Factors, Financing and Leasing: the New Obligations

On April 1, 2025, FINTRAC obligations came into force for factors, cheque-cashing businesses, and financing or leasing entities — the Budget 2024 amendments, implemented by SOR/2025-68. The three arrivals were routed differently, and the routing matters. Cheque-cashing became a prescribed money services business service under PCMLTFR s. 29.1. Factors and financing or leasing entities did not: they are separate reporting-entity classes in their own right, brought in under PCMLTFA s. 5(i) and s. 5(j) respectively. A factoring company is not an MSB and does not follow the MSB rulebook — a common early misreading of these amendments.

PCMLTFR s. 24.1 provides that a factor is engaged in a business or profession for the purposes of s. 5(i) of the Act. 'Factor' is defined in PCMLTFR s. 1(2) as a person or entity engaged in the business of factoring — with or without recourse against the assignor. Structuring purchases as full-recourse arrangements does not change the analysis.

PCMLTFR s. 24.15 sets out when a financing or leasing entity is caught: when it is financing or leasing (a) property, other than real property or immovables, for business purposes; (b) passenger vehicles in Canada; or (c) property, other than real property or immovables, valued at $100,000 or more. These are independent branches — a deal only needs to hit one.

Applying the test is a product-line exercise. A lessor writing equipment leases on excavators for construction firms is looking at branch (a) — business-purpose property, with no value floor. A company leasing passenger vehicles in Canada is looking at branch (b), whether the lessee is a business or a consumer. A lender financing a $150,000 pleasure boat for personal use is looking at branch (c). Point-of-sale financing embedded at a retailer's checkout gets the same three review questions: is the financed property for business purposes, is it a passenger vehicle in Canada, does the value reach $100,000? Catalogue every product line against the three branches and document the analysis — that record is the foundation of everything that follows.

Once in scope, both classes carry the standard architecture. PCMLTFA s. 9.6(1) requires a compliance program; s. 9.6(2) requires it to include policies and procedures to assess money laundering and terrorist financing risk in the course of the business's activities; and PCMLTFR s. 156(1)(c) requires that risk to be assessed and documented. Note the bar is rising: a new PCMLTFA s. 9.6(1.1), in force March 26, 2026, will require the program to be 'reasonably designed, risk-based and effective' — a written binder that nobody follows will not meet that standard.

The sector-specific reporting and record-keeping provisions sit in PCMLTFR ss. 24.11–24.14 for factors and ss. 24.16–24.2 for financing or leasing entities, with identity verification in ss. 93.1 and 93.2 respectively. For the exact report types, filing deadlines and record retention periods that apply to each class, check the current FINTRAC guidance for these sectors. On the know-your-business side, verifying entity clients means confirming the entity exists and identifying the people behind it; the acceptable verification methods are set out in FINTRAC's identity-verification guidance, and for high-risk relationships PCMLTFR s. 157 expects client identification and s. 138 beneficial-ownership information to be kept up to date.

The prescribed risk factors in PCMLTFR s. 156(1)(c) are clients and business relationships; products, services and delivery channels; the geographic location of activities; and any other relevant factor (the affiliate-risk factor applies only to financial entities under PCMLTFA s. 5(a) to (g)). For a factor, the client factor is two-sided by nature: the assignor whose invoices you purchase, and the account debtors who pay them. A client with clean corporate records can still route fabricated receivables through cooperative or fictitious debtors, so the risk assessment should cover debtor concentration, debtor verification and invoice patterns — round-dollar invoices, volumes inconsistent with the client's operational scale, debtors in jurisdictions unrelated to the client's trade, sudden spikes before an advance request. Product design belongs in the assessment too: recourse versus non-recourse purchasing, notification versus non-notification arrangements, and remote onboarding each shift the risk picture.

Two precision points. First, 'new technologies' is not one of the enumerated s. 156(1)(c) factors — new developments and new technologies are handled by the separate pre-implementation assessment in PCMLTFR s. 156(2), which requires the risk to be assessed and documented before launch. An automated invoice-upload portal or instant-advance feature should go through that assessment before it goes live. Second, third-party determination in factoring needs care: the transaction is triangular by design (factor, client, debtor), so the question is not whether someone else appears in the payment flow — someone always does — but whether a person other than your client is actually directing the arrangement, such as an undisclosed principal supplying the invoices or receiving the advances. For the precise triggers and records for the third-party determination, check the current FINTRAC guidance.

Where the s. 9.6(2) assessment rates a client or relationship high risk, PCMLTFA s. 9.6(3) requires the prescribed special measures in PCMLTFR s. 157: written policies and procedures for enhanced identity verification and other enhanced mitigation, including keeping client identification and s. 138 beneficial-ownership information current and conducting ongoing monitoring of business relationships at a frequency matched to the risk. (A citation trap worth avoiding: the high-risk provision is s. 157, a single undivided section — not s. 156(2).)

Three ministerial directives are in force under PCMLTFA s. 11.42, covering North Korea, Iran and Russia — and as of November 15, 2025 the Iran directive applies to every person or entity referred to in s. 5, which includes these new classes. The common core: treat every transaction originating from or bound for those countries, regardless of amount, as high risk for s. 9.6(3) purposes; verify the identity of anyone requesting or benefiting from it; apply due diligence with particular attention to sanctions evasion; and keep a record regardless of amount — with the Iran directive additionally requiring all such transactions to be reported to FINTRAC. Sanctions exposure also carries reporting duties: PCMLTFA s. 7.1(1) requires reporting to FINTRAC when a disclosure is required under the sanctions statutes, and s. 7(c) requires a suspicious transaction report on reasonable grounds to suspect a sanctions evasion offence. A factor advancing against invoices from foreign debtors, or a lessor with cross-border equipment placements, should build these screens into onboarding and payment review.