FINTRAC compliance programme and compliance officer

A money services business registered with FINTRAC must do more than register: under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) and its regulations it must implement a compliance programme from the first day of operation. FINTRAC examines the programme, not only the registration, and deficiencies lead to administrative monetary penalties that are published. This guide explains the five elements of the programme, how each one is built, common mistakes, and what our MSB compliance add-ons deliver.

The guide is general information, not legal advice. Registration and examinations are FINTRAC's; nobody can guarantee a registration.

The five elements of a compliance programme

1. A compliance officer — a person appointed to be responsible for implementing the programme, with the knowledge, authority and access to senior management the role needs.
2. Written, up-to-date policies and procedures — client identification, record keeping, reporting (suspicious transactions, large cash and large virtual currency transactions, electronic funds transfers), the travel rule for transfers, ministerial directives, sanctions and politically exposed persons.
3. A documented risk assessment — of the business's clients, products, delivery channels, geography and new technologies, with the measures taken for high risks.
4. An ongoing training programme — written, for every employee and agent who deals with clients or transactions.
5. A two-year effectiveness review — at least every two years, an internal or external review of the policies, the risk assessment and the training, reported to senior management (PCMLTFR s. 156(3)).

Why FINTRAC examines the programme itself

A registration number on its own tells FINTRAC nothing about whether the business is actually complying. An examination checks whether the five elements above exist in writing, whether they match the services the business actually offers, and whether the compliance officer, the training and the effectiveness review show evidence of having been carried out — not only that a folder of policies exists. A programme that is accurate on paper but was never delivered to staff, or never updated when the business added a service, fails an examination just as a missing programme does.

Building each element, step by step

1. Appoint the compliance officer with real authority and direct access to senior management, not only a title.
2. Write the risk assessment of the business's own clients, products, delivery channels, geography and new technologies — not a generic template.
3. Draft the policies and procedures so they match both the risks identified and the services actually registered with FINTRAC.
4. Build and deliver the training programme to every employee and agent who deals with clients or transactions, and keep a record that it was delivered.
5. Schedule the effectiveness review, at least every two years, to test whether the policies, the risk assessment and the training still work in practice.

Common mistakes

• A programme that exists only on paper. Policies that were never delivered to staff, or a training record that was never kept.
• A risk assessment copied from a template. It must reflect the business's own clients, products and geography, not a generic list.
• An effectiveness review treated as a formality. It has to test the programme against evidence, and report the result to senior management.
• A compliance officer without the authority the role needs. A name on an organisation chart is not the same as someone who can actually implement the programme.

Mistakes made at the registration stage itself — such as declaring the wrong services or registering before the compliance programme exists — are covered in our guide to Canada MSB and FINTRAC registration.

Our add-ons

• FINTRAC compliance programme — from €4,600: policies and procedures, risk assessment and training programme, written for your services;
• designated compliance officer — appointment — from €2,200: the appointment documents and the description of the duties;
• risk assessment and two-year effectiveness review — from €3,400: the review required by PCMLTFR s. 156(3), with a report for senior management.

The programme and the compliance officer are added automatically with a new MSB registration (from €19,500), because an MSB without them is not compliant from day one. The add-ons above are ordered separately when an existing MSB needs its programme rebuilt or updated — for example after adding a service, before a FINTRAC examination, or because the programme was never properly built when the business first registered. The registration itself is renewed every two years: see FINTRAC registration renewal and Canada MSB registration.

What is not included

Our fee covers the documents and the appointment described above. It does not include the FINTRAC registration itself — see Canada MSB and FINTRAC registration — or the day-to-day work of running the programme once it exists: identifying clients, keeping records and filing the transaction reports FINTRAC's guidance requires. Those stay with the business and its compliance officer; our documents and training give them the framework to do it.

What you receive

• a compliance programme covering all five elements, ready for a FINTRAC examination;
• the compliance officer's appointment;
• where ordered, the effectiveness review report.

The amounts are our fees for the standard scope; no VAT is added. FINTRAC charges no fee for MSB registration. All communication takes place by email.

Ready to start? Choose the new MSB registration: the compliance programme and the compliance officer appointment arrive ticked. Order.

To see which of our services your company needs, open the Business Navigator.

Frequently asked questions

Related guides

• Canada MSB and FINTRAC registration
• Buying a ready-made Canada MSB
• FINTRAC MSB registration renewal

More on this topic: Canada MSB.