The biggest shift in Canadian AML rules in over a decade
The first quarter of 2026 brought the most significant package of changes to Canada's anti-money laundering regime in years. Between the Strengthening Canada's Immigration System and Borders Act, the Budget 2025 Implementation Act, and the final tranche of Budget 2023 and 2024 amendments coming into force, FINTRAC's expectations of reporting entities have shifted in ways that touch every MSB in the country.
If you run an MSB, a virtual currency dealer, or a payment service provider, this is not a set of changes you can read about next quarter. The penalty framework has been rewritten, stablecoin issuers are being pulled into the MSB regime, beneficial ownership reporting has new teeth, and a universal enrolment requirement is on the way. Here's what actually changed, when each piece takes effect, and what you should be doing about it now.
Strengthening Canada's Immigration System and Borders Act
Announced March 26, 2026, this legislation rewrites the enforcement architecture of the PCMLTFA. The headline is administrative monetary penalties, but the structural changes go further: new compliance tools, a redefined compliance program standard, and a universal enrolment requirement that will affect every reporting entity sector.
A new penalty framework with higher ceilings
The Act introduces a redesigned administrative monetary penalty regime with materially higher maximums and a new "ability to pay" factor used to set the actual penalty within those ranges. In practical terms, the days of treating an AMP as a manageable cost of doing business are over for entities of meaningful size. FINTRAC will calibrate penalties to actually sting, and the published record of penalties — already a reputational issue for banking partners — becomes a more serious risk.
Compliance agreements and compliance orders
FINTRAC now has two new tools between "findings letter" and "penalty." A compliance agreement is a negotiated, time-bound remediation plan with milestones the entity commits to meet. A compliance order is unilateral: FINTRAC can direct an entity to take specific corrective action by a specific date. Both create enforceable obligations. Missing a milestone in either is itself a violation that can trigger penalty action. For MSBs that have historically negotiated post-examination action plans informally, this is a meaningful change in tone.
The new compliance program standard
Compliance programs must now be "reasonably designed, risk-based, and effective." Each word matters. "Reasonably designed" means the program has to fit your actual business, not be a generic template. "Risk-based" means the controls have to track the risk assessment, not be a one-size-fits-all checklist. "Effective" is the new one — and the most demanding. It shifts the focus from whether the documents exist to whether the program actually works in practice. Examiners will look at outputs: are STRs being filed when they should be? Are KYC gaps being detected and closed? Are training shortfalls actually being remediated? A binder full of policies will no longer be sufficient evidence.
Universal enrolment with FINTRAC
The Act introduces a universal enrolment requirement: every reporting entity subject to the PCMLTFA must enrol with FINTRAC, not just MSBs. The timing depends on regulations that have not yet been finalised, but the direction is clear. FINTRAC wants a complete inventory of regulated entities under a single registration framework, which means more visibility, more correspondence, and a lower threshold for being identified for examination. For existing registered MSBs the immediate impact is small; for adjacent businesses that previously operated under sector-specific rules without active enrolment, it's a structural change.
A formal definition of "anonymous client"
The legislation introduces a defined term for an anonymous client, closing a gap that has been exploited in some virtual currency and prepaid contexts. Combined with the existing prohibition on opening or maintaining anonymous accounts, the practical effect is to eliminate the "we didn't actually verify them, but we also didn't open an account" argument. If money is moving on behalf of someone whose identity is not properly recorded, that's now squarely a compliance failure.
The Stablecoin Act: issuers become MSBs
Buried in the Budget 2025 Implementation Act, also enacted March 26, 2026, is what amounts to a new regulatory regime for stablecoin issuers. The mechanism is simple: stablecoin issuers must register with FINTRAC as money services businesses dealing in virtual currency, and the Bank of Canada will maintain a public registry of issuers.
For existing virtual currency dealers, this is mostly a clarification — the rules they already follow now extend to a category that was previously in a grey zone. For stablecoin-issuance projects that operated as fintech rather than as registered MSBs, this is a decision point. The full compliance program, KYC stack, transaction reporting, and record-keeping obligations of an MSB now apply. Effective dates are pending the implementing regulations and Canada Gazette publication, but the legislative authority is in place. If you are issuing or planning to issue a Canadian-dollar or other stablecoin with Canadian users, the planning has to start now, not when the regulations land.
Budget 2024 amendments: now in force
Three pieces of the Budget 2024 package are now operational. If your compliance program has not been updated to reflect them, you are already out of date.
Private-to-private information sharing
Reporting entities can now voluntarily share information with each other to detect money laundering, terrorist financing, and sanctions evasion. This is genuinely new ground in the Canadian regime — historically, sharing client information between competitors was a privacy and confidentiality minefield. The new framework provides a safe harbour, but it's gated: participating entities must submit a code of practice, get Privacy Commissioner approval, and operate within the model code published by FINTRAC. For larger MSBs and virtual currency dealers with overlapping client bases, this is a powerful new tool. For most smaller operators, the compliance overhead of joining a sharing arrangement will outweigh the benefit, at least in the short term.
