FINTRAC Desk Examination: How to Produce Requested Records Within 30 Days

FINTRAC has called your compliance officer to notify your business of a compliance examination, and a formal notification letter confirming the details is on its way. That letter contains a request for information, documents, and records, along with a timeline for producing them. This is a document-production and examination-response playbook: how to read the request correctly, organize what FINTRAC has asked for, validate it before you send it, and avoid the mistakes that turn a manageable desk examination into a longer and more difficult one.

Many businesses search for phrases like “FINTRAC desk review,” “how to pass a FINTRAC audit,” or “FINTRAC audit preparation.” FINTRAC's own term for this activity is compliance examination, and where the examination is conducted remotely rather than at your premises, FINTRAC calls it a desk examination. This guide uses that terminology throughout, because the vocabulary matters here. A desk examination is no lighter than an on-site visit, and no step in it guarantees a “pass.”

If your business has not yet been contacted and you want to know what documentation you should already have on file, start with our FINTRAC Examination Readiness Checklist, which covers the broader governance, policy, training, and client-file documentation every reporting entity should maintain. This guide starts once FINTRAC has made contact and a document request is in your inbox.

What a FINTRAC Desk Examination Is

FINTRAC conducts compliance examinations under its mandate to assess compliance with Parts 1 and 1.1 of the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) and its associated Regulations. The PCMLTFA gives FINTRAC the authority to inquire into the business and affairs of any reporting entity covered by the Act, and FINTRAC carries this out through two examination formats.

• On-site examinations, conducted at your place of business.
• Desk examinations, conducted remotely.

You are told which format applies during the notification call and again in the written notification letter. In both formats, you are required to send the requested information, documents, and records to FINTRAC for a preliminary review before the assessment phase begins. For a desk examination, interviews with your compliance officer, employees, and agents are also conducted remotely, by telephone or videoconference.

FINTRAC applies a risk-based approach to decide which businesses it examines and how deeply, drawing on your compliance history, past examination findings, report quality and timing, and information available about your business and sector. Nothing about the desk format changes what is being assessed. FINTRAC uses the same assessment methods, reaches the same categories of findings, and can recommend the same range of outcomes, from no further action through to a Notice of Violation, regardless of whether the examination happens on your premises or remotely.

What Happens When FINTRAC Notifies Your Business

The process opens with a phone call, not a letter. A FINTRAC compliance officer calls the person responsible for implementing your compliance program, commonly your compliance officer, to discuss the upcoming examination's scope and proposed date.

A written notification letter follows, addressed to your compliance officer, confirming where and when the examination will take place. FINTRAC's current assessment manual states that this letter is usually sent 30 to 45 days before the examination date, and that larger businesses may be given more than 45 days given the volume of information and data typically involved.

The letter itself is FINTRAC's formal request for information, documents, and records, and for your assistance throughout the examination. It typically asks you to send your compliance program documents and, where relevant, lists of transactions and records of transactions in advance, so that a portion of the assessment can happen before the examination proper begins. FINTRAC has also been clear that it may come back for additional information or documents later in the process; the initial request is substantial but may not be exhaustive.

The 30-Day Record Production Rule: What It Actually Means

People often oversimplify this rule, so it helps to be precise. The Proceeds of Crime (Money Laundering) and Terrorist Financing Regulations require that any record you are legally required to keep be produced within 30 days of a request by an authorized FINTRAC officer. FINTRAC's assessment manual and its sector-specific record-keeping guidance both restate this as a record-keeping standard: your required records must be kept “in such a manner that they can be provided to FINTRAC within 30 days of a request,” and retained for five years, or longer where the PCMLTFA and associated Regulations specify a longer period.

This is a standard for how you keep your records. It applies whether or not an examination is underway, and it does not start a countdown when FINTRAC calls. FINTRAC can test it at any time: if asked today, could this reporting entity produce its required records within 30 calendar days? An examination is one occasion on which that standard gets tested directly.

