Bill C-12 has introduced major changes for reporting entities regulated under Canada's anti-money laundering framework. Having received Royal Assent on March 26, 2026, Bill C-12 is now part of the Government of Canada's broader effort to strengthen border security, fight transnational organized crime, and prevent illicit financing.
For businesses covered by the Proceeds of Crime (Money Laundering) and Terrorist Financing Act, also known as the PCMLTFA, the new rules significantly expand FINTRAC's compliance obligations and increase the financial consequences of AML violations. Reporting entities should now review their AML programs, customer due diligence controls, risk assessments, and suspicious transaction reporting systems to ensure they remain compliant.
Bill C-12 covers several key areas:
- FINTRAC registration for reporting entities;
- higher AML administrative monetary penalties;
- compliance orders and agreements;
- AML effectiveness reviews;
- restrictions on anonymous and false-name accounts;
- stronger regulatory oversight across PCMLTFA-covered sectors.
These changes make Bill C-12 compliance a priority for Canadian businesses operating in regulated sectors.
What Is Bill C-12?
Bill C-12 is a Canadian legislative reform that strengthens the country's anti-money laundering and counter-terrorist financing framework. It builds on earlier proposals and introduces stricter obligations for reporting entities under the PCMLTFA.
The purpose of Bill C-12 is to support Canada's efforts to combat:
- money laundering;
- terrorist financing;
- organized crime;
- cross-border illicit finance;
- financial fraud;
- misuse of regulated businesses.
For Canadian reporting entities, the bill creates stronger expectations around AML governance, internal controls, compliance monitoring, and timely remediation of identified weaknesses.
New Maximum Penalties Under Bill C-12
One of the most important changes under Bill C-12 is the 40-fold increase in maximum administrative monetary penalties for AML compliance violations, in force since March 26, 2026.
Under the current penalty structure:
- Minor violations now carry a maximum penalty of $40,000, up from a previous maximum of $1,000.
- Serious violations now carry a maximum of $4 million, up from $100,000.
- Very serious violations now carry a maximum of $20 million, up from $500,000.
These higher penalties reflect a stronger regulatory focus on effective AML controls, accurate reporting, proper record-keeping, and timely correction of compliance failures. For reporting entities, weak or outdated AML programs now carry significantly higher financial and regulatory risk.
The Aggregate Cap for Multiple Violations
The individual penalty maximums above are not the ceiling in every case. Where FINTRAC issues a single notice of violation covering multiple violations, the cumulative penalty for an entity is now capped at the greater of $20 million or 3% of the entity's gross global revenue from the prior financial year.
This 3% figure matters most for large or diversified businesses. Where the violating entity is part of a group of affiliated entities, the calculation is not limited to that entity's own revenue — it uses the gross global revenue of the entire affiliated group. For some large reporting entities, this can push the effective cap well past $1 billion. A payment institution or MSB registered under FINTRAC that sits inside a larger corporate group should factor this group-level exposure into its risk assessment, not just its own standalone revenue.
FINTRAC Registration and the Universal Enrolment Framework
Under the current framework, FINTRAC registration still applies mainly to money services businesses (MSBs) and foreign MSBs. Bill C-12 also enacts a broader universal enrolment requirement that will eventually apply to all reporting entities covered by the PCMLTFA — but this part of the reform is not yet in force. It takes effect on a date to be set by order in council, with non-MSB reporting entities expected to face mandatory enrolment from 2027.
Businesses already registered with FINTRAC as an MSB or foreign MSB are exempt from the new universal enrolment requirement once it commences — registration already covers what enrolment would otherwise require. For MSBs, in other words, this part of Bill C-12 changes little directly; the immediate impact falls on other PCMLTFA-covered sectors that currently have obligations under the Act but no formal registration process, including banks, insurers, securities dealers, real estate professionals, accountants, and casinos.
Sectors expected to be affected once universal enrolment commences include:
- money services businesses (already registered, and therefore exempt from separate enrolment);
- foreign money services businesses (same exemption applies);
- payment companies;
- securities dealers;
- real estate businesses;
- casinos and gaming operators;
- dealers in precious metals and stones;
- other entities covered by Canadian AML regulations.
For regulated businesses, FINTRAC registration is not just an administrative step. It forms part of a broader compliance framework that requires companies to demonstrate proper AML controls, risk management, and accountability. For a full breakdown of who currently needs to register or enrol with FINTRAC and how registration differs from the newer enrolment concept, see our guide MSB vs PSP Registration in Canada: Costs & Guide.
