How to Write an AML Request for Information (RFI): Practical Templates for MSBs and PSPs

An effective AML request for information names the specific transaction or relationship it concerns and states the information gap: one missing fact, or a small set of related, well-defined questions. It gives a neutral reason for asking, lists the evidence that would resolve the question, says how to respond securely, and sets an internal response date. It is tied to a documented information gap. "Please send more KYC information" is not an RFI that anyone can answer well. "Please describe the commercial purpose of the CAD 18,400 payment of 14 September to Northwind Supply Ltd. and, if available, provide the related invoice" is.

There are two directions to manage:

• Outgoing RFIs. The business asks a customer, payment partner or correspondent for information.
• Incoming RFIs. A bank or other partner asks the business for information about its own customers or payments.

The drafting principles overlap, but the obligations, privacy limits and risks differ. This guide covers both. It includes three original templates, a method for judging responses, an RFI tracking log and a worked case.

What an AML RFI is, and what it is not

"RFI" is industry terminology, not a FINTRAC form. Canadian law does not prescribe an RFI template, a universal response deadline or a mandatory approval process for sending one. An RFI is a practical method a business may choose to help meet obligations that do exist. Under FINTRAC's ongoing monitoring requirements, reporting entities must:

• keep client information up to date
• reassess client risk
• determine whether transactions are consistent with what they know about the client
• detect transactions they must report

They must also keep records of the measures taken and the information obtained. FINTRAC lists asking the client as one example of a reasonable measure.

Four kinds of request are often blurred together:

An RFI is also not a suspicious transaction report (STR). It can feed into an STR assessment, but it never replaces one, and a pending RFI does not suspend a reporting obligation.

Terminology varies across sectors. MSBs, foreign MSBs and other reporting entities have PCMLTFA obligations. A payment service provider registered with the Bank of Canada under the Retail Payment Activities Act does not take on identical FINTRAC duties by registering. Its FINTRAC obligations depend on whether it carries on regulated activities, such as remitting or transmitting funds as an MSB. The templates below are still useful to a PSP that answers banks or partners, even where a particular FINTRAC obligation does not apply to it in the same way.

When to issue an RFI, and when not to

Common triggers include:

• a payment purpose that does not match the customer's stated business
• missing or inconsistent beneficiary details from a partner
• activity outside the customer's established profile
• a new destination country
• an unclear economic rationale
• questions about where funds came from
• incomplete corporate ownership information
• payments that appear to involve someone other than the customer

An alert from a monitoring system is not, on its own, a reason to send an RFI. Many alerts close on information the business already holds. The investigation steps that come before this point are covered in AML transaction monitoring. An RFI starts where that review identifies a gap that only someone outside the team can fill.

The recipient matters:

• Customer-facing RFIs ask a client to explain or document its own activity.
• Partner-facing RFIs ask a payout partner, correspondent or processor for information it holds about a payment. When the gap concerns regulatory report fields specifically, see what data to collect from payment partners before filing an EFTR.
• Incoming bank RFIs reverse the roles. The business becomes the respondent.

Sometimes contacting the customer is the wrong step. If the available facts already point toward suspicion, a question can alert the customer, as discussed in the confidentiality section below. If the answer can be found internally, for example in onboarding records, prior transactions or public registries, look there first.

Decide what question actually needs answering

Before drafting, the analyst should be able to answer eight questions in a sentence each:

1. What triggered the review?
2. Which facts are already established, and where are they recorded?
3. What exactly is missing?
4. Who is best placed to provide it: the customer, a partner, or internal records?
5. What evidence would actually resolve the question?
6. Is outreach appropriate, or could it compromise a possible report?
7. Is a statutory deadline already running, such as an STR or a threshold report?
8. Who approves sending the RFI under internal policy? No law requires a particular approver.

Weak: "Please explain the transaction."

Better: "Please explain the commercial purpose of the CAD 18,400 payment made on 14 September 2026 to Northwind Supply Ltd., and provide the invoice or agreement supporting that purpose, if available."

The second version identifies the payment precisely and asks one question. It names evidence that could answer that question, and the "if available" wording leaves room for a legitimate explanation where no document exists. It can also be answered once, without a follow-up asking what was meant.

Anatomy of a well-written RFI

The structure below reflects good practice. It is not a government format.

Ask for evidence without over-collecting

Each type of question has its own relevant evidence. Ask only for what bears on the gap.

Source of funds and source of wealth are different questions. Asking a remittance customer for a full wealth history to explain one payment is disproportionate. No single document proves a transaction is legitimate either. An invoice shows that a document exists, not that the trade happened. The broader distinction between identity, entity and risk information is explained in KYC vs KYB vs CDD.

