FINTRAC Suspicious Transaction Reports: PCMLTFA Compliance Guide 2026

In Canada, the obligation to report suspicious transactions flows directly from the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA), which mandates that reporting entities submit Suspicious Transaction Reports (STRs) to FINTRAC (the Financial Transactions and Reports Analysis Centre of Canada) within three business days of forming reasonable grounds to suspect that a transaction is related to money laundering or terrorist activity financing. FINTRAC is Canada's financial intelligence unit, established in 2000 under the PCMLTFA. This guide covers who must report, how to file via the FINTRAC portal, large cash transaction reports (LCTRs), provincial considerations including Quebec's Loi 25, and the consequences of non-compliance.

Regulatory disclaimer: This guide is for informational purposes only. PCMLTFA obligations are subject to ongoing regulatory change. Seek qualified legal advice for specific situations.

Who must file STRs under the PCMLTFA?

The PCMLTFA imposes reporting obligations on "reporting entities" — a broad category defined in sections 5 and 5.1 of the Act:

As of June 2025, amendments to the PCMLTFA Regulations expanded STR requirements for real estate developers and introduced new customer identification obligations for certain high-risk transactions. The federal Department of Finance consultation paper (January 2026) signals further amendments expected in late 2026.

Canadian entities must be aware that provincial compliance requirements run parallel to federal PCMLTFA obligations. Quebec's AUTORITÉ DES MARCHÉS FINANCIERS (AMF Québec) supervises provincially incorporated financial institutions and imposes additional compliance program requirements that may exceed federal minimums.

The 3-business-day filing deadline

Under section 7 of the PCMLTFA and the Suspicious Transaction Report Regulations, a reporting entity must submit an STR within three business days after the entity first forms reasonable grounds to suspect that a transaction is related to money laundering or terrorist activity financing.

The key trigger is the formation of "reasonable grounds to suspect" — a standard lower than civil balance of probabilities. FINTRAC's Guideline 2 (Money Laundering and Terrorist Financing Indicators) clarifies that reasonable grounds can arise from:

• Unusual transaction patterns inconsistent with the client's profile
• Unexplained wealth or inconsistent source-of-funds declarations
• Structuring of transactions to fall below reporting thresholds
• Clients who are reluctant to provide identification or beneficial ownership information
• Matches against FINTRAC's typologies or public RCMP alerts

There is no minimum dollar threshold for STRs. A suspicious transaction of $100 must be reported with the same obligation as one of $10 million.

Large Cash Transaction Reports (LCTRs) and Electronic Funds Transfer Reports (EFTRs)

In addition to STRs, the PCMLTFA requires:

Large Cash Transaction Reports (LCTRs): Reporting entities that receive $10,000 or more in cash — in a single transaction or in two or more transactions of less than $10,000 in a 24-hour period (known as "24-hour rule") — must file an LCTR within 15 calendar days of receiving the cash.

Electronic Funds Transfer Reports (EFTRs): Transfers of $10,000 or more internationally must be reported within 5 business days.

Terrorist Property Reports: Reporting entities that possess or control property belonging to a listed terrorist or terrorist group must report immediately to FINTRAC and the RCMP, with no monetary threshold.

How to file: FINTRAC's secure web portal

All STRs, LCTRs, and EFTRs are submitted through FINTRAC's secure web portal, accessible via fintrac-canafe.gc.ca. Reporting entities must register before filing. Large institutions can use batch XML reporting through FINTRAC's API.

A complete STR includes:

1. Report header: reporting entity details, contact information for the compliance officer
2. Transaction details: date, amount in CAD, type of transaction, account numbers, and nature of funds
3. Subject information: full legal name, date of birth, address, SIN (Social Insurance Number) or business number, nature of relationship
4. Grounds for suspicion: a detailed, fact-based narrative explaining the basis for the suspicion — generic phrases such as "unusual activity" are insufficient

After submission, the portal generates a report number that must be retained in the entity's compliance records.

