Two obligations sit side by side and pull in opposite directions: report what you suspect, and never let the person you suspect find out you reported it. Neither one is optional, and the second is easy to breach by accident through ordinary-sounding questions.
Key takeaways
FINTRAC’s Suspicious Transaction Report guidance sets a standard that is lower than most agents assume. It is a possibility standard, not a certainty standard — you are explicitly not required to verify the underlying facts or prove an offence took place. Instead, you weigh what you know: the facts of the transaction, the surrounding context, and whether the pattern matches FINTRAC’s published indicators (see red flags that should slow a deal down), and ask whether “another person with similar knowledge and training would likely reach the same conclusion.” That’s the test — a reasonable-person standard applied to your specific training and role, not a forensic finding.
There is no fixed number of days. FINTRAC’s own wording is “as soon as practicable” after you reach reasonable grounds to suspect — but that flexibility is not an invitation to sit on it. The guidance is direct about the consequence of delay: “The greater the delay to submit a Suspicious Transaction Report, the greater the need for a suitable explanation.” In practice, that means the moment you reach the suspicion threshold is the moment your own clock starts running, and the file should show what you knew and when.
The prohibition sits on the same page, stated without hedging: “You are not allowed to inform anyone, including the client, of the contents of a Suspicious Transaction Report, or that you have made or will make such a report, if the intent is to prejudice a criminal investigation.” The guidance applies this “whether such an investigation has begun or not” — you don’t get to wait and see whether police are actually involved before the duty applies.
The practical risk isn’t a slip of the tongue — it’s conduct. FINTRAC’s guidance names the failure mode directly: “you should not be requesting information that you would not normally request during a transaction if you believe this would tip off the client.” A sudden burst of unusual questions, a visible change in how carefully you’re reviewing a file, or hesitating on a step you’d normally move through quickly can communicate suspicion just as clearly as saying it outright. The safer posture is to keep your process consistent — ask the questions a careful agent would ask on any file of this kind, document your reasoning privately, and let the report itself carry the substance rather than your visible behaviour on the file.
A compliance officer — a role every reporting entity must appoint under FINTRAC’s compliance-programme requirements — is the internal channel these concerns are meant to move through; see what a risk assessment looks like in practice for how that role is structured, including for a sole proprietor acting as their own compliance officer.
Filing isn’t the end of the paper trail. FINTRAC’s retention table requires a copy of the report itself to be kept for “at least five years after the day it was submitted” — a different clock-start than most of FINTRAC’s other record types, which run from when the underlying record was created rather than when anything was filed. That five-year window matters for the same reason the tipping-off rule matters: if a question ever comes back about that file, years later, the report and your supporting documentation need to still exist and still make sense on their own, without you having to reconstruct your reasoning from memory.
Two mistakes are equally real. Waiting for certainty before reporting sets the bar too high — FINTRAC’s own standard is a reasonable-grounds-to-suspect test, not proof. But treating every unusual detail as automatically reportable sets the bar too low, and risks exactly the visible-behaviour-change problem the tipping-off guidance warns about — a client who senses you’ve become suddenly formal or hesitant can draw the same conclusion a direct statement would produce. The discipline the guidance is really asking for is consistency: apply the same level of scrutiny to every file, and let a genuine pattern, not a gut reaction to one detail, be what crosses the threshold.
Two separate penalty regimes — don’t merge them
FINTRAC’s own administrative monetary penalties run up to $500,000 per violation for an entity in the most serious tier — a completely different figure, under a completely different statute, from RECO’s discipline fines or PIPEDA’s breach-reporting offence provisions. Keep the three regimes distinct in your own thinking, since they can theoretically apply to overlapping facts but never share a penalty schedule.
FINTRAC’s own definitions section is explicit that the reporting duty attaches before a deal closes, not only after: “All references to transactions should be read to include both attempted transactions and completed transactions.” A buyer who backs out the moment you ask a routine identification question, on a file that already matched a published indicator, does not make the suspicion disappear — a deal that never closed can still need a report.
Escalating internally through your own compliance programme is a different thing from tipping off the subject of the report, and FINTRAC's compliance-officer structure exists precisely so a concern has somewhere to go. The prohibition is aimed at the client and anyone outside that internal reporting channel, not at your own required compliance infrastructure.
That uncertainty is exactly what the reasonable-person test is built for — ask whether someone with your training, looking at the same facts, would likely reach the same conclusion. If you’re genuinely unsure, document what you observed and consult your compliance officer rather than deciding alone.
Not automatically. Filing an STR is a reporting obligation, not a legal bar on completing a lawful transaction. Whether and how to proceed is a separate question from the reporting duty itself.
At least five years after the day it was submitted — a clock that starts at filing, unlike most of FINTRAC’s other record types, which start from when the underlying record was created.
Not automatically — but FINTRAC’s own wording makes delay costlier, not free: the guidance states “The greater the delay… the greater the need for a suitable explanation.” A documented reason for the gap between forming suspicion and filing matters more the longer that gap runs.
A short call can help you build a documented process for the moment a file starts to look wrong.
