FINTRAC Casino Sector Penalties: Nova Scotia Gaming and New Brunswick Lotteries and Gaming Fined a Combined $631,538.50

FINTRAC's September 3, 2026 announcement named two provincial Crown corporations in the casino sector. Nova Scotia Gaming Corporation was penalized $231,826 and the New Brunswick Lotteries and Gaming Corporation was penalized $399,712.50, a combined $631,538.50. Both penalties have been paid in full and both cases are closed.

This is the second time this summer that FINTRAC has published a casino-sector penalty involving Atlantic Canada's public gaming bodies. On July 9, 2026, FINTRAC announced a $212,025 penalty against Atlantic Lottery Corporation Inc., the Moncton-based agency owned by the four Atlantic provinces, for one unreported suspicious transaction report plus policy and risk assessment failures. Read together, the three cases describe the same control problem from three angles: player activity that showed recognizable indicators, and no suspicious transaction report to show FINTRAC that anyone noticed.

What FINTRAC announced

Both penalties followed compliance examinations and were imposed within a day of each other in late July. The public notices were published together on September 3, 2026.

Nova Scotia Gaming Corporation: three violations

FINTRAC's public notice lists three administrative violations against Nova Scotia Gaming Corporation, which conducts and manages casino gaming in the province.

New Brunswick Lotteries and Gaming Corporation: one violation, larger penalty

The New Brunswick notice cites a single violation, also classified very serious. The corporation failed to submit three STRs where there were reasonable grounds to suspect that one or more transactions were related to the commission or attempted commission of a money laundering or terrorist activity financing offence. FINTRAC says its examination identified transactions, both conducted and attempted, by players where numerous money laundering and terrorist financing indicators were present.

The one-violation penalty in New Brunswick is larger than the three-violation penalty in Nova Scotia. That is not an anomaly. The number of violations is not what drives the amount. The classification of each violation drives it, together with the criteria in section 73.11 of the Act, including the harm done and the entity's compliance history, and section 6 of the administrative monetary penalties regulations. STR failures sit in the very serious category, and the New Brunswick case involved more of them. For the penalty ranges by classification, see our FINTRAC AMP penalty schedule.

The indicators FINTRAC says were present

Both public notices list the indicators that appeared in the unreported cases. They read like an online casino monitoring checklist rather than a gaming floor checklist:

• Common identifiers, such as addresses or phone numbers, used by multiple players who do not appear to be related.
• A common credit card used by multiple online players for deposits.
• An account linked to seemingly unconnected parties.
• Adverse media or other reliable sources linking a player, or related transacting parties, to criminal activity.
• Seemingly false information, such as credit card details, or identification that appears counterfeited, altered, or inaccurate.
• Transactions showing financial connections with people who previously raised suspicion.
• Excessive deposits using prepaid cards, which may involve an excessive number of cards.
• A chargeback on the financial instrument used for a deposit, indicating unauthorized use.

Spokespeople for both provinces told The Canadian Press that the penalties relate to Atlantic Lottery's online casino operations, which Atlantic Lottery runs on behalf of the provincial Crown corporations. That matters for how casino compliance programs are designed. Chargebacks, shared payment cards, prepaid card stacking, and identifier overlap live in payment and account data, not at the cage. If a monitoring program was built around cash buy-ins and disbursements, these indicators may never reach the compliance officer.

Attempted transactions and small amounts still require an STR

The Nova Scotia violation is explicitly about attempted transactions, and the New Brunswick notice covers transactions that were both conducted and attempted. Section 7 of the PCMLTFA applies to attempted transactions, and it applies at any amount. There is no dollar threshold for an STR.

The Canadian Press reported that the two unreported Nova Scotia transactions were worth $750 and $465, that Nova Scotia Gaming said it investigated immediately, banned and suspended the players involved, and changed its policies to address FINTRAC's concerns, and that New Brunswick's finance minister said the degree of real harm associated with the audit findings was minimal.

Those responses illustrate the gap. Taking action against a player is not a substitute for reporting. Banning an account protects the operator. The STR is what gives FINTRAC the information it needs to connect that account to activity at other reporting entities. FINTRAC's acting director framed the point in the release: the obligations in the Act exist so that FINTRAC receives the reporting needed to generate actionable financial intelligence for law enforcement and national security investigations.

