Bill C-12 and the new FINTRAC effectiveness standard: what Canadian MSBs and PSPs need to do in 2026

Before Bill C-12, the question for a compliance program was whether it had the required elements. Since March 26, 2026, the Act also requires the program to be reasonably designed, risk-based and effective (PCMLTFA s. 9.6(1.1)). Bill C-12 is the Strengthening Canada's Immigration System and Borders Act, S.C. 2026, c. 4.

That adds a harder question: does the program work? The shift changes what a defensible compliance program looks like. It also puts Canadian MSBs and PSPs at risk if their documentation has not changed even though the standard it is judged against has.

What Bill C-12 changed

The Act now says the program must be reasonably designed, risk-based, and effective. The table sets out the difference.

The penalty increase draws the headlines, but the standard matters as much. A program can now draw findings when something is missing and also when what is present does not appear to work.

The "reasonably designed, risk-based, and effective" standard

The phrase appears in PCMLTFA s. 9.6(1.1), which came into force on March 26, 2026. Each word carries weight, and the third depends on evidence of how the program operates.

Reasonably designed

The program must be built to address the money laundering and terrorist financing risks the business actually faces, using the business's own risk assessment instead of a generic template.

Risk-based

Controls must be calibrated to the ratings in a documented risk assessment. A high-risk customer segment should attract enhanced due diligence, and a low-risk one should not be over-controlled. The risk assessment is the foundation, and if it is generic, everything built on it is generic too.

Effective: the new part

A program is effective when it produces evidence that it is doing its job: alerts that get reviewed, escalations that get documented, STRs that get filed, training that gets completed and recorded. The evidence is the trail the program leaves behind.

A program that ticks every box on paper but produces no STRs, applies no enhanced due diligence, and shows no evidence of active monitoring may not satisfy the new standard.

Five things to check before your next FINTRAC examination

If you do only a few things this quarter, work through these five. Each is a place where the effectiveness standard is likely to expose a gap.

1. Does your risk assessment match your actual customer base? Open it and compare the customer types it describes against the customers you onboarded last quarter. If they have diverged, the assessment, and everything calibrated to it, is stale.
2. Can you show alerts being reviewed? Monitoring that leaves no documented review trail looks, to an examiner, like monitoring that is not happening. The disposition record is the evidence.
3. Can you explain your STR volume? A high-risk remittance business that files no STRs should be able to say why, with documented decisions behind it.
4. Are training completions recorded? "We train our staff" is not evidence. Dated, role-specific completion records are.
5. Has the program been reviewed in the last two years? A review of the program to test its effectiveness is required at least every two years. It must be carried out and documented by an internal or external auditor, or by the entity itself if it has no auditor, and the findings reported to a senior officer in writing within 30 days. An independent effectiveness review is a best practice, and many businesses use one because it tests the program the way an examiner would.

Test your program as if an examination were this week. The question is whether it would stand up today, not whether you could assemble the evidence if given a month's notice.

What this means in practice

Documentation and operation can no longer be managed separately. A policy that describes a procedure the business does not follow is worse than a gap: it records a discrepancy between what you say and what you do, and an examiner can test one against the other.

For businesses whose programs were written at registration and never revisited, this is the moment to close the gap between the binder and the day-to-day. For businesses that have grown (new products, new corridors, new customer types), the risk assessment probably no longer reflects reality, and every control calibrated to it has drifted with it.

Where to start

Start with the risk assessment, because it drives everything else. Then bring policies and monitoring into line with it, and confirm the result with a review.

• If your program has drifted or predates March 2026, a focused AML advisory engagement or a full compliance program build can close the gap to the new standard.
• If you need a named, accountable officer to own the program going forward, a fractional compliance officer carries it as a live obligation.
• If you want to know where you stand before an examiner tells you, an independent AML audit tests effectiveness directly.

The standard has moved, and many programs judged against it have not. Closing that distance should be a priority for any Canadian MSB or PSP this year.