Outsourced Transaction Monitoring for Remittance MSBs: What a Good Review Cycle Looks Like

A good outsourced transaction monitoring review cycle starts before any alert is opened. It begins by confirming that the external reviewers received every transaction they were supposed to see. From there it:

• ranks alerts by risk
• assigns each one to a named reviewer
• investigates the customer's activity in context
• escalates serious concerns quickly to the person authorized to decide them
• records an outcome for every case
• tests a sample of closed work
• feeds what it learns back into the rules

At the end of each cycle, the money services business (MSB) should be able to say what the provider reviewed, what is still open, what was escalated and decided, and whether the service is working.

For a remittance MSB, the difference that matters is between outsourcing review work and outsourcing accountability. A provider can do most of the analytical work. The MSB keeps the obligations: to monitor, to report, to keep records and to run a compliance program that works. Accountability becomes real through specific controls: population reconciliation, decision authority, escalation logs, backlog ownership, quality testing and evidence the MSB can retrieve on its own.

What the MSB is actually outsourcing

"Outsourced monitoring" covers very different arrangements. The contract, not the marketing description, defines the provider's role.

Buying monitoring software is not the same as engaging external analysts. Not every provider offers investigations or support with suspicious transaction reports (STRs).

A remittance agent is also a different kind of third party from a monitoring provider. An agent deals with customers and generates transactions on the MSB's behalf. A monitoring provider analyses data after the fact. Agent data may feed the provider's review, but agent oversight is a separate control area, covered in agent oversight for remittance MSBs.

Where outsourced alert review sits in the legal framework

FINTRAC's ongoing monitoring guidance applies once a business relationship exists. It requires periodic monitoring based on the risk assessment, and enhanced ongoing monitoring of high-risk clients. One stated purpose is to detect suspicious transactions that must be reported; others include keeping client information current and reassessing risk. Records of the measures taken and the information obtained must be kept for at least five years from the date each record is created.

Two consequences follow.

Alert review is only part of ongoing monitoring. A provider reviewing rule-based alerts supports monitoring, but it does not by itself keep client information current or reassess risk. It covers that only if the contract and workflow say so.

Not every remittance sender is in a business relationship. Under FINTRAC's business relationship guidance, an MSB enters one the second time it is required to verify a client's identity within a five-year period, or when it enters into a service agreement with an entity. For a foreign MSB, that entity must be in Canada. Suspicious transaction reporting applies regardless, including to attempted transactions. The broader framework is summarized in PCMLTFA requirements. Rule design and detection basics are in AML transaction monitoring.

FINTRAC's compliance program guidance says the compliance officer may delegate certain duties but "remains responsible for the implementation of the compliance program". It also says that using outside help does not transfer the reporting entity's responsibility. Its STR guidance allows a service provider to submit an STR on the entity's behalf, but states that the legal responsibility "cannot be delegated".

The review cycle, step by step

A cycle is complete only when all of the following are true, not when the provider reports "all cases processed":

• every expected record was received
• every alert has a disposition or a named owner
• open cases were carried forward with next actions
• urgent escalations were decided or are clearly owned
• decisions are documented
• QA findings from the previous cycle are closed or tracked

An illustrative operating calendar

Illustrative internal schedule. FINTRAC does not prescribe a daily, weekly or monthly timetable for external alert review. Each MSB sets cadence by risk and volume, and urgent cases follow their own route.

Who does what

Illustrative allocation. Real allocations depend on the contract, staffing and the MSB's written procedures. None of it moves the MSB's obligations to the provider.

FINTRAC does not require the compliance officer to review every alert personally. A provider's analyst may also draft or submit STRs where the MSB has authorized it. What the MSB must be able to show is who decided what, under which authority, and when.

Is the provider seeing every transaction?

An empty or quiet queue may mean low risk, or it may mean missing data. The remittance-specific inputs that matter most are:

• transaction ID, date and time with time zone
• send and payout amounts, currencies and the rate applied
• origin and destination corridor
• sender reference and beneficiary identifier
• channel and agent location
• status, including cancellations and reversals
• the customer's risk rating and expected activity
• links to earlier transactions

If coverage was incomplete for several days, finding the cause is not enough. Backfill the missing records, re-run the rules over the affected period, and review the resulting alerts with the same priority as current ones. Record the gap, the affected population and the remediation. The control failure belongs in the monthly service review and in management reporting.

This is different from onboarding data feeds. If customer onboarding is also outsourced, see ongoing monitoring with third-party onboarding tools.

