The Other Reporting Entities, at a Glance

PCMLTFA s. 5 is the single list that decides whether a business is a FINTRAC reporting entity at all. Identification, record-keeping, reporting and the compliance program all flow from landing on that list — but the Act only names the classes. The regulations (PCMLTFR) then tailor when each sector's obligations switch on and what it must document, which is why two businesses on the same roster can owe very different day-to-day work.

The widest coverage belongs to financial entities — the institutions referred to in paragraphs 5(a) to (g). Their obligations run across the whole business rather than activity-by-activity, and they carry one risk-assessment factor no other sector does: PCMLTFR s. 156(1)(c)(iv) requires financial entities in paragraphs 5(a) to (g) to assess risk arising from the activities of affiliated entities. Fintech teams fielding due-diligence questionnaires from a partner institution are usually seeing that institution work through its own s. 156(1)(c) assessment.

Securities dealers sit on the institution-based side, like financial entities: once a firm is in the class, the full suite — compliance program, client identification, records and reporting — applies across the trading business, not to isolated transactions.

Three sectors are activity-triggered instead. Accountants and accounting firms come onto the roster only when they carry out certain transactions on a client's behalf — moving client funds or executing purchases and sales for a client — not for audit, review or tax work as such. Real estate developers pick up obligations around sales of new builds to the public, with volume-based triggers defined in the regulations; brokers and sales representatives are on the roster through their own sector paragraphs. Dealers in precious metals and stones are pulled in by large cash or virtual-currency transactions in the trade. The exact trigger lists and dollar lines are sector-specific and not restated here — check the current FINTRAC guidance for your sector before relying on any summary.

Life insurance obligations are organized around particular products and transaction types rather than the whole book of business, so a life insurer's AML footprint is narrower than a deposit-taking institution's. Casinos carry the heaviest transaction-reporting load on the roster, including casino-specific reports — a useful calibration point for non-casino readers on what the maximum obligation set looks like.

The mortgage sector — mortgage administrators, mortgage brokers and mortgage lenders — became reporting entities on October 11, 2024, through SOR/2023-194, which added PCMLTFR ss. 64.1–64.6 and hooks the sector into PCMLTFA s. 5(i). Note that this date now appears on FINTRAC's mortgage sector requirements page, not its general changes page.

On April 1, 2025, three more classes came into force under SOR/2025-68 — and their classification differs in a way that matters for registration. Cheque-cashing businesses are covered as money services businesses: PCMLTFR s. 29.1 prescribes cheque-cashing services (alongside crowdfunding platform services) for PCMLTFA s. 5(h)(v) and (h.1)(v), so a cheque-casher registers with FINTRAC as an MSB. Factors are not MSBs — PCMLTFR s. 24.1 makes a factor a reporting entity in its own right under PCMLTFA s. 5(i), covering factoring with or without recourse (s. 1(2) definition), with obligations in ss. 24.11–24.14 and identity verification under s. 93.1. Financing or leasing entities are likewise a separate class under PCMLTFA s. 5(j): PCMLTFR s. 24.15 captures financing or leasing of property other than real property for business purposes, passenger vehicles in Canada, or property valued at $100,000 or more, with obligations in ss. 24.16–24.2 and s. 93.2.

On October 1, 2025, the remaining classes arrived. Acquirers of private automated banking machines are written directly into the Act's MSB definition — PCMLTFA s. 5(h)(iv.1) and (h.1)(iv.1), with 'private automated banking machine' defined in s. 2(1) and related record-keeping in PCMLTFR s. 33(k). Title insurers came in through SOR/2024-267, which added PCMLTFR ss. 64.7–64.8 and 102.2.

Whatever the doorway, the centre is the same. PCMLTFA s. 9.6(1) requires every person or entity referred to in s. 5 to establish and implement a compliance program, and s. 9.6(2) requires that program to assess money laundering and terrorist financing risk in the course of the business's activities. PCMLTFR s. 156(1)(c) makes that assessment a documented exercise against enumerated factors: clients, business relationships and correspondent banking relationships; products, services and delivery channels; the geographic location of activities; affiliate risk for the s. 5(a)–(g) financial entities; and any other relevant factor. New technologies are deliberately not on that list — a new development or technology that may affect clients, products, channels or geography triggers the separate pre-implementation assessment in s. 156(2), done before launch. The two-year program effectiveness review sits in s. 156(3).

Where the entity considers a s. 9.6(2) risk to be high, PCMLTFA s. 9.6(3) requires the special measures prescribed in PCMLTFR s. 157: written policies and procedures for enhanced identity verification and other enhanced mitigation, including keeping client identification and s. 138 beneficial-ownership information up to date and conducting ongoing monitoring of business relationships (s. 123.1) at a frequency appropriate to the risk. From March 26, 2026, PCMLTFA s. 9.6(1.1) adds that the program must be 'reasonably designed, risk-based and effective' — worth documenting not just what the program does, but why its design fits the assessed risk.

Three ministerial directives issued under PCMLTFA s. 11.42 are in force: North Korea (December 9, 2017), Iran (July 25, 2020, amended February 15, 2024 and November 15, 2025 — since the latter, expressly applying to every person or entity referred to in s. 5) and Russia (February 24, 2024). Their common core binds the whole roster: treat every financial transaction originating from or bound for those countries, regardless of amount, as high-risk for the purposes of s. 9.6(3); verify the identity of anyone requesting or benefiting from it; apply customer due diligence with particular attention to sanctions evasion (source of funds or virtual currency, purpose, beneficial ownership); and keep a record regardless of amount. The Iran directive additionally requires reporting all such transactions to FINTRAC and imposes correspondent-banking measures on the entities described in s. 9.4(1).

Sanctions screening itself is not mandated by the PCMLTFA or PCMLTFR — the freeze, dealings-prohibition and duty-to-determine obligations flow from United Nations Act regulations, the Special Economic Measures Act, the Justice for Victims of Corrupt Foreign Officials Act and the Criminal Code. But the PCMLTFA bolts FINTRAC reporting onto that regime: s. 7.1(1) requires a report to FINTRAC whenever a disclosure is required under Criminal Code s. 83.1 or a United Nations Act order or regulation (in force March 1, 2025), or under Part 1 of the SEMA or JVCFOA s. 7(2) (in force October 1, 2025), and s. 7(c) requires a suspicious transaction report where there are reasonable grounds to suspect a transaction relates to a sanctions evasion offence as defined in s. 2(1). Every class on the s. 5 roster carries these overlays, from casinos to title insurers.