FINTRAC Compliance Requirements For Financing And Leasing Entities In Canada Effective April 1, 2026

With contributions from Cassidy Bignell, an articling student at Dale & Lessmann

On April 1, 2025, the Financial Transactions and Reports Analysis Centre of Canada (“FINTRAC”) expanded its anti money laundering and anti terrorist financing regulatory framework to include businesses operating in the financing and leasing sector. Following a one year transition period, affected entities were required to comply with the applicable obligations under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (the “Act”) by April 1, 2026.

What is FINTRAC?

FINTRAC oversees compliance with Canada’s anti-money laundering and anti-terrorist financing laws and provides actionable financial intelligence to law enforcement and national security agencies. The Act was created to establish FINTRAC and combat money laundering and terrorist financing.

Definition of a Financing or Leasing Entity

A financing or leasing entity is any person or organization that engages in the business of providing financing or leasing services. This includes businesses that lease equipment, vehicles, or other high-value property, as well as those that provide loans or financial arrangements for such assets.

 A financing or leasing entity is subject to the Act and its regulations when they are involved in:

• financing or leasing property for business purposes, excluding real estate or immovable property; 
• financing or leasing property valued at $100,000 or more, excluding real estate or immovable property; or 
• financing or leasing passenger vehicles in Canada, regardless of value. 

Entities engaged in any of these activities must implement measures to identify clients, monitor transactions, and report any suspicious activity, in accordance with Canada’s anti-money laundering (AML) framework.

Overview of Requirements 

• Establish a Compliance Program

A robust compliance program serves as the foundation for an organization’s reporting, record-keeping, and client identification obligations. It must be formally documented in writing, approved by senior management, and regularly reviewed to ensure it remains aligned with regulatory expectations and business activities.

Key components of a compliance program include: 

• Appointing a Compliance Officer to oversee the program, monitor regulatory changes and ensure compliance obligations are met.
• Developing clear policies and procedures that guide employees on reporting requirements, client identification, record-keeping and risk management practices.
• Conducting regular risk assessments to evaluate exposure across products, services, customer types and geographic regions.
• Providing ongoing employee training so staff can recognize potential red flags and understand their compliance responsibilities.
• Performing periodic effectiveness reviews, at least every two years, to assess whether controls are working as intended and address any gaps.

• Implementing internal controls and oversight mechanisms to support consistent compliance across daily operations.

• Know Your Client and Due Diligence

A cornerstone of compliance is understanding who your customers are and appropriately monitoring their activities. Effective Know Your Client (“KYC”) procedures enable organizations to identify higher risk relationships, assess potential money laundering and terrorist financing risks and detect unusual activity before it escalates into a more significant concern.

Key due diligence requirements include:

• verifying customer identities before establishing a business relationship; 
• confirming beneficial ownership information for corporate customers;
• monitoring transactions for unusual patterns or activity that does not align with a client’s profile;
• reporting and documenting cash transactions of $10,000 or more;
• reporting and documenting virtual currency transactions of $10,000 or more; and 
• maintaining records for all financing and leasing agreements, including associated payments.

Organizations must also conduct enhanced due diligence where appropriate, including monitoring politically exposed persons (PEPs), heads of international organizations and other higher-risk clients. Ongoing monitoring and thorough documentation of due diligence decisions are essential components of this process.

• Reporting to FINTRAC

Entities must also comply with FINTRAC’s reporting obligations by submitting prescribed reports relating to suspicious transactions, terrorist property and certain large cash and virtual currency transactions. Reports triggered by monetary thresholds, including transactions involving $10,000 or more, must generally be filed within 24 hours of the reporting entity becoming aware of the transaction.

• Record-Keeping

Comprehensive record-keeping allows organizations to demonstrate compliance and provide evidence of their decision-making processes when required. Maintaining organized and accessible records also supports audits, investigations and regulatory reviews.

Required records generally include:

• copies of all reports submitted to FINTRAC;
• records of large cash and virtual currency transactions; 
• customer identification and transaction details related to financing and leasing agreements; and 
• compliance documentation such as policies, procedures, risk assessments, training logs and program review results.

These records must typically be retained for at least five years from the date of the transaction or report.

• Ministerial Directives

Periodically, FINTRAC may issue ministerial directives requiring organizations to take additional measures in response to emerging risks. These directives may introduce enhanced reporting requirements, additional monitoring obligations or modifications to existing KYC processes.

Organizations should have procedures in place to quickly assess and implement any new directives to ensure continued compliance.

• Risk Management and Ongoing Monitoring

FINTRAC expects reporting entities to tailor their compliance efforts based on the risk assessment performed by the entity. Rather than applying the same controls to every customer or transaction, organizations should focus additional scrutiny on higher-risk areas.

This includes:

• identifying products, services, customers and regions that present elevated risk;
• applying enhanced due diligence measures where necessary;
• reviewing and updating risk assessments on a regular basis; and 
• conducting ongoing monitoring and internal audits to identify potential compliance issues before they become regulatory concerns.

Compliance examinations 

To ensure compliance with the FINTRAC regulations, FINTRAC is authorized to conduct compliance examinations to assess whether reporting entities are meeting their statutory obligations. 

Penalties for non-compliance

FINTRAC has broad enforcement powers and may impose administrative monetary penalties (“AMPs”) or pursue criminal sanctions against reporting entities that fail to comply with the requirements of the Act and its associated regulations.

Administrative monetary penalties are civil enforcement measures imposed directly by FINTRAC to encourage compliance with regulatory obligations. The amount of an AMP is generally determined based on factors such as the nature and extent of the non compliance, the harm caused and the reporting entity’s compliance history. By contrast, criminal penalties may be pursued in cases involving knowing, wilful or reckless violations of the Act, including failures to report suspicious transactions, the provision of false or misleading information or systemic non compliance, and may result in significant fines, imprisonment, or both.

Conclusion

The expansion of FINTRAC’s regulatory framework to financing and leasing entities represents a significant compliance development for businesses operating in these sectors. Organizations that fall within the scope of the Act must ensure they have implemented and maintain a comprehensive compliance program, including appropriate KYC procedures, reporting processes, record keeping practices and risk based monitoring controls.

Given FINTRAC’s authority to conduct compliance examinations and impose significant administrative monetary penalties and, in certain circumstances, criminal sanctions for non compliance, organizations should proactively assess whether their current practices satisfy the applicable requirements. Businesses that have not yet reviewed their operations in light of the new rules should do so as soon as possible to identify and address any compliance gaps.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.