The practical control is a routing rule. When a player is blocked, suspended, or has a deposit declined for identity or payment reasons, the case should be routed to an STR decision with a documented rationale, whether the answer is to file or not to file.

Ministerial Directives belong in casino policies

The Nova Scotia policy finding is narrow and specific: the written policies and procedures failed to document and apply Ministerial Directives. Under section 11.42 of the PCMLTFA, the Minister of Finance can direct reporting entities to apply specific measures to transactions involving designated foreign jurisdictions or entities. The directive in force concerns the Islamic Republic of Iran, and it applies to every reporting entity, including casinos.

FINTRAC updated its Iran directive guidance on June 23, 2026, including casino-specific instructions for under-threshold casino disbursements and a transition period that ends on December 23, 2026. We covered the update in our Iran Ministerial Directive reporting article. For a casino program, the policy manual needs to state how staff recognize an Iran connection in online and land-based play, what enhanced measures apply, which records are kept, and which FINTRAC report type is used. A manual that never mentions ministerial directives fails the requirement to be kept up to date, even if everything else in it is current.

An enterprise-level risk assessment is the recurring casino finding

FINTRAC found that Nova Scotia Gaming Corporation had not completed and documented an enterprise-level risk assessment based on its overall business activities. That echoes the CNE Casino penalty of $199,000 announced in September 2025, the Northern Isga Foundation penalty of $91,162.50 announced in March 2026, and the Atlantic Lottery penalty in July. Counting those cases, FINTRAC has published at least five casino-sector penalties in twelve months, and four of them cite the documented risk assessment obligation.

For a provincial gaming corporation, the enterprise view has to cover every channel it conducts and manages: land-based casinos run by a private operator, online casino and lottery products run through a shared agency, video lottery, and the payment methods each channel accepts. FINTRAC's wording, overall business activities, is the point. A risk assessment that covers the casino floor but not online deposits is not enterprise-level.

Who is the reporting entity when operations are outsourced

Casino Nova Scotia's Halifax and Sydney properties and Casino New Brunswick in Moncton are operated by Great Canadian on behalf of the Crown corporations, and Atlantic Lottery runs online casino and lottery products for both provinces. FINTRAC's notices name the Crown corporations, not the operators. Under the PCMLTFA, the reporting entity for a casino is the body that conducts and manages the gaming, so the obligations to report, to keep policies current, and to assess risk stay with it regardless of who runs the platform.

Operationally, that means data and decisions have to cross organizational boundaries. If the operator's fraud team sees the chargeback and the Crown corporation's compliance officer owns the STR decision, the handoff has to be defined, timed, and documented. Service agreements should say who monitors, who escalates, who decides, who files, and where the evidence lives.

What casino and online gaming compliance teams should check this month

1. Attempted and declined activity. Confirm that blocked deposits, failed identity checks, suspended accounts, and player bans are routed to an STR decision with a documented rationale, not only to a fraud or responsible gaming queue.
2. Payment-side indicators. Make sure chargebacks, shared credit cards, prepaid card stacking, and shared identifiers across accounts generate alerts that reach the compliance officer.
3. Ministerial Directive procedures. Add or update written procedures for the Iran directive, including detection, enhanced measures, IR2020 selection, and the Casino Disbursement Report instructions that apply after December 23, 2026.
4. Enterprise-level risk assessment. Document risk across every channel, product, delivery method, geography, and third-party relationship, and refresh it when a new product or payment method launches.
5. Senior officer approval and currency. Check the approval trail and the last review date of every policy document, and record what changed.
6. Operator and agency handoffs. Map who monitors, escalates, decides, files, and retains records across the Crown corporation, the casino operator, and the shared lottery agency.
7. The evidence file. Sample closed alerts and confirm each one has a written reason for filing or not filing. FINTRAC examines the decisions you did not report as closely as the ones you did.

Bottom line

Two penalties, one message. FINTRAC's acting director said the Centre will take firm action, when it is required, to ensure that businesses fulfill their obligations. The release also notes that FINTRAC issued 35 Notices of Violation in 2025-26, the largest number in a single year, for more than $247 million in penalties. The Atlantic Canada penalties were paid and the cases are closed, but the notices are public, and the pattern across the region's gaming bodies is now visible to every examiner.

If a player can be banned for suspicious activity without an STR decision ever being recorded, the program has a gap that FINTRAC has already shown it will penalize.