The C$176.9 million administrative monetary penalty imposed against the Vancouver-based, overseas-operated, cryptocurrency exchange Xeltox Enterprises Ltd., operating under the name Cryptomus, by the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) on October 22, 2025, highlights the regulatory perils that face cryptocurrency exchanges that operate in Canada outside the law.
In what was the largest administrative penalty ever issued by FINTRAC, Cryptomus was found to have committed 2,593 violations, including failing to file 1,068 suspicious transaction reports. The violations related to transactions involving darknet markets and proceeds linked to child trafficking, fraud, ransomware payments and sanctions evasion, as well as failure to comply with a Ministerial Directive concerning financial transactions associated with the Islamic Republic of Iran. FINTRAC also noted a failure to report 1,518 transactions involving the receipt of C$10,000 or more in virtual currency from clients, among other violations.
As we have detailed previously, cryptocurrency exchanges that operate in Canada are subject to compliance with anti-money-laundering and know-your-client (AML/KYC) requirements under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (Canada) (the PCMLTFA).
The regulatory difficulties faced by Cryptomus in Canada are not limited to the fine from FINTRAC. Cryptomus had separately been penalized by the British Columbia Securities Commission (BCSC) for operating a cryptocurrency exchange without having complied with registration requirements under the Securities Act (British Columbia).
In the temporary order, issued against Cryptomus on May 20, 2025, Cryptomus was prohibited from trading securities or derivatives and from engaging in promotional activities.
The Cryptomus example, while extreme due to the specific nature of the violations, highlights the seriousness of Canadian regulators in enforcing applicable laws and the penalties that face cryptocurrency exchanges that serve residents of Canada without operating within the law, as we have detailed previously.
It is also notable that sanctions evasion transactions were cited among the other proceeds of crime violations as grounds for this penalty. Recent amendments to the PCMLTFA and its regulations now require reporting entities to report to FINTRAC any transactions suspected to involve sanctioned persons or property along with the traditional "suspicious transaction" reports concerning transactions involving suspected proceeds of crime. This reflects how the Government of Canada is increasingly using AML laws as a mechanism for civil enforcement of Canada's economic sanctions laws.
If you have questions regarding ensuring that your cryptocurrency exchange is operating in compliance with Canadian AML/KYC or securities laws, please contact any of the authors, or a member of the Bennett Jones Fintech Group or Anti-Money-Laundering Group.
