What happens if your MSB fails a FINTRAC effectiveness review?

A failed FINTRAC effectiveness review does not automatically end your MSB registration. But it sets in motion a chain of consequences that, if left unmanaged, can do exactly that.

Understanding what FINTRAC does after a negative review, and what you are required to do, is the difference between a manageable compliance gap and a regulatory crisis. This article covers what a failed review means, what FINTRAC's response looks like, and the concrete steps an MSB must take to recover.

What "failing" an effectiveness review actually means

FINTRAC does not issue a pass or fail grade on an effectiveness review. The terminology is more nuanced, but the outcomes are not.

Under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) and its regulations (subsection 156(3) of the Proceeds of Crime (Money Laundering) and Terrorist Financing Regulations, or PCMLTFR), an effectiveness review is required at least every two years, carried out by an internal or external auditor or, if there is none, by the entity itself. It assesses whether your compliance program works in practice as well as on paper. Reviewers test your policies, procedures, risk assessment, and training program against actual operational evidence.

The review produces findings, categorized by severity:

• Significant deficiency: a control failure that materially undermines your program's ability to detect or report money laundering or terrorist financing.
• Deficiency: a gap that weakens the program without completely disabling a control.
• Recommendation: an improvement that would strengthen the program but does not represent a current failure.

A review with multiple significant deficiencies is, in practical terms, a failed review. If FINTRAC or your banking partners see it, it shows that your compliance program is not operating effectively.

FINTRAC's role: who sees the review?

The independent effectiveness review is an internal document. You commission it, your reviewer produces it, and you retain it. FINTRAC does not automatically receive a copy.

However, FINTRAC examiners typically request the most recent effectiveness review at the outset of a compliance examination. If you cannot produce one, or if the review is out of date, that absence is itself a finding: a failure to meet the two-year review obligation under the PCMLTFR.

If your review contains significant deficiencies and FINTRAC's examiner reviews it, those findings can become the roadmap for the examination. The examiner will test precisely the areas the review identified as weak. A poor effectiveness review followed by no remediation is one of the most damaging compliance positions an MSB can be in.

What FINTRAC does after a compliance examination

When FINTRAC conducts a compliance examination, separate from your independent review, and identifies violations, its response depends on the severity and pattern of the findings.

Sending a findings letter

For lower-severity findings, FINTRAC typically sends a findings letter outlining the deficiencies found. This is not a penalty. It is a formal notice that your program has gaps and that FINTRAC expects remediation. Respond with a remediation plan within the timeframe FINTRAC specifies. Failure to respond, or a response FINTRAC considers inadequate, escalates the matter.

Issuing a Notice of Violation

For more serious findings (particularly repeated violations, systemic program failures, or a pattern of non-reporting), FINTRAC may issue a Notice of Violation alongside an Administrative Monetary Penalty (AMP). This is covered in detail in our companion article on responding to a FINTRAC Notice of Violation.

Referring to law enforcement

In cases where FINTRAC's examination reveals evidence of actual money laundering or terrorist financing activity, or deliberate non-compliance designed to facilitate it, FINTRAC may disclose information to law enforcement and other designated agencies. In its 2025-26 annual report, FINTRAC reported 31 cases of non-compliance disclosed to law enforcement.

Registration revocation

FINTRAC has statutory authority under the PCMLTFA to revoke an MSB registration on specific grounds, including ineligibility and failure to answer a request for clarification within 30 days. A compliance program that has materially failed, particularly one with findings that go unremediated across multiple examinations, increases the risk of FINTRAC action. FINTRAC registers MSBs and does not issue licences.

In its 2025-26 annual report, published on 26 October 2026, FINTRAC reported that it revoked the registrations of 82 money services businesses in fiscal year 2025-26, up from 12 the year before.

Banking consequences: the risk most MSBs underestimate

FINTRAC enforcement actions are public. Administrative monetary penalties, Notices of Violation, and revocations are published on FINTRAC's website.

