FINTRAC STR Filing Guide 2026 for Canadian MSBs

What is a Suspicious Transaction Report (STR)?

A Suspicious Transaction Report (STR) is filed with FINTRAC when you have reasonable grounds to suspect that a transaction, or attempted transaction, is related to money laundering or terrorist financing. There is no minimum dollar threshold: if you have reasonable grounds for suspicion, you must file.

Of all the obligations a Canadian MSB carries, the STR asks the most of your judgment. File it promptly, file it well, document how you got there, and your record stays clean. Miss any of the three, and you have a violation.

STR Filing Requirements

What "As Soon as Practicable" Means

Unlike LCTRs (15 calendar days) or LVCTRs and EFTRs (5 working days), FINTRAC does not give STRs a fixed deadline. The legal obligation is to file as soon as practicable after you determine that reasonable grounds to suspect exist. That means as quickly as the circumstances reasonably allow: not when it suits you, and not after needless delay.

"As soon as practicable" is not a loophole. Examiners ask whether the time between forming suspicion and filing can be justified. Sitting on a known STR for weeks is a compliance failure in itself, even if the report is filed in the end.

Why an STR Can Fairly Take Time

An STR cannot always be filed the moment suspicion first stirs. FINTRAC accepts that some steps take time, provided each one is necessary, documented and done without needless delay.

Missing Customer Identification Is Not a Reason to Wait

You must take reasonable measures to verify the identity of anyone who conducts or attempts a suspicious transaction, and report any identifying information you obtain or already hold in your records. But FINTRAC does not treat incomplete KYC as a reason to hold the report: the STR form is designed to be submitted with the information you have. Pull what is already in your systems, then file. Do not ask the client for ID you would not normally request if doing so could tip them off to your suspicion.

Building Reasonable Grounds

Suspicion often builds slowly. One unusual transaction may look harmless on its own; then you read the customer's history (past transactions, account notes, patterns) and the picture comes into focus. Time spent confirming that reasonable grounds exist is time well spent. Filing before the grounds are there is a mistake. So is failing to file once they plainly are.

Internal Compliance Review

Most compliance programs require a senior compliance or AML officer to approve an STR before it is filed. That review (is the narrative complete, are the grounds documented, are the required fields right?) takes time, and rightly so. The danger is a review queue nobody tracks, where STRs wait weeks for a signature.

Complex or Multi-Party Transactions

Some STRs involve several transactions, several parties, or activity over several days. Tying the transactions together, naming every party and writing a narrative that explains the pattern takes longer than a simple single-transaction STR. That is expected. But the clock has been running since reasonable grounds were first formed.

Filing STRs on FINTRAC's Web Reporting System (FWR)

STRs are submitted through FINTRAC's Web Reporting (FWR) system. The form asks for a good deal of structured data (customer identification, transaction details, account information) and a detailed written narrative explaining the basis for suspicion. In practice, filling it in by hand for each STR is one of the largest sources of delay.

How Manual Entry in FWR Causes Delay

The FWR STR form is detailed. Before entering a single field, the compliance officer must gather the data, format it for FWR and write a clear narrative. The usual sources of avoidable delay:

• Hunting for customer ID that wasn't captured at the time of the transaction
• Reformatting dates, phone numbers and ID fields to match FWR exactly
• Writing the narrative from a blank page
• Starting a form, being pulled away, and coming back to a session that has timed out
• Finding halfway through that required information is missing, and abandoning the submission

How Quantoflow Shortens the Work

Quantoflow checks the STR data before your compliance officer opens FWR, so every required field is ready when they log in. The Chrome Extension then fills in the FWR STR form (as it does for CDRs) with the checked customer data, transaction details and narrative from Quantoflow.

• Checked data: missing or badly formatted fields show up before FWR is opened, so the form doesn't fail halfway through
• Chrome Extension: customer ID, amounts, dates, account details and party information filled in from Quantoflow's records
• Drafted narratives: in Quantoflow Cases, the narrative is drafted from the case evidence with each source cited, and carries into the STR without retyping; AI drafting is also available as a Report add-on. A person always reviews the STR before it is filed
• Deadline tracking: the clock starts when a transaction is flagged as suspicious, and the reminders grow more insistent as time passes
• Permanent audit trail: when suspicion was formed, who flagged it, who reviewed it and when it was filed, all on the record, so you can show your timeline to any examiner

What Your STR Must Include

FINTRAC requires the following in every STR submission:

• Full customer identification (name, address, ID type and number)
• Transaction details: amount, date, frequency, method
• A detailed, specific description of why you believe it is suspicious
• Third-party involvement, if applicable
• Account information and institution details
• Any supporting documentation

What Triggers an STR?