Prioritizing remittance alerts

The MSB's risk assessment should drive priority: customer, product, channel, geography and agent risk. A provider's default score should not. A short matrix keeps triage consistent:

Context matters. A worker sending part of each paycheque to family, in amounts and to corridors that match the profile, is ordinary remittance behaviour. The same customer sending ten times the usual amount to unrelated recipients is not. Geography, nationality or occupation alone never makes activity suspicious. FINTRAC's MSB indicators themselves note that a single indicator on its own may not appear suspicious.

Priority is an operational ranking. It is not a reportability decision, and it does not replace sanctions obligations.

What a proper handoff contains

"Please review this payment" is not a handoff. Every time a case moves between the provider and the MSB, in either direction, it should carry:

The status should state plainly which of these the case is:

• a closure recommendation
• a request for more information
• an escalated investigation
• a possible reasonable-grounds case needing a decision
• a technical exception that cannot yet be assessed

When information is missing

External analysts often need a payment purpose, the beneficiary relationship, earlier history, invoices, or details from an agent or payout partner. The contract and procedures should state:

• Who can ask. Often the MSB sends requests to customers, while the provider drafts them, because the customer relationship and any risk of tipping off sit with the MSB. Where the provider contacts partners directly, that must be authorized.
• How information is shared. Through a secure channel, limited to what the case needs.
• How requests are tracked. Each request has a date, an owner, a follow-up date and a status. The case stays visible while it waits.
• What continues meanwhile. The analyst keeps reviewing the available information. An open request does not pause the assessment.
• When not to wait. If the facts already gathered give reasonable grounds to suspect, the STR proceeds. FINTRAC requires submission as soon as practicable after the measures that establish those grounds are completed, and it must be treated as a priority. Neither an outstanding request nor a contractual service level extends that.
• How the case resumes. When information arrives, the case returns to the queue at its existing priority and is reassessed.

For drafting customer, partner and bank requests, see the AML request for information templates.

Dispositions and who can close what

A routine false-positive closure is an operational decision. A substantive conclusion that reasonable grounds are not established, after a real investigation of concerning facts, is a different decision and needs fuller documentation. That is covered in documenting a decision not to file an STR.

Keeping STR decisions from falling between two organizations

The sequence is straightforward:

1. The provider identifies potentially suspicious activity.
2. It sets out the facts and its analysis.
3. A person authorized under the MSB's procedures decides whether reasonable grounds to suspect exist.
4. The MSB makes sure the report is filed if required.
5. Status and evidence are recorded with restricted access.

The risk lies in the gaps between those steps. Controls that close them:

• A dedicated escalation route. A dedicated channel and contact, not a general inbox. Out-of-hours coverage if the risk profile requires it.
• Time stamps. Escalation sent, received and acknowledged, each with the recipient's name.
• Decision tracking. Every escalation shows "decision pending", "STR filed" with the FINTRAC reference, or "not established" with the rationale.
• Fallback. A named alternate decision-maker when the primary one is unavailable.
• Duplicate control. One case owns each reportable matter, so two teams don't file or both assume the other did.
• Restricted access. The existence and contents of an STR are disclosed internally on a need-to-know basis. FINTRAC's guidance prohibits disclosing a report's contents with intent to prejudice a criminal investigation.

FINTRAC sets no monetary threshold and no fixed number of days for STRs. The timing rule is the one described above.

Managing open cases

Illustrative backlog register. Fictional cases; not a FINTRAC form.

Age alone is misleading. An administrative case open for three weeks while a customer is chased may be low risk. A potential sanctions match that is two hours old may not be. Review the backlog by priority first, then by age within each priority. The register should also make the following visible:

• Stale cases: no action within the internal limit for their priority.
• Repeat alerts: the same customer alerting again while a case is open should be linked to that case, not reviewed separately.
• Coverage: cases are reassigned during leave or holidays, with a named backup.
• Missed service levels: these escalate to the provider lead, and then to the compliance officer.
• Carry-forward: cases moving into the next period keep their owner and next action.
• Closure verification: a sample of closures is checked against the evidence.

All the dates and response targets in the register are the MSB's own internal standards. FINTRAC sets no universal limit on how long a case may stay open. Its STR timing ("as soon as practicable" once reasonable grounds are established) applies whatever the register says.

What quality assurance should test

Sample closed and open cases each cycle, weighting the sample towards high-risk and borderline outcomes. For each case, test whether:

• the disposition is correct and the rationale is reasonable
• all relevant transactions were reviewed, including other channels and linked parties
• the customer context was used, and red flags were assessed rather than just listed
• escalation happened when it should have, and on time
• evidence references open and support the notes
• high-priority cases were handled first
• patterns across linked transactions and repeat alerts were considered
• reviewers reach consistent outcomes on similar facts
• follow-up actions, such as profile updates, were completed
• the population behind the cycle was complete

Record each exception with its severity, root cause, owner and due date. Retest after remediation.

