Ministerial Directives: The Obligation Without a Threshold

Most Canadian reporting obligations arrive the same way: a regulation sets a dollar threshold, you build a rule around it, and your system files when the rule trips.

Ministerial directives do not work like that, and the difference catches people out. A directive is issued by the Minister of Finance, not by FINTRAC, under Part 1.1 of the PCMLTFA. FINTRAC's role is narrower than people assume — it informs reporting entities that a directive has been issued, then monitors and assesses compliance with it, including through examinations.

So a directive is not guidance, and it is not something you opt into based on your own risk assessment. It is a live obligation that FINTRAC will examine you against, and it applies to every person or entity named in section 5 of the Act.

Directives impose countermeasures on transactions coming from or going to designated foreign jurisdictions or entities. FINTRAC is explicit about the boundary:

That sentence is reassuring and misleading in equal measure. Reassuring, because a directive will not invent an activity you have never had to think about. Misleading, because "enhance or add" is doing an enormous amount of work — as the next section shows, the enhancement is usually the removal of the threshold that made the obligation manageable.

Two other structural features matter:

• They do not expire. A directive specifies its in-force date and then "will remain in force until officially revoked, suspended or amended." There is no renewal event to prompt a review on your side.
• They are reviewed, not re-issued. FINTRAC says directives "will be reviewed at least every three years from the day they take effect." A review can amend the directive without any change to its name or headline date, which is exactly how a directive you read once in 2020 stops matching what you are actually required to do.

All three were updated within the last two years. If your compliance manual names these directives but has not been revisited since you wrote it, the odds are good that it describes an older version of at least one of them.

Note also what triggers them. The Russia directive does not wait for a Russian counterparty to announce itself — FINTRAC says to "consider the facts, contexts and indicators of a transaction," and gives examples including Russian addresses in EFT details, ruble deposits or exchanges, and ruble-denominated bank drafts. The DPRK directive runs the other way and does not apply where there is no suspicion or explicit connection.

This is the part worth internalising, because it is the part your systems are least ready for.

All three directives require you to treat every transaction connected to the jurisdiction as high risk regardless of its amount, to verify the identity of anyone requesting or benefiting from it regardless of amount, and to establish the source of funds, the purpose of the transaction, and the beneficial ownership of any entity involved.

The Russia directive then spells out the record-keeping consequence in dollar terms: keep EFT and virtual currency transfer records for transfers below $1,000, receipt and exchange records below $3,000, and large cash or virtual currency records below $10,000.

Every one of those numbers is a threshold your filing pipeline almost certainly uses as a floor. Under a directive it becomes irrelevant.

The Iran directive goes a step further than records and requires reporting of transactions in any amount. The mechanism is the detail that tends to be missed entirely.

That means a business can be filing diligently, on time, in the right report type, and still be non-compliant with the directive, because the reports carry no marker and FINTRAC cannot tell they were filed under it. Nothing in a normal validation pass catches that. Deadlines still apply underneath: five working days for EFTs and virtual currency, fifteen calendar days for large cash, and "as soon as practicable" for the extended obligations.

Failing to comply with a directive is not a paperwork slip. FINTRAC describes it as "a very serious offence" and the exposure runs on two tracks.

Administrative. The AMP regime extends to all directives. Since Bill C-12 came into force on 26 March 2026, the ceiling for a very serious violation by an entity moved from $500,000 to $20,000,000 per violation. Violations before that date are assessed under the previous regime, so the date of the conduct decides the exposure.

Criminal. Non-compliance with a directive's measures or reporting requirements is an offence: on summary conviction, up to $250,000 and/or two years less a day; on indictment, up to $500,000 and/or five years. FINTRAC notes that criminal and administrative penalties "cannot be pursued against the same instances of non-compliance", and that it may refer extensive non-compliance to law enforcement.

One published analysis of FINTRAC's penalty notices against MSBs between 2020 and 2025 found that five of the twenty-five penalised businesses — twenty percent — were cited for failing to comply with a ministerial directive. Treat that as indicative rather than official: it is a count of published notices by a third party, not a FINTRAC statistic. The direction it points in is still worth taking seriously, because a directive failure is rarely a single missed report. It is a rule that was never built, producing a contravention on every transaction it should have caught.

The pattern behind directive findings is consistent, and none of it is carelessness:

• It sits outside the threshold model. Every other obligation in the pipeline answers "is this over the amount?" A directive answers "is this connected to the jurisdiction?" — a different question, asked of different data.
• Jurisdiction connection is fuzzy. A ruble-denominated draft or a Russian address buried in EFT details is a detection problem, not a lookup.
• There is no renewal prompt. Directives persist silently and are amended without fanfare. Nothing in your calendar tells you the Iran directive changed in November 2025.
• Policies name directives without implementing them. Stating that you comply is not the same as having a rule that fires, a marker that is applied, and a record that proves both.

Practically: document how you determine a transaction is connected to each designated jurisdiction, build detection that does not depend on a dollar floor, apply the marker where one is required, and diarise a review of all three directives at least annually rather than every three years.

A ministerial directive does not give you a new report to file. It takes away the number that told you when to file, for one jurisdiction, indefinitely, and it is examined.

If your controls for Russia, Iran and the DPRK are a paragraph in a policy document rather than a rule in your monitoring and a marker on your reports, that is the gap — and since March 2026 it is a gap priced at up to twenty million dollars per violation.