Cryptomus Hit with Record $177M Fine by FINTRAC

A cryptocurrency exchange has been hit with a record-setting fine of nearly $177 million by Canada’s financial intelligence agency for multiple compliance failures, including not reporting more than 1,000 transactions tied to suspected criminal activity. The Financial Transactions and Reports Analysis Centre of Canada (Fintrac) announced the penalty against Xeltox Enterprises Ltd., which does business as Cryptomus and was previously known as Certa Payments Ltd., on Wednesday.

The $176,960,190 penalty surpasses Fintrac’s previous largest fine—about $20 million, issued to Peken Global Ltd., the operator of KuCoin, in September. Fintrac director and CEO Sarah Paquet said the scale of the enforcement action was driven by the gravity of the alleged violations, many of which reportedly involved trafficking of child sexual abuse material, fraud, ransomware payments and evasion of international sanctions.

Thousands of unreported crypto transactions

Fintrac’s findings identify 1,068 instances in July 2024 where Cryptomus failed to file required reports for transactions connected to known darknet markets and virtual wallets with suspected links to criminal operations. Darknet markets are online platforms often used for illicit trade, and virtual currencies can obscure the identity of users, making both attractive vehicles for money laundering and other illegal activity.

In addition, Fintrac said Cryptomus did not report 7,557 transactions originating from Iran between July 1 and Dec. 31, 2024. Under ministerial directives addressing financial activity tied to the Islamic Republic of Iran, those transactions should have been treated as high risk. Cryptomus was required to verify sender and beneficiary identities, carry out enhanced due diligence, retain full transaction records and submit reports to Fintrac—none of which, according to the agency, were adequately performed.

Fintrac also found 1,518 large transfers in July 2024 that exceeded the $10,000 reporting threshold for virtual currency transfers; these transfers went unreported as well. The agency noted that Cryptomus’s policies and procedures were incomplete and inadequate, creating persistent gaps in ongoing monitoring and know-your-client (KYC) obligations.

Case highlights growing regulatory scrutiny

Adam Garetson, partner and head of the digital assets group at Gowling WLG, said the size of the fine reflects both the seriousness of the alleged misconduct and its breadth. “The alleged non-compliance is significant in volume, and it includes transactions that appear directly linked to criminal activity and regular flows to sanctioned jurisdictions,” he said. “Those are particularly egregious allegations.”

Garetson noted that the wider Canadian crypto market has generally moved toward compliance with anti-money laundering (AML) rules and securities regulations. Still, the Cryptomus penalty comes amid increasing support—domestic and international—for heavier fines and tougher enforcement to deter illicit finance in the crypto sector.

Whether Fintrac can collect the full penalty may depend on the company’s ties to Canada. Xeltox is incorporated in British Columbia but appears to have limited operations or employees based in the country, raising questions about recoverability. Garetson added that international cooperation among AML regulators is improving, which could raise the likelihood of enforcement and recovery across borders.

Paquet said Fintrac remains committed to working with domestic partners and international allies to protect Canadians and strengthen the integrity of the financial system.

A record year for enforcement

Under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act, a wide range of businesses—including banks, crypto platforms, real estate professionals and casinos—must keep records, identify clients, establish compliance programs and report certain transactions to Fintrac. Cryptomus has faced other measures: the B.C. Securities Commission imposed a temporary ban in May on the firm’s trading of securities and market activities.

Fintrac issued 23 violation notices in 2024–25 to businesses that failed to comply, marking the most notices in a single year since the agency acquired fining authority. Those notices led to more than $25 million in penalties during that period. Since gaining legislative power to impose sanctions in 2008, Fintrac has levied more than 150 penalties against non-compliant entities.