FATF's New Information Sharing Report: What It Means for Canadian AML Compliance

The Financial Action Task Force (FATF) recently published a comprehensive report on information sharing between public and private sector organizations working to combat illicit finance. The report, "Information Sharing to Combat Illicit Finance – Global Overview of Public and Private Sector Partnerships and Data Protection Arrangements," documents how financial crime detection is increasingly dependent on secure information exchange, collaborative risk analysis, and coordinated action.

For Canadian reporting entities—especially MSBs, PSPs, fintechs, crypto and VASP companies, finance and leasing firms, and other organizations subject to FINTRAC obligations—this report signals an important shift. AML compliance can no longer operate in isolation. The report shows that financial crime is more digital, faster-moving, and increasingly cross-border. Stopping it requires businesses to share information securely, act on emerging trends, and demonstrate documented decision-making. This matters because these themes align with the direction of modern risk-based AML supervision, including governance, documentation, ongoing monitoring, and effective controls.

Why FATF Is Focusing on Information Sharing

Modern financial crime moves fast. Money laundering, terrorist financing, proliferation financing, and fraud exploit gaps in detection and information flow. A transaction that looks routine at one financial institution may be part of a larger illicit scheme visible only when information is shared across institutions and sectors.

FATF's focus on information sharing reflects this reality. The report documents how public agencies (FINTRAC, law enforcement, central banks, financial intelligence units worldwide) and private sector organizations (banks, payment service providers, fintechs, cryptocurrency exchanges, telecoms, digital platforms) are building formal and informal partnerships to exchange data, typologies, red flags, and emerging risk trends.

Information sharing works when:

• Financial institutions report suspicious activity promptly and with clear rationale
• Public and private sectors exchange typologies and emerging fraud patterns
• Businesses update their internal monitoring rules based on new threats
• Data is protected through encryption, access controls, and privacy compliance
• Organizations can act on the information they receive

Without information sharing, each organization operates with incomplete information. With it, patterns emerge. Connections become visible. Enforcement becomes faster and more effective.

The report identifies at least 84 public-private partnerships globally, showing how jurisdictions are using structured information-sharing models to improve the detection, analysis, and disruption of illicit finance risks.

Key Takeaways from the FATF Report

The FATF report highlights several important realities for AML compliance:

1. Public-private partnerships are becoming more important

Governments alone cannot detect and stop all illicit finance. Financial institutions and private sector organizations see transactions in real time. They hold customer data, transaction records, and behavioral patterns that law enforcement cannot access unilaterally. Effective AML requires formal channels for secure information exchange between public agencies and private businesses.

2. AML compliance cannot depend only on internal data

A single business's transaction data tells only part of the story. Fraud and money laundering schemes span multiple institutions, payment methods, and jurisdictions. Businesses need to monitor their own activity but also stay informed about external threats, emerging typologies, and risk trends flagged by regulatory agencies and peer organizations.

3. Fraud, money laundering, and digital payments are increasingly connected

Criminals move seamlessly between traditional finance and digital assets. A customer may use a currency exchange to convert funds, a cryptocurrency platform to move value across borders, and a remittance service to reach a beneficiary. Each transaction looks routine in isolation. Only through information sharing do patterns emerge.

4. VASPs, fintechs, telecoms, and digital platforms have a growing role

Money moves through many channels now. Virtual asset service providers, fintech payment apps, mobile money services, and telecom payment systems are all part of the financial ecosystem. AML compliance must address these channels, and information sharing must include them.

5. Data protection must be built into information sharing

Information sharing does not mean abandoning privacy or data protection. The FATF report emphasizes that secure information exchange requires encryption, access controls, data minimization, and compliance with privacy laws. Businesses cannot share customer data freely; they must follow legal and regulatory frameworks governing data protection.

6. Information sharing only works when businesses can act on it

Receiving information about emerging threats is only useful if compliance teams can update their risk assessments, adjust their monitoring rules, retrain their staff, and respond to new indicators. A business that receives typology information but never updates its transaction monitoring rules gets no benefit.

What This Means for Canadian Reporting Entities

The FATF report does not create new Canadian legal obligations. FINTRAC's rules and the Proceeds of Crime (Money Laundering) and Terrorist Financing Act remain the primary framework for Canadian AML compliance.

However, the report signals the direction of stronger AML expectations. It reflects how effective AML compliance is practiced globally. For Canadian businesses, this means:

Monitoring and surveillance are evolving. Businesses should expect regulators and law enforcement to rely increasingly on real-time information sharing, collaborative risk analysis, and rapid response to emerging threats. Your AML program should support this.

Documentation matters more. When businesses must justify their AML decisions to regulators and law enforcement partners, documentation becomes critical. Why was this alert escalated? Why was that alert closed? What led to this suspicious transaction report filing? Clear records demonstrate that your decisions are reasoned and defensible.

Risk assessments need updating. As new fraud typologies emerge and criminal techniques evolve, AML programs need to adapt. A risk assessment written two years ago may not capture current threats. Businesses should review and update risk assessments at least annually or when their business model changes.