Keep four activities separate:

• Case quality control: checks on individual cases, routinely.
• Provider quality assurance: testing of the provider's service as a whole.
• Rule-performance analysis: whether scenarios detect what they should.
• FINTRAC's two-year effectiveness review: the review of the compliance program. Each review must start within 24 months of the start of the previous one, after that one is completed, and be carried out by an internal or external auditor, or by the business itself if it has no auditor.

The first three feed the fourth. None replaces it.

A provider scorecard

Illustrative metrics. FINTRAC does not prescribe a scorecard or target percentages; set internal thresholds and explain them.

STR counts are not a performance measure. More reports do not prove better monitoring, and fewer do not prove worse. Report them for context only, alongside the quality results.

Scenario 1: related remittances across channels

Fictional. A remittance MSB sends transfers online and through agent locations. Its provider receives online transactions daily and agent transactions in a weekly file.

The three transfers, all to the same beneficiary, in Eastern Time:

 #  Date and time  Channel  Amount  T1  Tue Sep 8, 2026, 19:42  Online  CAD 2,900  T2  Wed Sep 9, 2026, 11:15  Agent location, cash-funded  CAD 3,400  T3  Thu Sep 10, 2026, 01:42  Online  CAD 3,100

• Original alert. A velocity rule fires on T1 and T3: two online transfers, 30 hours apart, to a beneficiary new to the customer. The customer's profile shows monthly transfers of about CAD 800 to a family member in another country.
• First look. The analyst sees two transfers, notes the new beneficiary, and asks the MSB for the payment purpose. The case is held as "information requested".
• Discovery. The weekly population reconciliation shows that one agent location's file for that week was never delivered. When it is backfilled, it contains T2.
• Reassessment. The case now shows three transfers across two channels within 30 hours, totalling CAD 9,400. That is roughly ten times the customer's usual monthly pattern, to a new beneficiary with no known relationship to the customer. The agent's notes for T2 also record that another person appeared to direct the transaction, and the customer's answer to the purpose request is vague and inconsistent with those notes. The monitoring analysis looks across the whole multi-day pattern. Separately, the reporting team applies FINTRAC's prescribed 24-hour aggregation rules to the MSB's own static window, which here runs midnight to midnight under its policy. On that basis, each transfer falls in a different window. A 30-hour span is not one 24-hour window, and neither test depends on the other. The combined amount does not establish suspicion. Its being below CAD 10,000 is no reassurance either.
• Escalation. The analyst escalates with a facts summary, the three transactions, the agent notes and the customer's response.
• Decision. The compliance officer weighs the combination of facts against FINTRAC's MSB indicators, not any single one. These include the profile change, the use of multiple channels, a possible instructing third party and an unexplained new beneficiary. She concludes that reasonable grounds to suspect are established, and the STR is filed as soon as practicable. With different facts, for example a documented family emergency consistent with the agent notes, the outcome could be different. The decision record would explain why.
• Evidence kept. The alert, reconciliation report, backfilled file, case notes, request log, decision record and STR acknowledgement. Access to the STR material is restricted.
• Control fix. Agent files move to daily delivery, with a late-file alert. Every customer with agent activity in the gap week is re-run through the rules, and the resulting alerts are reviewed. The gap is reported in the monthly service review.

Scenario 2: a backlog during a corridor surge

Fictional. After a natural disaster in a destination region, transfers on that corridor triple for three weeks. Most of this is ordinary family support. At the same time, the provider's lead analyst for the account goes on unplanned leave.

• Detection. The weekly aging report shows open cases rising from 45 to 310. Twelve high-priority cases are past the internal target, and two potential sanctions matches are still unreviewed after a day.
• Triage. The compliance officer and the provider lead re-sort the queue by priority. The two potential sanctions matches go to the MSB's sanctions procedure the same day; both prove to be false matches, and this is documented. High-priority cases come next, then standard.
• Reassignment. The provider assigns two backup analysts. The MSB's own compliance delegate reviews urgent and high-priority cases directly for one week.
• What cannot be done. Volume-rule alerts on the surge corridor are not closed in bulk. Analysts review them individually using a documented surge rationale, comparing each customer's activity with their own history. A temporary threshold change on the corridor is considered, but rejected without a documented risk assessment and compliance approval.
• Retrospective review. Once the queue is under control, every case that breached the internal target is checked for whether the delay affected an escalation. One case should have been escalated nine days earlier. It is escalated, the reasonable-grounds decision is made, and the delay is recorded in the case file.
• Service failure. The breach is logged in the provider issue register, with its root cause: a single point of failure in staffing, and no surge plan.
• Contract and service changes:
  • a named backup analyst
  • a surge clause with agreed additional capacity
  • daily aging reports while the backlog exceeds an agreed level
  • notice of key staff absences
• Verification. Four weeks of scorecards show the backlog back within tolerance. A targeted QA sample of surge-period closures finds no further missed escalations, and the issue is closed at the oversight meeting.