Two further points:

• Identity verification has its own rules. If an RFI aims to verify identity for regulatory purposes, a scanned ID received by email is not automatically one of FINTRAC's authorized verification methods. Verify identity through an authorized method; the RFI only gathers the material.
• Questions about who directed a payment are third-party questions. If the gap is who instructed or benefited from a transfer, the specific questions and records are set out in FINTRAC third-party determination requirements.

Three RFI templates

These are illustrative templates for adaptation. They are not official FINTRAC documents. All names, references and amounts are fictional.

Template 1: Customer transaction clarification

Use this when a customer's payment does not fit their known activity and an explanation may resolve it.

Subject: Information request regarding your payment of 14 September 2026 (ref. RFI-2026-0412)

Dear Ms. Patel,

As part of our regular review of customer activity, we need some additional information about the following payment to complete our records:

• Date: 14 September 2026
• Amount: CAD 18,400
• Recipient: Northwind Supply Ltd., Rotterdam, Netherlands
• Our reference: TX-48210

Please answer the following:

1. What was the purpose of this payment?
2. What is your relationship with Northwind Supply Ltd.?
3. Were these funds your own, or did you send them for, or on the instructions of, another person or business?
4. Do you expect to make similar payments in future? If so, approximately how often and in what amounts?

If available, please also provide one document supporting your answer to question 1, such as an invoice or agreement.

Please reply through the secure upload link in your customer portal by 2 October 2026. Do not send identity documents or bank statements by ordinary email. If you have questions, or if any item is unavailable, contact our compliance team using the details in your customer portal.

Thank you for your help.

Compliance Team

Template 2: Payment partner or correspondent request

Use this when a partner's records do not match yours, or a detail is missing.

Subject: Data discrepancy: your ref. PX-9917-22 / our ref. TX-50133 (RFI-2026-0419)

Hello,

We are reconciling the transfer below and have found a discrepancy that we need your help to resolve.

Please confirm from your records:

1. The beneficiary's full name, and whether payment was made to an individual or a business.
2. The date and time (with time zone) you received the payment instructions.
3. The status of the payment: paid, pending, returned or rejected.
4. Any additional references linked to this transfer.

If your records include the identification details captured at payout, please provide the identifier type, number and issuing jurisdiction, to the extent you are permitted to share them. If any item cannot be shared under the laws that apply to you, please tell us which item and the reason, so we can record it.

Please respond through our agreed SFTP channel by 29 September 2026, in line with our data-sharing schedule. For anything urgent, contact Daniel Okafor, Compliance Operations, at the escalation contact in our agreement.

Regards,

Payment Operations Compliance

Template 3: Responding to a bank's AML RFI

Use this when your bank asks about payments through your account. The response answers the bank's questions in its own numbering and separates verified facts from customer explanations.

Subject: Response to your request ref. BNK-RFI-77102 dated 18 September 2026

Dear Relationship Compliance Team,

Thank you for your request regarding the three outgoing wires of 2 to 9 September 2026 (your refs. W-1180, W-1194, W-1207). Our responses follow your numbering.

1. Who is the remitter, and what is the relationship? The payments were made on behalf of our customer, Lakeshore Textiles Inc., a corporate client since March 2024. Our records show its business as importing fabrics for resale.

2. What was the purpose of the payments? According to the customer, and consistent with the invoices described below, the payments settled three purchase orders with Delta Mills Co., a supplier in Vietnam. The amounts and dates match the invoices we hold.

3. Is this activity consistent with the customer's expected profile? The payments are within the customer's expected monthly volume. The destination is consistent with its supplier base recorded at onboarding.

4. Please provide supporting documents. We attach copies of the three invoices (Annex A), uploaded through your secure portal.

Information not provided: Your question 5 asks for the customer's bank statements for the past 12 months. We do not hold these, and our customer relationship does not give us a basis to obtain them. If the remaining information leaves your question unresolved, we would be glad to discuss what further detail would help.

For follow-up, please contact Priya Shah, Chief Compliance Officer.

Regards,

Compliance, [MSB legal name]

A bank response should never confirm, deny or describe whether an STR has been filed. It also does not need to hand over internal suspicion analysis or risk-scoring workings. The bank needs facts and evidence, not the MSB's internal deliberations. How banks review MSBs more broadly is covered in what a CDD review actually involves.

How to evaluate an RFI response

A response has to be assessed, not just filed. Check it against these points:

• Completeness: every numbered question is answered, or the answer explains why not.
• Specificity: the answer refers to the actual payment, not a general description of the business.
• Consistency: names, amounts, dates and counterparties match your records.
• Documentary support: documents relate to the specific question asked.
• Credibility: the explanation is plausible for this customer, given what you already know.
• Contradictions: nothing in the answer conflicts with earlier statements or other records.
• Resolution: the original concern is actually answered, rather than replaced by a new topic.
• New questions: whether the answer raises issues that need their own follow-up.

