How FINTRAC's Crackdown on Crypto MSBs Is Reshaping the Industry
FINTRAC has moved from warnings to hard enforcement against crypto money services businesses (MSBs). Between September 2025 and March 2026, it issued the largest penalty in its history (C$176,960,190 against Cryptomus), fined KuCoin's operator C$19,552,000, and revoked dozens of MSB registrations, most of them tied to crypto. For compliant operators, the message is clear: registration is only the starting line, and a working compliance program is now the price of staying in the Canadian market.
Canada's crypto sector spent years in a grey zone where registering with FINTRAC felt like a box to tick. That era is over. A record fine, a wave of revocations, new federal legislation with penalties up to 40 times higher, and a proposed ban on crypto ATMs have changed what it takes to operate a virtual currency business in Canada.
This guide breaks down what happened, why it happened, who was affected, and what it means for crypto businesses that want to keep serving Canadians.
What is FINTRAC, and why does it regulate crypto businesses?
The Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) is Canada's financial intelligence unit and anti-money laundering (AML) supervisor. It enforces the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA).
Since June 1, 2020, businesses that deal in virtual currency (exchanges, brokers, crypto ATM operators and similar services) have been classified as MSBs under the PCMLTFA. That means they must:
Register with FINTRAC before offering services, and renew that registration every two years
Build a written compliance program with policies approved by senior management
Assess and document their money laundering and terrorist financing risks
Verify client identity and keep records
File suspicious transaction reports (STRs) when there are reasonable grounds to suspect a transaction is linked to money laundering or terrorist financing
File large virtual currency transaction reports (LVCTRs) when they receive C$10,000 or more in virtual currency (a requirement in force since June 1, 2021)
Foreign MSBs are not exempt. A business located outside Canada that directs services at people in Canada must register as a foreign MSB and meet the same core obligations.
One point is often misunderstood: FINTRAC registration is not a licence or an endorsement. As FINTRAC's own MSB registry notes, a listing only shows that a business satisfied the legal requirements to register. What matters is whether the business keeps meeting its obligations after that.
What triggered FINTRAC's crypto crackdown?
Three forces came together between 2024 and 2026.
Feel Invincible. Experience Freedom.
Open your Invincible Wallet in minutes. Start sending payments that move at the speed of your business.
1. Evidence that crypto platforms were moving criminal money. FINTRAC's examinations found platforms that were not reporting transactions tied to fraud, ransomware, sanctions evasion and child exploitation. These were not paperwork slips; they were failures to flag the exact activity AML rules exist to catch.
2. Fraud against Canadians. Crypto has become a favourite payment rail for scammers. In its Spring Economic Update materials (May 2026), the federal government estimated that Canadians lost between C$142 million and C$284 million in 2024 to fraud facilitated by crypto ATMs, and cited estimates that 85% to 98% of crypto ATM transactions are linked to illicit activity.
3. Political will. In a March 17, 2026 statement, Finance Minister François-Philippe Champagne described a "significantly increased pace of action" at FINTRAC and said the government would "monitor and pursue new measures to address risks posed by virtual currency businesses, such as cryptocurrency MSBs and crypto ATMs." Parliament followed with new legislation that sharply raised penalties (more on that below).
FINTRAC was already on an upward trend before crypto took centre stage. In fiscal 2024 to 2025, it issued 23 notices of violation totalling more than C$25 million, the highest annual count in its history.
Which crypto businesses were hit, and why?
Cryptomus (Xeltox Enterprises Ltd.): the largest penalty in FINTRAC history
On October 22, 2025, FINTRAC announced a C$176,960,190 administrative monetary penalty against Xeltox Enterprises Ltd., a British Columbia-incorporated company operating as Cryptomus (formerly Certa Payments Ltd.). The penalty was imposed on October 16, 2025.
FINTRAC found violations in six areas:
Failing to submit suspicious transaction reports on 1,068 occasions (July to August 2024)
Failing to report receipt of C$10,000 or more in virtual currency on 1,518 occasions (July to August 2024)
Failing to comply with a Ministerial Directive
Failing to develop and maintain written compliance policies and procedures approved by a senior officer
Failing to assess and document money laundering and terrorist financing risks
Failing to notify FINTRAC of changes to its registration information
According to FINTRAC, the unreported transactions included activity linked to child sexual abuse material, fraud, ransomware payments and sanctions evasion. Compliance Week described it as a "severe breach of Canada's anti-money laundering framework." (Note: some international outlets report this penalty as roughly US$126 million; the official figure is in Canadian dollars.)
