$176M FINTRAC Penalty Underscores Growing Compliance Pressure
On October 16, 2025, the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) imposed an administrative monetary penalty (AMP) of $176,960,190 on Xeltox Enterprises Ltd. (operating as Cryptomus, formerly Certa Payments Ltd.).
What Went Wrong
FINTRAC’s examination found that Xeltox/Cryptomus failed to meet multiple key obligations under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) and its Regulations. Among the violations were over a thousand instances where suspicious transaction reports were not filed despite clear grounds to suspect money laundering or terrorist financing, and more than 1,500 occasions where large virtual currency transactions – valued at $10,000 or more – were not reported. The company also lacked up-to-date written compliance policies, failed to conduct proper risk assessments, and did not notify FINTRAC of changes to prescribed registration information.
Why It Matters for MSBs
This enforcement action sends a strong signal to the entire money services business (MSB) community. As the virtual currency and payment services sectors continue to expand, FINTRAC is intensifying its scrutiny of compliance frameworks across the board. Weak anti-money laundering (AML) and anti-terrorist financing (ATF) controls can severely undermine transparency and accountability, leaving both traditional and digital MSBs vulnerable to regulatory action.
As one of the leading providers of MSB registration and support services in Canada, we at Approved MSB Services have witnessed a clear rise in FINTRAC’s enforcement activity, along with a substantial increase in penalties for non-compliance. This trend reinforces the importance of proactive compliance, not only to avoid fines, but to maintain credibility and operational integrity in an increasingly regulated environment.
For every MSB, this case underscores the importance of maintaining compliance programs that are current, comprehensive, and approved at the senior level. Suspicious transaction reporting must be proactive, not reactive, and virtual currency dealings, especially large transactions, must be carefully monitored and reported.
Effective risk assessment and timely communication of any operational or registration changes are now non-negotiable expectations.
What Went Wrong
FINTRAC’s examination found that Xeltox/Cryptomus failed to meet multiple key obligations under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) and its Regulations. Among the violations were over a thousand instances where suspicious transaction reports were not filed despite clear grounds to suspect money laundering or terrorist financing, and more than 1,500 occasions where large virtual currency transactions – valued at $10,000 or more – were not reported. The company also lacked up-to-date written compliance policies, failed to conduct proper risk assessments, and did not notify FINTRAC of changes to prescribed registration information.
Why It Matters for MSBs
This enforcement action sends a strong signal to the entire money services business (MSB) community. As the virtual currency and payment services sectors continue to expand, FINTRAC is intensifying its scrutiny of compliance frameworks across the board. Weak anti-money laundering (AML) and anti-terrorist financing (ATF) controls can severely undermine transparency and accountability, leaving both traditional and digital MSBs vulnerable to regulatory action.
As one of the leading providers of MSB registration and support services in Canada, we at Approved MSB Services have witnessed a clear rise in FINTRAC’s enforcement activity, along with a substantial increase in penalties for non-compliance. This trend reinforces the importance of proactive compliance, not only to avoid fines, but to maintain credibility and operational integrity in an increasingly regulated environment.
For every MSB, this case underscores the importance of maintaining compliance programs that are current, comprehensive, and approved at the senior level. Suspicious transaction reporting must be proactive, not reactive, and virtual currency dealings, especially large transactions, must be carefully monitored and reported.
Effective risk assessment and timely communication of any operational or registration changes are now non-negotiable expectations.
What Your Business Should Do Now
- Review and Update Your Policies & Procedures: Ensure they are approved by senior management, reflect current business activities (including any virtual-asset services), and are reviewed at least annually.
- Strengthen Suspicious-Transaction Reporting: Implement mechanisms to identify and flag transactions with red flags (e.g., large sums of virtual currency, unusual flows, sanction-evading behaviour).
- Virtual-Currency Oversight: If you accept or transmit virtual currency, check the $10,000+ thresholds, reporting requirements and ensure that your systems capture the necessary data and generate timely reports.
- Document Risk Assessments: Establish a documented risk matrix showing how you evaluate geography, product/service type, client profile, virtual-asset involvement, delivery channels and other prescribed factors.
- Monitor Regulatory Filing Obligations: Ensure your business responds quickly to any changes in registration information, licensing, or regulatory status—failure to notify changes is a standalone violation.
- Training & Culture: Senior leadership must own compliance. Regular staff training and monitoring demonstrate that AML/ATF is treated as integral to your business, not just as a checkbox requirement.
Final Thought
The size and severity of the penalty against Xeltox/Cryptomus serve as a clear reminder that regulatory enforcement in Canada’s MSB sector is escalating. Virtual-asset exposure remains a particular area of risk, and compliance expectations are only increasing. Now is the time for MSBs to ensure their frameworks meet the new regulatory reality.
If your business would benefit from expert guidance, our team is here to help.
We work with MSBs to review compliance programs, strengthen reporting frameworks, and deliver training that meets FINTRAC expectations.
Reach out to us to discuss how we can support your compliance goals and reduce the risk of costly penalties.
The size and severity of the penalty against Xeltox/Cryptomus serve as a clear reminder that regulatory enforcement in Canada’s MSB sector is escalating. Virtual-asset exposure remains a particular area of risk, and compliance expectations are only increasing. Now is the time for MSBs to ensure their frameworks meet the new regulatory reality.
If your business would benefit from expert guidance, our team is here to help.
We work with MSBs to review compliance programs, strengthen reporting frameworks, and deliver training that meets FINTRAC expectations.
Reach out to us to discuss how we can support your compliance goals and reduce the risk of costly penalties.
