Fintech, crypto and AML regulatory digest: June 2026

At a glance

• FINTRAC imposed a $693,742.50 administrative monetary penalty on Necosmart (13010431 Canada Inc.) for five violations including failure to file suspicious transaction reports and 94 virtual currency record-keeping deficiencies.
• Two individuals were arrested and charged with theft, fraud over $5,000, and laundering proceeds of crime over $5,000 — the culmination of a five-year fugitive case involving an alleged $5M investor scam.
• The Bank of Canada issued a PSP reporting reminder on June 29 and announced it will begin publishing Notices of Violation, formalising RPAA enforcement into a visible public record.
• Switzerland updated its Syria sanctions list effective June 16 — all financial intermediaries must freeze affected assets and report to SECO without delay.
• FINMA confirmed its SRO-based AML supervision framework remains active and updated, with the recognised SRO list refreshed on July 2, 2026.

‍

June 2026 produced a clear pattern across both jurisdictions: regulators are moving enforcement into the open. In Canada, FINTRAC issued a $693,742.50 penalty against a virtual currency MSB, the RCMP concluded a five-year fugitive investigation with criminal charges for laundering and fraud, and the Bank of Canada signalled it will begin publishing payment supervision violations. In Switzerland, a Syria sanctions amendment required immediate action from all financial intermediaries. Each item below is drawn directly from source.‍

Canada: enforcement

What is a FINTRAC administrative monetary penalty? 

‍An administrative monetary penalty (AMP) is a financial sanction FINTRAC issues to businesses that fail to meet their obligations under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA). AMPs are published publicly and serve as a compliance reference for the broader MSB sector: each published case identifies the specific violations the regulator found and measured against.

‍FINTRAC imposes $693,742.50 penalty on Necosmart for MSB violations

FINTRAC issued an administrative monetary penalty of $693,742.50 against 13010431 Canada Inc., operating as Necosmart, on March 27, 2026. Necosmart is a money services business based in Edmonton, Alberta. The penalty covers five violations found during a compliance examination.

Violations found:

• Failure to submit suspicious transaction reports — 4 STRs not filed (very serious violation, PCMLTFA section 7)
• Failure to develop and apply written compliance policies and procedures — deficiencies in STR processes, KYC, and record-keeping
• Failure to apply enhanced measures to mitigate high-risk transactions and clients (PCMLTFA subsection 9.6(3))
• Failure to assess and document money laundering and terrorist financing risk (PCMLTFA subsection 9.6(1))
• Failure to keep prescribed records — 94 deficiencies in virtual currency exchange transactions (minor violation)

The Necosmart case is notable for two reasons. First, the scale: at $693,742.50, it is the largest FINTRAC AMP publicly listed for 2026 to date. Second, the virtual currency dimension: the 94 record-keeping deficiencies in virtual currency transactions signal that FINTRAC is actively examining crypto MSBs against the same documentation standards applied to traditional currency exchange.

RCMP arrests two fugitives after five-year manhunt on laundering and fraud charges

The RCMP arrested Fernando Honorate de Silva Fagundes, 70, and Emilia Alas-As Elansin, 44, in Algonquin Highlands, Ontario on May 26, 2026, following an unrelated call for service that led to their identification. The two had been wanted on Canada-wide warrants issued in November 2021 — nearly five years as fugitives.

Charges laid against each:

• Theft
• Fraud over $5,000
• Laundering proceeds of crime over $5,000

The underlying alleged conduct: misappropriation of approximately $5 million in investor funds between January 2019 and December 2020 through an Alberta-based day trading company. Fagundes is believed to have been involved in similar conduct in Portugal, the United States, Saskatchewan, and Ontario. The arrest was made by the RCMP Federal Policing Northwest Region's Integrated Market Enforcement Team in Calgary, with support from the Ontario Provincial Police.

The compliance implication is not in the arrest itself but in how five years of evasion ended: through an unrelated police contact, not through a financial intelligence report. That gap is what STR filing, beneficial ownership identification, and transaction monitoring are designed to close.

