Unregistered FMSB penalties in Canada: Binance, KuCoin, the $20M cap

FINTRAC is Canada's AML registrar and supervisor, not a licensor, and it says so itself: "FINTRAC does not issue licenses or certificates of registration to businesses it regulates" (fintrac-canafe.canada.ca). The market's "MSB licence" shorthand is exactly that - shorthand. But the modest label changes nothing about the duty. Section 11.1 of the PCMLTFA provides that every person or entity referred to in paragraph 5(h) or (h.1) must register with the Centre, and paragraph 5(h.1) is the foreign limb: businesses with no place of business in Canada that direct money services at persons or entities in Canada and provide those services to clients in Canada.

FINTRAC's registration guidance adds the timing: foreign money services businesses that direct and provide services to clients in Canada must register before they begin to operate. There is no published de minimis threshold and no single-client safe harbour - Canada-directed marketing, a .ca domain and a Canadian business-directory listing are the primary indicators, and we unpack them in how FINTRAC's directing-services test actually works. If the test catches the model, every day of unregistered operation sits on the wrong side of s. 11.1.

The AMP regime attaches a penalty to each violation, and a reporting failure is a violation per missed report, not per inspection. A large virtual currency transaction report is due whenever a business receives $10,000 or more in virtual currency - so an unregistered exchange serving clients in Canada manufactures a new violation with every qualifying receipt.

That is the whole story of the headline numbers. FINTRAC's penalty notice against Binance Holdings Limited lists failure to register as an FMSB first, then 5,902 large virtual currency transactions received without the required reports. Peken Global Limited, operating as KuCoin, was penalised for failure to register (classified Serious), 2,952 unreported large virtual currency transactions, and 33 unreported suspicious transactions - the suspicious-transaction failures classified Very Serious. Failure to register is rarely penalised alone: an unregistered FMSB is, by definition, filing none of the reports a registered one must file, so the register-failure headline arrives with a violation count that scales with transaction volume.

Bill C-12 received royal assent on 26 March 2026 as S.C. 2026, c. 4, and rewrote the AMP ceilings with effect from that date. The ranges in the AMP Regulations now run $1 to $40,000 for a minor violation, $1 to $4,000,000 for a serious violation and $1 to $20,000,000 for a very serious violation (SOR/2007-292, s. 5). The statute itself caps a single violation at $4,000,000 where committed by a person and $20,000,000 where committed by an entity, and where multiple violations are penalised together, the cumulative total is capped at the greater of those amounts or 3% of gross global revenue (PCMLTFA s. 73.1). The revenue limb is the one designed for scale: for a large international platform, 3% of gross global revenue can exceed $20 million by a wide margin.

Both existing FMSB penalties were imposed before these maximums took effect. Read the table above with that in mind: the per-occasion arithmetic that produced $6 million and $19.5 million now runs against materially higher ceilings. The maximums have been in force since 26 March 2026 - verify the current figures in the consolidated PCMLTFA and AMP Regulations on laws-lois.justice.gc.ca before relying on them.

The AMP track is administrative, and it is not the only one. Knowingly contravening s. 11.1 is a criminal offence under s. 74 of the PCMLTFA: on summary conviction, a fine of up to $2,500,000, imprisonment for up to two years less a day, or both; on indictment, a fine of up to $5,000,000, imprisonment for up to five years, or both. The administrative and criminal tracks are distinct regimes - an AMP notice is not a conviction, and the criminal provision requires knowledge. Both FMSB cases to date have been administrative penalties, not prosecutions.

The third layer is publicity. FINTRAC publishes the names of penalised businesses, the amounts and the full violation lists on its public administrative monetary penalties pages, and it issued news releases in both FMSB cases. The public MSB registry cuts the same way from the other side: anyone can check in minutes, against a monthly-updated register, that a business serving clients in Canada has never registered.

The economics of non-registration are asymmetric. On one side sits a free registration and the ordinary cost of running an AML compliance programme; on the other, per-occasion penalties against eight-figure ceilings, criminal exposure for knowing contravention, and a permanent public record. If the directing-services test catches your model, the options are to register as an FMSB - the requirements are set out in the registration guide linked above - or, where a Canadian footprint is part of the plan anyway, to operate through a registered domestic MSB, including by acquiring one through our Canadian MSB acquisition route. What no option includes is staying unregistered while serving clients in Canada.