Two reports landed in the last week of October, and a speech from earlier in the month explains what they mean. Read together, they tell financing and leasing businesses more than any one of them does alone.
- On October 26, FINTRAC published its 2025–26 Annual Report: record penalties, a record number of compliance activities, and the first full year in which financing or leasing entities were covered.
- On October 29, the Auditor General tabled an audit of FINTRAC that found its compliance oversight wanting.
- On October 9, FINTRAC's Deputy Director of Supervision told an industry conference where the new supervision money is going. Leasing and financing companies are on the list by name.
What the annual report says about enforcement
The headline numbers from the report and FINTRAC's results by the numbers:
- 35 notices of violation in 2025–26, up 52% on the year before, for more than $247 million. The year before that was 23 notices for $25 million. Most of the dollar jump is one $176 million penalty, the largest in FINTRAC's history, on a virtual currency money services business. But the report says the count was also a record: "the highest number and largest amount of administrative monetary penalties levied in a single year."
- 4,874 assessment and monitoring activities, also a record, including 625 targeted examinations and information demands and 89 full-scope examinations.
- 82 money services businesses had their registrations revoked, up from
All of that was under the old penalty schedule. The report's opening message reminds readers that the Bill C-12 changes in force since March 2026 raised penalties "by up to 40 times the current amounts, making it clear that businesses will not be allowed to treat non-compliance as a cost of doing business," and added public compliance orders backed by penalties of up to $30 million or 3% of global revenue.
Where financing and leasing sits in that picture
So far, not in the exam numbers. The report lists financing or leasing entities among the sectors "newly covered" in 2025–26, alongside cheque cashers, factors, title insurers and private ATM acquirers. What the report describes doing for them that year is guidance: 17 "targeted guidance initiatives" aimed at new sectors, with financing and leasing businesses named.
The examinations went elsewhere. More than 55% of all assessment work targeted money services businesses. The 89 full-scope exams went mostly to precious metals dealers (34), real estate (29) and mortgage brokers (9). FINTRAC doesn't break out a financing or leasing figure at all.
The mortgage sector, covered since 2024, shows what the next stage looks like. In 2025–26, mortgage brokers received more self-attestations (222) and more risk questionnaires (218) than any other sector, plus 9 full-scope examinations. The October 9 speech says financing and leasing is heading the same way. FINTRAC's supervision budget goes from roughly $60 million in 2025–26 to about $85 million this fiscal year, and one of the four things the extra money is for is to:
"Supervise newer sectors, such as mortgage lenders, leasing and financing companies, and factoring companies"
Another is to implement the Bill C-12 programs, "including a new administrative monetary penalty framework and a universal enrolment program." The same speech calls universal enrolment "a game changer for us." Once it is switched on, FINTRAC will have a list of every financing and leasing business it supervises, and won't have to find them first.
Why the Auditor General's audit matters to you
Most coverage of the Auditor General's report was about slow intelligence to police. The part that affects reporting businesses is the chapter on supervision, and its overall conclusion is blunt: FINTRAC "did not effectively carry out its role in overseeing compliance with Canada's anti-money laundering laws."
The reasoning goes like this. By the auditors' count, about 36,000 businesses were under FINTRAC's supervision, and the audit charts the sectors added since 2020, with "financing and leasing entities" among those added in 2025. To keep up, FINTRAC leaned on light-touch assessments, mainly self-attestations and risk questionnaires. The audit found that these "relied largely on reporting entities providing accurate and honest information," that FINTRAC "had limited ability to verify the information it received," and that they gave "a lower level of assurance" than examinations. On the auditors' own scale, a self-attestation gives the lowest confidence of any assessment type.
The recommendation is that FINTRAC "develop and implement procedures to verify the information submitted by reporting entities in higher-risk sectors." FINTRAC agreed. Its formal response says answers to self-assessments and questionnaires, "including responses that deviate from expectations or demonstrate other red flags," already feed into decisions on "follow-up supervisory activity or enforcement action," and that it will add "a formal procedure to further standardize these verification activities."
These tools are aimed at businesses like yours. The annual report counts 812 self-attestations and 984 risk questionnaires last year, and says FINTRAC focuses self-attestations on, among others, "entities with no previous compliance history," using them to identify "higher-risk businesses for more intrusive supervisory activities." The audit shows those answers haven't been easy to check. Its recommendation, and FINTRAC's commitment, are that they will be. Treat every answer you give FINTRAC as one you may have to back up with documents. If you tick "yes, we have a documented risk assessment," expect an examiner to ask to see it.
Auto theft is in the report too
One more passage is worth a dealer's attention. FINTRAC made 27 disclosures to police in support of auto theft investigations last year. It singles out two cases. In Project Chickadee, a joint OPP and CBSA investigation into a network moving stolen vehicles overseas, police seized "306 stolen vehicles valued at approximately $25 million." In Project Credit, Halton police charged four people accused of running a GTA car theft network and "chop shop" and re-VINning stolen vehicles.
Proceeds of auto crime have to end up somewhere, and a vehicle bought, financed or leased with them can pass through a business like yours. That is the kind of activity a suspicious transaction report is for, and FINTRAC can only act on what someone reports.
What to do with this
The clearest instruction came in the October 9 speech. Businesses should "know your risks, document them clearly and make sure they are driving your compliance program." That is a description of what an examiner checks, so check it yourself first:
- Open your risk assessment. If it was written once and hasn't been touched since, date a review now. A document that names your real clients, products, payment channels and geography beats a generic template every time.
- Check that the program matches it. Every high-risk category in the assessment should map to something you actually do differently: more ID checks, a source-of-funds question, a second sign-off.
- Pull five recent deal files and see whether an outsider could tell, from the file alone, that the client was identified and screened. Our piece on how an examination works walks through what they ask for.
If you'd rather see the gaps laid out for you, our free 12-item readiness checklist turns your answers into a gap report.
Sources: FINTRAC, 2025–26 Annual Report and news release (October 26, 2026); results by the numbers 2025–26; speaking notes for Tina Matos, Deputy Director of Supervision (October 9, 2026); Office of the Auditor General of Canada, FINTRAC's Activities to Combat Money Laundering (Report 21, October 29, 2026), and FINTRAC's statement on the audit. This post summarizes public reports and is not legal advice.