Cheque Cashers: FINTRAC Obligations in Plain English

Obligations for cheque-cashing businesses came into force on April 1, 2025, as part of the Budget 2024 amendments implemented by SOR/2025-68. The mechanism is PCMLTFR s. 29.1, which prescribes cheque-cashing services (alongside crowdfunding platform services) for the purposes of PCMLTFA s. 5(h)(v) and (h.1)(v). The effect: a person or entity in the business of providing cheque-cashing services is a money services business — or a foreign MSB — and must register with FINTRAC.

The same day brought factors and financing or leasing entities into the regime, but through a different door: they are separate reporting-entity classes under PCMLTFA s. 5(i) and 5(j), with their own regulation sections. Cheque cashers alone entered as MSBs, and that routing matters because the MSB route is the one that carries FINTRAC registration. Whether a particular business model amounts to being in the business of providing cheque-cashing services is a scoping question the regulation does not elaborate on — check the current FINTRAC guidance for the sector before concluding either way.

Registration with FINTRAC is the entry obligation that comes with MSB status. The mechanics — forms, renewal cycles, what triggers an update — live in FINTRAC's current MSB registration guidance rather than here; work from the current version.

Registration is paperwork; the compliance program is the ongoing work. PCMLTFA s. 9.6(1) requires every reporting entity to establish and implement a compliance program, and s. 9.6(2) requires policies and procedures to assess, in the course of the business's activities, the risk of a money laundering or terrorist activity financing offence. PCMLTFR s. 156(1)(c) makes that assessment a documented one, covering clients and business relationships; products, services and delivery channels; the geographic location of activities; and any other relevant factor. A fourth enumerated factor — risk from affiliated entities — applies only to financial entities under PCMLTFA paragraphs 5(a) to (g).

Two timing rules are easy to miss. PCMLTFR s. 156(2) requires the risk assessment before launching a new development or technology that may affect clients, products, delivery channels or geography — a storefront cheque casher planning app-based remote deposit assesses and documents that risk before go-live, not after. New technologies are not an enumerated s. 156(1)(c) factor; the pre-implementation assessment is where they live, and s. 156(3) adds a two-year effectiveness review of the program. Then, from March 26, 2026, new PCMLTFA s. 9.6(1.1) requires the program to be "reasonably designed, risk-based and effective" — a standard about how the program performs, not just whether it exists on paper.

The baseline verification triggers for MSB services — which transactions, at what dollar amounts — are the numbers a teller's procedures get built around, and they are not reproduced here: check the current FINTRAC guidance for cheque-cashing businesses before setting cut-offs.

What the framework fixes independently of any threshold is the high-risk overlay. Where the business assesses a client or situation as high risk, PCMLTFA s. 9.6(3) requires the special measures prescribed in PCMLTFR s. 157: written policies and procedures for enhanced identity-verification measures based on the assessed risk, plus any other enhanced mitigation — including keeping client identification and beneficial-ownership information (s. 138) up to date and ongoing monitoring of business relationships (s. 123.1) at a frequency appropriate to the risk level.

Ministerial directives add a second overlay with no dollar floor: every transaction originating from or bound for North Korea, Iran or Russia is treated as high risk regardless of amount, and the identity of any person or entity requesting or benefiting from it must be verified, with due diligence paying particular attention to sanctions evasion — source of funds, purpose of the transaction, beneficial ownership.

Think of records in two families. Governance records prove the program exists and works: the documented risk assessment (PCMLTFR s. 156(1)(c)), pre-launch assessments for new technology (s. 156(2)), the written s. 157 high-risk policies, and the two-year effectiveness review (s. 156(3)). Transaction and client records prove individual obligations were met — the full list of prescribed MSB records and their retention periods sits in the PCMLTFR and FINTRAC's recordkeeping guidance, so build the register from the current version rather than a summary.

One record rule is absolute: a record must be kept of every transaction originating from or bound for North Korea, Iran or Russia, regardless of amount. Build these records at the counter — who presented the instrument, what it was, where the funds were headed — because a record assembled at transaction time is far stronger evidence than one reconstructed later.

Sanctions list-screening itself is not a PCMLTFA obligation — the freeze, dealings-prohibition and duty-to-determine obligations flow from the United Nations Act regulations, the Special Economic Measures Act, the Justice for Victims of Corrupt Foreign Officials Act and the Criminal Code. What the PCMLTFA adds is FINTRAC reporting on top: s. 7.1(1) requires a report to FINTRAC whenever the business must make a disclosure under Criminal Code s. 83.1 or a United Nations Act order or regulation (in force March 1, 2025), or under SEMA Part 1 or JVCFOA s. 7(2) (in force October 1, 2025). Separately, s. 7(c) requires a suspicious transaction report where there are reasonable grounds to suspect a transaction is related to a sanctions evasion offence, a term defined in PCMLTFA s. 2(1).

Three ministerial directives are in force under PCMLTFA s. 11.42: North Korea (December 9, 2017), Iran (July 25, 2020, amended February 15, 2024 and November 15, 2025) and Russia (February 24, 2024). Since November 15, 2025 the Iran directive applies to every person or entity referred to in PCMLTFA s. 5 — which includes MSBs — and it goes further than the other two: every Iran-connected transaction must also be reported to FINTRAC. Routine transaction reports beyond these — large cash and the like — carry thresholds and deadlines set in FINTRAC's reporting guidance; check the current version before writing them into procedures.