Ontario’s online casinos—which include some of the world’s largest—couldn’t file suspicious transaction reports to Canada’s money-laundering watchdog’s website for an entire year following a major cyberattack in March 2024.

The Financial Transactions and Reports Analysis Centre of Canada (Fintrac)’s web portal, which requires users to manually fill out forms for each suspicious transaction and upload them one at a time, is mostly used by small businesses, but it’s also how Ontario’s online casinos submit their reports, three sources with direct knowledge of the matter told The Logic. Fintrac also has a secure data feed for filing reports that’s mostly used by banks and other large organizations, but iGaming Ontario (iGO)—the crown corporation established in 2021 to oversee online gambling—hasn’t set it up.

iGO spokesperson Josh Elliott confirmed this in an emailed statement, adding that online casinos didn’t regain access to the portal until March 2025. That means information about the overwhelming majority of fraud, money laundering or other suspicious activity Ontario online casinos detected during the year-long period following the hack went largely unreported.

Ontario became the first province in the country to let private firms that had previously operated in a grey market register and pay tax when it legalized online gambling in 2022. Despite Canadian casinos being a notorious vector for money laundering, iGO launched the legal market in 2022 without first implementing a modern system for filing suspicious transaction reports, two sources told The Logic. That system was already under strain before the hack made things worse. The sources did not want to be identified discussing non-public information that could damage their relationships with Fintrac and iGO.

“There’s a money-laundering issue in Canada, especially in the gaming industry,” said one source. “If you’re gonna bring in the biggest guys and start generating billions of dollars in revenue, you’ve got to monitor that stuff.”

Fintrac took down its web-based system for reporting suspicious transactions for security reasons in March last year after a “malicious actor” gained unauthorized access. Fintrac opted to complete an update of its tech systems as well before restoring access, a process that took months. It took iGO a full year to give online casinos access to the reporting tool again because the organization wanted to ensure “appropriate security and privacy safeguards are in place,” Elliott said in an email. Fintrac has said the attacker didn’t transfer any sensitive data.

Ontario’s registered online casinos are technically contractors of iGO. The 49 online casinos licensed in the province, including international giants such as FanDuel, DraftKings and BetMGM, collectively processed almost $83 billion in wagers in the 2024 fiscal year.

Elliott confirmed that iGO is building an automated processing system to replace the current “burdensome” one. Online casinos are free to use their own bots and other automation tools to speed up the process of filing reports, he said. 

Elliott noted that before Ontario legalized online gambling, grey-market online casinos operating in the country didn’t have any money-laundering oversight at all. iGO has submitted more than 80,000 reports to Fintrac on behalf of its operators since April 2022, he said.

Fintrac gave all businesses a deadline of March 31 to submit their backlogged reports from the outage period, but a significant portion of the online casinos operating in Ontario still haven’t submitted them, two sources told The Logic. 

Elliott confirmed there are still backlogged reports that haven’t been filed. “We and our operators have made progress in clearing the backlog as we continue to work with Fintrac to determine a reasonable timeline for completion,” he said.

Asked for comment, Fintrac spokesperson Mélanie Goulette Nadon did not mention iGO directly, but said Fintrac has encouraged casinos and other high-volume businesses to file reports through its direct data feed instead of the web portal. “Timely reporting is crucial to keeping Canadians safe,” she said.

Raymond Kahnert, a spokesperson for the Alcohol and Gaming Commission of Ontario, iGO’s regulator, said the organization is aware of the situation, but did not respond to questions asking whether it had any concerns or planned to take any action. Goulette Nadon said Fintrac will address organizations having trouble filing their backlogs in a timely manner “on a case-by-case basis to ensure compliance.”

Ontario has faced criticism for launching an online betting without a system allowing problem gamblers to proactively ban themselves from every registered online casino in the province at once, as they can for brick-and-mortar ones.

A compliance professional at one online casino said iGO deserves similar criticism for failing to provide the sector with software that would automate the suspicious transaction reporting process at launch. “You do anticipate growing pains. But the process shouldn’t be three years behind,” they said. 

The largest operators in the industry file thousands of reports to Fintrac each year, two sources with direct knowledge told The Logic. To keep up with the paperwork, online casinos must hire far more compliance staff in Ontario than in other jurisdictions, three sources said.

Because filing reports is so resource intensive, online casinos are disincentivized from thoroughly tracking suspicious activity, one source said.

Fintrac requires firms to file a separate report for each individual transaction, rather than grouping all transactions related to a single suspicious incident together. The compliance professional gave an example of a fraud ring their online casino identified that involved dozens of accounts and hundreds of transactions over the course of a few weeks, requiring weeks of work to file reports manually. “They’re nasty to do, they’re brutal,” they said.

Paul Burns, CEO of the Canadian Gaming Association, said “there’s a lot of frustration” in the industry over Fintrac’s filing requirements, which he said are focused on administrative compliance rather than generating actionable intelligence. Given the proper tools, online casinos can track money laundering and crime much more easily than their brick-and-mortar counterparts, since everyone’s identity is known and no cash exchanges hands, he said.

Dealing with the fallout from the Fintrac hack has “been awful for everybody,” Burns said. “The costs have been quite incredible.” 

Canada will undergo an international review of its money-laundering controls later this year, which compliance experts have said could result in a failing grade because of high-profile scandals and a deteriorating relationship with the U.S. Countries that fail the audit are placed on a so-called “grey list,” which could put a damper on foreign investment, make it harder for banks to maintain international relationships and restrict the government’s ability to borrow.