A vague answer: "Payment for business. All legitimate."

A stronger answer: "Deposit on 40 rolls of cotton fabric under purchase order PO-3317, invoice attached; balance due on delivery in November."

The stronger answer gives you something to check: does the invoice match the amount, date and counterparty, and does the trade make sense for this customer? Even so, an invoice does not automatically close a case. Equally, an unanswered RFI is not proof of wrongdoing. Both are inputs to the analyst's assessment.

Follow-ups, partial answers and non-responses

Different gaps need different handling:

• Only some questions answered: ask again only about the unanswered items, and say which ones.
• A partner sends records that conflict with yours: treat the conflict as the new question. Do not pick whichever record suits the file.
• A bank asks for information you do not hold: say so plainly. Do not obtain information you have no basis to collect just to satisfy the request.
• A document cannot legally be shared: record the reason, and offer what can be shared, such as a summary or a redacted copy.
• The customer misses the internal date: send a follow-up, then escalate under your procedures.
• Several RFIs are open for one customer: consolidate them, so the customer is not handling overlapping requests.
• The answer creates new discrepancies: reassess the case, not just the RFI.

Each open RFI needs a named owner and a priority set by risk. The file should record each contact attempt, so the business can show the reasonable efforts it made. Restrictions on the relationship, such as holding further transfers or ending it, are business decisions taken under internal policy. They are not legal requirements triggered automatically by a missed date. Nothing in Canadian law fixes the number of reminders.

For correspondent and bank relationships, the Wolfsberg Group's Transaction Monitoring RFI Best Practice Guidance (2022) describes industry practice. It suggests an indicative response window of 10 to 30 business days depending on complexity, and recommends that respondents explain why any information cannot be provided. This is non-binding industry guidance, not a Canadian legal standard, but it is a useful reference when agreeing expectations with a bank.

RFIs, STRs and confidentiality

An RFI and an STR operate on different tracks. Under FINTRAC's suspicious transaction reporting guidance:

• Reporting threshold: an STR is required once the business has reasonable grounds to suspect that a transaction or attempted transaction is related to money laundering, terrorist activity financing or sanctions evasion. That is a step above a simple hunch.
• Timing: the report must be submitted as soon as practicable after the measures that establish those grounds are completed, and treated as a priority.
• No proof needed: the business does not have to verify every fact or prove an offence.

This produces two different situations:

• Situation 1: the facts fall short of reasonable grounds to suspect. Here, ordinary business questions may legitimately clarify the activity, either removing the concern or confirming it.
• Situation 2: the facts already establish reasonable grounds to suspect. Here, the reporting obligation comes first. Waiting for a discretionary RFI response is not a reason to delay the report.

An unanswered RFI does not on its own make a transaction reportable. A refusal or an inconsistent answer can, however, form part of the facts considered.

Confidentiality limits what outreach can say. Reporting entities must not disclose that they made an STR, or its contents, with the intent to prejudice a criminal investigation. FINTRAC also advises against requesting information you would not normally request if doing so could tip off the client. In practice:

• word customer RFIs as routine review questions
• never refer to a report, a suspicion or an investigation
• route a case through compliance review before any outreach where suspicion is already forming

Questions to customers are not prohibited while a case is open. How to document the decision itself is covered in the guide to documenting a decision not to file an STR.

Privacy and secure information sharing

Collecting and sharing personal information in an RFI is governed by privacy law, as well as by AML rules. Under the federal private-sector law, PIPEDA, organizations are expected to:

• identify why they are collecting information
• limit collection to what is needed for that purpose
• use and disclose it only for that purpose, unless consent is obtained or an exception applies
• protect it with appropriate safeguards
• keep it only as long as necessary

Some provinces have their own private-sector privacy laws. Disclosures to institutions outside Canada can also raise additional questions under foreign law.

In practice:

• Ask only for what the question needs. Request bank statements only where the source of funds for a specific payment cannot be established another way.
• No contract overrides the law. A bank or partner agreement can set out what each side expects to share. It is not, by itself, legal authority to disclose a customer's personal information, and it does not displace PIPEDA, applicable provincial privacy law, confidentiality duties or legal privilege. You are not obliged to send customer documents simply because a counterparty asks for them.
• Use secure channels. Exchange documents through secure portals or encrypted transfers. Limit access to the people working the case.
• Disclose only with a valid legal basis. Before sending a customer's personal information to a bank or partner, confirm that a valid legal basis exists. That usually means the customer's informed consent for that purpose, or a specific exception in the privacy law that applies to you. Where the basis is unclear, seek legal advice before disclosing, or share only information that is not personal information.

RFI tracking log

Illustrative internal register, not an official FINTRAC record. All entries are fictional.

