What you need to know about new AML obligations for private ABM acquirers

Beginning October 1, 2025, entities that provide private automated bank machine (ABM) acquirer services, must adhere to Canada’s Anti-Money Laundering and Anti-Terrorist Financing laws.

As of October 1, 2025, the Canadian AML legislation has been expanded to include providers of private automated banking machines (ABM) acquirer services. For clarity purposes, it is essential to break down what that means at a fundamental level.

What is an ABM?

Per FINTRAC, an ABM is an electronic machine used by customers of a financial institution to perform transactions such as cash withdrawals and balance checks without a human teller. Functionally, an ABM is the same thing as an automated teller machine (ATM).

What is a private ABM?

Private ABMs, also known as white-label ATMs (WLATMs), are independently owned ABMs. This means they are not owned or operated by banks or credit unions in Canada. Independent businesses, such as gas stations, convenience stores, salons, bars, and event centres can own private ABMs.

Who are private ABM acquirers?

While a private ABM operator owns the physical machine and is responsible for loading it with cash, a private ABM acquirer helps connect the ABM to payment card networks, such as Interac, Visa, and Mastercard. Clients or cardholders can utilize these machines to withdraw money from their respective Canadian bank accounts.

It is essential to state that parties under the AML Act in Canada are the providers of these acquirer services to privately owned ABMs.

Concerns with WLATMs

According to the 2025 Assessment of Money Laundering and Terrorist Financing Risks in Canada, WLATMs are vulnerable to money laundering as they can be “owned, operated, or controlled by criminals, who can load the WLATMs with large amounts of illicit proceeds.”

A 2008 RCMP Strategic Intelligence Assessment found that between $315 million and $1 billion a year could be laundered through WLATMs. Despite efforts to address this growing money laundering and terrorist financing risk, WLATMs continue to be associated with criminality, according to RCMP reports.

To mitigate these risks, the federal government introduced new obligations for entities providing acquirer services to privately owned ABMs. 

Obligations for entities that provide private ABM acquirer services

You must register as a Money Services Business (MSB) with FINTRAC

• According to AML laws, these services will fall under the ambit of MSBs
• There are specific obligations MSBs must fulfill as required by the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA). Therefore, to meet the new federal requirements, all entities that provide private ABM acquirer services must register as an MSB with FINTRAC.

Develop a comprehensive AML compliance program

• Entities that provide private ABM acquirer services will be required to develop an AML program to include:
  • A formally appointed compliance officer with sufficient authority.
  • Written policies and procedures approved by senior management.
  • A risk assessment, specific to ATM locations, transaction volumes, and client types.
  • Training for all relevant personnel with documentation of attendance.
  • Biennial reviews of compliance effectiveness, including gap remediation.

Know-Your-Client/ Know-Your-Business and record keeping

• Entities that provide private ABM acquirer services will be required to verify the identities of owners/ operators of ATMs, those loading cash, and settlement-account holders. They will need to maintain documentation on beneficial ownership and criminal record checks for controlling persons. Relevant record-keeping obligations will also apply.

Reporting obligations to FINTRAC

• Entities that provide private ABM acquirer services will be required to file the following reports to FINTRAC:
  • Suspicious Transaction Reports (STRs) based on reasonable grounds.
  • Listed Persons or Entity Property Reports

Following the date the regulations go into effect, penalties for noncompliance can be significant. FINTRAC can use administrative monetary penalties ranging from $1,000 to $500,000 per violation, depending on the severity of the issue.