Payment Radar
FINTRAC Advisory Updates FATF High-Risk Jurisdiction Directives for DPRK and Iran
FINTRAC issued an advisory on July 15, 2026, updating reporting entities on FATF-identified high-risk jurisdictions.
What changed
FINTRAC, Canada’s Financial Transactions and Reports Analysis Centre, which enforces anti-money-laundering reporting rules for money-services businesses, issued an advisory on July 15, 2026, updating reporting entities on Financial Action Task Force (FATF)-identified high-risk jurisdictions. The advisory details Ministerial Directives for the Democratic People’s Republic of Korea (DPRK) and Iran, requiring enhanced due diligence, identity verification, record-keeping, and sanctions evasion risk assessments for all transactions involving these countries. It also reiterates obligations for Myanmar, Russia, Afghanistan, and Middle East jurisdictions, including suspicious transaction reporting and compliance with sanctions. The advisory references FATF statements from June 19, 2026, and previous FINTRAC guidance. The core shift is the explicit requirement for enhanced due diligence and sanctions evasion risk assessments specifically for the DPRK and Iran, alongside mandatory reporting of suspicious transactions related to sanctions evasion to FINTRAC. This updates prior guidance to align with the latest FATF statements and strengthens the compliance burden for transactions touching these specific high-risk areas.
Why a business should care
The advisory imposes new compliance requirements that could impact transaction processing times, increase operational costs, and expose entities to regulatory risks if not properly implemented. Failure to comply could result in regulatory penalties, reputational damage, and increased risk of sanctions evasion. For businesses handling international payments, especially those involving the DPRK, Iran, Myanmar, Russia, Afghanistan, Ukraine, Belarus, Moldova, and Middle East jurisdictions, these rules are not optional. The enhanced due diligence and identity verification steps mean more scrutiny on customers and transactions, which can slow down processing and require more resources. The risk of sanctions evasion is highlighted, meaning businesses must actively assess and report suspicious activity. Ignoring these requirements isn’t just a compliance oversight; it’s a direct threat to the integrity of the financial system and could lead to severe consequences for the business.
Who it affects
Canadian and US merchants, financial institutions, payment processors, and compliance officers handling international transactions, particularly those involving the DPRK, Iran, Myanmar, Russia, Afghanistan, Ukraine, Belarus, Moldova, and the Middle East. Any entity that processes payments, verifies identities, or maintains records for cross-border transactions falls under this advisory. This includes traditional banks, fintech companies, payment gateways, and even smaller merchants who facilitate international sales. Compliance officers are directly responsible for ensuring these new directives are integrated into existing programs. The impact is high for these groups, as non-compliance carries significant risks.
What to consider doing
Pull your current compliance program documentation and cross-reference it against the new Ministerial Directives for the DPRK and Iran. Specifically, verify that your enhanced due diligence procedures, identity verification protocols, record-keeping practices, and sanctions evasion risk assessments are explicitly updated to cover these jurisdictions. If gaps are found, engage your compliance vendor or legal counsel immediately to implement the necessary changes.
Uncertainty and risks
Regulatory penalties, reputational damage, increased risk of sanctions evasion, and operational disruptions due to enhanced due diligence requirements are the primary risks. The advisory’s implementation details may evolve as FINTRAC and FATF continue to monitor the situation. Businesses should be prepared for potential updates to the directives or additional guidance. The risk of sanctions evasion remains high, and failure to detect and report suspicious transactions could lead to severe regulatory action. Operational disruptions are also a concern, as enhanced due diligence may slow down transaction processing and require additional staff training. The uncertainty lies in how strictly these requirements will be enforced and what specific thresholds will trigger reporting obligations. Businesses must stay agile and responsive to any further guidance from FINTRAC or FATF.
Comments