The requirement applies to required records: the categories of records the PCMLTFA and its Regulations oblige a given reporting entity to keep. Depending on the reporting entity's sector and activities, required records can include account-opening records, large cash and large virtual currency transaction records, records of electronic funds transfers and virtual currency transfers, casino disbursement records, foreign currency and virtual currency exchange transaction tickets, information records, the records required under client identification and know-your-client requirements, and copies of reports submitted to FINTRAC. Which of these apply, and which additional sector-specific records apply, depends on the reporting entity's sector, the services it provides, and the specific PCMLTFA and Regulations requirements attached to those activities; a currency exchange business and a casino, for example, do not carry an identical required-record list.

Not everything FINTRAC asks for in an examination notification letter is a required record in this technical sense. An organizational chart, a description of how your business handles a particular product line, or a list of your active agents is useful and expected material. FINTRAC may also require other relevant information or documents under its examination powers, including through a notice that specifies the time and manner for production; under the PCMLTFA, a person or entity served with such a notice must provide the material in accordance with what the notice states. Those requests should be handled according to the instructions and deadlines set out in the applicable notice or examination request, and should not be treated as negotiable or open-ended. Not every line item in a document request carries the same statutory 30-calendar-day producibility clock that applies to required records. Treat the 30-day rule as the baseline standard your record-keeping systems need to meet at all times, and treat the specific instructions and deadlines in your notification letter and any related notice as the operative dates for that particular examination.

30 Days to Produce Records Is Not the Same as 30–45 Days’ Examination Notice

These two numbers often get conflated, and the confusion causes real scheduling mistakes. They are unrelated concepts that happen to share a similar figure.

Do not assume your business automatically has a fixed number of days to respond once the notification call happens. The instructions and dates in your specific notification letter, any related notice, and any dates agreed with your assigned FINTRAC compliance officer are what govern your production timeline for that examination.

Why the Notification Call Matters

FINTRAC treats the date of the notification call as the start of the compliance examination process, whenever the letter arrives and whenever any interview or on-site visit takes place. This has two direct consequences.

• Any reportable financial transaction from the period under review that has not been reported to FINTRAC as of that call date is treated as not having been reported, which can result in a deficiency.
• Any compliance program document, such as your policies and procedures, found to have been created or adjusted after that call date may itself be treated as a deficiency, separate from whatever the document's content says.

In practice, this means your internal examination-response work should begin as soon as the notification call occurs, not when the formal letter later arrives. The notification call does not start a statutory 30-day production clock; it mainly governs how FINTRAC treats late reports and post-notification document changes, as described above. The formal production deadlines for a given examination remain those stated in the applicable notice, request, and your underlying record-keeping requirements.

What FINTRAC May Request in a Desk Examination

The exact request depends on your sector, risk profile, the period under review, and FINTRAC's specific scope decisions, so no single checklist applies to every business. It is more useful to think in terms of categories.

Compliance program documents

Your compliance policies and procedures, your documented risk assessment, training program materials and delivery records, and documentation from your most recent effectiveness review, including evidence that its findings were actioned.

Transaction and reporting materials

This is the category businesses most often get wrong. FINTRAC does not need a list of the reports you already submitted; it already holds those in its own database. What it typically asks for is a list of your underlying large cash, large virtual currency, or electronic funds transfer transactions, pulled directly from your own source systems or the systems your third-party service provider uses, so that FINTRAC can compare that population against what you actually reported and identify any transactions that should have been reported but were not.

Client and know-your-client records

Identity verification evidence, entity information, beneficial ownership records where applicable, and third-party determination records where the activity in question requires them.

Business and operations information

Products and services offered, locations and agents, the systems and workflows behind your compliance program, and general organizational information FINTRAC needs to understand how your business actually operates.

No business should assume it will receive the identical request list as another reporting entity, even a similarly sized one in the same sector. The request in your notification letter, and any related notice, is the one that governs; a generic industry checklist helps you anticipate the request, but you still need to read the letter literally.

Build a Request-to-Record Matrix Before Producing Anything

Before anyone touches a source system, break the notification letter down into a working tracking document. FINTRAC does not prescribe this template. It is a practical project-management tool your team builds for internal use, and a useful habit whether or not an examination is underway.

