AML compliance program Canada — the PCMLTFA five pillars, built for your business
Every business registered with FINTRAC must maintain a written AML compliance program under the PCMLTFA. A registration number is not enough — FINTRAC examines the program itself, and a program that does not reflect your actual business will generate findings regardless of how long you have been registered.
ComplyFactor builds AML compliance programs for Canadian MSBs, PSPs, fintechs, and VASPs — structured around FINTRAC's five mandatory pillars, calibrated to your business model, and documented to survive an examination from day one.
What is a PCMLTFA compliance program — and what must it cover?
A PCMLTFA compliance program is the documented framework through which a FINTRAC reporting entity demonstrates it has identified its money laundering and terrorist financing risks and implemented controls to manage them. It is not a policy template — it is a living set of documents that must reflect your actual business: your customer types, products, transaction volumes, geographies, and delivery channels.
Under PCMLTFA Part 1, Section 9.6, the program must be reasonably designed, risk-based, and effective — the three-part standard FINTRAC applies during every examination. A program can be reasonably designed on paper but ineffective in practice. FINTRAC examines all three.
The program must cover five specific pillars — each with its own documentation requirements, examination criteria, and common failure patterns. A program missing any of the five is non-compliant on its face.
FINTRAC's three-part standard
Every program is examined against all three — not just whether it exists.
The 5 pillars of AML compliance under FINTRAC
FINTRAC's five-pillar framework is the structural foundation of every PCMLTFA compliance program. Each pillar has a specific legal basis, a defined examination focus, and a documented pattern of failure that appears repeatedly in enforcement actions.
PCMLTFA s.9.6 — a senior officer must be designated and named in your FINTRAC records. See compliance officer & fractional MLRO.
Whether the officer is named, holds genuine authority, and is demonstrably engaged in the program.
A name on the form with no real involvement — or a junior employee without the authority the role requires.
Written, business-specific policies covering your AML obligations and the internal procedures that implement them.
Whether policies are current, reflect the actual business, and are followed — tested directly against your records.
A registration-day template describing procedures the business does not follow — the single most common FINTRAC finding.
PCMLTFR s.156 — a documented risk assessment across customer, product, geographic, and delivery-channel risk.
Whether the assessment is documented, business-specific, current, and actually drives your controls.
Generic risk ratings that don't match the customer base — or an assessment never updated as the business changed.
PCMLTFR s.165 — ongoing, role-specific training for relevant employees, documented and retained.
Whether training was delivered, role-specific, completed in time, with completion records to show the examiner.
One-size-fits-all or undocumented training — or no completion evidence retained at all.
PCMLTFA s.9.6(2) — an independent effectiveness review at least once every two years.
Whether a review was conducted within the past two years and its findings reported to senior management.
No review on record — or a "review" that was never genuinely independent of the compliance function.
When Canadian businesses need a compliance program build
A compliance program is not a one-time document — it is a framework that must evolve with your business. These are the four situations where a full build or rebuild is the right action.
New MSB or PSP registration
FINTRAC expects a working program from day one — not a registration-day placeholder. We build the full five-pillar framework behind your registration so the first examination finds a program, not a gap.
Examination findings require a rebuild
FINTRAC has identified program deficiencies and you need to demonstrate a corrected framework. We rebuild the affected pillars and document the changes against the findings, so the fix holds up on review.
Built at registration and never updated
Your program was written when you registered and hasn't moved since — while the business, and the Bill C-12 standard, have. We rebuild it to reflect what you actually do today.
Business model has changed significantly
New product lines, new customer types, or new geographies change your risk profile — and your program must change with them. We re-run the risk assessment and recalibrate every dependent control.
What our AML compliance program build covers
A program build is not a consulting engagement — it is a documentation project with a defined output. Here is exactly what a ComplyFactor build produces.
Our AML program build process
Building a PCMLTFA-compliant program requires understanding your business before writing a single policy. Our five-phase process is designed around that principle — discovery first, documentation second.
Business discovery
We map your business model — customer types, products, transaction flows, geographies, and sector-specific obligations (MSB, PSP, VASP, or finance company). This informs every component; without it, the output is generic.
Risk assessment
We build your risk assessment before writing any policy. Risk ratings drive your monitoring thresholds, CDD trigger criteria, and resource decisions. A program built without one is built on assumptions.
Program drafting
Each component is drafted to reflect the risk-assessment outputs and your actual procedures. We do not write policies that describe a business you don't operate — FINTRAC tests policies against records.
Review & calibration
You review the draft; we calibrate any component that doesn't accurately describe your operations. A policy that doesn't reflect reality is worse than none — it documents a gap.
Delivery & briefing
Finalised documents delivered in editable format, version-controlled and dated — with an implementation briefing covering what changed, what obligations are now active, and your next compliance-calendar dates.
FINTRAC's current program standards — the post-Bill C-12 shift
Before Bill C-12, FINTRAC's approach was primarily existence-based — did you have a program? Under Bill C-12 (March 2026) the standard became effectiveness-based: is your program reasonably designed, risk-based, and effective in practice? A program that ticks every box on paper but produces no STRs, applies no EDD, and shows no active monitoring will not satisfy the new standard.
Every ComplyFactor program is built to the post-Bill C-12 effectiveness standard — designed to produce evidence of active compliance, not just to document that a program exists.
What Canadian businesses receive
A complete, documented compliance framework — every component formatted for FINTRAC examination and editable for ongoing maintenance.
Why Canadian MSBs & PSPs choose ComplyFactor
Programs built from your business outward — to the effectiveness standard FINTRAC now examines.
Built by a named specialist
Your program is built by a CAMS-certified AML specialist with direct FINTRAC examination experience — named in your engagement, because program builds require author credibility.
Built for your business — not from a template
Every component is written for your customer types, products, and transaction flows. We don't maintain a library of templates to adapt. Generic programs produce generic gaps.
Post-Bill C-12 effectiveness standard
Every program is tested against the "reasonably designed, risk-based, and effective" standard — not just the pre-2026 existence requirement. FINTRAC examines effectiveness; so do we.
Risk assessment first — always
We build the risk assessment before writing any policy. Your ratings drive your monitoring thresholds, CDD criteria, and resource allocation. A program built without one is built on assumptions.
Delivered as editable documents — not PDFs
Your program is delivered in fully editable format so your compliance officer can maintain it without coming back to us for every change. You own it.
