Written with Heidi Unrau
On March 2, 2024, the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) experienced a major cyber incident. As a security precaution, FINTRAC has taken most of its reporting systems offline, including MSB registration. Canadian reporting entities remain responsible for all anti-money laundering (AML) requirements during the outage.
Application programming interfaces (APIs) are available for some reports, including large cash transaction reports (LCTRs), large virtual currency transaction reports (LVCTRs), and suspicious transaction reports (STRs), as of April 8, 2024.
Reporting entities that are not able to submit reports via API must do so once other systems are back online. In the interim, special processes for priority STR submission and other notifications have been established.
Watch for Official Guidance
It’s essential that you follow FINTRAC’s official communications regarding the outage. Outlier’s insights are meant to complement this directive, not replace it. The official word from FINTRAC remains the final authority on these matters.
It is recommended that all Canadian AML Compliance Officers sign up for FINTRAC’s mailing list to get the latest news from the regulator (if you are not signed up already).
Accessing FINTRAC’s APIs
As of April 8, 2024, FINTRAC APIs are currently available for:
- LCTRs
- LVCTRs
- STRs
An API is a way for different computer programs to communicate with each other. To use FINTRAC’s APIs, reporting entities must first apply to register and be granted access by FINTRAC. The implementation of APIs for reporting will require the support of your technical team or software provider. Reporting via API is different from batch reporting (for those that use it) as the API provides a secure exchange of information that does not require the installation of batch-transmitting software.
For reporting entities that have not implemented API functionality, additional guidance has been provided by FINTRAC.
Priority STRs
For priority STRs with national security or other dangerous implications, FINTRAC has provided a dedicated email address and telephone number to help you with this (see below).
Please note that the CSIS and RCMP systems for Terrorist Property Reporting (TPR) are unaffected by the outage and remain operational.
Priority STR Submission Contact Info:
- Email: STR-DOD@fintrac-canafe.gc.ca
- Call Centre: 1-866-346-8722 (toll free)
Reporting entities that are unsure of whether or not an STR is considered a priority may first contact FINTRAC using the information above to determine whether this submission method should be used. It is expected that STRs submitted via this method will also be re-submitted once systems are back online.
No Late Reporting Penalties
FINTRAC has indicated that the regulator understands that late reporting is an inevitable consequence of the outage. Therefore, FINTRAC has indicated that reporting entities will not be penalized for late reporting (within reason). It is expected that reporting entities will submit reports promptly once systems are back online.
Fulfilling Reporting Obligations
During the outage, reporting entities are required to track all reportable transactions. Keep detailed records of transactions that could not be reported during the outage. This will ensure that all required transaction reports are accurately and efficiently submitted once systems are restored.
In addition to information about reportable transactions, reporting entities should keep detailed records of:
- The outage timing (provides useful context that may factor into future audit and examination-related data analysis)
- All late reports submitted
- Time required to clear the backlog once systems become operational
At this time, FINTRAC has not indicated that reporting entities should submit a voluntary self-declaration of non-compliance (VSDONC) related to late reporting due to the current outage. However, if there is a reporting backlog that will take significant time to clear, this may be considered once the outage has been resolved.
No Paper Submissions!
FINTRAC has explicitly advised against submitting paper copies of reports during the outage. Once the issue has been resolved, electronic reporting through the appropriate channels will resume.
MSB Registration & Inquiries
In a recent update on May 17, 2024, FINTRAC introduced a new web form specifically for existing Money Services Businesses (MSBs). This form allows currently registered MSBs to renew, update, or cancel their registration easily. You can access the form here:
It does not appear that new MSB registrations can be completed at this time. MSB registration inquiries can be directed to:
Be Prepared & Stay Alert
Stay up to date on the latest FINTRAC communications to ensure compliance should directives change.
For critical reporting and MSB registration needs, use the designated emails and phone numbers provided by FINTRAC. Keep all communications clear, concise, and accurate with all the necessary information.
Key FINTRAC Contact Information
Issue | Phone | |
New MSB Registration Inquiries | MSBRegistration@fintrac-canafe.gc.ca | n/a |
Existing MSB Registration Renewals, Updates, or Cancellations | https://forms-formulaires.alpha.canada.ca/en/id/clwtp4i5j031kx883je15qc78? | n/a |
Priority STR Reporting | STR-DOD@fintrac-canafe.gc.ca | 1-866-346-8722 |
General Inquiries | guidelines-lignesdirectrices@fintrac-canafe.gc.ca | n/a |
API Support | tech@fintrac-canafe.gc.ca | n/a |
Additional Resources
Below, you’ll find a slide deck presentation and a YouTube video with the same information in this article. You are welcome to use and distribute these resources:
- Slide Deck: Quick Notes on FINTRAC’s Cyber Incident & Outage
- YouTube Video: FINTRAC’s March 2024 Cyber Incident: Notes for Canadian AML Reporting Entities
Need a Hand?
If you have any questions or concerns, the team at Outlier Solutions are here to help. Please contact us.