The New AML Enforcement Reality: What Securities Firms Need to Know (and Do) Now
Canada’s anti-money-laundering regime changed materially on March 26, 2026. For securities firms, the most significant development is not simply higher potential penalties: it is the express legal requirement that the AML compliance program be reasonably designed, risk-based, and effective.
That shift moves the practical examination question beyond whether a firm has the required policies, training, risk assessment, and biennial review. The question for a securities firm is no longer simply whether its AML framework is documented. If asked how a material client or transaction risk was identified, assessed and addressed, could your firm demonstrate, through documented evidence, that its AML controls are effectively managing that risk in practice?
FINTRAC can now ask whether the program demonstrably works—whether the firm identifies risk, detects unusual activity, investigates appropriately, escalates concerns, files high-quality reports where required, and corrects control failures promptly.
A more consequential enforcement framework
The Strengthening Canada’s Immigration System and Borders Act (Bill C-12), which received Royal Assent on March 26, 2026, introduced a new administrative monetary penalty framework under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA).
The headline figures are substantial:
The cumulative cap is the greater of $4 million (individual) or $20 million (entity), as applicable, and 3% of the relevant prior-year gross global income/revenue.
For an entity in an affiliated group, the relevant revenue can be deemed to be the gross global revenue of the group—not merely that of the regulated Canadian operating entity.
The practical point is not that every compliance failure will attract a large penalty. FINTRAC must still apply the statutory framework to the facts before it. But an AML failure that is widespread, repeated, or linked to an ineffective control environment can now have a fundamentally different financial and governance significance.
The recent Xeltox case illustrates how quickly counts of discrete deficiencies can become consequential. FINTRAC imposed a $176,960,190 AMP on Xeltox Enterprises Ltd. in October 2025, arising from 2,593 contraventions across six categories. FINTRAC identified, among other matters, failures involving suspicious transaction reports and large virtual-currency transaction reports. The penalty was imposed under the pre-March 2026 framework and has been appealed to the Federal Court.
For firms, the lesson is not that a crypto-sector outcome can simply be imported into the securities sector. It is that a systemic failure in client due diligence, monitoring, investigation, reporting, recordkeeping, or governance can produce multiple contraventions and material exposure.
The new effectiveness requirement
A risk assessment may identify complex ownership structures as higher risk, but effectiveness is tested by what happens when such a client is actually onboarded: whether the information obtained, escalation and ongoing monitoring reflect that assessment.
The change should not be read as displacing the detailed compliance-program requirements. A firm must still maintain the required elements, including a designated responsible person, written policies and procedures, a documented risk assessment, training, and an effectiveness review. The difference is that a technically complete program may no longer be enough if it cannot be shown to operate effectively in the firm’s actual business.
For securities firms, FINTRAC may reasonably expect to see a clear and documented connection among:
The firm’s risk assessment and its client, product, geography, delivery-channel, transaction, and third-party risks.
Client identification, beneficial-ownership, third-party, and politically exposed person controls.
Expected-account-activity information and ongoing monitoring.
Alert-generation, triage, investigation, escalation, and reporting decisions.
Quality assurance over investigations and suspicious transaction report narratives.
Management information, senior-officer oversight, and remediation of identified weaknesses.
Neither the number of STRs filed nor the absence of filings is, on its own, a reliable measure of effectiveness. What matters is whether the firm can demonstrate that potentially suspicious activity is identified, assessed and reported when the regulatory threshold is met.
What matters for securities firms
The securities context requires more than generic AML controls. Firms should examine whether their program identifies risk at the points where illicit funds or suspicious activity may enter, move through, or leave the business.
Relevant scenarios may include:
A subscription, investment account funding, or redemption involving unexplained third-party payments, recently incorporated entities, trusts, nominees, or opaque holding structures.
Client activity inconsistent with stated occupation, source of funds, investment objectives, expected account activity, or known wealth profile.
Rapid liquidation and withdrawal patterns, including transfers to unrelated third parties or higher-risk jurisdictions.
Multiple accounts sharing a beneficial owner, bank account, contact details, device indicators, IP data, or other links that are not adequately understood.
Private-placement, exempt-market, thinly traded, or promoter-linked activity that raises fraud, market-manipulation, or proceeds-of-crime concerns.
Account activity connected to fraud proceeds, elder financial exploitation, sanctions-evasion indicators, or crypto-to-fiat conversion patterns.
Outsourcing a function does not outsource accountability. A firm should understand what information it receives, which exceptions are escalated and how it gains assurance that delegated controls operate as intended.
