Fintrac compliance program for Canadian MSBs
Canadian MSBs and FMSBs must establish and implement a compliance program under the PCMLTFA. A FINTRAC registration number is not enough — the program must be documented, kept current, and implemented in practice.
ComplyFactor builds FINTRAC compliance programs for Canadian MSBs, FMSBs, and payment or virtual currency businesses with applicable FINTRAC obligations. Each program is tailored to the business model and covers the required compliance officer, policies and procedures, risk assessment, ongoing training, and two-year effectiveness review plan.
What Is a FINTRAC Compliance Program in Canada?
A FINTRAC compliance program is the framework a reporting entity establishes and implements to meet its obligations under the PCMLTFA and associated Regulations. It supports reporting, recordkeeping, client identification, risk management, training, and other applicable compliance requirements, and must reflect how the business actually operates.
A FINTRAC compliance program must be established, implemented, kept current, and tailored to the reporting entity’s actual business and risks. FINTRAC assesses whether the required compliance-program elements are documented and operating effectively in practice.
FINTRAC requires a compliance program to include core elements covering the Compliance Officer, written policies and procedures, risk assessment, ongoing training program and plan, and a two-year effectiveness review and plan. Each element must be documented and implemented as applicable to the reporting entity.
What FINTRAC expects from a compliance program
Every program is examined against all three — not just whether it exists.
The 5 pillars of AML compliance under FINTRAC
FINTRAC's five-pillar framework is the structural foundation of every PCMLTFA compliance program. Each pillar has a specific legal basis, a defined examination focus, and a documented pattern of failure that appears repeatedly in enforcement actions.
Compliance officer designation
A Compliance Officer must be appointed and given the authority and access to resources needed to implement the compliance program.
Whether an appropriate Compliance Officer has been appointed and has sufficient authority, resources, business knowledge, and understanding of the applicable AML requirements.
Formal appointment without sufficient authority, resources, knowledge, or genuine involvement in implementing the compliance program.
Written policies &
procedures
Written compliance policies and procedures must be tailored to the business, kept up to date, and, for an entity, approved by a senior officer.
Whether policies and procedures reflect current regulatory requirements and actual business practices, and whether the documented controls are being followed.
Generic or outdated policies that do not reflect the business’s actual products, clients, processes, risks, or current regulatory obligations.
AML risk assessment
The business must assess and document its money laundering, terrorist financing, and sanctions-evasion risks, considering clients and business relationships, products and services, delivery channels, geography, new technologies, sector risks, and other relevant factors.
Whether the risk assessment reflects the current business and whether identified high-risk areas are supported by appropriate enhanced measures.
Generic risk ratings, missing rationale, or an assessment that has not been updated as the business, products, technologies, clients, or geographic exposure changed.
Ongoing compliance training program & plan
Reporting entities with relevant employees, agents, mandataries, or other authorised persons must maintain a written, ongoing compliance training program and documented training plan.
Whether training is relevant to recipients’ roles, delivered according to the documented training plan, and supported by records of dates, attendees, and topics covered.
Training that is generic, undocumented, not tailored to relevant roles, or not delivered according to the documented training plan.
Two-year effectiveness review
A plan for testing the effectiveness of the compliance program must be documented, and the review must be carried out at least every two years.
Whether the review tested the policies and procedures, risk assessment, and ongoing training program and plan, and whether the results and required management reporting were documented.
A missing, late, inadequately scoped, or poorly documented effectiveness review, or a review that does not test all required compliance-program elements.
When Canadian businesses need a compliance program build
A compliance program is not a one-time document — it is a framework that must evolve with your business. These are the four situations where a full build or rebuild is the right action.
New MSB or PSP registration
New MSBs and FMSBs need a documented compliance program that reflects how the business will actually operate. ComplyFactor builds the required framework around your services, customers, transaction flows, risks, reporting obligations, and internal controls before regulated activity scales.
Examination findings require a rebuild
If a FINTRAC examination identifies deficiencies in the compliance program, ComplyFactor can revise the affected elements, document remediation actions, update supporting procedures, and help organise evidence showing how the findings have been addressed.
Built at registration and never updated
If the compliance program was created at registration and has not been updated as the business or regulatory requirements changed, ComplyFactor can reassess the current operation and rebuild the relevant documents and controls around how the business works today.
Business model has changed significantly
New products, services, customer types, delivery channels, technologies, jurisdictions, or transaction patterns can materially change the business’s risk profile. We update the risk assessment and revise the related policies, procedures, monitoring, and enhanced measures where required.
What our AML compliance program build covers
A program build is not a consulting engagement — it is a documentation project with a defined output. Here is exactly what a ComplyFactor build produces.
Our FINTRAC Compliance Program Build Process
Building an effective FINTRAC compliance program starts with understanding how the business actually operates. Our five-phase process begins with the business model and risk assessment, then translates those findings into practical policies, controls, training, and governance documentation.