STR obligations are triggered when you have reasonable grounds to suspect:

• Potential money laundering: funds derived from criminal activity
• Terrorist financing: funds intended to support terrorist activity
• Structuring: transactions deliberately split to avoid reporting thresholds
• Unusual patterns inconsistent with a customer's known profile or business
• Unexplained large cash movements with no apparent legitimate purpose
• Cross-border transfers lacking a clear or credible business reason

STR Best Practices

• Record the moment suspicion forms: who noticed it, when, and what they saw. That timestamp starts your "as soon as practicable" clock
• Be specific in the narrative: exact amounts, dates, customer statements and the indicators that raised concern. "Unusual transaction" is not a narrative
• Review quickly: sign-off is proper, but an STR that waits two weeks in a queue is not filed "as soon as practicable"
• Don't tip off the customer: FINTRAC prohibits telling clients that an STR has been filed (tipping off is itself an offence)
• Review customer profiles regularly: an STR obligation can come from a pattern over time as well as from a single transaction
• Collect ID at the time of the transaction: with complete records on hand, nobody goes hunting when it is time to file

Enforcement and Penalties

FINTRAC is enforcing harder. Recent cases show that compliance failures, late or missing STRs above all, draw heavy administrative monetary penalties. In 2024–25 alone, FINTRAC issued 23 Notices of Violation with more than $25 million in total penalties, the highest annual volume since 2008.

Penalty ranges

Recent FINTRAC Penalties for STR Failures

These cases show the scale of penalties for STR failures:

• Xeltox Enterprises (Cryptomus), $176,960,190 (October 2025): 2,593 violations including 1,068 unreported STRs and failure to maintain effective compliance measures.
• MP Technology Services Ltd., $536,853.35 (December 2025): Failed to submit STRs for transactions with exposure to darknet marketplaces and sanctioned entities.
• KuCoin (Peken Global), $19,552,000 (September 2025): Unregistered foreign MSB with 33 unreported STRs linked to darknet marketplace activity.
• Juba Express Inc., $67,150 (December 2025): Multiple compliance failures including no effective compliance regime and failure to report suspicious transactions.

Bill C-12: Higher Maximum Penalties Are Now in Force

Bill C-12 (the Strengthening Canada's Immigration System and Borders Act) received Royal Assent and came into force on March 26, 2026. It raised the maximum penalties under the PCMLTFA by a factor of 40:

• Per violation: up to $20,000,000 for an entity and $4,000,000 for an individual (previously $500,000 and $100,000)
• Per notice of violation: capped at the greater of $20,000,000 or 3% of gross global revenue for an entity
• New tools: mandatory compliance agreements and compliance orders for violations committed after March 26, 2026

Violations that occurred entirely before March 26, 2026 are still assessed under the previous penalty amounts.

Frequently Asked Questions

Is there a minimum dollar amount for filing an STR?

No. STR obligations are based on suspicion, not transaction size. A small transaction can still require reporting if the facts and context support reasonable grounds to suspect.

Do attempted transactions need STR review?

Yes. Attempted transactions can be reportable where suspicion criteria are met. The transaction does not need to have completed for an STR obligation to arise.

What does FINTRAC expect in the suspicion narrative?

Clear facts, indicators, context, a timeline, and the reasoning that explains why suspicion was reached. Vague language like "transaction appeared unusual" is marked deficient in examinations.

Can software replace analyst judgment?

No. Whether reasonable grounds to suspect exist is a human judgment. Software brings consistency, speed and better evidence; the decision stays with your team.

What's the difference between an STR and other FINTRAC reports?

STRs are based on suspicion and have no monetary threshold or fixed filing deadline. LCTRs, LVCTRs, and EFTRs are threshold-based (dollar amount or count) with fixed deadlines (15 calendar days for LCTRs, 5 working days for LVCTRs and EFTRs). Each is independent: filing an STR does not satisfy other reporting obligations if they also apply.