Canada: PSP and RPAA supervision

What is the RPAA?  The Retail Payment Activities Act (RPAA) is Canada's federal framework for supervising payment service providers (PSPs). Administered by the Bank of Canada, it requires PSPs to register, implement operational risk frameworks, safeguard end-user funds, and meet mandatory reporting obligations. Full supervisory scope came into effect on September 8, 2025.

‍Bank of Canada confirms active RPAA supervision expectations

The Bank of Canada issued a reminder on June 29 about PSP reporting obligations. On June 12, it announced that it will begin publishing Notices of Violation publicly. This formalises what was previously resolved through private compliance orders into a visible, searchable public record.

Under the RPAA, registered PSPs must:

• Establish a framework to manage operational risks
• Respond effectively to incidents
• Safeguard end-user funds in accordance with the RPAA and its regulations
• Submit annual reports and pay assessment fees (cost-recovery model: one-time registration fee plus annual assessment)
• Meet mandatory reporting requirements

PSPs that fail to maintain these requirements are now subject to published enforcement action. A revised compliance order was issued to XTM Inc. on February 27, 2026 — one of the first publicly documented enforcement cases under the RPAA.

PSP registry remains the reference point for registration status

The Bank of Canada maintains the public registry of registered PSPs, alongside a list of applicants and a list of refused or revoked registrations. Registration does not constitute endorsement: the Bank notes explicitly that registered PSPs remain subject to risk supervision and enforcement activities.

Entities must clear national security screening coordinated by the Department of Finance before registration is approved. The registry is searchable by legal name, trade name, head office country, and violations status. For businesses conducting due diligence on payment partners, or assessing their own registration status, the registry is the authoritative reference point.

Switzerland: AML and sanctions

What is a FINMA-recognised SRO?  A self-regulatory organisation (SRO) is a civil law body that supervises the AML compliance of non-bank financial intermediaries in Switzerland. Under Article 2(3) of the Anti-Money Laundering Act (AMLA), professional intermediaries must affiliate with a FINMA-recognised SRO. The SRO, not FINMA directly, supervises affiliated members on an ongoing basis, though FINMA retains oversight authority over the SROs themselves.

‍FINMA SRO framework confirmed as the primary AML supervision layer

FINMA updated its list of recognised SROs on July 2, 2026. The framework structure remains unchanged: non-bank financial intermediaries operating in Switzerland must be affiliated with a recognised SRO or hold direct FINMA supervision.

SROs are responsible for defining how their members implement AMLA due diligence requirements, including beneficial owner identification and money laundering suspicion reporting. SROs can impose penalties on members and, in serious cases, suspend them. FINMA conducts on-site inspections of SROs or delegates to qualified audit firms, and may withdraw SRO recognition if requirements cease to be met.

For crypto businesses pursuing a Swiss SRO membership — typically through VQF — the SRO framework sets the compliance baseline that must be in place before FINMA will engage on licensing questions.

Switzerland updates Syria sanctions list — financial intermediaries must act

Switzerland's State Secretariat for Economic Affairs (SECO) modified Annex 7 of the Ordinance on Measures against Syria (SR 946.231.172.7), effective June 16, 2026 at 23:00. The updated list of sanctioned persons, entities, and organisations was published on June 15, 2026.

Obligations for financial intermediaries:

• Implement all prohibitions set out in the Ordinance immediately upon its entry into force
• Freeze assets of sanctioned persons and entities
• Report affected business relationships to SECO

Where suspicious circumstances exist that cannot be resolved through investigation, a report must be filed with the Financial Intelligence Unit (MROS) per Article 9 of the AMLA.

The applicable sanctions database for Switzerland is SESAM (SECO Sanctions Management). Financial intermediaries must maintain live access to SESAM and screen both existing clients and new onboarding following each update.

What this means for regulated businesses

Three patterns emerged from June's regulatory activity across Canada and Switzerland.

Enforcement is becoming a public record.  FINTRAC's $693,742.50 penalty against Necosmart and the Bank of Canada's announcement that it will publish Notices of Violation both point in the same direction: compliance failures are moving into the open. Decisions that would previously have been resolved through private correspondence now carry reputational consequences alongside financial ones. For virtual currency MSBs specifically, the Necosmart case confirms that FINTRAC is applying the same documentation and reporting standards to crypto transactions as to traditional exchange.

