Private ABM Acquirers: Registration, Records and Obligations

On October 1, 2025, the remaining regulations implementing the Budget 2023 and Fall Economic Statement 2023 amendments came into force and created obligations for acquirers of private automated banking machines (PABMs), alongside title insurers. The implementing regulations are SOR/2024-266 and SOR/2024-267. This was the last step in a wider expansion of Canada's regime: the mortgage sector came in on October 11, 2024, and factors, cheque-cashing businesses and financing or leasing entities on April 1, 2025 — so if you searched for ABM rules before late 2025 and found nothing, that gap is why.

The legal hook is in the Act itself. PCMLTFA s. 5(h)(iv.1) and (h.1)(iv.1) cover persons and entities engaged in the business of providing, "in relation to a private automated banking machine, acquirer services" — (h) for domestic businesses, (h.1) for foreign ones. "Private automated banking machine" is a defined term in PCMLTFA s. 2(1), and that statutory definition — not industry shorthand like "white-label ATM" — controls which machines and which acquiring arrangements are in scope. Read the definition before assuming a particular machine fleet is in or out.

A common misreading is to hunt for PABM acquiring in the prescribed-services regulation. Cheque-cashing did enter the regime that way — PCMLTFR s. 29.1 prescribes cheque-cashing (and crowdfunding platform) services for the purposes of PCMLTFA s. 5(h)(v) and (h.1)(v). PABM acquiring did not: it is written directly into the money services business definition at s. 5(h)(iv.1). The practical effect is the same — a business providing PABM acquirer services is an MSB (or foreign MSB) and must register with FINTRAC — but the drafting route matters when you are tracing your own obligations back to their source.

Registration is an administrative step with its own process, forms and renewal cycle; for the mechanics, check the current FINTRAC guidance. The more important point for a founder is that registration is the beginning of the obligation set, not the end of it: every registered MSB carries the full compliance-program, record-keeping and reporting framework described below.

PCMLTFA s. 9.6(1) requires every person or entity referred to in s. 5 to establish and implement a compliance program, and s. 9.6(2) requires that program to include policies and procedures to assess, in the course of the business's activities, the risk of a money laundering or terrorist activity financing offence. PCMLTFR s. 156(1)(c) then requires that risk to be assessed and documented against prescribed factors: clients, business relationships and correspondent banking relationships; products, services and delivery channels; the geographic location of activities; and any other relevant factor. (A fifth factor — affiliate risk — applies only to financial entities under PCMLTFA s. 5(a) to (g), so it does not reach a PABM acquirer.)

Note what is not on that list: "new technologies" is not an enumerated s. 156(1)(c) factor. New developments and new technologies are handled separately by PCMLTFR s. 156(2), which requires the risk assessment to be done and documented before a new development or technology that may affect clients, products, services, delivery channels or geography is introduced — directly relevant each time an acquirer adds a new machine type, site category or settlement flow. PCMLTFR s. 156(3) adds a two-year effectiveness review of the program. And from March 26, 2026, PCMLTFA s. 9.6(1.1) will require the program to be "reasonably designed, risk-based and effective" — a standard worth designing to now rather than retrofitting later.

Sector-specific record-keeping and know-your-client provisions for PABM acquirers include PCMLTFR s. 33(k). The full prescribed list of records, the identity-verification triggers and the retention periods are set out in the Regulations and FINTRAC's sector material — check the current FINTRAC guidance for the complete inventory rather than borrowing a record list from another MSB activity, because the prescribed records differ by service line.

Where the business considers a risk identified under PCMLTFA s. 9.6(2) to be high, s. 9.6(3) requires the special measures prescribed in PCMLTFR s. 157: written policies and procedures for taking enhanced measures, based on the assessed risk, to verify identity, and for any other enhanced mitigation — including keeping client identification information and s. 138 beneficial-ownership information up to date and conducting ongoing monitoring of business relationships (s. 123.1) at a frequency appropriate to the risk level. Two drafting traps: s. 157 is a single undivided section (there is no s. 157(2)), and PCMLTFR s. 156(2) is the new-technology pre-assessment, not the high-risk provision.

Becoming a PCMLTFA s. 5 entity puts a PABM acquirer inside the scope of the three ministerial directives currently in force under PCMLTFA s. 11.42: North Korea (in force December 9, 2017), Iran (in force July 25, 2020, amended February 15, 2024 and November 15, 2025 — and as of November 15, 2025 it expressly applies to every person or entity referred to in s. 5) and Russia (in force February 24, 2024). The common core: treat every financial transaction originating from or bound for those jurisdictions, regardless of amount, as high-risk for the purposes of s. 9.6(3); verify the identity of anyone requesting or benefiting from it; exercise customer due diligence with particular attention to sanctions evasion; and keep a record of the transaction regardless of amount. The Iran directive additionally requires reporting all such transactions to FINTRAC.

Sanctions list-screening itself is not mandated by the PCMLTFA — the freeze, dealings-prohibition and duty-to-determine obligations flow from the United Nations Act regulations, the Special Economic Measures Act, the Justice for Victims of Corrupt Foreign Officials Act and the Criminal Code. But the PCMLTFA bolts FINTRAC reporting onto that regime: s. 7.1(1) requires a report to FINTRAC whenever a disclosure must be made under Criminal Code s. 83.1, a United Nations Act order or regulation (reporting in force March 1, 2025), SEMA Part 1 or JVCFOA s. 7(2) (in force October 1, 2025), and s. 7(c) requires a suspicious transaction report where there are reasonable grounds to suspect a transaction relates to a sanctions evasion offence as defined in s. 2(1).