What Happened
Anti-money laundering (AML) compliance has become one of the most critical regulatory obligations for iGaming operators in Canada. The Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) and its associated regulations establish the legal framework that governs how gambling businesses must detect, prevent, and report money laundering and terrorist financing activities.
The Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) is the federal agency responsible for administering and enforcing AML requirements across all reporting entities in Canada, including online casinos, sports betting operators, and other iGaming platforms. As Canada's regulated iGaming market has expanded, particularly following the launch of Ontario's open market in 2022, FINTRAC's oversight of the sector has intensified.
In recent years, FINTRAC has updated its guidance for the gambling sector, conducted compliance examinations of licensed operators, and imposed administrative monetary penalties on entities that have failed to meet their obligations. These actions reflect a broader trend toward stricter AML enforcement across all segments of the Canadian financial system.
FINTRAC Reporting Requirements
iGaming operators in Canada are classified as reporting entities under the PCMLTFA and must comply with a comprehensive set of reporting obligations. These requirements are designed to create a trail of financial intelligence that FINTRAC can analyze to identify potential money laundering or terrorist financing activity.
Large Cash Transaction Reports
While the concept of large cash transactions is more commonly associated with land-based casinos, the reporting framework extends to online operators in the context of certain transaction types. Operators must report any transaction or series of transactions involving $10,000 or more within a 24-hour period. For iGaming operators, this typically involves monitoring electronic fund transfers, payment processor transactions, and cryptocurrency deposits where applicable.
Suspicious Transaction Reports
Suspicious Transaction Reports (STRs) are a cornerstone of Canada's AML framework. Operators are required to file an STR with FINTRAC whenever they have reasonable grounds to suspect that a transaction or attempted transaction is related to the commission of a money laundering or terrorist financing offence.
- STRs must be filed within 30 days of the determination that reasonable grounds for suspicion exist
- Operators must not inform the individual that an STR has been filed (tipping off is prohibited)
- The obligation to file applies regardless of the dollar amount of the transaction
- Operators must document their analysis and the indicators that led to the suspicion
FINTRAC has published sector-specific guidance for the gambling industry that outlines common money laundering indicators, including rapid cycling of funds through accounts, minimal gaming activity relative to the volume of deposits and withdrawals, and the use of multiple accounts or payment methods to obscure the source of funds.
Terrorist Property Reports
Operators must also file Terrorist Property Reports if they become aware that they are in possession or control of property owned or controlled by a listed terrorist entity or individual. This obligation requires operators to screen their customer databases against the Consolidated Canadian Autonomous Sanctions List and other relevant lists.
Know-Your-Customer (KYC) Requirements
Know-your-customer verification is a fundamental component of AML compliance in the iGaming sector. Canadian regulations require operators to verify the identity of their customers and to maintain up-to-date records of this verification.
For iGaming operators, KYC verification typically occurs at account registration and at various trigger points throughout the customer relationship. The standard KYC process involves collecting and verifying the following information from customers.
- Full legal name, date of birth, and residential address
- Government-issued photo identification such as a passport, driver's licence, or provincial photo ID card
- Verification of address through utility bills, bank statements, or government correspondence
- For high-risk customers, enhanced due diligence measures including source of funds and source of wealth documentation
Operators must complete identity verification before allowing certain transactions, including withdrawals above specified thresholds. The regulations also require ongoing monitoring of customer activity to detect changes in risk profile or behaviour patterns that may warrant additional scrutiny.
Beneficial Ownership and Politically Exposed Persons
In addition to standard KYC, operators must take reasonable measures to determine whether a customer is a politically exposed person (PEP) — either domestic, foreign, or an international organization PEP — or a head of an international organization. PEPs are considered higher risk due to their potential exposure to corruption, and operators must apply enhanced due diligence measures to these customers.
The requirement to determine beneficial ownership applies when customers are acting on behalf of third parties or when accounts are held by corporate entities. Operators must identify the individuals who ultimately own or control the funds being used on their platform.
Record-Keeping Obligations
Canadian AML regulations impose extensive record-keeping requirements on iGaming operators. These records must be maintained for a minimum of five years and must be made available to FINTRAC upon request during compliance examinations.
Records that must be maintained include all customer identification documents, transaction records, copies of all reports filed with FINTRAC, risk assessment documentation, and records of compliance training provided to staff. Operators must also maintain a record of their compliance program, including policies, procedures, and the results of internal audits and effectiveness reviews.
FINTRAC has emphasized that record-keeping deficiencies are among the most common compliance failures identified during examinations of gambling sector reporting entities. Operators are advised to invest in robust record management systems and to conduct regular internal reviews to ensure completeness and accuracy.
Compliance Program Requirements
Every iGaming operator in Canada must establish and maintain a comprehensive AML compliance program. The PCMLTFA specifies the minimum elements that such a program must include.
- Appointment of a designated compliance officer responsible for the implementation and oversight of the program
- Written compliance policies and procedures that address all regulatory obligations
- A risk assessment that identifies and documents the money laundering and terrorist financing risks to which the operator is exposed
- An ongoing training program for all employees who handle transactions or customer interactions
- A two-year effectiveness review conducted by an internal or external auditor to assess whether the compliance program is functioning as intended
The compliance program must be tailored to the operator's specific risk profile, taking into account factors such as the geographic markets served, the types of products offered, the customer base, and the payment methods accepted.
Recent Enforcement Actions
FINTRAC has taken an increasingly assertive approach to enforcement in the gambling sector. Administrative monetary penalties (AMPs) have been imposed on several gambling entities for violations including failure to file STRs, inadequate KYC procedures, and insufficient record-keeping.
While FINTRAC does not always publicly disclose the identity of penalized entities, the agency publishes summaries of enforcement actions that describe the nature of the violations and the penalties imposed. These summaries serve as a warning to the broader industry and highlight the areas where FINTRAC is focusing its compliance efforts.
Provincial regulators have also incorporated AML compliance into their own oversight of iGaming operators. In Ontario, the AGCO requires operators to demonstrate compliance with PCMLTFA requirements as a condition of their registration, creating an additional layer of regulatory accountability.
Why It Matters
AML compliance is not merely a regulatory checkbox for Canadian iGaming operators. It is a fundamental obligation that directly impacts the integrity of the regulated market and public confidence in the sector. Failures in AML compliance can expose operators to significant financial penalties, reputational damage, and the potential loss of their operating authorization.
The broader context of AML enforcement in Canada's gambling sector is shaped by the findings of the Cullen Commission in British Columbia, which documented extensive money laundering through the province's land-based casinos. The commission's recommendations have influenced a national conversation about the adequacy of AML measures across all gambling channels, including iGaming.
What's Next
FINTRAC is expected to continue strengthening its oversight of the iGaming sector in 2026. Anticipated developments include updated guidance on the application of AML requirements to emerging payment methods, including cryptocurrencies and digital wallets, as well as enhanced expectations for transaction monitoring technology.
The federal government has also signaled its intention to review certain provisions of the PCMLTFA as part of a broader modernization effort. This review may result in changes to reporting thresholds, enhanced powers for FINTRAC, and new requirements for the gambling sector that reflect the evolving risk landscape.
Operators should expect compliance examinations to become more frequent and more detailed as FINTRAC allocates additional resources to the growing iGaming market. Proactive investment in compliance infrastructure and staff training will be essential for operators seeking to maintain their standing in Canada's regulated gambling environment.