News

A pair of record anti-money laundering penalties issued within weeks of each other in Canada herald a new approach to enforcement as pressure, both at home and abroad, on the nation’s financial intelligence unit to crack down on illicit finance continues to build.

On Wednesday, Canada’s Financial Transactions and Reports Analysis Centre, also known as Fintrac, disclosed a penalty of $177 million against Xeltox Enterprises, a cryptocurrency exchange in British Columbia, for, among other violations, not flagging thousands of payments linked to darknet markets, child sexual abuse, fraud, ransomware and sanctions evasion.

The penalty against Xeltox shatters Fintrac’s previous record assessment of $20 million against Peken Global, the parent company of a second exchange, KuCoin, on Sept. 25, and the $9.2 million that the agency extracted from TD Bank in May of last year, which now ranks third.

Once outliers, higher AML penalties will become the “new normal” if legislation now circulating in Ottawa in the runup to the Financial Action Task Force’s next evaluation of Canada in December takes root, said Stephen Scott, a former financial crime investigator with the Royal Canadian Mounted Police.

“This will most definitely be a trend,” said Scott, now an AML consultant in Alberta. “The agency is now in a position to start expanding its reach.”

The legislation, Bill C-12, would raise maximum penalties for “minor, serious and very serious” violations by as much as 40-fold and newly require all companies under AML regulations to register with Fintrac, and thereby address some of the shortcomings that emerged when the Financial Action Task Force, also known as FATF, last evaluated Canada in June 2016.

Bill C-12 would further bar most businesses from accepting more than $10,000 of cash in a single transaction, and allow law enforcement agencies to share financial intelligence directly with banks, money services businesses, or MSBs, and other companies that file reports to Fintrac.

“Canada wants to be seen by FATF as taking its oversight and enforcement role seriously,” said Peter Aziz, senior counsel in the financial institutions and regulatory practice at Tory’s law firm in Toronto. “The higher penalty and new law on the books are ways to demonstrate that.”

Cryptomus

Fintrac alleged Wednesday that from July 2024 to July 2025, Xeltox, operating under the name Cryptomus, caused “severe harm and demonstrated significant, widespread non-compliance with regulatory requirements” by handling payments for suspected darknet criminals.

Specifically, Cryptomus lacked an AML program capable of detecting potentially illicit transactions, even when customers sent or received cryptocurrency to and from digital addresses that law enforcement agencies or news outlets had already linked to criminals, or to Iran, Russia or other adversarial nations.

During the 12 months in question, Cryptomus further breached AML requirements by failing to link more than 7,500 transactions to Iran and sufficiently vet the parties involved in those payments, and by neglecting to file thousands of currency transaction reports, including more than 1,500 CTRs in July 2024 alone.

Cryptomus at no point categorized customers by the level of risk they presented, according to Fintrac, and neither identified nor measured the financial crime-related threats that the exchange’s own products, services and geographical footprint posed.

Moreover, when registering as an MSB in Canada, Cryptomus did not notify Fintrac that it dealt exclusively in cryptocurrency, and did not provide the agency with an accurate phone number and email address.

Corporate records linked to Cryptomus, which has no employees in Canada, list Uzbekistani national Sabina Salim Kizi as sole director and a mailbox service in Vancouver as the company’s address, which differs from the address that appears in British Columbia’s business directory.

Despite the record-high penalties and possibility of higher maximums, Fintrac will probably limit their use to egregious instances of non-compliance, said Aziz.

“The hope is that these penalties will be reserved for cases where there’s no compliance, or where there is deliberate non-compliance,” said Aziz. “Fintrac said it is going to take a risk-based approach, and I’m not sure there is much that is higher-risk than this [the case against Xeltox].”

Contact Chelsea Carrick at ccarrick@acams.org