As compliance geeks, we’re compelled to open with some important caveats. This post is made by Outlier Compliance Group, which is a private consulting firm, and does not speak in any official capacity for the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC), Canada’s anti-money laundering (AML) regulator. If FINTRAC indicates something that does not align with the views expressed here, it’s safe to assume that their position is the correct one (and if that’s the case, please let us know).
What’s the issue?
Several clients and colleagues called us with questions about email requests for information received from FINTRAC in January/February 2025. These requests were received by virtual currency (VC) dealers that operate one or more automated teller machines (ATMs). To some, these emails seemed unusual, and in a time in which we’re all bombarded with scams, it makes sense to check the legitimacy.
As a first step, we always check the sender. In this case, the email was from MSBRegistration@fintrac-canafe.gc.ca which is a legitimate FINTRAC email address. All FINTRAC email addresses end in “@fintrac-canafe.gc.ca”. It is noteworthy that there may be some phishing red flags present, although these were legitimate emails:
- The receiving company is not specified (other than by the receiver’s email address);
- The intended recipient is not named (other than by the receiver’s email address), and at least one email that we saw was directed to “to whom it may concern”;
- The request for information asks for a response by email, rather than a more secure channel such as Canada Post’s ePost service, which FINTRAC generally uses to receive information during examinations.
FINTRAC has confirmed that these requests for data are legitimate, and that businesses receiving the requests that prefer to send data via a secure method (ePost) may request to do so.
What’s being requested?
The subject line of the email is “Request for Wallet Addresses Information under subsection 63.1(2) of the PCMLTFA” and, as implied, FINTRAC is requesting comprehensive lists of the VC addresses used by the companies.
While the data being requested (virtual currency wallet addresses) is public in some ways (transactions are posted on public blockchains), not all wallets are attributed to specific businesses, and there are many reasons that a business may prefer to exchange this data with the regulator securely.
No time period is provided in the request, and for some companies, particularly those that use hierarchical deterministic wallet types, which generate new addresses for every transaction, this can mean thousands of addresses. If this is the case, we recommend reaching out to FINTRAC as soon as possible, as a smaller time period may suffice for the regulator’s analysis, depending on the transaction volumes.
What is Section 63.1(2) of the PCMLTFA?
The Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) section 63.1(2) reads:
Obligation to provide information
(2) The person or entity on whom the notice is served shall provide, in accordance with the notice, the documents or other information with respect to the administration of Part 1 or 1.1 that the authorized person may reasonably require.
In plain language, this means that FINTRAC has the right to request information from reporting entities, and they are exercising this right by sending the request that you’ve received.
Did you receive an email?
If you are a VC ATM operator, and you aren’t sure if you’ve received a request, check your e-mail (including spam and deleted folders) using the search terms:
- Request for Wallet Addresses Information under subsection 63.1(2) of the PCMLTFA; and/or
- MSBRegistration@fintrac-canafe.gc.ca.
We aren’t sure if this request was sent to all VC ATM operators, or only a select group (again, we don’t speak for FINTRAC), but if you did receive a request, it’s important to respond to it within the time indicated in the email. Like all requests from regulators, it is time sensitive.
Need a hand?
If you have questions about how to respond to FINTRAC’s request, or AML generally, please feel free to contact us here, or by email at info@outliercanada.com.