FINTRAC's 2026 Crypto Crackdown: What 50 Revoked MSB Registrations Mean for Your Business
Dozens of MSB registrations were revoked. Many of them were linked to crypto. In some cases, multiple revocations happened in a single day. That is what Canada's enforcement posture has looked like across 2025 and 2026 for virtual currency businesses, and the government has said publicly that the pace is not slowing down. If your crypto firm is registered with FINTRAC but has not seriously reviewed its compliance program recently, this article is worth reading before the regulator comes to you first.
Why This Enforcement Wave Is Different from Anything Before It
Crypto regulation in Canada has been in place since 2021. FINTRAC began requiring virtual currency businesses to register as money services businesses (MSBs) that year, so enforcement is not new.
What is new is the scale, the speed, and the signal behind it.
Volume. Fifty MSB registrations were revoked in a single quarter. Twenty-three in a single day. This has never happened before.
Penalty size. In September 2024, FINTRAC penalized the operator of a foreign virtual currency platform approximately C$20 million for operating in Canada without proper foreign MSB registration and for missing large virtual currency transaction reporting obligations. One month later, in October 2024, FINTRAC issued a C$176.96 million penalty against the operator of a Vancouver-based crypto platform. That remains the largest publicly reported penalty imposed on a cryptocurrency business in Canada.
The violations in that October 2024 case included 1,068 unreported suspicious transactions in a single month, 1,518 missed Large Virtual Currency Transaction Reports, and 7,557 Iran-linked transfers that went unflagged despite a specific Ministerial Directive requiring exactly that.
Government commitment. The federal government said in March 2026 that FINTRAC is "strengthening enforcement and increasing transparency on compliance actions" and that it will "continue to monitor and pursue new measures to address risks posed by virtual currency businesses."
It is a statement of direction.
This is not a sweep that firms can wait out. It is a sustained enforcement posture, and it is getting more aggressive, not less.
AMLI Analysis: Firms that read each enforcement action as an isolated event are missing the pattern. This is a maturing regulatory posture, and the trajectory is clear.
Who Is Getting Revoked and What Is Triggering It
FINTRAC's authority to revoke MSB registration comes from the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA). Revocation is not a last resort. It sits alongside administrative monetary penalties (AMPs) and criminal referrals as a standard enforcement tool.
Revocation grounds include:
-
Prior conviction for money laundering, terrorist financing, or a related criminal offence
-
Failure to respond to a FINTRAC information request within 30 days
-
Failure to update registration details such as business name, address, or ownership
-
Inability to support the agency's mandate, for example, where a firm cannot be meaningfully contacted or examined
-
Ineligibility at time of registration or on review
Some of the firms revoked had no physical presence in Canada. They operated from outside the country while offering cryptocurrency exchange and money transfer services to Canadian users.
Their registration was revoked.
Physical absence from Canada is not a compliance defence. If your firm serves Canadian users, Canadian law applies to your business.
Legal requirement: All businesses dealing in virtual currency in Canada, including foreign entities directing services at Canadians, must register with FINTRAC as MSBs or foreign MSBs (FMSBs) before operating. See FINTRAC's MSB registration guidance and use the check to see if you need to register tool.
Operational expectation: Registration must be active and accurate. Changes in ownership, services, or address must be updated promptly. Stale registration is itself a revocation risk, separate from any other compliance issue.
AMLI Analysis: Many revocations happen not because of criminal conduct but because a firm quietly stopped engaging with its obligations. Registration is an ongoing responsibility, not a one-time task.
Getting Registered Is Not the Same as Being Ready
This is one of the most consequential misunderstandings in early-stage crypto compliance, and it shows up in enforcement cases again and again.
FINTRAC is clear on this point: registration confirms a business has met the threshold to operate. It does not certify that the compliance program is adequate, that monitoring is working, or that the team can handle difficult decisions consistently under pressure.
One recent enforcement case is a clear example.
The firm was registered. It had a listed Canadian address. But FINTRAC described its compliance program as "incomplete and inadequate." Its monitoring system failed to detect more than 1,000 suspicious transactions in a single month. The Canadian address on file was a rented mailbox. Contact details were outdated.
Registration was in place. Everything behind it had failed.
Legal requirement: All reporting entities must establish and implement a compliance program. FINTRAC's requirements cover five elements: a compliance officer, written policies and procedures, a documented risk assessment, a training program, and an effectiveness review at least every two years. See FINTRAC's compliance program overview.
Operational expectation: These five elements must be functional and current. They should evolve as the business grows, not sit unchanged from the day of registration.
AMLI Analysis: A compliance program is not a filing. It is the operational logic that determines whether a business can meet its legal obligations on the day FINTRAC asks.
What FINTRAC Actually Examines When It Reviews a Crypto MSB
The enforcement record is useful precisely because it tells you, in specific terms, where programs break down. These are not theoretical priorities. They are the areas where the largest cases have collapsed.
1. Suspicious Transaction Reporting (STRs)
An STR must be filed when there are reasonable grounds to suspect that a transaction is related to money laundering or terrorist financing. The threshold is reasonable grounds to suspect, which sits below certainty and below probability. Many compliance teams set their internal bar too high, which is part of why so many STRs go unfiled.
In one enforcement case, a firm missed 1,068 in a single month.
FINTRAC also makes clear that attempted transactions can meet the STR threshold, not only completed ones. See FINTRAC's STR guidance.
2. Large Virtual Currency Transaction Reports (LVCTRs)
An LVCTR must be filed for any single or aggregated virtual currency receipt of C$10,000 or more within 24 hours. This obligation does not require suspicion. It requires only threshold monitoring and timely filing.
In that same enforcement case, the firm missed 1,518 of these in a single month.