Compliance officers need earlier involvement. When a business launches a new product, payment corridor, or customer segment, compliance should be part of the planning—not added afterward. AML controls should be built into product design and customer onboarding from the start.

Training should reflect real threats. Generic AML training is forgettable. Training should address the typologies, red flags, and threats actually relevant to your business. A remittance company's staff need different training than a cryptocurrency exchange's staff.

Practical AML Lessons for Canadian Businesses

Use this checklist to review whether your AML program aligns with information sharing best practices:

1. Risk assessment reflects current fraud typologies

Review your documented risk assessment. Does it address current money laundering and fraud methods? Does it reflect new risks from digital payments, cryptocurrency, or emerging payment corridors? If your risk assessment hasn't been updated in over a year, consider refreshing it.

2. Staff know when and how to escalate activity

Can your frontline staff recognize suspicious activity? Do they know the escalation process? Can they explain their reasoning when they flag a transaction? Conduct spot checks: ask compliance staff why alerts were escalated or closed. Their answers should show clear reasoning.

3. Alert closure and escalation decisions are documented

Every alert should be reviewed and the decision documented. Why was this alert cleared? What factors did you consider? What sources did you check? Documentation shows that your program works deliberately, not randomly.

4. Monitoring rules are updated when new risks emerge

When FINTRAC publishes guidance on new typologies, or when industry partners share information about emerging fraud patterns, your business should assess whether your monitoring rules need adjustment. Outdated rules miss new threats.

5. AML training is specific to your business

Is your training copied from another industry or tailored to your specific operations? Training should address the risks actually present in your business: the corridors you serve, the customers you onboard, the payment methods you use, the fraud risks you face.

6. Information-sharing practices comply with privacy and data protection

If your business receives threat information from public agencies or peer organizations, are you handling customer data securely? Are you limiting access to those who need it? Are you complying with privacy laws when data is shared?

7. AML program effectiveness is tested independently

An independent review tests whether your policies work in practice. Do your staff follow documented procedures? Do your monitoring rules catch the patterns they're supposed to catch? Is your customer identification process working? An independent AML audit provides confidence that your program actually operates.

Where Businesses Often Fall Short

Common AML program weaknesses often include:

Information is collected but not analysed. Businesses gather customer data, transaction records, and monitoring alerts but never convert that information into better risk decisions. Data sits unused.

Alerts are reviewed without clear rationale. Staff close alerts with minimal investigation. There's no documented thought process. FINTRAC examiners cannot see why decisions were made.

Risk assessments are not updated after new typologies. FINTRAC or industry groups publish information about new fraud methods or money laundering techniques. Businesses read the guidance but don't update their risk assessment or monitoring rules.

Compliance teams are excluded from product and payment decisions. A business launches a new payment corridor or customer type without consulting its compliance team. The compliance program is not adapted to the new risk profile.

Records do not show how decisions were made. When FINTRAC examines the business, auditors cannot retrieve documentation showing that suspicious activity investigations were thorough and reasoned.

AML programs exist on paper but are weak in practice. Policies look good. Staff don't follow them. Monitoring rules are configured but not working correctly. Management doesn't understand the program.

These gaps are preventable with clear governance, documented decision-making, regular training, and independent testing.

How This Connects to FINTRAC Readiness

The FATF report is not a FINTRAC rule. But Canadian businesses should treat it as a practical reminder to strengthen the fundamentals that FINTRAC examines:

An effective AML compliance program includes clear policies, documented risk assessment, customer identification controls, transaction monitoring, suspicious activity escalation procedures, comprehensive recordkeeping, staff training, and independent testing. These fundamentals are what FINTRAC looks for during examinations, and they are what the FATF report describes as essential to modern AML compliance.

When you can show FINTRAC that your AML program is documented, regularly updated, supported by staff training, and tested independently, you demonstrate that your organization takes illicit finance seriously. That matters.

Final Thoughts

The FATF report's core message is clear: AML compliance can no longer work in silos. Financial crime is digital, fast, and cross-border. Stopping it requires information to flow securely between public agencies and private businesses, between institutions, and within organizations. It requires businesses to analyze information, update their controls, and document their decisions clearly.

For Canadian reporting entities, this is both a challenge and an opportunity. The challenge is that effective AML requires ongoing investment in governance, documentation, training, and testing. The opportunity is that businesses that invest in robust AML programs—with clear documentation, regular updates, and independent verification—are better positioned to detect and prevent financial crime and to demonstrate their commitment to regulators.

If your business is reviewing its AML program against these best practices, consider conducting an AML advisory review to identify gaps and opportunities for improvement. ComplyFactora helps Canadian MSBs, PSPs, fintechs, VASPs, and other reporting entities review AML programs, strengthen documentation, and prepare for FINTRAC scrutiny.

Reference: For the full FATF report, visit Information Sharing to Combat Illicit Finance – Global Overview of Public and Private Sector Partnerships and Data Protection Arrangements

ComplyFactor Advisory Team

ComplyFactor specializes in AML/CTF compliance, FINTRAC MSB and PSP registration, independent effectiveness reviews, and practical compliance program design for Canadian MSBs, PSPs, fintechs, VASPs, and other reporting entities.

Our services Book a consultation