RPAA supervision is operational, not transitional.  The Bank of Canada's June 29 reporting reminder and the February compliance order against XTM Inc. confirm that the RPAA is in active enforcement mode. PSPs that completed registration but have not built out their operational risk framework, incident response procedures, and safeguarding controls are exposed. Registration was the starting point, not the finish line.

Sanctions compliance requires operational infrastructure.  The Syria sanctions update is a reminder that sanctions screening is a continuous process, not a one-time check at onboarding. Financial intermediaries in Switzerland must have live access to SESAM, a documented screening process triggered by list updates, and a clear escalation path to SECO and MROS.

Frequently asked questions

‍

What triggers a FINTRAC administrative monetary penalty?

AMPs are issued when FINTRAC determines that a business has violated its obligations under the PCMLTFA. Common triggers include failures in suspicious transaction reporting, know-your-client procedures, record keeping, and risk documentation. The Necosmart case (March 2026, $693,742.50) shows the range: from very serious violations like missing STR filings to minor record-keeping deficiencies — each assessed separately and combined into a single penalty.

Which businesses must register under the RPAA in Canada?

The RPAA covers payment service providers that perform retail payment activities in Canada or for Canadian end-users. This includes businesses processing electronic funds transfers, providing payment accounts, or enabling payment transactions. Registration with the Bank of Canada is mandatory for in-scope entities.

What happens after a PSP registers with the Bank of Canada?

Registration does not end the compliance obligation. Registered PSPs remain subject to ongoing risk supervision, must submit annual reports, pay assessment fees, and maintain compliant operational risk frameworks and safeguarding arrangements. The Bank may issue compliance orders or Notices of Violation for failures identified during supervision.

What is the difference between MSB registration with FINTRAC and PSP registration with the Bank of Canada?

They are separate obligations under different frameworks. FINTRAC registration under the PCMLTFA applies to money services businesses and covers AML and counter-terrorist financing compliance. Bank of Canada registration under the RPAA applies to retail payment service providers and covers operational risk, fund safeguarding, and incident reporting. Many businesses will be subject to both.

Does joining a Swiss SRO satisfy FINMA AML requirements?

For non-bank financial intermediaries, including most crypto businesses operating under Swiss law, SRO membership is the primary route to AML compliance under the AMLA. The SRO supervises member firms on FINMA's behalf. FINMA retains ultimate authority and conducts its own oversight of the SROs. SRO membership does not replace the need for a robust internal AML programme.

What is SESAM and when must it be used?

SESAM is Switzerland's official sanctions management database, operated by SECO. Financial intermediaries must screen clients and transactions against SESAM to identify sanctioned persons and entities. When a match is found, the intermediary must freeze the relevant assets and report to SECO. SESAM is updated when Switzerland adopts or amends sanctions ordinances.

What must a Swiss financial intermediary do when a new sanctions list is published?

The intermediary must immediately screen existing clients and new onboarding against the updated list, freeze any assets belonging to newly listed persons or entities, and report affected relationships to SECO. Where suspicious circumstances remain after investigation, a separate report must be filed with MROS under Article 9 of the AMLA.

Does FINTRAC publish the details of administrative monetary penalties?

Yes. FINTRAC publishes the full penalty notice for each AMP, including the entity name, penalty amount, penalty date, and each violation with its legal reference and severity classification. The Necosmart notice, for example, lists five violations individually with the specific number of missing STRs and the count of record-keeping deficiencies. Published cases are a practical compliance benchmark for the broader MSB sector.

Key resources

‍This digest is provided for informational purposes only and does not constitute legal or regulatory advice. Regulatory frameworks change. Verify all details against the primary sources cited before making compliance or licensing decisions.

If you are preparing to enter regulated markets in Canada or Switzerland and need to understand how these developments affect your structure, licensing path, or banking approach, DM Strategy works with fintech and crypto founders on exactly these decisions. Start with a readiness assessment at dmstrategy.io.

‍