Canada's Financial Transactions and Reports Analysis Centre of Canada has imposed the largest administrative monetary penalty in its institutional history, levying C$176,960,190 on Xeltox Enterprises Ltd on 16 October 2025. Xeltox operates two digital payment platforms — Cryptomus and Certa Payments — and FINTRAC identified no fewer than 2,593 separate contraventions of the Proceeds of Crime (Money Laundering) and Terrorist Financing Act across the company's Canadian operations. The penalty is of an entirely different order of magnitude from any previous FINTRAC enforcement action; the prior record was C$7.4 million, issued against TD Bank in 2023, making the Xeltox penalty more than twenty-three times larger than the previous high-water mark in the regulator's history.
FINTRAC identified that Xeltox had operated without registering as a money services business, a foundational requirement under the Act for any entity providing money transfer, currency exchange, or virtual-asset services in Canada. Operating without registration removes the baseline regulatory visibility — encompassing mandatory compliance programmes, transaction reporting obligations, and know-your-client procedures — that the Act exists to secure. The regulator found that the absence of registration was accompanied by sweeping compliance failures across every core requirement of the AML and counter-terrorist financing framework.
2,593 CONTRAVENTIONS SPANNING CORE COMPLIANCE OBLIGATIONS
The scale of the violations — 2,593 individual contraventions — is wholly without precedent in FINTRAC's enforcement record. The regulator identified failures to maintain an adequate compliance programme, including the written policies, ML/TF risk assessment documentation, and staff training requirements the Act mandates for all reporting entities. Systemic failures were also found in transaction reporting, encompassing large cash transaction reports and electronic funds transfer reports that should have been submitted to FINTRAC on an ongoing basis. Know-your-client requirements, which oblige money services businesses to identify and verify client identities before providing services, were found to have been systematically disregarded across the Xeltox platforms.
The Cryptomus platform offers crypto-payment processing services to businesses and individuals internationally, operating in a segment that has attracted sustained regulatory attention globally for its potential use in layering illicit funds across multiple jurisdictions. Certa Payments operates in a related payments segment. Both platforms were captured within FINTRAC's assessment of Xeltox's obligations under Canadian law, since the company's services extended to Canadian clients regardless of where Xeltox was incorporated or physically domiciled.
RECORD PENALTY SIGNALS TOUGHER STANCE ON UNREGISTERED OPERATORS
FINTRAC's decision to impose a penalty of this size reflects a deliberate and highly visible escalation in its enforcement posture toward entities that operate outside the registered perimeter of Canada's AML regime. In the 2024–25 fiscal year, the regulator issued 23 Notices of Violation, the most in any single year in its history, for a combined total of more than C$25 million. The Xeltox penalty alone exceeds that entire annual aggregate by a factor of seven and dwarfs every previous enforcement action the regulator has undertaken.
The C$176.96 million penalty sends an unambiguous message to unregistered money services businesses and crypto-asset operators that providing services to Canadian customers without satisfying registration and compliance obligations carries consequences that are potentially existential in financial terms. FINTRAC has not disclosed publicly whether Xeltox has indicated an intention to appeal the penalty, or whether any parallel referrals to law enforcement authorities have been made in connection with the findings arising from the case.