Bill S-8 2nd reading · Senate

Combatting Financial Crimes and Drug Trafficking Act

Amends the Proceeds of Crime (Money Laundering) and Terrorist Financing Act to add rules for virtual currency ATMs (record-keeping, identity verification, reporting, and a $1,000 daily limit), prohibit most third-party cash deposits, and allow certain reporting entities to collect personal information without consent when it comes from government or law enforcement for anti-money-laundering purposes. Part 2 amends the Canada Post Corporation Act to allow mail items to be demanded, seized, detained or retained under the Criminal Code, the Controlled Drugs and Substances Act, or the Cannabis Act.

Governance

Sponsor · Hon. Pierre Moreau

What it means for you

Virtual currency ATM users would face identity checks and a $1,000 daily cap, and banks and other institutions could share and use your personal information with less notice to you. Mail sent through Canada Post could be seized or held by police in drug or criminal investigations.

No debate summary yet — we'll add the for/against once this bill is debated.

Where do you stand on this bill?

You are reading this in full, for free. An account is what lets you act on it.

A free account lets you record where you stand, see how your MP voted, email them about it, and get a summary of what matches you — daily, weekly, monthly, or not at all.

Share this bill View full bill on LEGISinfo ↗

Demos deep analysis

What this bill does

Bill S-8 tightens Canada's anti-money-laundering and financial crime rules in two main ways. First, it adds new requirements for crypto ATM operators, cash-handling businesses, and financial firms registered with the federal financial intelligence agency (FINTRAC). Second, it lets police seize mail under drug and criminal laws without running into a legal barrier in the Canada Post Act. Most Canadians will feel this indirectly — through changes at their bank, at crypto kiosks, or in how mail is handled by law enforcement. People who run money services businesses, operate crypto ATMs, or handle large cash transactions will feel it directly.

What changes

7 See all 7 changes Hide

1 New law name Affects almost no one directly

This affects almost no one directly. It is a naming clause only.

Parliament gives this package of changes a formal short title: the Combatting Financial Crimes and Drug Trafficking Act.
No new duties or rights are created by this clause alone.

Sources in the bill: Clause 1

2 New rules for crypto ATMs, cash deposits, and financial-sector registration Affects crypto ATM users, crypto ATM operators, banks, money services businesses, charities, any business accepting large cash payments

This affects you if you use a crypto ATM, operate one, run a business or charity that accepts large cash payments, work at a bank or money services company, or are applying to register with FINTRAC.

Crypto ATM operators must record every transaction their machines process, in line with regulations.
Crypto ATM operators must verify the identity of every person who uses their machine, in line with regulations.
Crypto ATM operators must report every transaction to FINTRAC (Canada's financial intelligence agency) within 15 days, including the machine's ID number, wallet addresses, and the user's name, address, and date of birth.
Crypto ATM operators must cap each user at $1,000 in transactions per 24-hour period on any single machine.
Crypto ATM operators must give FINTRAC up-to-date details about each machine: location, brand, serial number, cash source, and the wallet address used to run it.
Banks and similar institutions must refuse cash deposits into an account from anyone who is not the account holder or authorized to give instructions on that account, except in prescribed cases.
Banks and similar institutions must not open or maintain an account for a crypto ATM operator unless that operator is registered with FINTRAC.
Anyone engaged in a business, profession, or public fundraising must not accept a cash payment, donation, or deposit of $10,000 or more in a single transaction, with fines on conviction of up to three times the amount accepted. Banks and certain regulated entities are exempt.
Knowingly operating, hosting, loading cash into, or collecting cash from an unregistered crypto ATM is a criminal offence. On indictment (a more serious court process), fines reach up to $5,000,000 or up to five years in prison, or both.
FINTRAC must deny a registration application if it has reasonable grounds to believe the applicant gave false or misleading information, including by leaving something out.
FINTRAC must revoke an existing registration on the same grounds.
Five new reasons make a business ineligible to register with FINTRAC, including being subject to a compliance order without making real progress, or acting on behalf of a previously rejected applicant.
Newly registered businesses must confirm within 90 days whether they have started their registered activities and list their bank accounts. If they miss this deadline, they are treated as having stopped all registered activities.
Newly registered businesses must notify FINTRAC at least 30 days before starting any new activity that requires registration.
The Finance Minister gets new powers to review any registration for national security or financial-system integrity reasons, to impose conditions or orders on registrants, and to bar a class of applicants from registering for a set period. These ministerial directives and orders are not subject to the standard rules that apply to government regulations.
The Finance Minister can issue a temporary order restricting a registrant's activities without first hearing from them, if waiting would harm the public interest. The order lasts up to 30 days and can continue if the registrant does not respond.
A business denied registration because of a ministerial directive cannot appeal to FINTRAC's Director. It may apply to the Finance Minister for a review within 30 days.
Banks and regulated businesses may collect and use a person's personal information without that person's knowledge or consent if the RCMP or a prescribed government agency shares it for detecting money laundering, terrorist financing, or sanctions evasion. The business must not use that information to interfere with a criminal investigation. No lawsuit can be brought against a business that does this in good faith.
The ownership-disclosure threshold in registration applications drops from 20% to 5%, meaning anyone owning or controlling 5% or more of a registrant must now be disclosed.

