Enforcing
Canada’s Anti-Spam
Legislation (CASL)

Focus on domain name abuse in Canada

Canadians are targeted and sometimes fall victim to phishing campaigns that rely on deceptive domain names to trick them into thinking they are interacting with trusted organizations such as banks, government agencies, and other popular services (e.g., parcel and food delivery services, parking and highway toll, telecom, technology, media and streaming services). These look-alike domains are easy to buy, which is why domain name registrars can play an important role in identifying and preventing phishing campaigns.

• The CRTC issued an enforcement advisory outlining that domain name registrars can be held liable under Canada’s Anti-Spam Legislation (CASL) if they facilitate, knowingly or by negligence, the sending of phishing messages.
• Complaints submitted by Canadians through the Spam Reporting Centre (SRC) since 2022 have identified areas where registrars can improve their practices, and the CRTC reminds and educates stakeholders on a regular basis of their obligations to address spam and phishing-related issues.
• The CRTC will continue to monitor this issue and apply appropriate enforcement action against registrars who do not comply.

For businesses - Enhanced Focus on CASL Compliance

The introduction of CASL requirements over 10 years saw CRTC compliance and enforcement activities follow a phased-in approach, beginning with sustained outreach and education, warning letters, and imposing administrative monetary penalties (AMPs) when necessary, recognizing that companies were transitioning under a new piece of legislation at that time.

As CASL is now well-established and widely understood in the Canadian marketplace, there is a heightened expectation of compliance from those who send commercial electronic messages to Canadians. Canadians continue to submit a high volume of complaints to the SRC regarding unwanted spam messages and difficulties unsubscribing, often due to broken links or overly complicated unsubscribe processes.

The CRTC will continue to investigate complaints and intends to take stronger enforcement measures when appropriate, including applying administrative monetary penalties that are proportionate to the severity and extent of the violations (up to $10,000,000 per violation for a business or $1,000,000 for individuals).

Enforcement measures between October 1, 2025 and March 31, 2026

Long description:

• 11 Warning or Information Letters
• 96 Notices to Produce
• 2 Preservation Demands

Reporting unsolicited commercial electronic messages to the SRC is a key part of how the CRTC gathers intelligence on spam and electronic threats.

The CRTC, the Competition Bureau, and the Office of the Privacy Commissioner of Canada share responsibility for CASL compliance and leverage the SRC database to collect information that supports their respective mandates.

Between October 1, 2025 and March 31, 2026:

• The SRC received 189,908 submissions, averaging 7,304 per week
• Approximately 4,545 complaints were submitted using the SRC's online form , which allows users to report spam and other electronic threats in detail
• The remaining submissions, about 98%, were submitted by email to spam@fightspam.gc.ca

The best way to report spam is to use the SRC online form and upload your spam message.

Long description:

189,908 submissions to the Spam Reporting Centre

The CRTC collaborates with many countries around the globe to fulfill its mandate, to promote international cooperation and address problems relating to spam and unsolicited communication.

The CRTC, along with 25 partner organizations, participated in Maple Disruption, a Canadian Anti-Fraud Centre and National Cybercrime Coordination Unit (NC3) of the Royal Canadian Mounted Police initiative to disrupt and degrade key enablers that fraudsters rely on, including malicious email addresses, phone numbers, bank accounts, websites, and cryptocurrency accounts. This operation took place from December 8 to 11, 2025, and focused on phishing, bank investigators, and investment scams.

Maple Disruption partners worked together to identify instances of suspected fraud and coordinated over 3,000 disruptive actions against fraud enablers. These included:

• shutting down malicious email accounts
• blocking malicious phone numbers
• taking phishing websites down
• flagging suspicious transactions
• blocklisting criminal cryptocurrency addresses linked to fraud

Partnerships such as these are another tool the CRTC employs to be responsive to activities that negatively affect the day-to-day lives of Canadians.

Maple Disruption 2025