Oversight meetings and corrective action

There is no legally mandated meeting format, but a regular meeting with the provider, typically monthly, gives oversight a fixed point. An illustrative agenda:

1. Scorecard results against internal service levels
2. Backlog by priority, and any stale cases
3. Urgent and high-priority escalations: timing and outcomes
4. QA findings and rework themes
5. Data access and completeness issues
6. Changes in risk: new corridors, products, agents, volume shifts
7. Provider staffing, turnover and training gaps
8. Corrective actions: new, overdue and closed
9. Repeat deficiencies, and whether to escalate to senior management

Minute the decisions and track actions to closure, with evidence. Repeat findings should change the response: closer sampling, contractual remedies, or senior management involvement.

Contract clauses that make oversight possible

FINTRAC does not prescribe a standard outsourcing agreement or service level, and a contractual service level never changes when an STR is due.

Privacy, confidentiality and evidence

Give the provider only the customer and transaction information its scope needs, through secure transfer and role-based access. Under the applicable privacy law, whether PIPEDA or a substantially similar provincial private-sector statute, the MSB generally remains accountable for personal information it transfers to a service provider for processing. The Privacy Commissioner's guidelines for processing personal data across borders explain that the transferring organization must use contractual or other means to ensure comparable protection. A contract is a protection tool, not a separate legal basis for wider disclosure or reuse. In practice:

• Agree where data is processed, including any cross-border delivery, and which subcontractors may access it.
• Keep STR-related information restricted on both sides.
• Make sure case files, decision records and supporting evidence can be retrieved by the MSB without the provider's help, including during a FINTRAC examination.
• On termination, require complete export of cases and evidence in a usable format.

Retention periods differ by record type. Ongoing monitoring records must be kept for at least five years from creation. An STR copy must be kept for at least five years after the report is sent. Map each record category in the outsourced process to its own rule, and set contractual retention for anything else.

Outsourced monitoring checklist

• Full transaction population received and reconciled, by channel, each cycle
• Alert coverage and priority criteria set from the MSB's risk assessment
• Provider scope and permitted decisions documented
• Escalation route, alternate decision-maker and out-of-hours coverage in place
• Dispositions defined and applied consistently
• Every open case has an owner and a next action
• Reasonable-grounds decisions tracked separately and made promptly
• QA sample completed and findings remediated
• Service-level breaches logged and addressed
• Scorecard reviewed at the oversight meeting
• Senior management informed of material issues
• Evidence retrievable by the MSB independently
• Outsourced monitoring included in the next two-year effectiveness review

Frequently asked questions

What happens to open investigations when a monitoring contract ends?

They remain the MSB's cases. Before the exit date, agree a cut-over list of every open case with its status, evidence and next action. Then either have the outgoing provider finish defined cases by a set date, or transfer them to the new team with a structured handoff. Any case where reasonable grounds may exist should be decided by the MSB's authorized person before the transfer, rather than waiting for a new team to pick it up. Confirm that all case files have been exported and can be opened before access ends.

Can two providers review different product lines for the same MSB?

Yes, but the split creates a blind spot. A customer who uses both money transfer and foreign exchange can look normal to each provider separately. The MSB has to maintain or arrange consolidated monitoring oversight. It can do that through its own systems, or through a shared monitoring arrangement with controlled access, a common customer identifier and cross-referral rules between the providers. Either way, customer-level reviews across product lines should be performed or coordinated by the MSB's compliance function.

What if the provider finds a possible issue involving the MSB's own employee or agent?

The escalation should bypass the person concerned and anyone who reports to them. The agreement should give the provider a direct route to the compliance officer, or to a designated senior officer if the compliance officer is involved. Restrict the case so that only those handling it can see it. Assess it in the usual way, including whether reasonable grounds to suspect exist, and handle the employment or agent-relationship questions separately.

Outsourced reviewers can carry much of the alert workload, but the cycle still needs someone with authority to set monitoring parameters, decide escalations and stand behind the case record. ComplyFactor provides fractional compliance officer services for Canadian MSBs. These include transaction monitoring oversight, review of flagged activity, escalation decisions for suspicious transaction assessment, documented investigation outcomes and reporting support.