Sources in the bill: Clause 2(1)Clause 2(2)Clause 4Clause 5Clause 6Clause 7Clause 8Clause 9Clause 10Clause 11Clause 12Clause 13Clause 14Clause 15Clause 16Clause 17Clause 18Clause 20Clause 21Clause 23(1)Clause 23(2)Clause 23(4)Clause 24Clause 25Clause 26Clause 27Clause 28Clause 29Clause 30Clause 31Clause 32Clause 33Clause 34Clause 35

3 Privacy law updated to allow covert information sharing Affects banks, money services businesses, anyone whose data may be shared with financial institutions by police

This affects you if your personal information is held by a bank or money services business and may be shared with that business by police or a government agency without your knowledge.

Canada's federal private-sector privacy law (PIPEDA) is updated to allow regulated financial businesses to collect and use a person's personal information without their knowledge or consent, when that information is shared by the RCMP or a prescribed agency for detecting money laundering, terrorist financing, or sanctions evasion.
A person whose information is collected this way cannot demand to see it under the normal access rules that apply to covertly collected information.

Sources in the bill: Clause 37(1)Clause 37(2)Clause 38

4 Regulatory definitions updated Affects businesses registered under anti-money-laundering rules

This affects you if you are a compliance officer or legal adviser working under Canada's anti-money-laundering regulations. The practical meaning of the terms does not change.

The regulations under the anti-money-laundering law are updated so that the definitions of 'shell bank' (a foreign bank with no real physical office) and 'virtual currency' now apply to both the law and its regulations, removing a duplication.

Sources in the bill: Clause 39

5 Registration rules: new deadlines and lower disclosure threshold Affects businesses applying to register with FINTRAC, existing FINTRAC registrants

This affects you if you are applying to register with FINTRAC or are already registered, especially if you or a co-owner hold a 5% or greater stake in the business.

The Finance Minister must complete a national-security review of a registration within 180 days of deciding to start one, about six months.
Applicants must now disclose any licence, registration, or authorization number issued by any federal or provincial regulator for their activities.
The ownership-disclosure threshold drops from 20% to 5%: anyone owning or controlling 5% or more of the applicant or registrant must now be reported to FINTRAC.

Sources in the bill: Clause 40Clause 41Clause 42

6 Penalty classifications and coming-into-force dates Affects crypto ATM operators, banks, money services businesses, FINTRAC registrants

This affects you if you operate a crypto ATM, work at a bank or money services business, or are registered with FINTRAC and need to know when new obligations begin.