Business discovery
We map your business model, including customers, products and services, transaction flows, delivery channels, geographic exposure, technologies, counterparties, and the FINTRAC obligations applicable to your activities. This becomes the factual basis for the compliance program.
Risk assessment
We develop the AML risk assessment before finalising the compliance framework. The identified risks inform the policies and procedures, enhanced measures for higher-risk situations, monitoring approach, training priorities, and other controls required for the business.
Program drafting
We draft each compliance-program component around the risk assessment and the procedures your business actually follows. Policies, reporting workflows, recordkeeping requirements, training, monitoring, and governance documentation are aligned so the written program reflects operational reality.
Review & calibration
You review the draft against your actual operations, and we refine any component that does not accurately reflect your processes, responsibilities, systems, or controls. The goal is a documented program that matches how the business operates in practice.
Delivery & briefing
Final documents are delivered in editable, version-controlled format, together with an implementation briefing covering key responsibilities, required controls, outstanding actions, and the compliance dates your team needs to manage.
FINTRAC Compliance Program Requirements After Bill C-12
Bill C-12 received Royal Assent on March 26, 2026 and expressly requires compliance programs to be reasonably designed, risk-based, and effective. The amendments also strengthened FINTRAC’s administrative monetary penalty framework. Reporting entities should be able to show not only that required compliance-program documentation exists, but that the program is appropriately designed for the business’s risks and operates effectively in practice.
What Canadian businesses receive
A complete, documented compliance framework tailored to your business, delivered in editable format for implementation, ongoing maintenance, governance, and regulatory review.
Why Canadian MSBs Choose ComplyFactor
Business-specific compliance programs built around your actual risks, operations, and current FINTRAC requirements.
Built by a named specialist
Your program is developed by a CAMS-certified AML specialist who is identified in the engagement and works directly with your business model, risk assessment, policies, controls, and implementation requirements.
Built for your business — not from a template
Each component is tailored to your customers, products and services, transaction flows, delivery channels, geographic exposure, technologies, and operating procedures so the written program reflects how the business actually works.
Current FINTRAC effectiveness requirements
Since March 26, 2026, the PCMLTFA expressly requires compliance programs to be reasonably designed, risk-based, and effective. ComplyFactor builds the program around those current requirements and the FINTRAC obligations applicable to your business.
Risk assessment first — always
We build the risk assessment before writing any policy. Your ratings drive your monitoring thresholds, CDD criteria, and resource allocation. A program built without one is built on assumptions.
Delivered as editable documents — not PDFs
Your program is delivered in fully editable format so your compliance officer can maintain it without coming back to us for every change. You own it.
Frequently asked questions — AML compliance program Canada
FINTRAC requires a compliance program to include: (1) an appointed Compliance Officer responsible for implementing the program; (2) written compliance policies and procedures that are kept up to date; (3) a documented AML risk assessment; (4) a written, ongoing compliance training program and training plan; and (5) a documented plan for testing the effectiveness of the compliance program, with the review carried out at least every two years.
Yes. Canadian MSBs and FMSBs are FINTRAC reporting entities and must establish and implement a compliance program that meets the requirements applicable to their activities. The program includes an appointed Compliance Officer, written policies and procedures, a documented risk assessment, an ongoing training program and plan, and a two-year effectiveness review and plan. Other sectors, including certain payment service providers and financing or leasing entities, may also have FINTRAC obligations where they fall within the applicable reporting-entity rules.
The timeline depends on the complexity of the business, the number of regulated activities, the quality of existing documentation, and the scope of the risk assessment and controls required. ComplyFactor confirms the proposed timeline in the written engagement scope after the initial scoping call.
A template can be useful as a structural starting point, but the final compliance program must reflect the reporting entity’s actual business, risks, procedures, products, services, clients, delivery channels, and regulatory obligations. FINTRAC assesses whether the documented program is current and implemented in practice, not simply whether a policy document exists.
Compliance policies and procedures must be kept up to date when legislative, regulatory, operational, or other relevant changes occur. The risk assessment and other program elements should also be updated when material changes affect the business or its risk profile. Separately, the effectiveness of the compliance program must be reviewed at least every two years.
An AML compliance program is the documented framework used to meet applicable PCMLTFA obligations, including the Compliance Officer, policies and procedures, risk assessment, ongoing training program and plan, and two-year effectiveness review plan. An AML audit or effectiveness review tests whether the required program elements are effective in practice. The compliance program is the framework; the effectiveness review tests how well that framework is working.
FINTRAC requires the effectiveness review to be carried out at least every two years. It may be conducted by an internal or external auditor, or by the reporting entity itself where it does not have an auditor.
Book a Free FINTRAC Compliance Program Consultation
Tell us about your business model, current AML documentation, and the compliance program support you need. We’ll scope the requirements and explain the appropriate next steps in a free 30-minute consultation.