Compliance Orders and Agreements
Bill C-12 also strengthens FINTRAC's authority to require corrective action after identifying compliance failures. Compliance agreements, previously discretionary, are now mandatory: FINTRAC must require a reporting entity found to have committed a prescribed violation to enter into a compliance agreement.
A compliance agreement includes:
- specific deficiencies identified by FINTRAC;
- corrective measures required from the business;
- implementation deadlines;
- reporting obligations;
- evidence needed to demonstrate remediation.
If an entity fails to comply with the agreement, or FINTRAC instead issues a compliance order that the entity violates, the financial consequences escalate further: penalties of up to the greater of $30 million or 3% of worldwide gross revenue for an entity, calculated at the affiliated-group level in the same way as the aggregate cap above. A compliance order that goes unmet must also be made public, adding a reputational consequence on top of the financial one.
This creates a stronger incentive for businesses to address AML weaknesses before they become enforcement issues.
AML Program Effectiveness Reviews
A key part of Bill C-12 is the increased focus on the real effectiveness of AML programs. Reporting entities must be able to show that their compliance systems are not only documented, but also properly designed, risk-based, and functioning in practice — this is now a codified standard, and failing to meet it is itself classified as a very serious violation.
An effective AML compliance program should include:
- a documented business-wide risk assessment;
- written AML policies and procedures;
- customer identification and verification controls;
- customer due diligence and enhanced due diligence measures;
- suspicious transaction monitoring;
- record-keeping procedures;
- ongoing staff training;
- independent AML effectiveness reviews;
- board or senior management oversight.
This means that having AML policies on paper is no longer enough. Canadian reporting entities must be able to demonstrate that their AML framework works in day-to-day operations.
Ban on Anonymous and False-Name Accounts
Bill C-12 also strengthens restrictions on anonymous accounts and accounts opened under false names. This is especially relevant for account-based reporting entities and businesses that onboard customers digitally.
Reporting entities should ensure that their onboarding process can properly verify customer identity and detect inaccurate, incomplete, or misleading information.
Important controls include:
- reliable identity verification;
- beneficial ownership checks;
- sanctions and watchlist screening;
- business information verification;
- monitoring for suspicious account activity;
- escalation procedures for inconsistent customer data.
These requirements are particularly important for financial institutions, MSBs, fintech companies, payment providers, and other businesses exposed to higher financial crime risks.
Who Is Affected by Bill C-12?
Bill C-12 affects reporting entities subject to Canada's AML framework. This includes businesses and professionals with obligations under the PCMLTFA and related regulations.
The changes are especially important for:
- money services businesses;
- foreign money services businesses;
- fintech platforms;
- payment service providers;
- securities dealers;
- real estate businesses;
- casinos;
- dealers in precious metals and stones;
- accountants and accounting firms;
- other regulated businesses under Canadian AML law.
Because the bill expands FINTRAC's enforcement reach, all reporting entities should assess whether their current AML compliance program is still sufficient.
What Reporting Entities Should Do Now
To adapt to the current requirements, Canadian reporting entities should review their AML compliance framework and identify gaps before FINTRAC raises concerns.
Recommended steps include:
- reviewing current AML policies and procedures;
- updating the business-wide risk assessment;
- testing customer due diligence controls;
- reviewing transaction monitoring rules;
- checking suspicious transaction reporting procedures;
- assessing beneficial ownership verification;
- updating staff training materials;
- documenting board and senior management oversight;
- preparing for possible FINTRAC examination;
- conducting an independent AML program review;
- confirming FINTRAC registration or enrolment status now, and monitoring for the commencement date of universal enrolment if the business is not an already-registered MSB.
Businesses should also ensure that compliance responsibilities are clearly assigned and supported by adequate resources. Under the current framework, AML compliance is a core governance issue, not only an administrative function.
Why Bill C-12 Matters for AML Compliance in Canada
Bill C-12 marks a major shift in AML compliance in Canada. Higher penalties, a mandatory compliance-agreement regime, stronger enforcement powers, and increased focus on AML effectiveness all mean that reporting entities face greater regulatory risk if their programs are outdated or poorly implemented.
For Canadian businesses, the key message is clear: AML compliance must be practical, risk-based, documented, and regularly tested.
Companies that act now can reduce regulatory exposure, improve internal controls, and show FINTRAC that they take their obligations seriously.
Final Thoughts
Bill C-12 compliance is now a core priority for Canadian reporting entities. With penalties up 40-fold and compliance agreements no longer optional, businesses should not wait for a regulatory examination before updating their AML framework.
A properly designed AML program can help reporting entities meet PCMLTFA requirements, reduce financial crime risk, and avoid costly enforcement action. For companies operating in regulated sectors, now is the right time to review policies, test controls, and strengthen internal compliance systems.