Breaching the new crypto ATM record-keeping and identity-verification rules is classified as a Minor violation, attracting administrative fines.
Failing to report crypto ATM transactions to FINTRAC is classified as a Serious violation, attracting higher administrative fines.
Exceeding the $1,000 per-24-hour transaction cap on a crypto ATM is classified as a Very Serious violation, attracting the highest tier of administrative fines.
Accepting a prohibited third-party cash deposit into a bank account is also classified as a Very Serious violation.
Most new record-keeping and identity rules take effect 90 days after royal assent. Reporting and machine-information rules take effect 180 days after royal assent. The criminal offence for operating an unregistered crypto ATM takes effect 18 months after royal assent. Some provisions, including the $10,000 cash ban and the new short title, take effect on a date set by the federal cabinet.

Sources in the bill: Clause 43Clause 44Clause 45Clause 46Clause 47Clause 48Clause 49Clause 50(2) and 50(3)Clause 50(4)(a)Clause 50(4)(b)Clause 50(5)Clause 51(1)Clause 51(2)Clause 51(3)Clause 51(4)

7 Police can now seize mail under drug and criminal laws Affects anyone sending or receiving mail in Canada

This affects you if you send or receive mail in Canada. Police can now legally intercept your mail under criminal or drug laws without Canada Post facing any legal liability for allowing it.

Police and investigators can now seize, detain, or demand mail under the Criminal Code, the Controlled Drugs and Substances Act, or the Cannabis Act. Canada Post must allow this. Authorities must give Canada Post written notice within 60 days of any seizure, unless the item was already delivered or returned.
Canada Post, the federal government, and its employees are fully exempt from lawsuits arising from any such seizure. Opening or hiding mail without legal authority remains an offence, but that authority now extends to four federal laws, not just the Customs Act.

Sources in the bill: Clause 52Clause 53

What might happen next

6 See all 6 Hide

Likely

Who: Independent crypto ATM operators

What: Crypto ATM operators are likely to exit the market or reduce their number of machines rather than absorb the new registration, identity-check, and transaction-cap costs.

One view

One view holds that removing unregistered machines cleans up a channel widely used for financial crime.

Another view

Another view holds that closures push cash-to-crypto users toward unregulated online or peer-to-peer platforms, reducing government visibility rather than increasing it.

Expected

Who: Front-line staff and compliance departments at banks and credit unions

What: Banks and credit unions are expected to add screening steps to catch third-party cash deposits and to verify that any customer operating a crypto ATM holds a FINTRAC registration.

One view

One view holds that these checks reduce money laundering risk at the deposit counter.

Another view

Another view holds that the checks inconvenience legitimate customers — for example, a family member depositing cash on behalf of an account holder.

Expected

Who: Non-profit and religious organizations

What: Charities and religious organizations that accept cash donations are expected to train staff and post notices to avoid accepting $10,000 or more in cash, which becomes an offence.

One view

One view holds that the rule closes a channel used to funnel illicit money through charitable giving.

Another view

Another view holds that it deters legitimate large donors and adds administrative strain to small organizations.

Likely

Who: Money services businesses, foreign exchange dealers, and fintech companies seeking FINTRAC registration

What: Money services businesses are expected to face longer and less predictable registration timelines because the Minister of Finance now has power to review applications on national security grounds.

One view

One view holds that ministerial review is necessary to keep bad actors out of the financial system.

Another view

Another view holds that open-ended review with limited disclosure creates unfair uncertainty for legitimate businesses.

Uncertain

Who: Police and investigative agencies; Canada Post operational staff

What: Law enforcement agencies are expected to use postal interception powers more frequently now that the Canada Post Act no longer blocks seizures under drug and criminal laws.

One view

One view holds that the change is a necessary update that removes an accidental legal barrier to drug enforcement.

Another view

Another view holds that broader mail seizure powers, without stronger oversight, erode privacy expectations in the postal system.

Plausible

Who: Small independent money services businesses

What: Small money services businesses are expected to face higher per-transaction compliance costs than large institutions, and some are likely to exit the market.