Status values are distinct steps, not synonyms:

• Awaiting response: sent, no reply yet.
• Partial response: some items answered.
• Complete response received: all items answered.
• Information validated: checked against records and found consistent.
• Escalated: passed to the compliance officer.
• Closed with documented rationale: a decision recorded on the case.

Receiving a response is not the same as closing a case.

Keep the log free of personal details. The log holds references, and the documents themselves stay in a restricted case file. Where an RFI forms part of ongoing monitoring, the measures taken and the information obtained fall within FINTRAC's record-keeping requirement. Those records are kept for at least five years from creation. Other RFI material, such as correspondence about a bank's inquiry into your own account, is retained under your internal retention policy. Do not assume one statutory period applies to every RFI record.

Worked example: a pattern that does not fit

Hypothetical.

1. Trigger. A Calgary remittance MSB's monitoring flags a customer, a retail employee onboarded in 2025 with expected monthly transfers of about CAD 800 to family overseas. In September the customer sends six transfers totalling CAD 7,200 to four different recipients in two countries.
2. Existing information reviewed. The onboarding file, the past year of transfers, the recipients' names, and prior alerts (none). Two of the recipients share a surname with the customer. The other two do not appear in the customer's history.
3. The unresolved question. Who are the two new recipients, what are the payments for, and where did the additional funds come from?
4. Is outreach appropriate? The facts, so far, are a change in volume with plausible innocent explanations. The analyst records that they do not yet amount to reasonable grounds to suspect. A routine information request is appropriate.
5. RFI sent. A version of Template 1 asks about the purpose of the six transfers, the relationship to each recipient, whether anyone else asked the customer to send funds, and the source of the extra funds. It requests a supporting document only for the source of funds.
6. Reply. The customer explains that the two family recipients are siblings paying school fees, and attaches the fee notices. The other two recipients are described as "friends who needed help". No document is provided for the source of funds, which the customer describes as "savings".
7. Verification. The fee notices match the amounts and dates of three transfers. The "friends" answer gives no names that match the recipients' records. The savings explanation is inconsistent with the volume compared with the customer's stated income.
8. Follow-up and escalation. A focused follow-up asks only about the two unexplained recipients and the funding source. When that receives no response by the internal date, the analyst escalates the case to the compliance officer for a documented STR assessment. The assessment rests on the facts as a whole: the change in volume, two recipients with no explained connection, and a funding claim the customer's stated income does not support. The missing reply is one of those facts, not the reason for reporting. Transfer limits are applied under internal policy while the assessment is completed.
9. Evidence kept. The RFI and the follow-up, the reply and the fee notices, the verification notes and the escalation record.
10. Outcome. The RFI resolved the family transfers, which were verified and documented. It did not resolve the other two recipients or the source of funds. The case is therefore not closed. It sits with the compliance officer for a documented decision on whether the facts reach reasonable grounds to suspect. If they do, the STR is filed as soon as practicable. If they do not, the no-file rationale is recorded and the customer stays under enhanced monitoring. Either way, the decision is made on the reporting standard, not on the RFI.

RFI quality checklist

• The information gap is specific and documented
• The recipient is the party who actually holds the information
• The request is proportionate to the gap
• The language is neutral and refers to no suspicion or report
• Transaction references, amounts and dates are correct
• Each requested document relates to a numbered question
• The response date is stated as an internal or contractual expectation
• A secure channel is specified
• Confidentiality and tipping-off risk were considered before sending
• An owner and a follow-up date are assigned
• The response will be assessed against the case, not just filed
• Any regulatory action, such as an STR, is handled on its own timeline

Frequently asked questions

What language should an RFI be written in?

Use the language the recipient actually works in, as far as practical. An answer to a question the customer did not understand is not reliable evidence. For customers, that may mean French or another language used in the relationship. For foreign partners, the agreed working language of the contract. Keep a record of the version sent. If a translated reply is relied on, record who translated it.

Can we reuse our response to a bank's earlier RFI?

Only as context. Each inquiry concerns specific transactions, and a response about earlier payments does not answer questions about later ones. It is reasonable to refer to an earlier response where the facts are unchanged, for example the same supplier on the same contract. Confirm that the earlier documents still apply, and answer the new questions in full.

What if an RFI was sent to the wrong recipient?

Treat it as a privacy incident. Contact the unintended recipient promptly to ask that the message be deleted, and record what personal information was included. Assess the incident under your privacy breach procedures, including whether it must be reported or the affected individual notified. Then send the RFI to the correct recipient. If the wording could have suggested a suspicion to anyone, have compliance review the exposure.

When RFIs are issued inconsistently, answered without evidence or closed without assessment, the underlying problem is usually in investigation procedures and records. ComplyFactor provides AML advisory support to Canadian MSBs and payment businesses, including program reviews, monitoring frameworks and compliance remediation.