FINTRAC 2025-26 Annual Report: 35 Penalties Worth $247 Million, 82 MSB Revocations and 4,874 Supervisory Activities

FINTRAC published its 2025-26 Annual Report on October 26, 2026, four days after posting its results by the numbers for the same year. Here are the supervision and enforcement figures that apply to you as a reporting entity, each with the FINTRAC line it comes from.

The news release says FINTRAC supervises more than 38,000 businesses. The report says FINTRAC has "shifted more fully to an enhanced risk-based approach to supervision, moving beyond measuring technical compliance to promoting risk awareness, risk identification and effective risk mitigation," and moved from a regional structure to a sector-specific one. We covered that shift in FINTRAC risk-based supervision in 2026.

Penalties: 35 Notices of Violation Worth More Than $247 Million

The report names the sectors most penalized in 2025-26: financial entities (12), money services businesses (8), casinos (5) and real estate (5). It also gives five years of totals:

The report describes three of the year's penalties:

• Xeltox Enterprises Ltd. (operating as Cryptomus), October 2025, $176 million, "the largest penalty in its history." Among other violations, FINTRAC found it failed to submit STRs where there were reasonable grounds to suspect links to trafficking in child sexual abuse material, fraud, ransomware payments and sanctions evasion. Our Xeltox penalty post has the details.
• Peken Global Limited (also operating as KuCoin), July 2025, $19,552,000, for failing to register with FINTRAC, failing to report large virtual currency transactions on 2,952 occasions and failing to report suspicious transactions on 33 occasions.
• MP Technology Services Ltd., a subsidiary of MoonPay Inc., November 2025, $536,853.35, for four violations, including failing to report suspicious transactions with direct or indirect exposure to darknet marketplaces, sanctioned entities and child sexual abuse material.

The report says the Strengthening Canada's Immigration System and Borders Act, passed in March 2026, increased FINTRAC's penalties "by up to 40 times the current amounts" and gave FINTRAC authority to issue Compliance Orders. The interim Director and CEO's message says those orders "will be made public," and that failure to comply can result in a penalty of up to $30 million or 3% of the business's global revenues. See FINTRAC's new AMP framework under Bill C-12.

On the 31 disclosures to law enforcement, 28 involved money services businesses. The report says FINTRAC may disclose non-compliance for potential criminal investigation "when it is extensive or if there is little expectation of immediate or future compliance."

82 MSB Registrations Revoked, Up From 12

The interim Director and CEO's message gives the reason: FINTRAC revoked the registrations of 82 money services businesses "for failing to respond to clarification requests or demands for information." It adds that this information includes crypto wallet addresses. The report's registry section says MSBs "are also required to respond in a timely manner to demands for information from FINTRAC or their registrations are revoked," and must renew their registration every two years.

More than 55% of FINTRAC's assessment activities were directed at money services businesses, including full-scope examinations on larger, more traditional MSBs, targeted assessments on crowdfunding platforms and payment service providers, and information demands on high-risk virtual asset service providers. Penalties on MSBs totalled more than $198 million.

As of March 31, 2026, 3,396 money services businesses were registered with FINTRAC, up from 2,778. During the year, 23 new registrations were denied. The report says FINTRAC publishes the names of revoked MSBs "to enhance transparency and assist other business sectors with their risk assessments." Our FINTRAC reporting for MSBs page covers the reports MSBs file.

4,874 Assessment and Monitoring Activities

The report breaks the year's activities into these types:

Self-attestations. FINTRAC "focuses its self-attestations on businesses offering higher-risk products and services, entities in higher-risk locations, businesses that are important because of market share, and entities with no previous compliance history." The report says they help identify "higher-risk businesses for more intrusive supervisory activities."

Risk Questionnaires. The report says the questionnaire "compels businesses to provide details on their risks, business model and compliance measures," and that FINTRAC used the answers to triage "businesses that were mainly compliant and those that had major gaps in compliance to inform future supervisory activities."

Examinations. A full-scope examination covers "the entire compliance program of a business." A targeted examination is "limited to a specific risk or vulnerability or a specific anti-money laundering and anti-terrorist financing control." FINTRAC also holds quarterly monitoring meetings with Canada's largest banks and a major credit union.

After an examination. FINTRAC monitors action plan commitments, and "an action item is considered closed once the business can demonstrate that it has taken all appropriate corrective measures." Our post on what happens after a FINTRAC examination covers findings, compliance agreements and compliance orders.

294 Voluntary Self-Declarations of Non-Compliance

The report says many of the 294 declarations "related to late reporting due to human error or systems issues and the remediation of previous non-compliance by recently onboarded sectors."

FINTRAC's guidance says a written self-declaration should include:

• the name of the reporting entity and contact details of the person submitting it;
• for reporting issues, the number of reports affected, their type, the time period, and the reason the reports were not submitted, were late or were incorrect;
• for other issues, the time period and the reason they occurred;
• a plan to resolve the issues and submit all outstanding or corrected reports, including measures and timelines for corrective action.

The guidance sets two conditions: "When the voluntarily declared non-compliance issue is not a repeated instance of a previous submission to FINTRAC, and when this declaration has not been made after you have been notified of an upcoming assessment activity, FINTRAC will work with you to resolve the issue."

What Businesses Reported: 653,835 STRs

Annex A of the report counts 17,758,142 financial transaction reports received in 2025-26. The report attributes the decline from earlier years to "a new, more efficient reporting system that allows for the submission of numerous transactions in each report." Transactions inside STRs rose from 32.9 million in 2024-25 to 74.6 million in 2025-26.

Eight Questions From FINTRAC's 2025-26 Annual Report

1. Can you answer a FINTRAC clarification request or demand for information on time? 82 MSB registrations were revoked "for failing to respond to clarification requests or demands for information" (Message from the interim Director and CEO).
2. If you are an MSB, is your renewal date tracked? MSBs "must renew their registration every two years" (Money services business registry section).
3. Could you complete a Risk Questionnaire today with "details on their risks, business model and compliance measures"? (Supervisory activities section.)
4. Do you match a self-attestation focus? Higher-risk products and services, higher-risk locations, market share, or no previous compliance history (Supervisory activities section).
5. When you find a late or missed report, can you declare it before FINTRAC notifies you of an assessment? FINTRAC's self-declaration guidance sets that condition.
6. Would your self-declaration state the number, type and time period of reports affected, the reason, and a plan with timelines? FINTRAC's self-declaration guidance lists each item.
7. After an examination, can you show evidence for each action item? An item closes "once the business can demonstrate that it has taken all appropriate corrective measures" (Supervisory activities section).
8. Does your risk assessment use FINTRAC's published list of revoked MSBs? FINTRAC publishes those names to "assist other business sectors with their risk assessments" (Money services business registry section).

Bottom Line

In 2025-26, FINTRAC carried out 4,874 assessment and monitoring activities, revoked 82 MSB registrations and issued 35 notices of violation totalling more than $247 million.

In FINTRAC's words: "These actions signaled an important shift in FINTRAC's regulatory expectations toward stronger, more effective anti-money laundering and anti-terrorist financing controls."