← Blog
Industry

Canada's AML Penalty Regime Was Rebuilt in March. Here's What Changed for MSBs.

On 26 March 2026, two Acts were given royal assent on the same day, and between them Canada’s anti-money-laundering enforcement regime was substantially rewritten. The larger of the two, the Strengthening Canada’s Immigration System and Borders Act (S.C. 2026, c. 4), carries the amendments to the Proceeds of Crime (Money Laundering) and Terrorist Financing Act in its Part 9. The second, the Budget 2025 Implementation Act, No. 1 (S.C. 2026, c. 3), enacted the Stablecoin Act and made its own amendments to the PCMLTFA.

Much of the commentary written since has attributed these changes to Bill C-2, the Strong Borders Act. That attribution is wrong, and the error is worth correcting before anything is planned around it. The provisions that are now law arrived as Bill C-12. Bill C-2 remains at second reading in the House of Commons, where it has sat without recorded activity since 17 September 2025. What follows is written for a compliance officer at a money services business, and separates what came into force from what was only ever proposed.

The Compliance Programme Is Now Judged on Whether It Works

A new subsection was added to the compliance-programme obligation. Under section 9.6(1.1) of the Act, a reporting entity “shall ensure that the program is reasonably designed, risk-based and effective.” The existing element-by-element requirements were not replaced; an outcome standard was layered on top of them.

The consequence sits in the penalty schedule rather than the Act. In the Administrative Monetary Penalties Regulations, the new provision was classified as a very serious violation — the top of three tiers. Under section 5 of those Regulations, the ranges are $1 to $40,000 for a minor violation, $1 to $4,000,000 for a serious violation, and $1 to $20,000,000 for a very serious one.

The Element List Was Re-Classified at the Same Time

The re-classification was not limited to the new effectiveness standard. Items 196 to 201 of the schedule were moved into the very serious column, and those items cover the compliance-programme elements themselves as set out in section 156 of the Regulations: the appointment of the compliance officer, written policies and procedures approved by a senior officer, the documented risk assessment, the training programme, and the two-year effectiveness review.

The practical shift is one of exposure rather than obligation. A documentation gap of the kind that previously attracted a mid-range penalty now sits in the same tier as the most serious failures in the regime. A series of minor violations is also aggregated: under section 4(2) of the Regulations, a series is treated as a serious violation where the penalties total $400,000 or more.

Checking what the amended Act now requires?A Canadian question such as "what must a compliance programme contain under the PCMLTFA" is answered by ARGOS with a citation to the Act itself, not a summary of it.

Try a free question

Ceilings Were Tied to Revenue, and Computed Across the Group

The per-violation maximum in section 73.1(2) is $4,000,000 for a person and $20,000,000 for an entity. The figure that matters more is in section 73.1(3): for all violations on a single notice taken together, the maximum is the greater of $20,000,000 and 3% of the entity’s gross global revenue. Under section 73.1(4), where the entity is part of an affiliated group, the group’s gross global revenue is deemed to be the entity’s own.

A higher ceiling again applies to compliance orders. Under section 73.18(2), a compliance order violation reaches the greater of $30,000,000 and 3% of gross global revenue for an entity. Most summaries of the new regime stop at the $20,000,000 figure; it is not the highest number in the Act.

Compliance Agreements Became Mandatory and Orders Publishable

Two mechanisms were added that change what follows a finding. Under section 73.16(1), once proceedings in respect of a prescribed violation have ended, the Centre shall require the person or entity to enter into a compliance agreement — the discretion that language replaced is gone. An agreement not entered into within six months is deemed to have been refused.

Refusal or failure leads to a compliance order under section 73.17. Two features of that section deserve attention in advance: an order may require the entity to make public the measures taken or to be taken, and the Director shall make the order itself public. Enforcement outcomes that were previously a private correspondence have been given a publication route.

One procedural point should be diarised now rather than discovered later. Ability to pay was made a mandatory criterion in the assessment of a penalty, but section 73.111 restricts what may be considered to information supplied to the Centre before its stated deadline, with narrow exceptions for information that post-dates the deadline or was not reasonably available. Financial evidence prepared after the fact is, as a general matter, shut out. The two-year limitation period in section 73.5(1) is unchanged.

What Did Not Happen

Three things widely reported as Canadian law are not.

There is no cash payment ceiling. A prohibition on accepting cash payments of $10,000 or more, and a separate prohibition on third-party cash deposits, were both proposed — in clauses 136 and 135 of Bill C-2, as proposed sections 77.5 and 9.21. Neither was carried into Bill C-12. The word “cash” does not appear in S.C. 2026, c. 4 at all, and neither section exists in the consolidated Act.

