Canada MSB compliance & substanceOverview
FINTRAC's enforcement record shows where MSBs fall short. In a review of penalties imposed on MSBs between 2020 and 2025, the most frequent findings concerned policies and procedures, risk assessments, registration itself (operating unregistered, late change notices, lapsed renewals) and reporting failures, followed by record keeping, two-year reviews and ministerial directives. In other words, the issues are rarely exotic; they are about whether documented controls match the business and whether the administrative basics are kept current.
The stakes rose sharply in 2026. Under Bill C-12, which received Royal Assent on 26 March 2026, maximum administrative penalties for violations from that date increased up to forty-fold: up to C$40,000 for a minor violation, C$4 million for a serious violation and C$20 million for a very serious one. After a prescribed violation, FINTRAC must now require a compliance agreement; refusal or failure to comply leads to a published compliance order, and breach of an order is itself a violation carrying penalties of up to C$30 million or 3% of global revenue for entities. FINTRAC has also continued to revoke MSB registrations where businesses do not respond to requests or become ineligible.
Substance is the practical companion to compliance. Registration does not require a Canadian office, but an MSB that cannot show who runs it, where decisions are made, where records sit and which bank holds client money will struggle both with FINTRAC examinations and with Canadian banks, which apply their own risk appetite to MSB clients. Substance means a compliance officer who genuinely controls the programme, staff or service providers with defined roles, accessible records, and a banking and safeguarding arrangement that matches the declared business.
Where an MSB also performs retail payment functions such as holding end-user funds, the Retail Payment Activities Act adds a second layer: Bank of Canada registration, operational risk and incident-response frameworks, and safeguarding of end-user funds, in force since 8 September 2025. Building one integrated control framework for both regimes is more efficient than running them separately.
Key benefits
- Lower enforcement exposure under the 2026 penalty regime
- A registration that withstands FINTRAC examinations and clarification requests
- Stronger case for opening and keeping Canadian and international banking relationships
- Clear evidence trail for partners, investors and acquirers during due diligence
- Controls designed once to satisfy both FINTRAC and, where relevant, the Bank of Canada
- Reduced risk of revocation for administrative lapses such as late change notices or renewals
Requirements
- A compliance officer with real authority, independence and access to senior management
- Written policies and procedures kept current and approved by a senior officer
- A documented, business-specific risk assessment covering clients, products, channels, geography and technology
- An ongoing written training programme for employees, agents and anyone acting on the MSB's behalf
- An effectiveness review of the whole programme at least every two years, reported to senior management
- Accurate, timely transaction reporting, including the 24-hour rule and travel-rule information for transfers
- Client identification, beneficial ownership, politically exposed person and third-party determinations
- Ongoing monitoring and enhanced measures for higher-risk clients; compliance with ministerial directives
- Due diligence on agents and mandataries before engaging them, now reinforced by an offence under Bill C-12
- Registration hygiene: 30-day change notices and renewal before the two-year expiry
Licence options & capital
Compliance health check
A gap review of an existing registration against FINTRAC's expectations and recent enforcement themes, with a prioritised remediation plan.
Two-year effectiveness review
The mandatory review of policies, risk assessment and training, tested against actual transactions and reports, documented for FINTRAC and senior management.
Substance build-out
Design of local or remote operating substance: compliance officer arrangements, record locations, outsourcing controls, governance minutes and banking documentation.
Examination and enforcement support
Preparation for FINTRAC examinations, responses to findings, and handling of compliance agreements or orders under the post-2026 framework.
Step-by-step process
- 1
Baseline assessment
We review the registration file, ownership, activities and current programme against the PCMLTFA and FINTRAC guidance.
- 2
Risk assessment refresh
The risk assessment is rebuilt around actual client, product and geographic data rather than generic templates.
- 3
Policy and procedure alignment
Policies are rewritten to describe what staff actually do, including reporting workflows and escalation.
- 4
Substance and governance
Roles, reporting lines, outsourcing agreements, record storage and board oversight are formalised.
- 5
Testing and training
Sample testing of client files and reports, followed by targeted training for staff and agents.
- 6
Ongoing calendar
A compliance calendar tracks change notices, renewals, reviews and regulatory updates.
Typical documents
- FINTRAC registration confirmation and history of change notices
- Compliance officer appointment and job description
- AML/ATF policies and procedures, with approval records
- Risk assessment and supporting data
- Training plan, materials and attendance logs
- Most recent two-year effectiveness review
- Samples of client files and submitted reports
- Agent and outsourcing agreements with due diligence records
- Banking, safeguarding and reconciliation documentation
How Legal Wealth helps
Legal Wealth supports MSB owners who want a Canadian registration that holds up over time, not just on the day it is granted. We work discreetly with your management and compliance team to test the programme against FINTRAC's expectations, shape substance that reflects how the business genuinely operates, and keep a clear documentary record for regulators and banks. Our approach is compliance-first and tailored: we recommend only the measures your risk profile requires and coordinate with your auditors and advisers where needed.
Enquire with Legal WealthFrequently asked questions
Does a Canadian MSB need a physical office in Canada?
Not for FINTRAC registration; foreign MSBs can register without a place of business. However, records, a functioning compliance officer and a banking arrangement must exist, and Canadian banks typically expect visible operational substance.
How often must the compliance programme be reviewed?
An effectiveness review must be carried out at least every two years, covering policies, the risk assessment and training, and the results must be reported to a senior officer.
What are the most common reasons MSBs are penalised?
FINTRAC findings most often relate to inadequate policies and procedures, weak risk assessments, registration lapses and missed or deficient reports.
Can FINTRAC revoke a registration?
Yes, for example where a business fails to answer a clarification request, does not assist FINTRAC or becomes ineligible. Revoked MSBs are listed publicly.
How large can penalties be now?
For violations on or after 26 March 2026, up to C$40,000 for minor, C$4 million for serious and C$20 million for very serious violations, with higher caps for breaching a compliance order.
Last reviewed: 2026-10. Requirements, fees and timelines change. Information is general, reviewed on the date shown, and is not legal or tax advice.
Sources
- FINTRAC – Administrative monetary penalties: changes following legislative amendments
- FINTRAC – Money Services Business Registry
- McCarthy Tétrault – Bill C-12 brings hefty penalties into force
- MNP – What FINTRAC penalties reveal about MSB compliance
- Bank of Canada – Retail payments supervision key milestones
