The $177 Million Message: FINTRAC Raises the Bar for Crypto Compliance
With digital finance, borders are meaningless, and we're ill-equipped to handle that.
Yesterday, FINTRAC fined Xeltox Enterprises Ltd (operating as Cryptomus and previously known as Certa Payments Ltd) a record-breaking $177 million administrative monetary penalty. This is the largest penalty that FINTRAC has ever issued (by a long shot). Xeltox / Cryptomus is a virtual asset service provider registered in British Columbia that operates without staff or a physical presence in Canada.
In its news release on the administrative monetary penalty, FINTRAC noted that the penalty reflected the “magnitude of non-compliance” and the very serious nature of the violations. FINTRAC found that the crypto company failed to file suspicious transaction reports, noting that the company processed many transactions that it had reasonable grounds to suspect were related to proceeds from trafficking in child sexual abuse material, fraud, ransomware payments, and sanctions evasion.
The company also failed to report large virtual currency transactions of $10,000 or more (“threshold” reports in Canadian legislation).
Iran
The company also failed to comply with a Ministerial Directive (Iran). These directives are legally binding orders that tell reporting entities (like banks, money service businesses, casinos, etc.) how to handle transactions involving certain foreign jurisdictions, entities, or activities that pose a high risk of money laundering or terrorist financing. FINTRAC then communicates and enforces these directives. Under the current ministerial directive on Iran, reporting entities must:
Treat every transaction with Iran as high-risk
Verify the identity of any individual involved in these transactions
Ascertain the source of funds for these transactions
Keep a record of the transaction
Report all of these transactions to FINTRAC
FINTRAC found 7,557 instances between July 1, 2024, and December 31, 2024, in which the exchange failed to report transactions originating in Iran.
This is particularly important because over the last five years or so, Iran has increasingly used cryptocurrency to evade sanctions, finance the non-state (and terrorist) groups in its Axis of Resistance (such as Hizballah, Hamas, the Houthis, Palestinian Islamic Jihad, and others), to fund its proliferation activities and acquire dual-use materials, and facilitate oil sales.
While we don’t know if any of these transactions facilitated this activity (that’s part of the problem: the non-reporting of transactions prevents them from being analyzed for potential money laundering, terrorist financing, and sanctions evasion), this fine illustrates how a crypto exchange with a presence in Canada might be used for this highly illicit activity.
Interestingly, I looked at the company’s anti-money laundering statement, and it claims it does not process transactions with Iran. Or actually a host of other countries….
Our terrorist financing analysis course caters to researchers, intelligence, law enforcement, and compliance professionals to help them learn about terrorist financing, and analyze suspicious patterns and activities more effectively. Sign up today!
Exiting the Canadian Market?
The Globe and Mail reported that the Cryptomus website is blocked in Canada, and I confirmed that. However, using a VPN, I did have a look around the website (see the above-mentioned AML policy), and noted some of the services they offer. Given the website block, it appears the company is exiting the Canadian market.
This might make it challenging for FINTRAC to collect this penalty. (Briefly, the collection process looks like this: once FINTRAC issues a notice of violation, the entity has 30 days to act. If the entity pays the penalty, the matter is settled. The entity can also appeal the penalty to the Federal Court. The debt becomes owed to the Crown, interest starts accruing, and FINTRAC (or its delegates) can pursue collection. FINTRAC indicated that since 2012, 74% of penalties have been fully collected, and other cases are at the Federal Court.)1
I doubt there is any real prospect for collecting this fine, but it certainly is symbolic. Further, in C-2 (and subsequently C-12), amendments are proposed to FINTRAC’s legislation to increase the fines further. (I will happily be wrong, and would be delighted to see FINTRAC collect this fine. Let’s all keep our eyes out for news on this front.)
Why not criminal non-compliance?
One of the tools that exists in Canadian anti-money laundering laws is criminal non-compliance with the regime. Criminal non-compliance requires a person or entity to knowingly contravene certain sections (such as record-keeping requirements). In this case, it’s entirely possible that Cryptomus or its principals could have met the standard for criminal non-compliance. However, given that they have no real presence in Canada (and legal cooperation with Kazakhstan and Uzbekistan (the country of residence for the principals) is likely…challenging), I doubt there was any real prospect of charges in this case. But it might be the kind of thing that our much-promised and not-yet-delivered Financial Crimes Agency might look into.
This really illustrates how easily companies can operate and evade reporting requirements, and the consequences of failing to combat illicit financial activities. Crypto isn’t the wild west of finance anymore, but issues like this really illustrate how difficult effective regulation and enforcement are in an interconnected world. Canada’s AML/CTF regime still relies on territorial enforcement powers in a borderless financial ecosystem, which could increasingly render its enforcement mechanisms meaningless.2
Serious Implications for the Fight Against Illicit Finance
This case underscores how crypto exchanges can become nodes in transnational illicit finance networks, even when nominally registered in one jurisdiction but operating globally without a real footprint. The Cryptomus case illustrates how such entities can serve as de facto gateways for proceeds of cybercrime, sanctions evasion, and terrorist financing.
Further, the unreported Iranian transactions could point to latent sanctions-evasion corridors through crypto platforms, including those operating in Canada. Canada could be unknowingly enabling the digital infrastructure of sanctions evasion and illicit finance, with crypto exchanges acting as intermediaries for regimes or proxies (e.g., Iran-linked networks financing Hizballah or Houthis).
Beyond its symbolic value, the Xeltox/Cryptomus case reveals a deeper structural weakness: national AML systems remain ill-equipped to police decentralized and transnational digital value flows. When a company can register in one jurisdiction, have principals resident another, serve customers globally, ignore sanctions-related directives, and then simply block Canadian access after being fined, it exposes the fragility of enforcement in the face of digital finance’s borderless nature.
To date, the regulation and enforcement of national AML/CFT standards have been carried out at the national level. But with digital finance, borders are meaningless. This leaves only a few options for effective regulation and enforcement, like a supranational FIU with global enforcement powers, or a much more muscular FATF, or some sort of UN mechanism. All of these options will be difficult to implement in the current geopolitical climate.
© 2025 Insight Threat Intelligence Ltd. All Rights Reserved.
This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.
FINTRAC kindly provided this information in an email responding to some questions I asked about the collection process.
That is not to say that we should not try, or that FINTRAC should abandon its efforts. It’s more to emphasize that the Canadian system can be perfect, and significant issues will still arise, and our financial sector will still be abused.
Great insights Jennifer. Excellent piece