Client tipping-off prohibition

Section 8 of the PCMLTFA prohibits disclosing to any person that a suspicious transaction report has been filed or may be filed. This prohibition extends to clients, employees not involved in the reporting process, and third parties. Violation is a criminal offence under the PCMLTFA.

Privacy obligations: PIPEDA and Quebec's Loi 25

The Personal Information Protection and Electronic Documents Act (PIPEDA) governs the collection and use of personal information by private sector organizations in Canada. FINTRAC reporting obligations are recognized as a statutory exception to PIPEDA's consent requirements — reporting entities need not obtain client consent before reporting to FINTRAC.

In Quebec, Loi 25 (Act respecting the protection of personal information in the private sector, as amended in 2021–2023) imposes obligations that go beyond PIPEDA, including:

• Mandatory privacy impact assessments (PIAs) for new systems handling personal data
• Shorter data breach notification timelines (72 hours to the Commission d'accès à l'information)
• The right to data portability and automatic profiling restrictions

CheckFile supports over 3,200 document types across 32 jurisdictions, enabling Canadian reporting entities to centralize their AML/CTF evidence files with automated document verification. The CheckFile KYC platform uses multi-layer analysis to verify the authenticity of Canadian identity documents — passports, provincial driver's licences, and Permanent Resident Cards — detecting alterations that could compromise the integrity of the CDD record.

According to the ACFE 2024 Report to the Nations, manual fraud detection catches only 37% of cases with a mean detection lag of 87 days. Automated document verification shifts detection to the onboarding stage.

The AML red flags and suspicious activity indicators guide provides FINTRAC-aligned typologies for Canadian reporting entities.

Penalties for non-compliance

Administrative monetary penalties (AMPs): FINTRAC can impose AMPs under the PCMLTFA for violations of reporting, record-keeping, and compliance program requirements. Penalties range from $1 to $100,000 per violation, with a maximum of $500,000 per notice of violation. FINTRAC publishes all penalty decisions on its website, with the most recent large penalties exceeding $7 million for major financial institutions.

Criminal penalties: Willful non-compliance with STR obligations under section 74 of the PCMLTFA carries fines of up to $2,000,000 and/or imprisonment of up to five years. For corporations, fines can reach $2,000,000 per violation.

OSFI supervisory actions: OSFI can issue directions of compliance, memoranda of understanding, and — in extreme cases — revoke licenses for federally regulated institutions with persistent AML failures.

Frequently Asked Questions

What is the difference between an STR and an LCTR in Canada?

An STR (Suspicious Transaction Report) is filed when there are reasonable grounds to suspect money laundering or terrorist financing, with no minimum dollar threshold. An LCTR (Large Cash Transaction Report) is filed automatically when a reporting entity receives $10,000 or more in cash within a 24-hour period, regardless of suspicion. Both may be required for the same transaction.

Are lawyers in Canada required to file STRs?

The Supreme Court of Canada struck down STR obligations for lawyers in Canada (Attorney General) v. Federation of Law Societies of Canada [2015] SCC 7, ruling that they violated solicitor-client privilege under the Canadian Charter of Rights and Freedoms. However, lawyers remain subject to customer identification and record-keeping requirements under the PCMLTFA in specific non-privileged contexts.

How does FINTRAC handle STR data after it is received?

FINTRAC analysts review STRs and may disclose financial intelligence to Canadian law enforcement (RCMP, CBSA, CSIS) and foreign FIUs through the Egmont Group network when specific conditions are met. The identity of the reporting entity is protected in disclosures to law enforcement.

Do virtual currency businesses in Canada have different STR thresholds?

Virtual currency dealers (VCDs) registered with FINTRAC are subject to the same STR requirement (no dollar threshold, 3-business-day filing window) as other MSBs. Additionally, VCDs must file Large Virtual Currency Transaction Reports (LVCTRs) for virtual currency transfers of $10,000 or more within 24 hours.

What records must Canadian reporting entities keep after filing an STR?

Under sections 6 and 14 of the PCMLTFA Regulations, reporting entities must keep copies of STRs, along with all related KYC records and transaction documents, for a minimum of five years from the date of the transaction or report.