The firm should be able to identify who owns each step in the control chain: who gathers client information; who verifies identity and beneficial ownership; who monitors activity; who investigates alerts; who determines whether an STR is required; who prepares the narrative; and who ensures that decisions and deadlines are documented.
Governance, testing, and change management
The biennial effectiveness review remains important, but it should not be treated as the sole test of whether the program works. The regulations require a reporting entity to review its compliance program’s control design and operational effectiveness at least every two years and report the review’s findings, policy/procedure updates, and implementation status to a senior officer within 30 days of completion.
For securities firms, an effective assurance program should include targeted and continuous testing between formal reviews. Depending on its size and risk, a firm may benefit from targeted checks between its required two-year reviews. Would a review of actual client files and escalation decisions support the conclusions management draws from its policies and risk assessment?
Change management is now especially important. The regulations expressly require a reporting entity to assess and document money-laundering and terrorist-financing risk before implementing a new development or technology that may affect clients, business relationships, products, services, delivery channels, or geographic exposure.
That requirement has practical implications for automated onboarding, AI-supported due diligence, digital identity verification, surveillance tools, data-enrichment products, new distribution arrangements, new private-market offerings, crypto-adjacent products, and cross-border service models.
FATF and supervisory focus
Canada’s 2026 FATF/APG mutual evaluation report has now been published. Canada avoided placement on the FATF’s list of jurisdictions under increased monitoring, but the report nonetheless provides an important external assessment of the country’s AML/ATF system and identifies areas for continued improvement.
For securities firms, the practical significance is that the report reinforces the direction of travel: supervisory attention will remain focused on demonstrable effectiveness, quality of reporting, risk-based controls, beneficial ownership transparency, and the ability of Canada’s AML regime to produce useful financial intelligence and enforcement outcomes.
Firms should review the final report with their own risk assessment in mind, rather than assuming that a FATF finding automatically creates a new firm-level obligation. The more immediate question is whether the firm can evidence that its controls are calibrated to its actual risks and that management understands the limits, exceptions, and performance of those controls.
Immediate priorities
Securities firms should now consider three questions:
If audited tomorrow, could we demonstrate how our most material/inherent AML risks are mitigated and tested?
Would a review of actual client files, alerts and escalation decisions support the confidence expressed in our policies and reports?
Are gaps identified by earlier reviews demonstrably fixed, or simply marked closed?
The real exposure is not always the absence of a policy. It may be the gap between what a firm believes its controls achieve and what the evidence shows. In an environment of heightened regulatory attention, an independent, risk-based effectiveness review offers management a timely opportunity to identify and address that gap before an examination does.
—————
Next Steps with North Star Group
North Star Group supports EMDs, PMs, IFMs, and other registrants across the full lifecycle of their business, from incorporation and governance through capital raising, regulatory transactions, and disclosure, with legal counsel that reflects how the business actually operates today. Whether you need ad hoc legal or compliance guidance, ongoing outsourced legal or compliance capacity, or hands-on support navigating a securities, AML, or compliance matter, our team helps you move forward with clarity and confidence.
Reach out to us today at info@northstarcompliance.com
—————
About the Authors
Martha Rafuse (B.A. Western, LL.B. Osgoode, LL.M London School of Economics), is a Partner at North Star Legal, bringing more than two decades of securities regulatory experience across the financial industry, private legal practice, and government. Before joining North Star Legal, Martha led large compliance teams for both Canadian and U.S. firms, including RBC Phillips, Hager & North Investment Counsel Inc., RBC Dominion Securities Inc. (Retail), and RBC Royal Mutual Funds. Her earlier experience in big law firm private securities practice led to her experience with the Ontario Securities Commission, where she developed novel legal solutions and led significant policy initiatives involving NI31-103.
Read Martha’s full bio here.
Manish Advani (MBA, CAMS, FIS) is a Senior AML Consultant at North Star Compliance, bringing more than 15 years of experience in financial crime risk management, including anti-money laundering (AML), anti-terrorist financing (ATF), and sanctions compliance. Before joining North Star Compliance, Manish held senior compliance roles at leading Canadian financial institutions, including CIBC, TD Bank Group, Laurentian Bank, Scotiabank, and BMO, where his work spanned AML/ATF program governance, regulatory remediation, risk assessments, and independent testing of AML and sanctions controls. At CIBC’s AML Centre of Excellence, he led a large team for a regulatory remediation program involving approximately 200,000 business clients.
Read Manish’s full bio here.
This article is provided for general informational purposes only and does not constitute legal advice.