KYC/AML for Online Gambling in Canada: FINTRAC and Provincial Requirements 2026

Online gambling in Canada is regulated at the provincial level, with each province operating or licensing iGaming within its borders. At the federal level, anti-money laundering obligations for casinos are governed by the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) and its associated regulations, with FINTRAC (Financial Transactions and Reports Analysis Centre of Canada) as the federal financial intelligence unit. Major provincial operators include the British Columbia Lottery Corporation (BCLC), Ontario Lottery and Gaming (OLG), Alberta Gaming, Liquor and Cannabis (AGLC), and the Ontario iGaming private market that opened in April 2022.

This article is for informational purposes only and does not constitute legal or regulatory advice. Regulatory references are accurate as of the publication date. Seek qualified legal counsel for advice specific to your situation.

Canadian Gambling Regulatory Framework

Under the Criminal Code of Canada (Section 207), provinces have authority to license and operate gambling within their borders. The federal government does not issue gambling licences but regulates the AML/CFT aspects of casino operations through the PCMLTFA.

Key regulatory developments: Ontario became the first Canadian province to open its iGaming market to private operators in April 2022, with iGaming Ontario (iGO) as the regulatory body. This created a new model where licensed private operators can offer online casino games and sports betting alongside the provincial lottery. As of 2026, over 50 private operators hold iGO registrations.

FINTRAC Requirements for Casinos and Online Gambling

Under the PCMLTFA, casinos are reporting entities (PCMLTFA, Section 5). This includes online gambling operators where the platform operates as an extension of a licensed casino or as a provincially licensed entity. Obligations include:

• Maintaining a compliance program with written policies, a chief compliance officer, a risk assessment, and an independent audit function
• Filing Large Cash Transaction Reports (LCTRs) for cash transactions of CAD 10,000 or more in a single session
• Filing Suspicious Transaction Reports (STRs) with FINTRAC when there are reasonable grounds to suspect money laundering or terrorist financing, with no minimum dollar threshold
• Reporting Terrorist Property to FINTRAC, the RCMP, and CSIS when property believed to be owned by or controlled by a terrorist is identified

FINTRAC received over 3 million transaction reports from all reporting sectors in 2024, with casinos and gaming establishments among the major contributors (FINTRAC, Annual Report 2024).

Customer Identification Program Under the PCMLTFA

The PCMLTFA Regulations (Part 2) require casinos to identify clients:

• At the start of a gaming session when the client's total buy-in is CAD 10,000 or more (single transaction)
• When conducting an electronic funds transfer of CAD 1,000 or more
• When a casino disburse funds of CAD 10,000 or more
• At account opening (for online platforms that require an account)

Documents Required for Canadian Players

For individual customers, casinos must verify:

• Full legal name and date of birth
• Current address
• Government-issued photo ID: Canadian passport, provincial driver's licence (two-piece provincial ID acceptable), Permanent Resident Card, or Canadian Citizenship Certificate with photo

In Ontario, iGaming operators must verify player identity before any withdrawals, and ideally at registration. The iGO's Technical Standards mandate address verification using credit bureau checks, government ID verification, or both.

Operators accepting players from Quebec must be aware of specific Loto-Québec requirements and the provincial privacy law (Loi 25 — Act respecting the protection of personal information in the private sector), which has stricter requirements than PIPEDA in several respects.

CheckFile provides document verification compatible with both FINTRAC requirements and provincial iGaming operator standards.

Social Insurance Number (SIN)

Canadian casinos may request the player's Social Insurance Number (SIN) for tax reporting purposes (winning above CAD 1,000 may require a T4A slip). Unlike the US SSN requirement for KYC, the SIN is not mandatory for AML identification under the PCMLTFA — but collecting it is standard practice for tax compliance and identity verification purposes.

Enhanced Customer Due Diligence: High-Value Players and PEPs

The PCMLTFA Regulations require enhanced scrutiny for:

Third Party Determination: When a third party (not the customer) is conducting a transaction on behalf of the customer, casinos must identify the third party and keep records.