Your banking partners monitor these publications. A published AMP or Notice of Violation can prompt enhanced due diligence by your bank and, in some cases, account closure. For MSBs, losing a bank account is often more immediately damaging than the penalty itself.

Banks are particularly sensitive to two things: evidence that your compliance program is not functioning, and evidence that FINTRAC has taken formal action. An unresolved effectiveness review with significant deficiencies can also trigger bank concerns, even before FINTRAC gets involved, if it surfaces during a banker's periodic file review of your business.

Your obligations after a failed review

If your independent effectiveness review returns significant deficiencies, your obligations are clear.

• Remediation is not optional. The PCMLTFA requires that your compliance program be effective. A review that finds it is not effective creates an obligation to fix it. There is no statutory grace period, so remediation must begin immediately and be documented throughout.
• Document every remediation step. FINTRAC examiners look for evidence that findings were taken seriously. A remediation log that tracks each finding, the corrective action taken, who was responsible, and the completion date is the minimum standard. Verbal assurances carry no weight.
• Update your risk assessment and policies. Most significant deficiencies involve either an outdated risk assessment that no longer reflects your actual business, or policies not updated to reflect current PCMLTFA obligations. Both must be corrected before your next examination.
• Retrain relevant staff. Where a deficiency relates to how staff identify customers, file reports, or escalate suspicious activity, targeted retraining is required. Document who was trained, on what, and when.
• Consider an interim review. If your review returned multiple significant deficiencies, waiting two years for the next scheduled review leaves you exposed. An interim gap assessment, six to twelve months after remediation, confirms whether your fixes actually worked before FINTRAC tests them.

The most common deficiencies that cause reviews to fail

Findings that commonly produce significant deficiencies include:

• Incomplete or outdated risk assessment: FINTRAC expects your business risk assessment to reflect your current customer base, geographic exposure, products, and delivery channels. A risk assessment drafted at registration and never updated almost always fails.
• No evidence of ongoing transaction monitoring: Policies that describe monitoring without documentary evidence it is happening (flagged transactions, escalation records, review logs) are treated as non-functional controls.
• STR filing failures: Failure to file Suspicious Transaction Reports in circumstances that clearly warranted them, or STRs not sent as soon as practicable after reasonable grounds to suspect were established, are among the most serious findings FINTRAC makes.
• Third-party determination gaps: Many MSBs do not have documented processes for determining whether a transaction is conducted on behalf of a third party, a specific obligation under the PCMLTFR.
• Absence of a compliance officer: Having a named compliance officer on your FINTRAC registration but no evidence that person has performed compliance functions is a common and easily identified deficiency.

How ComplyFactor can help

If your effectiveness review has returned significant findings, or you have not had an independent review within the past two years, the time to act is now, not after FINTRAC schedules an examination.

ComplyFactor provides independent FINTRAC effectiveness reviews, along with full compliance program remediation for MSBs that need to close findings quickly. Our team works with you to prioritize deficiencies by risk, build a defensible remediation record, and prepare your program for the next examination cycle.

Contact ComplyFactor to discuss your current compliance position.

Frequently asked questions

Does FINTRAC automatically know if my effectiveness review found deficiencies?

No. The review is your internal document. FINTRAC does not receive it unless you are examined and the examiner requests it. However, if your program has not been remediated and FINTRAC examines you, the deficiencies will surface regardless.

Can FINTRAC revoke my registration based on an effectiveness review alone?

Not directly. Revocation requires FINTRAC to determine you are no longer eligible for registration, which typically follows a compliance examination, not just a review. However, a review with significant unresolved deficiencies creates the conditions for a negative examination outcome.

How long do I have to remediate findings from an effectiveness review?

There is no statutory deadline for remediating your own internal review findings. The obligation is to maintain an effective program. In practice, any deficiency that exists at the time of a FINTRAC examination will be treated as a current violation, so the sooner remediation is complete, the better.

What if my effectiveness review was conducted by someone without real independence?

FINTRAC's guidance says that, as a best practice, the reviewer should not be directly involved in the compliance program's activities. An internal review conducted by the same person responsible for the program's day-to-day operation falls short of that practice.