A matrix like this stops your team from responding to a paraphrase of the request instead of its actual wording, and it gives whoever is coordinating the response one reference point instead of a set of email threads.

Step-by-Step: How to Respond to a FINTRAC Document Request

Step 1: Read the request literally

Separate the letter into individual, discrete items before assigning any work. Work from the wording of the letter, whatever your team assumes FINTRAC probably wants. If a request is ambiguous, ask your assigned FINTRAC compliance officer for clarification rather than guessing.

Step 2: Confirm scope and period

Identify internally, as a scoping exercise, exactly which entities, business lines, branches, agents, products, and transaction types the stated review period covers. This internal scoping keeps your retrieval work focused and prevents both under-inclusion and unnecessary over-production.

Step 3: Assign internal owners

Assign a named, accountable person to each item in your request-to-record matrix. Depending on your organization, this may span compliance, operations, IT or data, finance, agent management, senior management, and any external vendors who hold relevant data on your behalf.

Step 4: Retrieve from source systems

Pull data directly from the system of record rather than rebuilding it manually in a spreadsheet, wherever a system export exists. Manually reconstructed data is harder to defend and to reproduce if FINTRAC asks a follow-up question, and it is more prone to the kind of gaps FINTRAC's assessment methodology is designed to surface.

Step 5: Validate completeness

Before anything leaves your building, check the date range, the transaction population, missing fields, duplicate entries, branch and agent coverage, currencies, reporting status, client identifiers, and the export logic used to generate the file. Tie each check to what was requested instead of running a generic data-quality pass.

Step 6: Reconcile related records

Where relevant, reconcile transaction data against the client or KYC record it relates to, and against the required FINTRAC report and any internal decision record connected to it. Not every transaction generates every possible record. The check is that the chain a given transaction should produce is intact wherever FINTRAC's request calls for that connection.

Step 7: Document genuine gaps

If a record cannot be produced, do not fabricate a substitute or quietly recreate it. Record what is missing, why, where it should have existed, what searches were performed to locate it, and what corrective action may be needed. Where this points to a compliance failure that was not previously identified, see the section below on discovering non-compliance after notification.

Step 8: Package files logically

Use clear file names, folders, and a mapping back to FINTRAC's own request numbers. Include a short data dictionary for anything unusual, and keep version and date information visible so it is obvious which extract is current. FINTRAC does not mandate a specific naming convention; the goal is that an examiner unfamiliar with your systems can find their way through the production without needing to ask basic orientation questions.

Step 9: Submit through the instructed secure channel

Given the sensitivity of client and transaction data, FINTRAC encourages electronic submission through a secure digital mailbox service that uses encryption suited to transmitting sensitive information, and it asks businesses that want to use this option to contact FINTRAC for the current process. Confirm the mechanics with FINTRAC before submitting rather than assuming them from a past examination. Do not send sensitive client or transaction records by ordinary email unless FINTRAC has specifically instructed you to do so.

Step 10: Maintain a production log

Track what was requested, what was submitted, the submission date, the version, the method used, the person responsible, any follow-up requests received, and anything still outstanding. Like the request-to-record matrix, this is a practical internal control and not a FINTRAC-prescribed record. It is the most useful artifact if a later question arises about what was or was not produced.

How to Validate Transaction Data Before Submission

Data exports are where most avoidable production problems originate. Before sending a transaction export to FINTRAC, verify each of the following against the wording of the request. Not every item will apply to your situation:

• The date window matches the stated review period exactly, including time-zone handling at the boundaries.
• All relevant branches, agents, and channels are included, including those outside your primary system of record.
• Each transaction carries a unique identifier consistent across your source system and the export.
• Timestamps and time zones are recorded consistently.
• Amount, currency, and (where applicable) sender or recipient identifiers are populated.
• Product or channel and transaction status fields, including cancelled or reversed transactions, are captured and not silently excluded.
• The export's totals reconcile against your source system's own totals for the same period.
• The filters used to generate the export are documented, so you can explain exactly what population the file represents.

FINTRAC does not publish a field list that applies identically to every sector, so the test is concrete: does this export faithfully and completely answer the question FINTRAC asked?

