FINTRAC compliance program for Canadian MSBs
Canadian MSBs and FMSBs must establish and implement a compliance program under the PCMLTFA. A FINTRAC registration number does not satisfy this requirement on its own. The program must be documented, kept current and followed in practice.
ComplyFactor builds FINTRAC compliance programs for Canadian MSBs, FMSBs, and payment or virtual currency businesses with FINTRAC obligations. Each program is based on the client's business model and covers the required compliance officer, policies and procedures, risk assessment, ongoing training, and two-year effectiveness review plan.
What Is a FINTRAC Compliance Program in Canada?
A FINTRAC compliance program is the framework a reporting entity establishes and implements to meet its obligations under the PCMLTFA and its Regulations. It supports reporting, recordkeeping, client identification, risk management, training and other compliance requirements. It must be kept current and reflect how the business actually operates.
When FINTRAC examines a reporting entity, it checks whether the required elements are documented and operating effectively in practice.
FINTRAC requires a compliance program to include five elements: the Compliance Officer, written policies and procedures, a risk assessment, an ongoing training program and plan, and a two-year effectiveness review and plan. Each must be documented and implemented as it applies to the reporting entity.
What FINTRAC expects from a compliance program
A program is examined against all three criteria. Having one on file does not meet the standard.
The 5 pillars of AML compliance under FINTRAC
FINTRAC's five required compliance-program elements make up every PCMLTFA compliance program. Each is described below by its legal basis, what FINTRAC examines and a common failure.
Compliance officer designation
A Compliance Officer must be appointed and given the authority and access to resources needed to implement the compliance program.
Whether an appropriate Compliance Officer has been appointed and has sufficient authority, resources, business knowledge, and understanding of the applicable AML requirements.
Formal appointment without sufficient authority, resources, knowledge, or genuine involvement in implementing the compliance program.
Written policies &
procedures
Written compliance policies and procedures must be tailored to the business, kept up to date, and, for an entity, approved by a senior officer.
Whether policies and procedures reflect current regulatory requirements and actual business practices, and whether the documented controls are being followed.
Generic or outdated policies that do not reflect the business’s actual products, clients, processes, risks, or current regulatory obligations.
AML risk assessment
The business must assess and document its money laundering, terrorist financing, and sanctions-evasion risks, considering clients and business relationships, products and services, delivery channels, geography, new technologies, sector risks, and other relevant factors.
Whether the risk assessment reflects the current business and whether identified high-risk areas are supported by appropriate enhanced measures.
Generic risk ratings, missing rationale, or an assessment that has not been updated as the business, products, technologies, clients, or geographic exposure changed.
Ongoing compliance training program & plan
Reporting entities with relevant employees, agents, mandataries, or other authorized persons must maintain a written, ongoing compliance training program and documented training plan.
Whether training is relevant to recipients’ roles, delivered according to the documented training plan, and supported by records of dates, attendees, and topics covered.
Training that is generic, undocumented, not tailored to relevant roles, or not delivered according to the documented training plan.
Two-year effectiveness review
A plan for testing the effectiveness of the compliance program must be documented, and the review must be carried out at least every two years.
Whether the review tested the policies and procedures, risk assessment, and ongoing training program and plan, and whether the results and required management reporting were documented.
A missing, late, inadequately scoped, or poorly documented effectiveness review, or a review that does not test all required compliance-program elements.
When Canadian businesses need a compliance program build
A compliance program has to change as your business changes. A full build or rebuild is usually needed in one of four situations.
New MSB or PSP registration
New MSBs and FMSBs need a documented compliance program that reflects how the business will actually operate. ComplyFactor builds the required framework around your services, customers, transaction flows, risks, reporting obligations, and internal controls before regulated activity scales.
Examination findings require a rebuild
If a FINTRAC examination identifies deficiencies in the compliance program, ComplyFactor can revise the affected elements, document remediation actions, update supporting procedures, and help organize evidence showing how the findings have been addressed.
Built at registration and never updated
If the compliance program was created at registration and has not been updated as the business or regulatory requirements changed, ComplyFactor can reassess the current operation and rebuild the relevant documents and controls around how the business works today.
Business model has changed significantly
New products, services, customer types, delivery channels, technologies, jurisdictions, or transaction patterns can materially change the business’s risk profile. We update the risk assessment and revise the related policies, procedures, monitoring, and enhanced measures where required.
What our AML compliance program build covers
A program build is a documentation project with a defined output. A ComplyFactor build produces the following.
Our FINTRAC Compliance Program Build Process
Building an effective FINTRAC compliance program starts with understanding how the business actually operates. Our five-phase process begins with the business model and risk assessment, then turns those findings into policies, controls, training and governance documentation.