Politically Exposed Persons (PEPs) and Heads of International Organizations (HIOs): The PCMLTFA amendments of 2019 require that all reporting entities, including casinos, take reasonable measures to determine if clients are domestic PEPs, foreign PEPs, HIOs, or their family members or close associates. If identified as a PEP or HIO, enhanced measures apply:

• Obtain senior management approval for the business relationship
• Assess the source of funds and source of wealth
• Conduct enhanced ongoing monitoring

High-Value Players: FINTRAC guidance recommends that casinos with high-value players establish procedures to assess and document the economic rationale for large transactions, particularly when the player's wealth source is unclear.

The enhanced due diligence guide provides a structured approach. CheckFile enables operators to centralize EDD documentation with a full audit trail.

Suspicious Transaction Reports (STRs) to FINTRAC

STRs must be filed with FINTRAC when there are reasonable grounds to suspect money laundering or terrorist financing, regardless of the dollar amount. The filing obligation is triggered by the "reasonable grounds to suspect" standard — lower than "belief" but higher than mere intuition.

Common STR triggers for Canadian online gambling operators:

• Player depositing large amounts immediately after account creation followed by withdrawal requests
• Structuring transactions around the CAD 10,000 LCTR reporting threshold
• Use of casino funds for multiple withdrawals to different bank accounts
• Gaming patterns inconsistent with the player's declared income or profession
• Suspicious requests for casino chips or credit balances to be transferred to third parties

STRs must be filed as soon as practicable — FINTRAC guidance suggests within 3 business days of detecting the suspicious transaction. The tipping-off prohibition in PCMLTFA Section 8 prohibits disclosure to the subject of the report.

PIPEDA and Loi 25 (Quebec) Data Privacy

Gambling operators handling personal data must comply with PIPEDA (Personal Information Protection and Electronic Documents Act) at the federal level, and Loi 25 (Quebec's Act respecting the protection of personal information in the private sector) for Quebec customers.

Quebec's Loi 25 (in force since September 2022–2023) imposes additional requirements: mandatory privacy impact assessments for high-risk processing, a privacy officer designation, and enhanced breach notification requirements within 72 hours to the Commission d'accès à l'information (CAI).

For a detailed guide on document retention across jurisdictions, see the document retention requirements guide.

Frequently Asked Questions

Is online gambling regulated by the federal government in Canada?

Online gambling licensing is a provincial responsibility under the Criminal Code. The federal government regulates the AML/CFT aspects of gambling through FINTRAC and the PCMLTFA. Each province has its own gambling regulator (iGO in Ontario, BCLC in BC, AGLC in Alberta, Loto-Québec in Quebec).

Do Ontario's private iGaming operators have the same FINTRAC obligations as casinos?

Yes. iGaming operators registered with iGaming Ontario are considered reporting entities under the PCMLTFA and must comply with all FINTRAC requirements applicable to casinos, including large cash transaction reporting, suspicious transaction reporting, and the full AML compliance program requirements.

What is the KYC threshold for online gambling platforms in Canada?

For FINTRAC purposes, the primary threshold is CAD 10,000 per gaming session for identification. However, iGaming operators in Ontario are required to verify identity before any withdrawals, making effective KYC at registration the industry standard. STR filing has no dollar threshold — it is triggered by reasonable grounds to suspect, not by amount.

How does Quebec's Loi 25 affect online gambling operators?

Loi 25 requires operators serving Quebec customers to implement stricter privacy protections than PIPEDA. This includes mandatory privacy impact assessments (PIAs) for new personal information processing systems, appointing a privacy officer, publishing a privacy policy on their website, and reporting data breaches to the CAI within 72 hours. Online gambling operators must have an adapted privacy framework for their Quebec player base.

Can foreign-licensed operators legally serve Canadian players?

Only operators licensed by a provincial gaming authority can legally offer online gambling to residents of that province. Foreign-licensed operators (e.g., Malta Gaming Authority, Gibraltar) serve Canadian players in a legal grey area — provinces may block them, and they are not subject to FINTRAC oversight. Players using such platforms have no provincial consumer protection.