Attack on FINTRAC | Suspicious transactions have been flying under the radar since March

It’s an unexpected windfall for criminals. Weakened by a cyberattack, Canada’s financial intelligence agency responsible for combating money laundering and terrorist financing is unable to fully play its role. Suspicious transactions have been flying under the radar since last March, without federal authorities being able to plug the breach.

The crisis involves the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC), a crucial player in criminal investigations across the country.

The agency, which employs more than 500 people and has a budget of $90 million, is responsible for collecting reports on large cash flows and suspicious transactions to detect money laundering, terrorist financing and other forms of crime. It reports to Finance Minister Chrystia Freeland.

FINTRAC collects approximately 20 million reports from 31,000 sources each year, including banks, currency exchanges, casinos, securities brokers and gem dealers. The information can then be forwarded to law enforcement or the tax authorities as needed.

On March 2, FINTRAC confirmed that it had been the victim of a hacker intrusion that forced it to take its reporting systems offline. A return to normal is still pending.

The organization’s management is reluctant to address the issue publicly. Its leaders declined our interview request and refused to detail the number of files that have not been processed in the past five months. They also refuse to specify exactly what tasks they are unable to perform.

“FINTRAC cannot publicly comment on its operations,” explains Mélanie Goulette Nadon, spokesperson for the organization.

She said a special computer interface was set up to receive reports from entities that provide the largest volume of transactions, which is 96% of the total. For the rest, FINTRAC asked all stakeholders to submit securely reports of suspicious transactions related to four priority subjects: terrorism, online sexual exploitation of children, trafficking of minors and any report related to direct police intervention. The rest will have to wait, but M^me Goulette Nadon assures that officials are actively working to restore the situation. Collaboration with police services continues and investigations have recently led to arrests thanks to the help of FINTRAC, she emphasizes.

“It delays everything”

However, the situation remains critical, according to Matt McGuire, a consultant at AML Shop and an expert in the fight against money laundering.

“They say they can still receive 96% of reports, but that figure is not just about suspicious transaction reports: it includes a whole spectrum of reports, including transactions that are sent automatically because the amount exceeds a certain threshold. What they don’t tell us is what proportion of suspicious transaction reports they continue to receive,” he explains.

Mr. McGuire has attended meetings with FINTRAC people to try to minimize the impact on the industry.

“One of the reasons they shut down the old system and NEVER restarted it is because they can no longer trust the data. They explained that a hacker – probably Russian, since the attack happened the day after new sanctions against Russia were announced – was able to get into the system through a junior account and then work his way up,” he says.

“They are managing this problem and it is delaying everything. If you want an interpretation of policies or directives from them, we are now talking about months to get an answer,” he laments.

At Mouvement Desjardins, spokesperson Jean-Benoît Turcotti acknowledges that the transmission of certain categories of reports to FINTRAC is suspended. “These reports are currently pending with us and will be submitted to FINTRAC as soon as it is possible to do so,” explains Mr. Turcotti.

Loto-Québec, for its part, says it has managed to put in place a protocol to continue transmitting reports for “priority” subjects, but has stopped the others.

“Due to the forced shutdown of FINTRAC’s systems, we had to temporarily interrupt the transmission of reports normally transmitted,” says spokesperson Renaud Dugas.

A security employee at a major Canadian bank, who spoke on condition of anonymity because he is not authorized to discuss the matter publicly, told The Press that his team’s suspicious transaction reports have not been processed by FINTRAC since March.

“It’s a disaster for financial intelligence. Especially in these times of political and financial interference from foreign countries. A G7 country… the partners must be going crazy,” says this source, who is directly assigned to the surveillance of potentially criminal transactions.

FINTRAC’s IT problems come as the agency’s chief technology officer, Janak Alford, is under fire for promoting an artificial intelligence application that could help the federal government manage public service payroll, without disclosing that the application was developed by a private company he owns. More than 30 civil servants worked to test the application and enter data into it, but the experiment was abruptly halted when The Press asked about this last spring.