One view

One view holds that exit of marginal operators improves the integrity of the sector.

Another view

Another view holds that consolidation reduces competition and may reduce service access in underserved communities.

Longer-term scenarios

5 See all 5 Hide

Scenario — not a prediction Regulated crypto ATM network shrinks; cash-to-crypto activity moves out of sight Plausible

One scenario analysts consider: as compliance costs drive small crypto ATM operators to close machines, and as identity requirements push privacy-conscious users toward peer-to-peer or offshore platforms, the regulated network of cash-to-crypto kiosks thins significantly. The result could be less visibility for FINTRAC, not more — the opposite of what the law intends. Cash-dependent users in areas where kiosks close would lose a low-friction access point with no regulated alternative nearby.

What could prevent this: Coordinated provincial licensing that keeps compliant operators viable. FINTRAC guidance that lowers the cost of compliance for small operators. Enforcement cooperation with peer-to-peer and offshore platforms. Publicly available regulated alternatives for cash-to-crypto conversion.

Scenario — not a prediction Market consolidates around large financial institutions; small operators disappear Plausible

One scenario analysts consider: fixed compliance and legal costs — registration filings, legal reviews, ongoing reporting — are easier for large institutions to absorb across high transaction volumes. Small independent money services businesses, unable to spread those costs, exit or are acquired. Over time, the regulated sector could become dominated by a smaller number of large players, reducing competition and potentially reducing service in communities that relied on independent operators.

What could prevent this: Proportional compliance tiers scaled to business size. Shared compliance utilities that let small operators pool costs. Competition enforcement to prevent anti-competitive consolidation. Provincial or federal support programs for small financial service providers.

Scenario — not a prediction Cash restrictions create a reinforcing cycle that excludes cash-dependent Canadians Plausible

One scenario analysts consider: as businesses refuse large cash transactions, charities restrict cash donations, and banks tighten third-party deposit rules, cash-dependent Canadians — including older adults, low-income households, and people without stable banking — find fewer places to conduct routine financial activity. Remaining providers, seeing a concentration of higher-risk cash users, may restrict services further. The cycle could deepen financial exclusion over a generation rather than reduce it.

What could prevent this: Broad prescribed exceptions for charities and legitimate third-party depositors. Clear regulatory guidance discouraging blanket de-risking. Basic banking requirements that protect cash access. Digital inclusion programs that give cash-dependent groups viable alternatives.

Scenario — not a prediction FINTRAC and the Minister face application backlogs as new duties pile up simultaneously Plausible

One scenario analysts consider: FINTRAC and the Department of Finance are asked to absorb several new workloads at once — sanctions-evasion analysis, new registration review criteria, mandatory revocation procedures, ministerial review of national security cases, and a 180-day deadline for registration decisions. If resources do not expand to match, application backlogs could grow, slowing market entry for legitimate businesses and creating uncertainty that falls hardest on smaller applicants who cannot afford to wait.

What could prevent this: Additional funding for FINTRAC and the Department of Finance. Digital modernization of application and review systems. Clear prioritization frameworks for concurrent review demands. Temporary staffing during the transition period.

Scenario — not a prediction Unpublished ministerial instruments and costly court review create a two-track system Low probability

One scenario analysts consider: some ministerial directives barring registration are not published in public registers and are served only on the affected party. Challenging them requires Federal Court review — expensive and procedurally complex. Smaller businesses, unable to afford that process, abandon their challenge and exit the market. If this pattern repeats without legislative correction, it could normalize a system where significant government decisions affecting businesses are made and enforced without full public transparency or accessible review.

What could prevent this: Federal Court procedural safeguards including security-cleared counsel for affected parties. Legislative sunset clauses requiring Parliament to renew the ministerial powers. Periodic parliamentary review of how the powers have been used. Transparency reforms requiring aggregate reporting on directives issued.

Its path through Parliament

First reading

Nov 2026

Second reading

Third reading

House of Commons

Royal Assent