Suspicious Indicators by Business Model

Every indicator list, whatever the sector, rolls up to a single statutory test. PCMLTFA s. 7 requires a report to FINTRAC where there are reasonable grounds to suspect that a transaction — completed or merely attempted — is related to a money laundering offence, a terrorist activity financing offence, or, as of August 19, 2024, a sanctions evasion offence. There is no monetary threshold: a $40 transaction can require a suspicious transaction report (STR), and a $400,000 one may not. The timing rule sits in the regulations, not the Act: the STR goes in as soon as practicable after you have taken the measures that let you establish reasonable grounds to suspect (SOR/2001-317 s. 9(2)).

Indicators are how that abstract test becomes concrete for a specific business model. They are not violations in themselves — one indicator is a prompt to look closer; a cluster of them, unexplained after review, is usually what pushes a file over the reasonable-grounds line. FINTRAC publishes and updates sector indicator lists; for current wording, check the current FINTRAC guidance on reporting suspicious transactions.

At a money services business (sector reporting obligations sit in PCMLTFR s. 30; s. 33 for foreign MSBs), the recurring pattern is structuring around the CAD $10,000 cash threshold. A customer who exchanges $9,500 three days in a row, or splits one amount across two tellers in an afternoon, is behaving exactly the way the 24-hour rule anticipates: PCMLTFR s. 126 deems two or more cash receipts totalling $10,000 or more within 24 consecutive hours a single transaction, reportable as a large cash transaction within 15 days (s. 132(3)). Conduct that appears designed to stay under a reporting threshold is also a classic prompt for STR analysis — and the STR itself has no threshold.

Other patterns MSB teams commonly escalate: several apparently unrelated senders remitting to the same beneficiary (the same-beneficiary aggregation lens exists precisely because this is a known typology); customers reluctant to explain the source of cash; and a customer who abandons the transaction the moment routine questions start. That last one matters more than teams expect — attempted transactions are expressly within the s. 7 reporting obligation.

For businesses dealing in virtual currency, the threshold mechanics mirror cash: receiving VC equivalent to CAD $10,000 or more triggers a Large Virtual Currency Transaction Report, and PCMLTFR s. 129 aggregates VC receipts totalling $10,000 or more within 24 consecutive hours. The deadline is the common trap: the LVCTR is due within five working days (s. 132(2)), not the 15 days practitioners carry over from the LCTR.

On the suspicion side, patterns compliance teams typically escalate include a new client funding an account from many unconnected external wallets and consolidating quickly, requests to split a conversion into pieces that each sit just under $10,000, and indifference to unfavourable rates or fees when speed of movement seems to be the point. FINTRAC's published virtual-currency indicators go deeper than any summary can; treat the current FINTRAC guidance as the authoritative list and map each indicator to a signal your platform actually captures.

A payments business watches two populations. On the merchant side, the strongest signal is drift from the onboarding profile: a business that described itself as low-ticket domestic retail suddenly processing large cross-border volume, refund ratios that stop resembling the stated model, or settlement instructions redirected to accounts with no visible link to the merchant. None of these alone establishes suspicion — the question is whether the pattern still makes commercial sense once you ask.

On the transaction rails, remember what is and is not threshold-reportable. International electronic funds transfers of CAD $10,000 or more are reportable at both initiation and final receipt within five working days (PCMLTFR s. 132(1)), with 24-hour aggregation under ss. 127–128. Domestic transfers are not threshold-reportable regardless of amount — but a purely domestic pattern can still ground an STR, because suspicion has no rail restriction. When applying the 24-hour rule, assess the three lenses separately — same conductor, same third party, same beneficiary — and only merge groupings into one report when the transactions in them are identical.

Support and front-line teams see what transaction monitoring cannot: a customer asking how to avoid "the paperwork," probing limits before transacting, or hanging up when asked for identification. Effective training gives agents three verbs — recognize, record, route — and explicitly removes a fourth: resolve. Agents should capture what was asked and answered as close to verbatim as possible, note what felt inconsistent, and pass it to the compliance function; the reasonable-grounds judgment belongs there, not on the call.

Two guardrails belong in every script. First, disclosure: PCMLTFA s. 8 prohibits disclosing that an STR has been or will be made, or its contents, with intent to prejudice a criminal investigation — and the operational rule most businesses adopt is simpler and safer: front-line staff never tell a customer that anything was flagged or reported. Second, escalation lanes: a suspected match to a listed person or entity is not an STR matter — it triggers the Listed Person or Entity Property Report under PCMLTFA s. 7.1, which FINTRAC guidance says must be submitted immediately, so support scripts should route those cases to the compliance officer without delay.