That is a mechanical failure. There is no complicated legal judgment involved. The transaction happened. The threshold was crossed. The report was not filed.
3. Written Policies and Procedures
The absence of written compliance policies was cited directly in multiple enforcement decisions. Informal practices do not constitute a compliance program. Without documented policies, there is no consistent standard to apply, no training foundation to build on, and nothing for a regulator to evaluate.
4. Beneficial Ownership and Customer Identification
FINTRAC requires reporting entities to confirm beneficial ownership and verify customer identity in accordance with PCMLTFA obligations. For virtual currency businesses where transactions can obscure source and destination, this is one of the most operationally complex areas to implement consistently. It is also one of the most common failure points.
5. Ongoing Monitoring
Ongoing monitoring must detect suspicious transactions, keep customer information current, reassess client risk, and confirm that transaction behaviour is consistent with what is known about the customer. This obligation begins when the business relationship begins, not after the customer becomes active. See FINTRAC's ongoing monitoring guidance.
AMLI Analysis: The violations behind the largest enforcement actions are rarely exotic. They are missed reports, missing policies, and monitoring systems that were never designed to function at real operating volume.
If Your Firm Is Based Outside Canada, Read This Section Carefully
The revocation of multiple foreign companies carries a specific message for international crypto businesses.
If your company is incorporated outside Canada but directs services at Canadian customers through a Canadian-facing website, Canadian payment options, or Canadian language and currency settings, you may qualify as a foreign money services business (FMSB) under the PCMLTFA.
FMSBs carry the same obligations as domestic MSBs. They must register with FINTRAC, designate a contact for the agency, implement a full compliance program, and meet the same reporting, recordkeeping, and client identification requirements.
Serving Canadian customers without registration is not a grey area. It is grounds for enforcement and possible revocation.
Legal requirement: Foreign entities directing virtual currency services at Canadian residents must register as FMSBs. See FINTRAC's foreign MSB guidance.
AMLI Analysis: A Canadian user base is a compliance trigger, not a jurisdiction-neutral fact. FINTRAC has now shown it will revoke foreign firms. The risk is not theoretical.
What a Defensible Crypto Compliance Program Looks Like
Recent enforcement actions across 2024, 2025, and 2026 have produced something valuable: a clear, concrete picture of what FINTRAC expects. The eight elements below are not aspirational. They are the baseline.
Active registration. Current ownership, services, contacts, and addresses are on file. Updated whenever the business changes. Stale details are a standalone revocation risk.
A real compliance officer. Not a title held by someone whose primary role is elsewhere. A designated officer with genuine authority, current AML knowledge, and documented involvement in compliance oversight.
Written policies and procedures. Documented standards for customer identification, beneficial ownership, transaction monitoring, red flag recognition, STR and LVCTR filing, enhanced due diligence, and escalation. These must reflect how the business actually operates, not a generic template unchanged since registration.
A current risk assessment. A documented assessment of the business's money laundering and terrorist financing risks based on customer types, transaction volumes, corridors, products, and geographic exposure. This should be updated when the business changes materially.
Transaction monitoring that works at volume. Processes are capable of detecting LVCTRs within the 24-hour threshold and flagging suspicious activity at the actual operating scale. A monitoring system that worked during testing but cannot handle current throughput is a non-functioning control.
Consistent STR and LVCTR filing. Reporting that does not depend on individual analyst discretion. Reporting gaps at the scale seen in recent enforcement actions reflect a process that was never designed for real volume.
Documented training. Current, relevant training for all staff involved in compliance. FINTRAC expects training to reflect the firm's actual risk environment.
An independent effectiveness review. A review confirming that controls are working as designed, conducted at least every two years. This report is not a self-assessment. It is an independent test of whether the program functions in practice.
AMLI Analysis: The enforcement record shows clearly what FINTRAC finds when any of these elements are absent.
What Happens to a Firm After Revocation
Revoked firms do not simply close quietly.
Revocation removes the legal right to operate as an MSB in Canada. Any ongoing virtual currency, money transfer, or exchange activity after revocation is a PCMLTFA violation. Revoked firms have 30 days to request a review, but rebuilding registration and demonstrating compliance readiness to a regulator that has already revoked the business is a significant undertaking.
Reputational damage often arrives before the legal process concludes. FINTRAC maintains a public registry. Banking partners, payment processors, and institutional counterparties check it. A revoked or lapsed registration can disrupt banking access and payment rails before the business has resolved its regulatory standing.
AMLI Analysis: The commercial and operational disruption that follows revocation often does more damage than the enforcement action itself.
A Quick Compliance Check: Eight Questions to Answer Before FINTRAC Does
Every registered virtual currency MSB should be able to answer the following without searching for documents:
-
Is the FINTRAC registration active and up to date, including ownership, services, and contact details?
-
Is there a designated compliance officer with documented authority and current AML knowledge?
-
Are written policies and procedures in place that reflect the actual business today, not a template from registration?
-
Does the transaction monitoring system file LVCTRs within 24 hours at current volume?
-
Are STRs reviewed and filed consistently, including for attempted suspicious transactions?
-
Has the compliance program been independently reviewed for effectiveness in the last two years?
-
Are beneficial ownership records current across all business relationships?
-
Is there a documented escalation path for higher-risk customers, onboarding decisions, and reportable activity?
If the answer to any of these is uncertain, that uncertainty is where the exposure sits.
How AML Incubator Supports Crypto MSBs Across Canada
AML Incubator works with virtual currency businesses, fintechs, and MSBs to build compliance programs that hold up under examination, not just at registration.
If your business is registered but you are not certain your compliance program would withstand a FINTRAC examination, that question is worth answering before the regulator asks it first.
Book a free compliance consultation with AML Incubator.
