Key Takeaways
- • FINTRAC imposed a record C$176.9 million ($126.14 million USD) administrative monetary penalty on Xeltox Enterprises Limited (operating as Cryptomus), the largest fine ever issued by Canada's anti-money laundering regulator, for 2,593 violations across multiple compliance failures.
- • Xeltox failed to submit suspicious transaction reports for activities connected to trafficking in child sexual abuse material, fraud, ransomware payments, and sanctions evasion—violations that prompted FINTRAC to characterize the enforcement action as "unprecedented."
- • The penalty reflects systemic AML/KYC (anti-money laundering/know-your-customer) deficiencies, including failure to report receipt of more than C$10,000 in virtual currency from a client and widespread gaps in suspicious activity reporting obligations.
- • FINTRAC simultaneously revoked registrations of 23 money services businesses linked to cryptocurrency operations, signaling a broad regulatory crackdown ahead of Canada's upcoming Financial Action Task Force audit in November 2025.
- • The enforcement action underscores heightened regulatory scrutiny of cryptocurrency platforms in Canada, following earlier penalties including C$19.6 million against KuCoin operator Peken Global Limited in September.
Summary
Canada's Financial Transactions and Reports Analysis Centre (FINTRAC) has issued a record C$176.9 million fine against Xeltox Enterprises Limited, a British Columbia-incorporated money services business operating under the brand name Cryptomus and previously known as Certa Payments Limited. The penalty, announced on October 22, 2025, represents the largest enforcement action in FINTRAC's history and reflects the regulator's escalating response to cryptocurrency platform non-compliance with federal anti-money laundering obligations.
The violation pattern centered on Xeltox's systematic failure to submit suspicious transaction reports despite clear grounds for suspicion. FINTRAC documented 2,593 instances of non-compliance across six distinct categories of financial crime. Most critically, the violations connected to trafficking in child sexual abuse material, fraud, ransomware payments, and sanctions evasion—triggers that elevated the case beyond standard compliance failures. The agency noted that Xeltox also failed to report receipt of more than C$10,000 in virtual currency from a single client, a straightforward reporting obligation under Canadian financial crime regulations. In a statement, FINTRAC emphasized that "given that numerous violations in this case were connected to trafficking in child sexual abuse material, fraud, ransomware payments and sanctions evasion, FINTRAC was compelled to take this unprecedented enforcement action."
The enforcement action occurred within a broader regulatory campaign. FINTRAC simultaneously revoked the registrations of 23 money services businesses with cryptocurrency linkages, and the agency had previously imposed a C$19.6 million penalty on Peken Global Limited (operator of cryptocurrency exchange KuCoin) in September—which that entity has since appealed as excessive. This concentrated enforcement effort precedes Canada's scheduled audit by the global financial crime watchdog Financial Action Task Force next month, positioning FINTRAC to demonstrate robust oversight capacity.
The Xeltox penalty signals that cryptocurrency platforms operating in Canada face substantial compliance burdens and material financial exposure for systemic AML/KYC violations. For institutional investors and fund managers evaluating exposure to crypto-linked financial services or Canadian regulatory risk, the decision underscores that virtual currency businesses face enforcement standards comparable to traditional financial institutions, with penalties now operating at scale sufficient to impact operational viability.
The violation pattern centered on Xeltox's systematic failure to submit suspicious transaction reports despite clear grounds for suspicion. FINTRAC documented 2,593 instances of non-compliance across six distinct categories of financial crime. Most critically, the violations connected to trafficking in child sexual abuse material, fraud, ransomware payments, and sanctions evasion—triggers that elevated the case beyond standard compliance failures. The agency noted that Xeltox also failed to report receipt of more than C$10,000 in virtual currency from a single client, a straightforward reporting obligation under Canadian financial crime regulations. In a statement, FINTRAC emphasized that "given that numerous violations in this case were connected to trafficking in child sexual abuse material, fraud, ransomware payments and sanctions evasion, FINTRAC was compelled to take this unprecedented enforcement action."
The enforcement action occurred within a broader regulatory campaign. FINTRAC simultaneously revoked the registrations of 23 money services businesses with cryptocurrency linkages, and the agency had previously imposed a C$19.6 million penalty on Peken Global Limited (operator of cryptocurrency exchange KuCoin) in September—which that entity has since appealed as excessive. This concentrated enforcement effort precedes Canada's scheduled audit by the global financial crime watchdog Financial Action Task Force next month, positioning FINTRAC to demonstrate robust oversight capacity.
The Xeltox penalty signals that cryptocurrency platforms operating in Canada face substantial compliance burdens and material financial exposure for systemic AML/KYC violations. For institutional investors and fund managers evaluating exposure to crypto-linked financial services or Canadian regulatory risk, the decision underscores that virtual currency businesses face enforcement standards comparable to traditional financial institutions, with penalties now operating at scale sufficient to impact operational viability.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.