Multiple Branches, Agents and External Vendors: Where Production Breaks Down

Where a business has multiple locations, FINTRAC's current assessment manual states that it typically asks for information, documents, and records from all locations to be made available for review at the location selected for the examination. This is a frequent point of failure for MSBs and other businesses with distributed operations, because branches and agents often maintain records on separate systems, in separate formats, or under separate retention practices.

Where agents are involved, FINTRAC's assessment methodology specifically contemplates asking a business for a list of its agents, copies of agency agreements, and a list of the transactions each agent has conducted, in order to confirm that reportable transactions handled by agents were actually submitted. A reporting entity remains responsible for its agents' reporting; an agency arrangement does not shift that responsibility.

FINTRAC's record-keeping guidance for money services businesses and foreign money services businesses is direct on the vendor and contractor question. Employees who keep records on the business's behalf are not required to keep them after their employment ends, and the same is true for a contractor once the contractual relationship ends. The obligation runs the other way: the reporting entity must obtain and keep the records that were held for it by an employee or contractor before that employment or contract ends. In practice, this means offboarding a compliance-adjacent vendor, such as an outsourced KYC provider or a transaction-monitoring service, or terminating an agent relationship, should trigger a records-retrieval step as well as a service cancellation. FINTRAC publishes equivalent record-keeping guidance for other reporting-entity sectors; confirm the specific wording that applies to your own sector before relying on this point in a live examination.

What Not to Rewrite After the Examination Starts

Because FINTRAC treats the notification call as the start of the examination, you cannot use the period after that call to quietly tidy up your compliance history. Specifically, avoid:

• Rewriting or backdating policies and procedures so they appear to have been current earlier than they actually were.
• Filing missing FINTRAC reports without informing FINTRAC that they relate to a gap identified after notification.
• Quietly recreating client identification or transaction records that should already have existed.
• Adjusting a risk assessment to look more current than it actually was on the notification date.
• Replacing outdated documents with new versions without disclosing that a replacement occurred.

FINTRAC's own guidance is direct on this point: it will generally not accept documents, records, or financial transaction reports created or corrected after the examination has started as evidence that a requirement was already being met during the period under review. Treating the post-notification period as a cleanup window does not remove a deficiency; it typically compounds it, because the timing itself becomes part of what FINTRAC assesses.

A real problem can and should still be fixed once it is found. But a fix made now does not prove the requirement was met throughout the period FINTRAC is reviewing, so describe the correction to FINTRAC as a correction.

What to Do If You Discover Non-Compliance After Notification

Discovering a gap while assembling a production is common. It is no reason to panic or to conceal the finding. FINTRAC's guidance is that if you identify non-compliance after an examination has started, you should inform your FINTRAC officer immediately and submit a voluntary self-declaration of non-compliance.

The distinction that matters here is timing. A voluntary self-declaration made before FINTRAC has started an examination is handled by FINTRAC working with the business to resolve the issue outside the examination context. A self-declaration made after the examination has started is treated differently: FINTRAC will assess the non-compliance as part of the examination itself, work with the business to correct it, and determine whether the non-compliance warrants an enforcement action. A self-declaration during an active examination does not stop the examination from assessing that gap, but it is the correct and expected way to disclose it once it has been found. This describes FINTRAC's process and is not legal advice; a business facing a significant gap discovered mid-examination should weigh that decision with its own legal or compliance counsel.

What Happens During FINTRAC Desk-Examination Interviews

FINTRAC may interview your compliance officer, employees, and agents as part of the assessment phase. For a desk examination, these interviews are conducted remotely, by telephone or videoconference, rather than in person.

FINTRAC has been explicit that it does not expect interviewees to memorize policies, procedures, or other documents word for word. Its stated goal is to confirm that your employees and agents are aware of the requirements that apply to their specific duties, and that they know how to seek clarification when they are uncertain. For preparation, staff should understand how their part of the process actually works day to day, be comfortable saying they are not sure and would check with the compliance officer, and describe real practice rather than reciting a script. Staff should not be coached toward rehearsed or misleading answers; the value of an interview to FINTRAC, and the credibility of your compliance program generally, depends on the answers reflecting how the business actually operates.

