What a CDD Review Actually Involves (And Why MSBs Need One Before They Bank)

Before a Canadian bank opens an account for a Money Services Business, someone inside that bank runs a customer due diligence review on the MSB itself. This isn't a formality. It's the gate that decides whether your business gets banked, gets banked with conditions, or gets declined — often without a clear explanation why.

Most MSB founders understand that they need an AML program to satisfy FINTRAC. Fewer understand that their bank is running its own due diligence review on them, using different criteria, before the bank will even consider an account application complete. This article walks through what that review actually covers, why it exists, and what to have ready before you approach a bank.

A CDD Review of Your MSB Is Not the Same as Your MSB's Own CDD Program

This distinction causes real confusion, so it's worth being precise about it upfront.

As a reporting entity under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA), your MSB has its own obligation to identify and assess its customers — the people and businesses sending money through your platform. That's your compliance program.

Separately, when you apply for a bank account, the bank treats your MSB as its customer. The bank — also a PCMLTFA reporting entity, and for federally regulated banks, subject to OSFI's AML expectations under Guideline E-13 — has to assess the money-laundering and terrorist-financing risk your business represents to them. That assessment is the CDD review this article is about.

Confusing the two leads MSBs to assume that having a compliant AML program automatically satisfies the bank. It's necessary, but it's only one input into a broader picture the bank is building of your business.

Why MSBs Get This Scrutiny in the First Place

FINTRAC's risk-based approach guidance identifies business type, products and services, delivery channels, and geographic reach as core factors in any reporting entity's risk assessment of its clients. Money services businesses — by the nature of moving funds across borders, handling cash, and serving customers who may not have other banking access — tend to score higher against several of these factors at once. That's not a judgment on any individual MSB; it's a structural reality of the sector.

Because of this, banks that choose to serve MSBs typically apply a deeper, more structured review than they would for a standard commercial customer, and they revisit that assessment periodically rather than treating account approval as a one-time event.

What Gets Reviewed: The Four Pillars

1. Entity Structure

The bank starts by confirming your MSB actually exists as the entity it claims to be, and that it's legally permitted to operate. This typically includes:

Gaps here are among the fastest ways to stall a review. A lapsed FINTRAC registration, a business description that doesn't match your actual activity, or an operating address that doesn't match your registered address will all generate follow-up questions before anything else gets looked at.

2. Ownership

Banks need to know who controls the business, not just who's named on the incorporation documents. This usually means:

ComplyFactor's guide to beneficial ownership verification in Canada covers how to run this search and document it properly — it's worth having this file ready before a bank asks for it, not after.

Complex or opaque ownership structures — multiple layers of holding companies, ownership split across several jurisdictions, nominee arrangements — will slow a review considerably even when nothing is actually wrong. If your structure is genuinely complex for legitimate commercial reasons, be ready to explain it in plain terms rather than letting the bank piece it together from documents alone.

3. Screening

This is where the bank checks your business and its principals against sanctions lists, watchlists, and adverse media. In practice this covers:

A hit doesn't automatically mean rejection. A true sanctions match will end the conversation; a PEP identification or a dated adverse media item usually triggers enhanced due diligence rather than an automatic decline. What matters most to the bank is whether you can explain and document any hit, not whether your file is entirely free of them.

4. Jurisdiction Exposure

Finally, the bank looks at where your money actually moves — not just where you're incorporated.

An MSB serving low-risk domestic corridors will clear this pillar quickly. An MSB with meaningful volume into jurisdictions FATF has flagged will face closer questioning, and should expect to explain the specific controls in place for those corridors rather than relying on a general statement that the AML program covers it.

The Table Banks Are Effectively Filling Out

This is illustrative rather than a fixed checklist — the exact weighting varies by bank, by MSB size, and by the specific corridors and products involved.

Why This Determines Approval — Not Just Documentation Completeness

It's tempting to treat this as a paperwork exercise: submit the right documents, get approved. In practice, the review is the bank forming its own risk opinion of your business, and that opinion has to hold up under its own regulatory scrutiny later. A bank's AML program — for federally regulated institutions, shaped by OSFI Guideline E-13 — has to demonstrate that it understood and priced the risk of every business relationship it accepted, MSBs included.

That's why a technically complete application can still stall: the bank isn't just checking boxes, it's deciding whether it's comfortable carrying your business as a client on an ongoing basis, including the monitoring and periodic review that comes after approval.

Preparing Before You Apply

The MSBs that move through this fastest treat the CDD review as something to prepare for in advance, not respond to reactively.

Weak documentation at this stage is one of the most common reasons banking applications stall or get declined outright. Getting this file in order before approaching a bank, rather than after a first rejection, is consistently the difference between weeks and months.

Frequently Asked Questions

Is a CDD review the same thing as the KYC my MSB does on its own customers?

No. Your customer identification obligations under the PCMLTFA are a separate requirement your MSB owes to FINTRAC for the people using your service. A CDD review is the bank assessing your MSB as its customer. The two overlap in method (identity, ownership, screening) but serve different regulatory relationships.

Does every bank apply the same standard when reviewing an MSB?

No. Banks set their own risk appetite and review depth within the bounds of their own AML program. Some banks decline MSBs as a category regardless of file quality; others review case by case. This is one reason ComplyFactor typically presents MSB clients with several banking options rather than one.

Can a bank re-run this review after my account is already open?

Yes. Ongoing monitoring means banks periodically reassess business relationships, particularly when a client's risk profile, ownership, or transaction pattern changes. A CDD review isn't a one-time gate — it's the first of several checkpoints over the life of the relationship.

What happens if the review flags a PEP among my owners or directors?

A PEP finding doesn't automatically block approval. It typically triggers enhanced due diligence — closer scrutiny of source of funds, more frequent monitoring, and sometimes senior management sign-off — rather than an outright decline.

If my ownership structure is genuinely complex, is there any way to speed up the review?

Provide a clear ownership diagram and a written explanation of the commercial rationale up front, rather than letting the bank reconstruct the structure from raw incorporation documents. Reviews slow down most when the bank has to ask repeated follow-up questions to understand a structure you could have explained in one page.

Where This Fits Into Your Broader Compliance Position

A CDD review is ultimately a test of whether your AML program and documentation hold up under outside scrutiny — which is exactly what FINTRAC examinations and effectiveness reviews test as well. If gaps show up here, they're worth treating as a signal, not a one-off obstacle.

If your compliance program needs strengthening before you're banking-ready, ComplyFactor's AML Compliance Program service builds documentation that holds up to both bank and FINTRAC scrutiny. For MSBs actively working through the banking process itself, see How to Get Banking for Your Canadian MSB or PSP.