Cryptomus has appealed the penalty to the Federal Court. Its registration was also among those revoked in March 2026.
KuCoin (Peken Global Limited): operating without registration
A month earlier, on September 25, 2025, FINTRAC announced a C$19,552,000 penalty against Peken Global Limited, the Seychelles-incorporated operator of the KuCoin exchange. The violations:
Failing to register with FINTRAC as a foreign MSB
Failing to report large virtual currency transactions of C$10,000 or more
Failing to submit suspicious transaction reports
KuCoin has also appealed. The case matters because it confirms FINTRAC will pursue offshore platforms that serve Canadians, not just businesses with a Canadian address.
The March 2026 revocation wave
On March 17, 2026, the federal government confirmed that FINTRAC had revoked 23 MSB registrations in a single day. Industry reporting at the time (including Finance Magnates and crypto.news) put the 2026 total at roughly 50 revoked registrations, with about 47 of them linked to crypto businesses. Firms named in coverage included foreign operators based in Slovakia and England, alongside Cryptomus.
A revoked business can no longer legally provide MSB services in Canada. FINTRAC publishes every revocation on its public list of MSBs with revoked registration, so banks, payment partners and customers can check a counterparty's status.
Why does FINTRAC revoke an MSB registration?
Most revocations are not about dramatic fraud cases. They come from basic failures that any operator can avoid. According to FINTRAC, a registration can be revoked when a business:
Is ineligible to register, for example because of certain criminal convictions, including under the PCMLTFA, or ties to a listed terrorist entity
Does not respond to a FINTRAC request for clarification within 30 days
Does not provide information or assistance FINTRAC asks for
Fails to keep its registration information up to date, such as changes in ownership, agents, address or services
The pattern in 2026 is telling. Many of the revoked registrants appear to have been foreign or thinly staffed operations that registered, then stopped engaging. When FINTRAC came asking, nobody answered. Separately, registrations that are not renewed within two years simply expire.
The lesson: a registration is a living obligation. Unanswered mail from FINTRAC can end a business.
What changed with Bill C-12 and the new penalty regime?
On March 26, 2026, Bill C-12 (the Strengthening Canada's Immigration System and Borders Act) received Royal Assent and overhauled FINTRAC's penalty powers. According to FINTRAC and legal analysis from firms including Blakes:
Violation type | Previous maximum | New maximum |
|---|---|---|
Minor | C$1,000 | C$40,000 |
Serious | C$100,000 | C$4,000,000 |
Very serious | C$500,000 | C$20,000,000 |
Other key changes:
A 40 times increase in maximum penalties per violation
An aggregate cap equal to the greater of C$20 million or 3% of gross global revenue
A new "very serious" violation for failing to maintain a compliance program that is reasonably designed, risk-based and effective
Mandatory compliance agreements for prescribed violations occurring after March 26, 2026
Compliance orders as a new enforcement tool
Mandatory FINTRAC enrolment for all reporting entities, with a public roll (to come into force by Order in Council)
Violations that occurred entirely before March 26, 2026 fall under the old framework. Anything after that date is exposed to the new maximums. For a crypto MSB with hundreds of unreported transactions, the math now looks very different.
What else is on the horizon for Canadian crypto businesses?
A proposed crypto ATM ban. The April 2026 Spring Economic Update proposed shutting down crypto ATMs across Canada, calling them a primary method for scammers to defraud victims and for criminals to place cash proceeds of crime. Details will come in legislation.
A new Canadian Financial Crimes Agency. Legislation to create it was tabled on April 27, 2026, with C$352.7 million in proposed funding over five years.
More transparency on enforcement. FINTRAC and the Department of Finance have both said they intend to publish more about compliance actions, which means reputational damage now arrives alongside the fine.
What does the crackdown mean for compliant crypto operators?
It is tempting to read this as bad news for crypto in Canada. For well-run businesses, it is closer to the opposite.
