic funds transfer records for prescribed transfers, often from $1,000.
• Virtual currency transfer records for prescribed transfers, often from $1,000.
• Large single-transaction and negotiable-instrument records, often from $3,000.
• Business-relationship, foreign-exchange, and remittance records where applicable.

This is where Retailo was most exposed. It assumed that because it filed few reports, it had little to keep. In fact, record-keeping can bite at smaller values than reporting — a transfer can be recordable at $1,000 even though no report is due. Confirm the exact categories and thresholds against FINTRAC's MSB record-keeping guidance, and do not treat all of your KYC paperwork as the full record set.

How long must MSBs keep FINTRAC reports and records?

As a general rule, FINTRAC records are kept for about five years, but the date the five years starts can vary by record type — for example, a report copy may run from when it was filed, while other records run from when they were created or when a business relationship ended. The records also have to stay accessible, so you can produce them within the time FINTRAC allows if asked.

Because the commencement date differs by document, do not apply one identical "five years from the transaction" period to everything. Confirm the retention trigger for each record type against current FINTRAC guidance, and store records so they can actually be retrieved — a record you cannot locate is, in practice, a record you did not keep.

How do you submit reports and keep an audit trail?

Most MSBs submit transaction reports through FINTRAC's online reporting system, with an API option for higher volumes; the Listed Person or Entity Property Report uses a prescribed process and must also go to the RCMP. Whichever method you use, keep evidence that each report was submitted, plus the underlying transaction data, so you can show an examiner a complete audit trail.

You can review the available channels in FINTRAC's submission methods guidance. Keep this operational rather than ad hoc: name who files, how submission confirmations are stored, and how reports link back to the transactions that triggered them.

Do FINTRAC obligations apply if none of your clients are in Canada?

Not by themselves — "no Canadian customers" does not mean "no Canadian obligations." If you are registered as an MSB or fMSB, your reporting and record-keeping duties follow your status and the transactions you handle, not only your customers' location. The honest answer for a business like Retailo is that it needs to assess STRs, virtual currency receipts, EFTs, and record-keeping regardless of where its customers sit.

Two practical points often decide these files. First, many banks and account providers expect you to show Canadian presence and a working AML program before they will keep you banked, and FINTRAC often expects MSBs to have a genuine Canadian physical presence. Banking is frequently the hardest part of going live, so treat it as a parallel workstream, not an afterthought. If you want help pressure-testing where you actually stand, book a call with Renno's fractional AML team.

Second, many MSBs are also payment service providers that must register under the RPAA — as Retailo was, with a pending Bank of Canada application. If both apply to you, Renno offers a combined MSB + RPAA registration bundle that also prepares the AML policy required for MSB registration and the operational risk management framework required under the RPAA. Our MSB registration service and the FINTRAC MSB registration process guide explain where that fits.

Frequently asked questions

Do I have to file a report if there were no reportable transactions?

Usually no single "nil" transaction report is required just because nothing was reportable — but that is different from your ongoing duty to run controls, review for suspicion, and keep required records. The safer framing is: no triggering event, no transaction report; but the program obligations never switch off. Verify whether any specific nil filing applies to your situation before assuming it does not.

Can the same transaction trigger both an STR and a threshold-based report?

Yes. The tests are different, so one transaction can require both. A $12,000 virtual currency receipt that also looks suspicious can trigger an LVCTR (because of the amount) and an STR (because of the suspicion). File both — one does not excuse the other.

Who is responsible if a third-party provider files our reports?

You are. Outsourcing the filing work to a compliance provider does not move the legal responsibility off the reporting entity. If a report is missed or wrong, FINTRAC looks to you. That is a good reason to keep oversight of the process even when a provider runs the day-to-day filings.

Work out which FINTRAC reports and records apply to you

If you handle payments, FX, or crypto and you are unsure which FINTRAC reports and records apply to your flows — especially with cross-border customers — book a call with Renno and we'll map your obligations to your actual transactions before your first FINTRAC examination or bank diligence request. You can also review our AML effectiveness review expectations to see how reporting records are tested in an audit.

This content is for informational purposes only and does not constitute legal advice.