When FINTRAC Requests More Records or Expands the Scope

FINTRAC's process typically begins with a preliminary assessment of the requirements inside the initial scope: reviewing your documents, conducting preliminary interviews, and reviewing a sample of your transaction records and financial transaction reports. Where that preliminary work identifies areas needing more attention, FINTRAC may sample additional client records, transaction records, or reports, and may conduct follow-up interviews. This can lead FINTRAC to broaden the scope of the examination beyond what the original notification letter described.

If the scope changes, FINTRAC will notify you. There is no fixed formula for how much sampling FINTRAC will use or how far scope can expand; it depends on what the preliminary review finds, consistent with FINTRAC's risk-based approach to examinations generally. A request for additional material after your initial production is a normal part of the process and does not necessarily mean something has gone wrong.

What Happens at the Exit Meeting

Once FINTRAC has concluded the desk examination, or reached the point where it is ready to move to conclusions even if some review continues afterward, it holds an exit meeting, typically by telephone or videoconference for a desk examination, to discuss its preliminary findings with you. These preliminary findings are presented as deficiencies, and each deficiency corresponds to a violation of a specific provision of the PCMLTFA or its associated Regulations.

At the exit meeting, you may offer additional information to help clarify a deficiency, and FINTRAC will agree with you on a timeline for providing that material. After reviewing what you provide, FINTRAC may maintain the original deficiency as stated, modify it, or withdraw it. At this stage clarifying information can change the outcome. That is another reason accurate, well-organized production earlier in the process matters: it gives you a stronger evidentiary position if a deficiency needs to be clarified or contested.

The Other 30-Day Deadline: Post-Examination Action Plans

After the exit meeting, FINTRAC may send an examination findings letter to your compliance officer describing the findings discussed at the exit interview, along with the documents, client records, transaction records, and financial transaction reports it examined, the results of its interviews, and, where applicable, the number of items sampled and the number of instances of non-compliance found. Individual deficient records or reports are listed in an annex. The letter may also note “observations” that are not deficiencies but that FINTRAC believes could strengthen your program; observations can evolve into deficiencies in a future examination if the same pattern recurs.

The letter states one of several possible outcomes: no further compliance or enforcement action, possible follow-up compliance action, a recommendation for an enforcement action such as an administrative monetary penalty, or a Notice of Violation. In some cases, FINTRAC will ask for an action plan describing how and when you will address the causes of the identified deficiencies. Where FINTRAC does request an action plan, it must be sent within 30 calendar days of receipt of the findings letter, unless FINTRAC specifies otherwise.

This is a separate 30-day concept from the record-production standard discussed earlier in this guide, with its own trigger and its own deadline.

Whether or not an action plan is requested, FINTRAC still expects the underlying causes of a deficiency to be addressed within a reasonable time. Where a Notice of Violation is issued, our guide to responding to a FINTRAC Notice of Violation covers that specific process, and our overview of FINTRAC administrative monetary penalties explains how penalty amounts are assessed. Where a prescribed violation triggers a mandatory compliance agreement, see our explanation of FINTRAC mandatory compliance agreements.

Common FINTRAC Record-Production Failures to Avoid

None of the items below is automatically a violation on its own. Some are operational mistakes that slow an examination down; others can point to, or create, an underlying regulatory deficiency. Assess the distinction case by case, and do not assume every production error is minor.

• An incomplete date range that excludes part of the stated review period.
• Missing branch or agent data because an export only pulled from the head-office system.
• An inconsistent transaction population, where the export logic quietly excludes a category of transaction FINTRAC asked about.
• Export filters applied incorrectly, so the file answers a narrower question than the one FINTRAC asked.
• Missing client identifiers that make it difficult to connect a transaction record back to a client file.
• Policy documents submitted without clear version and date information, making it unclear which version applied during the review period.
• Records that turn out to be held only by a former contractor or vendor, discovered too late in the process.
• Manually reconstructed data submitted in place of an actual source-system export, without disclosing that it was reconstructed.
• Sending the wrong file version because version control broke down between drafting and submission.
• No production log, so the business itself cannot say with confidence what has and has not been sent.
• Mistakes in secure transmission, such as sending sensitive material through an unconfirmed or unauthorized channel.
• Submitting an incomplete file with no context and failing to explain a data limitation.

