Canadian Regulator Fines Cryptomus $177M Over Darknet, Iran Transfers

FINTRAC said the British Columbia-based operator, formally known as Xeltox Enterprises Ltd., failed to report more than 1,000 suspicious crypto transactions in July 2024 tied to darknet markets and wallets linked to child exploitation, fraud, ransomware, and sanctions evasion. The agency also identified 7,557 unreported transfers from Iran between July and December 2024, alongside 1,518 large-value transactions exceeding C$10,000 that went unreported.

According to FINTRAC, Cryptomus lacked “adequate” client due diligence and had no functional risk assessment process in place. Its compliance program was described as “incomplete and inadequate.” The firm had already been banned from trading securities in British Columbia earlier this year by the provincial securities regulator.

Investor Takeaway

Part of a Wider Enforcement Wave

The action against Cryptomus follows a string of enforcement cases targeting offshore platforms that serve Canadian users. In July, KuCoin was fined C$19.5 million for operating without registration and failing to report transactions. In 2024, Binance was ordered to pay C$6 million later than similar breaches. FINTRAC said the penalties are part of an ongoing effort to bring the crypto sector in line with the compliance obligations applied to traditional financial institutions.

“This case demonstrates how virtual currency entities remain vulnerable to exploitation by illicit actors when compliance controls are fragile or ignored,” FINTRAC director Sarah Paquet said in a statement. She added that the agency will continue to pursue firms that “undermine Canada’s financial integrity.”

The regulator has sharpened its focus on platforms incorporated in Canada but operating largely offshore, where supervision has proven hard. Cryptomus was registered in British Columbia but allegedly processed thousands of cross-border transactions through third-party payment channels, including wallets linked to sanctioned jurisdictions.

Regulatory Tensions and Industry Response

Canada’s clampdown comes as regulators worldwide step up enforcement of crypto-related AML rules. The country has tightened oversight since 2021, when amendments to the Proceeds of Crime (Money Laundering) and Terrorist Financing Act expanded reporting requirements to virtual asset service providers. platforms must now submit detailed suspicious transaction reports, maintain client verification data, and flag cross-border transfers above C$10,000.

Industry groups argue that compliance expectations have outpaced technical capacity, especially for smaller firms. But regulators have taken a zero-tolerance approach to platforms linked with darknet markets or sanctioned regions. In its notice, FINTRAC cited several wallet addresses associated with Iranian counterparties that had previously appeared in U.S. Treasury sanctions advisories.

Lawyers familiar with the case said the penalty effectively removes Cryptomus from the Canadian market. “This is a death sentence for a firm of that size,” one Toronto-based compliance attorney said. “The scale of non-reporting here goes beyond negligence—it’s systemic disregard.” Cryptomus did not respond to requests for comment.

Investor Takeaway

Canada’s Broader Crypto Oversight Push

FINTRAC’s move aligns with efforts by the Canadian Securities Administrators (CSA) and the Bank of Canada to tighten controls on digital asset flows. Ottawa has pressed platforms to register as money services businesses and adopt full transparency on wallet addresses and counterparties. The latest crackdown underscores regulators’ concern over crypto’s use in sanctions evasion and cybercrime financing.

For the global crypto sector, Canada’s stance mirrors a trend viewn across the G7, where compliance violations now carry penalties comparable to those in traditional banking. The Cryptomus fine, more than nine times larger than the sanction against KuCoin, sets a precedent for how regulators may treat virtual asset service providers operating under fragile compliance structures.

As authorities push for uniform oversight, crypto firms registered in Canada are likely to face increased reporting burdens and enforcement risk. For FINTRAC, the record fine reinforces its message: failing to report suspicious transactions or sanction-linked flows is no longer tolerated.