ComplyFactor provides independent AML audit services to businesses across Canada, including Money Services Businesses (MSBs), Foreign Money Services Businesses (FMSBs), certain payment service providers with FINTRAC obligations, fintechs, and virtual currency businesses operating as MSBs or FMSBs. Our effectiveness reviews are conducted by compliance specialists with direct experience in Canadian AML regulation.
FINTRAC reporting entities must review the effectiveness of their compliance program at least every two years. ComplyFactor tests how key AML controls operate in practice and provides a clear, written remediation roadmap for any gaps identified.
We work with Canadian businesses that need to demonstrate AML compliance to FINTRAC — whether you are preparing for a scheduled effectiveness review, responding to a FINTRAC examination notice, or strengthening your program proactively.
Our AML audit covers the full scope of your PCMLTFA obligations — from transaction monitoring and KYC file quality to risk assessment validation and STR reporting. At the end of every engagement, you receive a written report suitable for presentation to senior management, satisfying the regulatory requirement for a biennial effectiveness review.
Bill C-12: FINTRAC penalties for serious AML violations now reach $4,000,000 under Bill C-12 (March 2026). Full examinations are active across all sectors. An independent audit is your strongest protection.
A FINTRAC two-year effectiveness review — often called an AML audit — assesses whether a reporting entity’s AML compliance program works effectively in practice. FINTRAC reporting entities must carry out this review at least once every two years, covering:
FINTRAC reporting entities that are required to maintain a compliance program must review its effectiveness at least once every two years. For ComplyFactor’s core client base, this commonly includes:
Currency exchange, remittance, payment and other businesses operating as MSBs or FMSBs.
Certain payment service providers are covered by FINTRAC as MSBs or FMSBs, depending on the payment services they provide.
Businesses dealing in virtual currency that operate as Canadian MSBs or foreign MSBs.
Effective April 1, 2025, financing or leasing entities within scope became subject to FINTRAC obligations.
FINTRAC examinations and enforcement actions repeatedly highlight weaknesses in core compliance-program controls. Common areas that warrant close review include:
ComplyFactor’s independent AML audit reviews the core elements of your compliance program against applicable PCMLTFA requirements and FINTRAC guidance. The scope is tailored to your business model and typically includes:
We assess whether your monitoring system is calibrated correctly — including documented thresholds, escalation procedures, and evidence that alerts are being reviewed and actioned.
We test a risk-based sample of customer files, including identity verification, beneficial ownership, source-of-funds documentation, third-party information, and ongoing monitoring evidence where applicable.
We review whether your risk assessment reflects your customer types, geographies, products, services, delivery channels, and other relevant risk factors, and identify gaps that may require remediation.
We verify that Suspicious Transaction Reports and Large Cash Transaction Reports have been filed correctly, on time, and with the required information.
We confirm that your training is documented, role-specific, completed on schedule, and meets the standard FINTRAC expects during an examination.
If your business is subject to FINTRAC’s compliance program requirements, a two-year effectiveness review must be carried out at least once every two years.
Every ComplyFactor AML audit follows a structured methodology designed to assess the effectiveness of applicable AML controls and provide senior management with clear, documented findings and remediation priorities.
We map the PCMLTFA obligations applicable to your business before fieldwork begins, including customer types, transaction volumes, geographic exposure, products and services, and applicable reporting requirements. A scoping call confirms the review scope and timeline.
We test how key controls operate in practice, including transaction monitoring parameters, sanctions screening where applicable, and STR escalation procedures. We document control weaknesses, evidence gaps, and areas requiring remediation.
We conduct risk-based sampling of KYC and EDD files, reviewing identity verification, beneficial ownership, source-of-funds information, third-party records, and ongoing monitoring evidence where applicable.
You receive a written audit report summarizing the review scope, findings, identified deficiencies, severity ratings, and a prioritised remediation plan with recommended implementation timelines. The report is designed to support management's review and documentation of the effectiveness assessment.
Bill C-12 received Royal Assent on March 26, 2026 and introduced a significantly stronger FINTRAC administrative monetary penalty framework. For violations occurring on or after March 26, 2026, higher penalty limits and new enforcement tools apply. This makes documented effectiveness testing, timely remediation, and evidence of an effective AML compliance program increasingly important. For an entity, the maximum cumulative penalty for prescribed violations identified in one notice is the greater of $20 million or 3% of its gross global revenue for the previous financial year.
