Canada’s anti-money-laundering agency is holding firm to a deadline for businesses to report suspicious financial transactions, despite complaints of technical glitches and delays in the wake of last year’s cyber attack.

In March of last year, the Financial Transactions and Reports Analysis Centre of Canada (Fintrac) took down the online system small businesses use to report suspicious transactions, after a “malicious actor” gained access they shouldn’t have had. The agency has said the attacker didn’t transfer any sensitive data. 

Because Fintrac had already been planning to update its reporting system, it opted to wait until the new system was ready before it restored access.

That process took months. During that time, businesses that rely on the web reporting system were unable to send transaction reports for Fintrac to analyze for signs of money laundering and terrorist financing. Canada’s large financial institutions—which are responsible for 96 per cent of the reports the agency receives—were unaffected because a secure data feed they use to file reports remained operational. But at smaller businesses, a backlog of reports piled up.

On Feb. 12, Fintrac informed those businesses they have until March 31 to submit their backlogged files. “Your timely reporting is critical to our capacity to analyze and disclose financial intelligence concerning suspected money laundering, terrorist activity financing, sanctions evasion and threats to the security of Canada,” Philippe Blanchette, acting deputy director of Fintrac, wrote in an email.

In a Feb. 26 letter to Fintrac, a copy of which The Logic obtained, Joseph Iuso, executive director of the Canadian Money Services Business Association (CMSBA), said the deadline is imposing an unfair burden on his fintech members and other small businesses that must file reports, such as accountants and jewellers. Some still don’t have access to the web portal they’re supposed to use to file their reports, Iuso’s letter said. He asked Fintrac to change the deadline to give companies eight months from whenever they received access to the reporting system to submit their backlog.

The cyber attack “was not the fault of [the small and medium-sized businesses], Fintrac or any other party,” Iuso wrote. Despite that, he added, Fintrac’s deadline is putting a lot of pressure on small businesses to dedicate significant resources “in a very short period of time versus how long it took to create the backlog in the first place.”

While most of the thousands of businesses responsible for reporting to Fintrac now have access to the system, bugs and technical glitches are common, adding to the stress of meeting the deadline, Iuso wrote in his email to the agency. In a statement to The Logic, Fintrac spokesperson Mélanie Goulette Nadon said the agency’s systems are “fully operational.”

A March 17 response from a Fintrac official, whose name was redacted from a copy The Logic obtained, said the agency is “prepared to discuss case-by-case treatments to ensure compliance.” However, the deadline is firm, the official said, saying Fintrac’s systems “are operational and ready to receive these reports” and reiterating that “failure to comply with the deadline may result in enforcement actions.”

In her statement, Goulette-Nadon reiterated that the deadline is March 31, but said “businesses that have taken reasonable actions to submit reporting are encouraged to reach out to Fintrac if they are facing issues.”

Asked for comment, Iuso said in an email that based on that response the CMSBA is advising members to contact Fintrac directly if they are having trouble meeting the deadline.