FINTRAC Travel Rule: requirements for Canadian regulated firms

The "Travel Rule" is the requirement that specific information about the originator and the beneficiary of a transfer must "travel" with the payment along the entire chain that handles it. In Canada, it is grounded in the PCMLTFA and FINTRAC regulations, and it applies to two transfer types most regulated firms now handle: international electronic funds transfers (EFTs) and virtual currency transfers. The international standard behind it is FATF Recommendation 16.

This article is the definitive requirements explainer. If you are looking for the most common failure modes we see in the field (especially on the crypto side), read the companion piece, Crypto and the Travel Rule: where Canadian VASPs are getting it wrong.

Who is covered by the Travel Rule in Canada?

Three categories of reporting entity have direct Travel Rule obligations under FINTRAC:

• Money services businesses (MSBs) and foreign MSBs that initiate, receive, or transmit international EFTs.
• Financial entities (banks, credit unions) handling international EFTs.
• Money services businesses (including VASPs) that send or receive virtual currency transfers on behalf of a client.

Payment service providers (PSPs) become subject to overlapping Travel Rule-equivalent obligations through the Retail Payment Activities Act framework and, where they qualify as MSBs, through the PCMLTFA itself. The two regimes are not identical, but the information-flow expectations converge.

What information has to travel with the transfer?

For both international EFTs and virtual currency transfers, the regulations require the originator and the beneficiary to be identified, and for that identifying information to be transmitted with the transfer. The minimum data set is:

• Originator (the sender): name, account number (or unique transaction reference), and address.
• Beneficiary (the recipient): name, and account number (or unique reference).
• Transfer details: amount, currency, and date.

For virtual currency transfers, the address fields become the wallet addresses (or equivalent identifiers), and the "account number" obligation maps to the unique transaction reference (hash). The information must be transmitted on or before the transfer settles, and it must be retained on file for at least five years.

What are the thresholds?

The Travel Rule applies at and above the following thresholds, in Canadian dollars or equivalent:

• International EFTs: CAD $1,000 and above.
• Virtual currency transfers: CAD $1,000 and above.

Two important nuances. First, the thresholds apply to single transactions and to multiple related transactions that aggregate to the threshold (the "24-hour rule" for combined transactions). Second, the reporting obligations that sit alongside the Travel Rule (the EFT Report at CAD $10,000 and the Large Virtual Currency Transaction Report (LVCTR) at CAD $10,000) are separate filings with their own thresholds. Travel Rule information has to be captured below the reporting threshold even if you are not filing a report.

How does the Travel Rule interact with STRs, LCTRs, EFTRs, and LVCTRs?

The Travel Rule is an information-flow obligation. The reporting obligations are separate filings. Both depend on having the underlying data captured cleanly. Practically:

• A Suspicious Transaction Report (STR) can be triggered by any transaction at any value, including ones below the Travel Rule threshold. The originator and beneficiary information you captured to satisfy the Travel Rule feeds directly into the STR.
• A Large Cash Transaction Report (LCTR) sits alongside, for cash deposits or receipts at CAD $10,000 and above. Not Travel Rule, but adjacent.
• An Electronic Funds Transfer Report (EFTR) is filed for international EFTs at CAD $10,000 and above, in or out. The same originator and beneficiary fields populate the report.
• A Large Virtual Currency Transaction Report (LVCTR) is filed for virtual currency receipts at CAD $10,000 and above. The Travel Rule data is the spine of this report.

Building the Travel Rule capture once, in the system of record, is what makes the four reports come out clean. Building it separately for each report is what makes them come out inconsistent, which is the deficiency examiners find most often.

What about cross-border virtual currency transfers between counterparties?

The transmission half of the Travel Rule is the operationally hardest part, especially for crypto. The originator VASP has the originator information; the beneficiary VASP needs to receive it. Canada accepts the use of compliant counterparty messaging protocols (such as IVMS 101-aligned protocols like TRP, OpenVASP, and TRISA) provided the information that ends up captured matches the regulatory minimum. Where the counterparty is unhosted (a self-custodied wallet), FINTRAC expects the regulated entity to conduct due diligence on the customer and on the destination wallet, not to rely on counterparty messaging that does not exist.

Recordkeeping and retention

Whether you filed a report or not, you must retain the originator and beneficiary information, plus the transaction details, for at least five years from the date of the transfer. The records must be retrievable in a reasonable time on request from FINTRAC. "In a reasonable time" in practice means hours to days, not weeks, and not "we will need to go ask the vendor".

How BriteBase handles the Travel Rule

The AML Operating Platform captures the Travel Rule data set at onboarding and at the point of transfer, ties it to the customer of record, and carries it through into the STR, EFTR, and LVCTR filings automatically. The AML Managed Service adds the practitioner work on top: counterparty due diligence on unhosted wallets, sanctions and PEP screening of originators and beneficiaries, and examination response if a Travel Rule deficiency is flagged. Pricing is one predictable annual cost across four tiers.

FAQ