Universal enrolment is not in force, and would not apply to MSBs in any event. The new enrolment provisions were included in the Act but their commencement was left to an order of the Governor in Council that has not been made. Section 11.4001(2) then excludes persons and entities referred to in paragraphs 5(h) and 5(h.1) — domestic and foreign money services businesses — because they already register under section 11.1.

The tiered penalty amounts are not in the Act. Section 73.1(2) sets flat maxima. The $40,000, $4,000,000 and $20,000,000 tiers are in section 5 of the Administrative Monetary Penalties Regulations. A compliance memo that cites the Act for the minor-violation range is citing the wrong instrument.

One date is worth reading carefully. FINTRAC has stated that the new framework applies to violations occurring after 26 March 2026, while the transitional provision in the Act applies the new Part 4.1 to violations committed on or after the commencement day. A violation on 26 March itself is treated differently by the two texts.

The Hard Date Is 1 October 2027

The agent regime is the largest operational item on the calendar, and it is not new law — it is a transitional deadline now approaching. Requirements to verify the eligibility of agents came into force on 1 October 2025. For agents already engaged before that date, sections 83.2 and 83.3 of the Act require, no later than the second anniversary, that eligibility be verified against paragraphs 11.11(1)(a) to (f), that the criminal record documents be obtained and reviewed, and that the business’s own documents be provided to the Centre. That second anniversary is 1 October 2027.

The obligation then recurs rather than closing: re-verification and an updated criminal record check are required within 30 days of the second anniversary of the most recent verification. Two constraints make this an operations problem rather than a filing one. Documents must have been issued no more than six months before they are submitted, under section 6.03(1) of the Registration Regulations, and criminal record check turnaround is not within the business’s control. For an agent network of any size, the work is volume-driven and cannot be compressed into the final quarter.

An AML Penalty Is Now a Payments Licensing Event

For firms holding a registration under the Retail Payment Activities Act, the two regimes were formally connected. Sections 48 and 52 of that Act were amended so that a notice of decision or an imposed penalty from the Director of FINTRAC, in respect of a serious, very serious or compliance order violation, becomes a ground on which registration may be refused — with a five-year lookback — or revoked. An AML enforcement outcome and a payments licence are no longer separate risk registers.

What Should Be Done This Month

  1. The compliance programme should be re-read against section 9.6(1.1) as an effectiveness question, and evidence of outcomes — not only the existence of policies — should be capable of being produced.
  2. The two-year effectiveness review and the documented risk assessment should be confirmed as current, given both now sit in the very serious tier.
  3. Group exposure should be re-modelled on the 3% of gross global revenue basis, including affiliated entities, and taken to the board rather than left in the compliance function.
  4. Agent records should be inventoried now against the 1 October 2027 deadline, with a schedule that accounts for the six-month document currency rule.
  5. Anonymous-account controls should be tested against the new section 9.2, including the “obviously fictitious” limb, which is a name-screening question as much as an onboarding one.
  6. Where an RPAA registration is held, the AML and licensing risk registers should be merged.

A closing note on posture. What was raised in March was not principally the number of rules but the standard against which existing ones are assessed, and the visibility of the outcome when that standard is not met. An entity that can produce its policies but not demonstrate that they worked is exposed in a way it was not before. More weight therefore falls on the record behind each decision than on the rulebook itself.

The same movement — from rules followed to reasoning evidenced — was visible in Australia’s reforms earlier this year, and what changed there for remitters is set out in a companion post. Cited regulatory answers of this kind, across both jurisdictions, are provided by ARGOS.

Cited answers, an audit-ready trail, and PEP & sanctions screening.A free workspace can be started in minutes, no sales call required.

Start free

Sources

Statutory and regulatory text is reproduced from the Justice Laws Website under the Reproduction of Federal Law Order (SI/97-5), which permits reproduction without charge or permission provided due diligence is exercised as to accuracy and the reproduction is not represented as an official version. This post is not an official version. FINTRAC material is referenced and linked but not reproduced, as commercial redistribution of it requires FINTRAC’s prior written permission. The Justice Laws consolidations cited above were current to 21 June 2026 (last amended 26 March 2026); Canada Gazette Part II was separately checked through 26 August 2026 to confirm nothing further had been registered in the interval.

This post is a summary of the amendments as they have been read here and does not constitute legal advice. The Act, the Regulations and FINTRAC’s guidance should be checked before any control is changed.