Compliance agreements are now mandatory, and penalties for affiliated groups scale to total revenue
Canada just armed FINTRAC with penalties up to $30 million, mandatory compliance agreements, and a rule that puts enforcement orders on the public record.
That is the headline out of Part 9 of Bill C-12 — the Strengthening Canada's Immigration System and Borders Act — which received Royal Assent on March 26, 2026. Most of the public attention landed on the immigration overhaul. But buried in this omnibus statute is a thorough rewrite of the Proceeds of Crime (Money Laundering) and Terrorist Financing Act, and it lands directly on every reporting entity in the country — securities dealers, portfolio managers, and the wealth divisions of Canada's major banks included.
The penalty numbers tell the story quickly. A single prescribed violation now carries a maximum administrative penalty of $4 million for a person and $20 million for an entity. Stack multiple violations on one notice, and the cap rises to the greater of $20 million or 3 percent of the entity's gross global revenue from the prior financial year. For firms that sit inside a larger corporate structure, the revenue figure is not limited to the offending subsidiary. It is calculated on the entire affiliated group. Any bank wealth arm or large advisory network will recognize what that means in practice.
The compliance agreement framework has been rebuilt from the ground up. The old regime was optional. It no longer is. Under the new section 73.16, FINTRAC must now require a compliance agreement from any person or entity found to have committed a prescribed violation. That agreement has to identify what went wrong, spell out the steps the entity must take to fix it, and set a deadline.
Walk away from the table — or miss the deadline — and the Director of FINTRAC must issue a compliance order. Under subsection 73.17(4), that order must be made public. For any wealth firm where reputation is the product, that is no small thing.
Violate the compliance order itself, and a new category of penalty applies. The maximum jumps to the greater of $5 million or 3 percent of gross global income for a person, and the greater of $30 million or 3 percent of gross global revenue for an entity. The affiliated group revenue calculation applies here too.
Criminal fines have also climbed. Core record-keeping and reporting contraventions under section 74 now carry fines of up to $2.5 million on summary conviction or $5 million on indictment, along with imprisonment of up to two years less a day or five years, respectively. Reporting offences under sections 9 and 11.43 carry summary conviction fines of up to $10 million. And a separate offence now exists under section 77.1 for knowingly providing false or misleading information to FINTRAC — including by omission — with fines of up to $2.5 million on summary conviction or $5 million on indictment.
Then there is the new compliance standard. Section 9.6 of the Act now requires every reporting entity to ensure its compliance program is "reasonably designed, risk-based and effective." That is not decorative language. It is a statutory benchmark, and it gives regulators a clear measuring stick for the next time they walk through your compliance infrastructure.
On the information-sharing front, FINTRAC now has authority to share certain information with the Commissioner of Canada Elections where there are reasonable grounds to suspect it would be relevant to investigating offences under the Canada Elections Act. The Director of FINTRAC has also been added to the supervisory committee under the Office of the Superintendent of Financial Institutions Act — opening a new line of communication with other financial regulators.
There is also a new enrolment regime to prepare for. Under section 11.4001, every person or entity covered by section 5 of the Act must enroll with FINTRAC, with limited exceptions for certain categories and those acting solely as employees or agents of another reporting entity. The regime comes with its own application, renewal, change-of-information, and revocation process, along with review and appeal rights to the Federal Court. Failing to enroll is an offence under section 74 of the amended Act.
Not everything is live yet. Some provisions took effect on Royal Assent, but others — including the enrolment regime and certain information-sharing measures — come into force on a date to be set by Order in Council. A parliamentary review of the entire Act is set to begin at the start of the fifth year after Royal Assent.
The bottom line for wealth firms and financial institutions across Canada is not complicated. The fines are bigger. Compliance agreements are no longer a negotiation. Compliance orders go public. And the bar for what counts as an adequate compliance program just got a statutory definition. Firms that have not pressure-tested their programs against this new framework should probably start before the rest of the provisions land.