New regulated sectors (since April 1, 2025)
Factors, cheque-cashing businesses, and financing or leasing entities are now full reporting entities under the PCMLTFA. They must maintain compliance programs, identify clients, file reports, and keep records on the same terms as other regulated sectors. If your MSB does business with any of these counterparties — and many do — they are now subject to the same scrutiny you are, which changes the risk calculus and the documentation you can reasonably expect from them.
Beneficial ownership discrepancy reporting (since October 1, 2025)
When you assess a corporate client as high-risk for money laundering or terrorist financing, you must compare their beneficial ownership information against the federal beneficial ownership registry filings. Material discrepancies must be reported. This is a meaningful change in workflow: KYC for entity clients can no longer end at "we collected the names and percentages." You need to actually check them against the registry, document the comparison, and have a process for what counts as "material." If your KYC vendor or in-house process does not yet include this step, fixing it should be near the top of the queue.
The strengthened MSB framework (in force October 1, 2025)
The final tranche of Budget 2023 amendments brought a tighter MSB registration regime. The standards for who FINTRAC will register, what they will look at when reviewing applications, and the grounds on which registration can be denied or revoked have all been tightened. The headline shift is that registration is no longer a near-automatic process for anyone with a clean criminal record check.
Alongside the MSB framework, a few other pieces landed: agents and mandataries are now permitted to verify entity identity on a reporting entity's behalf, real estate representatives must verify the identity of unrepresented parties to a transaction, private automated banking machine acquirers and title insurers were brought into the regime as new reporting entities, and sanctioned-property reporting was expanded beyond the United Nations Act to cover the Special Economic Measures Act and the Justice for Victims of Corrupt Foreign Officials Act.
What MSBs should be doing right now
You don't have to react to all of this at once. But there are concrete steps that should be in motion in the next 30 to 60 days.
1. Re-test your compliance program against the new standard
"Reasonably designed, risk-based, and effective" is not a paper test. Run through your STR filing log against your transaction-monitoring alerts for the last 12 months. Look at where the gaps are. If your program would not survive a question of "show me that this works," that is the gap to close before the next examination cycle.
2. Add the beneficial ownership registry check to your KYC flow
If you onboard corporate clients, you need a defined process for comparing beneficial ownership records against the federal registry on high-risk files, a documented standard for what counts as a "material discrepancy," and a reporting workflow when one is found. This is not optional and it has been live since October 2025.
3. Recalibrate the risk model for AMPs
The new AMP framework, the "ability to pay" factor, and the introduction of compliance orders all change the cost-benefit picture of marginal compliance investment. If your business case for a new monitoring tool, an extra compliance hire, or an external review used to fail the "but the worst case is only a small fine" argument, run it again under the new ceilings.
4. If you touch stablecoins, plan the registration path
Stablecoin issuers need to assume MSB registration is coming and start the work now: corporate structure, ownership disclosure, compliance program, CAMLO, KYC stack, and banking. Any of those that do not exist will take months to put in place properly. Waiting for the regulations to be finalised before starting is a planning error.
5. Track the universal enrolment regulations
The implementation timing for universal enrolment depends on regulations that have not yet been published. Watch for the Canada Gazette draft. When it lands, the comment period and effective date will give you the planning horizon for any registration or re-registration work.
The direction of travel is unmistakable
Taken together, the 2025–2026 changes signal a clear shift in how Canada regulates financial-services intermediaries. The bar for what counts as an adequate compliance program has been raised. The penalty regime has more weight behind it. The perimeter of the regulated sector has expanded to include sectors that were previously outside, and is moving toward universal enrolment. Information sharing between regulated entities is now possible. And virtual currency, including stablecoins, has been brought further into the existing MSB framework rather than being given a separate regime.
For well-run MSBs, this is not a crisis. The basics — a real compliance program, current risk assessment, trained staff, clean records, timely reports — still carry the weight. What has changed is the cost of running a marginal program. The regulator now has more tools, larger penalties, and a clearer mandate to use them. The MSBs that treat compliance as an operating function rather than a documentation exercise will continue to do well. The ones that don't will feel the difference within the next examination cycle.
For the official source material, see FINTRAC's consolidated regulatory changes page, which is updated as new amendments come into force.
Need to bring your compliance program in line with the 2026 framework?
We help MSBs, virtual currency dealers, and PSPs translate FINTRAC's regulatory updates into operational changes — gap assessments against the new compliance program standard, beneficial ownership workflow design, stablecoin registration planning, and AMP risk reviews.
Book a free 30-minute consultation to map the changes that affect your business and the order in which to address them.
Book a Free Consultation