The field is getting smaller, and cleaner
Every revoked registration is one fewer competitor cutting corners on KYC or reporting. Customers, banks and partners are starting to check FINTRAC status before they transact. Businesses that can show a clean record, an active registration and a documented compliance program have a real commercial edge.
Your banking and payment partners matter more than ever
Most crypto businesses need a fiat rail: a way for Canadians to fund accounts in CAD and withdraw back to their bank. When a partner loses its registration, every business relying on it loses its on-ramp overnight. Due diligence on your payment providers is now part of your own risk management.
Questions worth asking any payment partner:
Is it currently registered with FINTRAC? (Check the public MSB registry yourself.)
Is it registered with the Bank of Canada under the Retail Payment Activities Act (RPAA)?
How are client funds safeguarded?
Does it run real-time fraud and transaction monitoring?
Does it understand crypto businesses, or will it close your wallet at the first large transfer?
This is where Invincible Pay fits. We are a FINTRAC-registered MSB and are regulated by the Bank of Canada under the RPAA. Our crypto on-ramp and off-ramp services give crypto businesses regulated CAD rails, including Interac e-Transfer up to $25,000 per transaction with no daily limit, EFT, domestic wires and a REST API, backed by 24/7 fraud monitoring and safeguarded, insured funds.
A compliance checklist for crypto MSBs in 2026
If you operate a virtual currency business that serves Canadians, use this as a starting point (and work with qualified AML counsel for your specific situation):
Confirm your registration is active and your renewal date is in your calendar.
Update FINTRAC within the required timelines whenever ownership, agents, addresses or services change.
Answer every FINTRAC request well inside the 30-day window.
Keep a written, senior-approved compliance program and review it at least every two years.
Document a real risk assessment that reflects your actual clients, products and geographies.
File STRs and LVCTRs on time. Automate detection where volume makes manual review unrealistic.
Screen for sanctions and Ministerial Directives, which now carry clear enforcement consequences.
Test your program's effectiveness, not just its existence. Under Bill C-12, an ineffective program is itself a very serious violation.
Vet your payment partners with the same care FINTRAC will apply to you.
The bottom line
FINTRAC's crypto crackdown is not a passing phase. Record penalties, a surge in revocations, 40 times higher maximum fines and proposed limits on crypto ATMs all point in one direction: Canada wants a crypto sector that meets the same AML standards as the rest of the financial system.
For operators who already take compliance seriously, that is an opportunity. Clients and partners are looking for businesses they can trust, and the market is clearing out those they cannot.
Need a regulated CAD payment partner for your crypto business? Invincible Pay offers FINTRAC-registered, Bank of Canada-regulated payment rails built for crypto businesses, with 5-minute onboarding. Talk to our team about crypto on-ramps and off-ramps today.
Frequently Asked Questions
Do crypto businesses need to register with FINTRAC?
Yes. Since June 1, 2020, businesses that deal in virtual currency in Canada, or foreign businesses that direct those services at people in Canada, must register with FINTRAC as money services businesses before operating. Registration must be renewed every two years.
What was the largest FINTRAC penalty against a crypto company?
The largest is C$176,960,190 against Xeltox Enterprises Ltd. (Cryptomus), announced October 22, 2025. FINTRAC found six violations, including 1,068 missed suspicious transaction reports and 1,518 unreported virtual currency transactions of C$10,000 or more. The company has appealed.
Why does FINTRAC revoke MSB registrations?
FINTRAC revokes registrations when a business is ineligible (for example, due to certain criminal convictions), fails to respond to a request for clarification within 30 days, does not provide requested information, or fails to keep its registration details current.
How much can FINTRAC fine a business now?
Since Bill C-12 received Royal Assent on March 26, 2026, maximum penalties are C$40,000 for a minor violation, C$4 million for a serious violation and C$20 million for a very serious violation, with an overall cap of the greater of C$20 million or 3% of gross global revenue.
How can I check if a crypto company is registered with FINTRAC?
Search FINTRAC's public Money Services Business Registry. FINTRAC also publishes a separate list of MSBs whose registrations have been revoked. Keep in mind that registration is not a licence or endorsement; it confirms the business met the legal requirements to register.
