FINTRAC STR Filing Guide 2026 for Canadian MSBs

What is a Suspicious Transaction Report (STR)?

A Suspicious Transaction Report (STR) is filed with FINTRAC when you have reasonable grounds to suspect that a transaction — or attempted transaction — is related to money laundering or terrorist financing. There is no minimum dollar threshold: if you have reasonable grounds for suspicion, you must file.

STRs are one of the most judgment-intensive compliance obligations for Canadian MSBs. Getting them right — promptly and with thorough documentation — is the difference between a clean regulatory record and a violation.

STR Filing Requirements at a Glance

"As Soon as Practicable" — What That Actually Means

Unlike LCTRs (15 days) or LVCTRs (24 hours), FINTRAC does not give STRs a fixed deadline. The legal obligation is to file as soon as practicable after you determine that reasonable grounds to suspect exist. This means as quickly as is reasonably possible given the circumstances — not at your convenience, and not after unnecessary delay.

"As soon as practicable" is not a loophole. FINTRAC examiners assess whether the time between forming suspicion and filing was justifiable. Unjustified delay — sitting on a known STR for weeks — is itself a compliance failure, even if the report is eventually filed.

Why STR Filing Legitimately Takes Time

There are genuine operational reasons why an STR cannot always be filed the moment suspicion first arises. FINTRAC recognizes that some steps take time — the key is that those steps are necessary, documented, and completed without unnecessary delay.

Gathering Complete Customer Identification

A complete STR requires verified customer identification — name, address, ID type and number. If a transaction was processed before full KYC was collected, your team may need time to retrieve or verify those records before the STR can be accurately completed. This is a legitimate reason for a brief delay, but it also underscores the importance of collecting ID at the point of transaction.

Building Reasonable Grounds

Suspicion sometimes emerges gradually. A single unusual transaction may look innocuous alone, but after reviewing a customer's history — cross-referencing past transactions, reviewing account notes, examining patterns — the picture becomes clear. The time spent confirming that reasonable grounds exist is justified. Rushing to file an STR before grounds are established, or failing to file after they clearly are, are both problems.

Internal Compliance Review

Most compliance programs require a senior compliance officer or AML officer to review and approve an STR before it is filed. This review step — checking that the narrative is complete, the grounds are documented, and the required fields are accurate — takes time and is entirely appropriate. The risk is when this review queue becomes a bottleneck with no tracking, and STRs sit for weeks awaiting sign-off.

Complex or Multi-Party Transactions

Some STR scenarios involve multiple transactions, multiple parties, or activity spanning several days. Documenting the full picture — tying together the transactions, identifying all parties, and writing a narrative that clearly explains the suspicious pattern — takes more time than a straightforward single-transaction STR. This is expected, but the clock is still running from the moment reasonable grounds were first formed.

Filing STRs on FINTRAC's Web Reporting System (FWR)

STRs are submitted through FINTRAC's Web Reporting (FWR) system. The form requires a significant amount of structured data — customer identification, transaction details, account information, and a detailed written narrative explaining the basis for suspicion. Completing this form manually for each STR is one of the biggest sources of delay in practice.

Why FWR Manual Entry Slows Down "As Soon as Practicable"

The FWR STR form is detailed. Compliance officers must gather all required data, format it correctly for FWR's fields, and write a clear narrative — before a single field is entered. Common friction points that cause avoidable delay:

• Hunting down customer ID records that weren't captured at the point of transaction
• Reformatting dates, phone numbers, and ID fields to match FWR's exact requirements
• Writing the suspicious activity narrative from scratch without a structured template
• Starting a form, getting pulled away, and returning to a session that has timed out
• Discovering mid-form that required information is missing and having to abandon the submission

How Quantoflow Removes the FWR Bottleneck

Quantoflow pre-validates all STR data before your compliance officer opens FWR. By the time they log in, every required field is ready. Our Chrome Extension then auto-populates the FWR STR form — the same way it works for CDRs — pulling validated customer data, transaction details, and pre-structured narrative fields directly from Quantoflow into the FWR form.