How ComplyFactor Can Support FINTRAC Examination Readiness

Responding well to a FINTRAC desk examination is largely a project-management and evidentiary exercise: reading the request accurately, retrieving the right records from the right systems, validating them, and presenting them in a way that lets FINTRAC do its assessment efficiently. ComplyFactor supports Canadian MSBs, FMSBs, and other FINTRAC reporting entities with examination readiness, document-request mapping, AML program review, transaction and data testing, remediation planning, and independent effectiveness reviews where a business wants an outside perspective before FINTRAC provides one. ComplyFactor does not represent clients legally before FINTRAC, cannot guarantee an examination outcome, does not control FINTRAC's findings, and cannot retroactively cure a compliance gap once an examination has already started; a well-organized response gives FINTRAC an accurate, complete picture of your program, which is the most a business can control once notification arrives.

Frequently Asked Questions

What if our source system cannot export data in the requested format?

Raise it with your assigned FINTRAC compliance officer rather than working around it silently. Explain the limitation, and where a system-generated list is not possible, FINTRAC's own assessment methodology already anticipates providing the underlying records instead, such as transaction tickets or receipts. What matters is that you disclose and explain the limitation instead of quietly transforming or reconstructing data.

Should we send extra documents FINTRAC did not request?

Generally, respond to what was actually asked, checked against your request-to-record matrix. Provide additional context only where it genuinely helps answer a specific request, and label it clearly as explanatory material rather than folding it into requested files. Sending a large volume of unrelated documentation does not automatically broaden FINTRAC's scope, but it does add to what FINTRAC has to sort through, and can occasionally invite scrutiny of material you were never asked to produce.

Can we ask FINTRAC to clarify an ambiguous document request?

Yes. If a specific item in the notification letter is unclear, ask your assigned FINTRAC compliance officer rather than guessing at what was meant. Clarifying a request is a normal part of the process and is no concession; it produces a more accurate response than working from an assumption FINTRAC never confirmed. FINTRAC will not necessarily rewrite or narrow the request, but you will understand it correctly before spending time on the wrong thing.

Should one person coordinate the entire examination production internally?

It helps considerably, as a matter of internal governance, although FINTRAC does not require it. A single production lead who owns the request-to-record matrix and the production log, even where individual departments retrieve and validate their own items, keeps the response consistent and avoids the same request being answered twice, differently, by two teams. Most businesses find it a practical control worth adopting for the duration of an examination.

What if two internal systems produce different transaction totals?

Reconcile the discrepancy rather than submitting whichever total looks more favourable. Check date ranges and time-zone handling, transaction status and reversals, duplicate entries, and whether both systems cover the same branches and agents, and confirm the export filters used in each system are actually comparable. If the discrepancy cannot be fully resolved before the deadline, document what you found, explain the likely cause, and disclose the difference to your assigned FINTRAC compliance officer rather than presenting one figure as though no discrepancy exists.

Can we correct a file after it has already been submitted to FINTRAC?

Contact your assigned FINTRAC compliance officer, explain what was wrong with the original submission, and provide a clearly identified corrected version rather than silently replacing the earlier file. Maintain your own version history so it is obvious internally, and to FINTRAC if asked, which version is current and why it changed. FINTRAC has not published a standalone formal correction procedure for examination production files the way it has for report corrections; treat this as a communication and version-control discipline rather than a prescribed process.

What if FINTRAC asks for a record our business believes it was not legally required to keep?

Do not simply decline to produce it based on your own internal assessment of what the PCMLTFA and its Regulations require. FINTRAC's examination powers extend to relevant information and documents beyond the narrow category of required records, so a request can be legitimate even where the item is not, in your view, a statutorily required record. Raise the disagreement with your assigned FINTRAC compliance officer and ask for clarification of the basis for the request. Where a significant dispute over a legal obligation remains, that is a question for your own legal counsel, not something to resolve unilaterally by withholding production.