Business discovery
We map your business model, including customers, products and services, transaction flows, delivery channels, geographic exposure, technologies, counterparties, and the FINTRAC obligations applicable to your activities. This becomes the factual basis for the compliance program.
Risk assessment
We develop the AML risk assessment before finalizing the compliance framework. The identified risks inform the policies and procedures, enhanced measures for higher-risk situations, monitoring approach, training priorities, and other controls required for the business.
Program drafting
We draft each compliance-program component around the risk assessment and the procedures your business actually follows. Policies, reporting workflows, recordkeeping requirements, training, monitoring, and governance documentation are aligned so the written program matches what the business does.
Review & calibration
You review the draft against your actual operations, and we refine any component that does not accurately reflect your processes, responsibilities, systems, or controls. The goal is a documented program that matches how the business operates in practice.
Delivery & briefing
Final documents are delivered in editable, version-controlled format, together with an implementation briefing covering key responsibilities, required controls, outstanding actions, and the compliance dates your team needs to manage.
FINTRAC Compliance Program Requirements After Bill C-12
Bill C-12, the Strengthening Canada's Immigration System and Borders Act, received Royal Assent on March 26, 2026. It expressly requires compliance programs to be reasonably designed, risk-based, and effective, and it strengthened FINTRAC’s administrative monetary penalty framework. A reporting entity should be able to show that its documentation exists, that the program is designed for the business’s risks and that it operates effectively in practice.
What Canadian businesses receive
A documented compliance framework written for your business and delivered in editable format, so your team can implement and maintain it and use it in a regulatory review.
Why Canadian MSBs Choose ComplyFactor
Compliance programs written around your actual risks, operations and current FINTRAC requirements.
Built by a named specialist
A named senior AML specialist, identified in the engagement, develops your program and works directly with your business model, risk assessment, policies, controls and implementation requirements.
Written for your business
Each component is written around your customers, products and services, transaction flows, delivery channels, geographic exposure, technologies and operating procedures, so the written program reflects how the business actually works.
Current FINTRAC effectiveness requirements
Since March 26, 2026, the PCMLTFA expressly requires compliance programs to be reasonably designed, risk-based, and effective. ComplyFactor builds the program around those current requirements and the FINTRAC obligations applicable to your business.
Ratings drive the controls
We build the risk assessment before writing any policy because its ratings set your monitoring thresholds, CDD criteria and resource allocation. Without one, those settings rest on assumptions.
Delivered as editable documents
Your program is delivered in editable format, so your compliance officer can maintain it without coming back to us for every change. You own the documents.
Frequently asked questions: AML compliance program Canada
FINTRAC requires a compliance program to include: (1) an appointed Compliance Officer responsible for implementing the program; (2) written compliance policies and procedures that are kept up to date; (3) a documented AML risk assessment; (4) a written, ongoing compliance training program and training plan; and (5) a documented plan for testing the effectiveness of the compliance program, with the review carried out at least every two years.
Yes. Canadian MSBs and FMSBs are FINTRAC reporting entities and must establish and implement a compliance program that meets the requirements applicable to their activities. The program includes an appointed Compliance Officer, written policies and procedures, a documented risk assessment, an ongoing training program and plan, and a two-year effectiveness review and plan. Other sectors, including certain payment service providers and financing or leasing entities, may also have FINTRAC obligations where they fall within the applicable reporting-entity rules.
The timeline depends on the complexity of the business, the number of regulated activities, the quality of existing documentation, and the scope of the risk assessment and controls required. ComplyFactor confirms the proposed timeline in the written engagement scope after the initial scoping call.
A template can be useful as a structural starting point, but the final compliance program must reflect the reporting entity’s actual business, risks, procedures, products, services, clients, delivery channels, and regulatory obligations. FINTRAC assesses whether the documented program is current and implemented in practice, and a policy document alone does not show that.
Compliance policies and procedures must be kept up to date when legislative, regulatory, operational, or other relevant changes occur. The risk assessment and other program elements should also be updated when material changes affect the business or its risk profile. Separately, the effectiveness of the compliance program must be reviewed at least every two years.
An AML compliance program is the documented framework used to meet applicable PCMLTFA obligations, including the Compliance Officer, policies and procedures, risk assessment, ongoing training program and plan, and two-year effectiveness review plan. An AML audit or effectiveness review tests whether the required program elements are effective in practice. The program is the framework, and the review tests how well it works.
FINTRAC requires the effectiveness review to be carried out at least every two years. It may be conducted by an internal or external auditor, or by the reporting entity itself where it does not have an auditor.
Book a Free FINTRAC Compliance Program Consultation
Tell us about your business model, current AML documentation, and the compliance program support you need. We’ll scope the requirements and explain the appropriate next steps in a free 30-minute consultation.