AML audit costs in Canada vary based on the size and complexity of the business, the scope of the effectiveness review, and the condition of the existing compliance program. Key pricing factors include:
ComplyFactor uses scope-based pricing for Canadian AML audits. We begin with a free 30-minute scoping call to confirm your business model, review scope, testing requirements, and expected timeline, then provide a written quote within 48 hours. Standalone audit engagements do not require an ongoing retainer.
Request an AML audit quote — free 30-minute scoping call with our Canada team and written scope and pricing within 48 hours.
+1 807 806 0444
Suite 211, 320 Matheson Blvd West, Mississauga, ON L5R 0H2
Whether you have received notice of a FINTRAC examination or are preparing proactively, these steps can help you identify gaps and organize the evidence FINTRAC may request.
Collect current versions of your AML policies and procedures, risk assessment, training records, effectiveness review documentation, and other records relevant to your FINTRAC obligations.
Review applicable FINTRAC reporting history and confirm that reportable transactions were identified, submitted within the required timelines, and supported by complete records.
Review a risk-based sample of customer files appropriate to your business size, complexity, transaction volumes, and risk profile. Check applicable identity verification, beneficial ownership, source-of-funds, third-party, and ongoing monitoring records.
Review whether your transaction monitoring rules, thresholds, and escalation procedures reflect your current business and risk profile, and document the rationale supporting them.
An external effectiveness review can help identify compliance gaps, test controls, and prioritize remediation before a FINTRAC examination or other regulatory review.
Every ComplyFactor AML audit engagement includes the following — all within the agreed scope price, with no hidden fees:
We work with Canadian MSBs, FMSBs, certain payment service providers, fintechs, and virtual currency businesses that fall within FINTRAC’s AML framework. Our focus is on practical compliance for non-bank financial businesses.
Unlike generalist firms, we focus on MSBs, FMSBs, payment businesses, fintechs, and virtual currency businesses with FINTRAC compliance obligations.
Our audit methodology reflects current PCMLTFA requirements, FINTRAC guidance, and the March 2026 changes to the administrative monetary penalty framework.
No retainer. No surprise fees. We agree scope and price before work begins and provide a written quote within 48 hours.
We do not just identify gaps. We provide a prioritised remediation plan and can support implementation so your team can address findings and strengthen compliance before future FINTRAC reviews.
Our audits are led by a CAMS-certified specialist with direct MLRO and FINTRAC examination experience across Canadian MSBs and PSPs.
Practical guides on FINTRAC effectiveness reviews, AML audits, examination readiness, costs, and remediation for Canadian MSBs and regulated businesses.
Most independent AML effectiveness reviews for Canadian businesses are completed within 2 to 4 weeks, depending on the size of your business and the current state of your documentation. ComplyFactor will provide a specific timeline estimate during your free scoping call.
Yes. Canadian MSBs and FMSBs subject to FINTRAC’s compliance program requirements must carry out a two-year effectiveness review at least once every two years. The review must test the effectiveness of the applicable compliance program elements and the results must be documented. For entities, prescribed findings must be reported in writing to a senior officer within 30 days after the review is completed.
If FINTRAC identifies non-compliance during an examination, it may take enforcement action depending on the nature and seriousness of the violations. Available measures can include administrative monetary penalties, compliance agreements and compliance orders. Under the post-March 26, 2026 framework, maximum penalties for prescribed serious violations can reach $4 million. Prompt remediation and well-documented compliance controls can help demonstrate how identified deficiencies are being addressed.
ComplyFactor uses scope-based pricing for AML audits. A free 30-minute scoping call is used to confirm your business model, review scope, testing requirements and expected timeline, after which we provide a written quote within 48 hours. Standalone audit engagements do not require an ongoing retainer.
Yes. ComplyFactor can conduct an external two-year effectiveness review of your AML compliance program. FINTRAC permits the review to be carried out by an internal or external auditor, or by the reporting entity itself where it does not have an auditor. FINTRAC also recommends, as a best practice, that the reviewer not be directly involved in the compliance program activities so the review remains impartial.
Tell us about your business and we'll confirm which services you need — free, no obligation, 30 minutes.