• Pre-validated data: Quantoflow surfaces missing or incorrectly formatted fields before FWR is ever opened — so the form session doesn't fail mid-completion
• Chrome Extension auto-population: Customer ID, transaction amounts, dates, account details, and party information filled automatically from Quantoflow's records
• Narrative templates: Structured prompts help your compliance officer write a complete, specific narrative quickly — covering what triggered suspicion, what the customer said, and what indicators were observed
• Deadline tracking: From the moment a transaction is flagged as suspicious in Quantoflow, the clock starts — with reminders escalating as the time since detection grows
• Immutable audit trail: The date and time suspicion was formed, who flagged it, who reviewed it, and when it was filed are all permanently recorded — giving you a defensible timeline for any FINTRAC examination

What Your STR Must Include

FINTRAC requires the following in every STR submission:

• Full customer identification (name, address, ID type and number)
• Transaction details — amount, date, frequency, method
• A detailed, specific description of why you believe it is suspicious
• Third-party involvement, if applicable
• Account information and institution details
• Any supporting documentation

What Triggers an STR?

STR obligations are triggered when you have reasonable grounds to suspect:

• Potential money laundering — funds derived from criminal activity
• Terrorist financing — funds intended to support terrorist activity
• Structuring — transactions deliberately split to avoid reporting thresholds
• Unusual patterns inconsistent with a customer's known profile or business
• Unexplained large cash movements with no apparent legitimate purpose
• Cross-border transfers lacking a clear or credible business reason

STR Best Practices

• Document the moment suspicion forms — record who identified it, when, and what was observed; this timestamp is the start of your "as soon as practicable" clock
• Be specific in your narrative — reference exact amounts, dates, customer statements, and the specific indicators that raised concern; "unusual transaction" is not a sufficient narrative
• Complete review quickly — internal sign-off is appropriate, but an STR sitting in a queue for two weeks awaiting approval is not "as soon as practicable"
• Don't tip off the customer — FINTRAC prohibits notifying clients that an STR has been filed (tipping off is itself an offence)
• Review customer profiles regularly — STR obligations can arise from patterns over time, not just individual transactions
• Collect ID at point of transaction — having complete customer records ready means no delay hunting for information when it's time to file

Enforcement & Penalties: The Cost of Non-Compliance

FINTRAC enforcement is intensifying. Recent penalties demonstrate that compliance failures — particularly delayed or missing STRs — result in significant Administrative Monetary Penalties. In 2024–25 alone, FINTRAC issued 23 Notices of Violation with more than $25 million in total penalties, the highest annual volume since 2008.

Recent FINTRAC Penalties for STR Failures

The following cases illustrate the scale of penalties for STR non-compliance:

• Xeltox Enterprises (Cryptomus) — $176,960,190 (October 2025): 2,593 violations including 1,068 unreported STRs and failure to maintain effective compliance measures.
• MP Technology Services Ltd. — $536,853.35 (December 2025): Failed to submit STRs for transactions with exposure to darknet marketplaces and sanctioned entities.
• KuCoin (Peken Global) — $19,552,000 (September 2025): Unregistered foreign MSB with 33 unreported STRs linked to darknet marketplace activity.
• Juba Express Inc. — $67,150 (December 2025): Multiple compliance failures including no effective compliance regime and failure to report suspicious transactions.

Bill C-2: Maximum Penalties Are Increasing Dramatically

Under Bill C-2 (tabled June 2025), maximum Administrative Monetary Penalties are proposed to increase significantly:

• Entities: Up to $20 million (previously $500,000) — a 40x increase
• Individuals: Up to $4 million (previously $100,000)
• Criminal penalties: Certain compliance failures can now result in criminal prosecution

Frequently Asked Questions

Is there a minimum dollar amount for filing an STR?

No. STR obligations are based on suspicion, not transaction size. A small transaction can still require reporting if the facts and context support reasonable grounds to suspect.

Do attempted transactions need STR review?

Yes. Attempted transactions can be reportable where suspicion criteria are met. The transaction does not need to have completed for an STR obligation to arise.

What does FINTRAC expect in the suspicion narrative?

Clear facts, indicators, context, timeline, and reasoning that explain why suspicion was reached. Vague language like "transaction appeared unusual" is flagged as deficient during examinations.

Can software replace analyst judgment?

No. Human assessment remains essential for determining reasonable grounds to suspect. Software supports consistency, speed, and evidence quality — but the decision rests with your team.

What's the difference between an STR and other FINTRAC reports?

STRs are based on suspicion and have no monetary threshold or fixed filing deadline. LCTRs, LVCTRs, and EFTRs are threshold-based (dollar amount or count) with fixed deadlines (15 days, 24 hours, etc.). Each is independent — filing an STR does not satisfy other reporting obligations if they also apply.