FINTRAC · AML / ATF · PROGRAM DESIGN
FINTRAC Compliance Program Requirements in Canada
A compliance program should show how the business identifies risk, assigns responsibility, runs controls and proves those controls are working—not simply that a policy document exists.
Independent professional-services website. Not FINTRAC or the Government of Canada. The reporting entity remains responsible for meeting the requirements that apply to its business.
The requirement
A FINTRAC compliance program is an operating framework.
MSBs and FMSBs are reporting entities. They need a compliance program that is established, implemented and maintained around the obligations that apply to their business.
The program is the control layer behind client identification, business relationships, ongoing monitoring, reporting, record keeping and other know-your-client requirements. It should make clear who owns each obligation, how a decision is made, which record proves it happened and how exceptions are escalated.
Five-part architecture
Each requirement should feed the next control decision.
These are not five independent documents. Together they explain who owns the program, how work is performed, where risk changes the control response, how people learn the rules and how the framework is tested.
Compliance officer
Give one person clear accountability for implementation, enough authority to do the job, and access to the people who control the business.
Policies & procedures
Turn legal obligations into instructions people can actually follow: triggers, required information, timing, ownership, exceptions and escalation.
Risk assessment
Assess ML, TF and sanctions-evasion exposure across clients, business relationships, products, services, channels, geography, new developments and technologies.
Ongoing training
Train the people who perform compliance-sensitive work on the obligations, internal procedures and escalation decisions relevant to their roles.
Effectiveness review
Test whether the program works in practice at least every two years, document findings and track what needs to change.
A sole proprietor with no employees, agents or other authorized individuals is not required by FINTRAC guidance to maintain a training program or plan for themselves.
The effectiveness review is required at least every two years. FINTRAC guidance says the next review must begin no later than 24 months from the start of the previous review.
From policy to evidence
What the program should control through the client lifecycle.
The useful question is not “do we have a policy?” It is “what happens when a real client, transaction, risk event or reporting trigger reaches the business?”
Client enters
Identity, beneficial ownership, third-party and PEP/HIO procedures establish who the business is dealing with.
Risk is assigned
Client, product, geography, delivery channel and other factors feed a documented risk decision.
Activity is monitored
Business relationships and higher-risk situations receive the monitoring and enhanced measures called for by the program.
Events are escalated
Staff know when to escalate suspicious or otherwise reportable activity and who owns applicable FINTRAC filings.
Evidence is retained
Records show what the business knew, what decision it made, what control was applied and what was reported or reviewed.
Transfer controls
Where applicable, procedures address Travel Rule information for EFT and virtual-currency transfers and the response when information is missing.
Directives & sanctions
The framework explains how relevant Ministerial Directives and sanctions-evasion considerations are identified, assessed and operationalized.
Agents & mandataries
For MSBs using agents or mandataries, the control environment should address eligibility, required checks, re-verification, training and oversight.
For MSBs using agents or mandataries, current FINTRAC requirements include eligibility and criminal-record-check controls, with ongoing re-verification requirements. Existing relationships can also be subject to transitional timing. The procedure should be built around the current rule and the actual agent model rather than a generic outsourcing clause.
Check current MSB obligations ↗2026 standard
The current test is explicit: designed, risk-based and effective.
Changes that came into force on March 26, 2026 state that compliance programs must be reasonably designed, risk-based and effective. For implementation, that pushes attention toward the relationship between the written framework and the evidence that controls actually operate.
Review FINTRAC's 2026 changes ↗Program diagnostic
Strong programs and weak programs usually leave different evidence.
This is a practical diagnostic lens—not a claim that every FINTRAC examination produces the same findings.
Procedures mirror the real transaction flow.
A generic manual describes a different operating model.
Risk ratings change monitoring or enhanced-measure intensity.
The risk assessment exists but does not change any control.
Roles, systems, triggers and escalation paths are named.
Policies repeat the law without telling staff what to do.
Training has a plan and delivery evidence.
Slides exist, but there is no reliable training record.
Program changes are versioned and tied to business or regulatory change.
Documents stay unchanged after new products, channels or technology.
Review findings have owners and closure evidence.
Testing identifies issues that remain open or undocumented.
Engagement scope
What the work product can actually contain.
Not every engagement needs every item. Scope should be based on what already exists, what is changing and which controls the business needs to build or repair.
Defines which FINTRAC program obligations and operating areas need to be addressed for the business model.
Scope memo / requirements mapTranslates obligations into role-based instructions, triggers, timelines, controls and escalation steps.
Approved / implementation-ready policy setDocuments risk methodology, relevant factors, rationale, mitigation and enhanced measures.
Risk methodology + assessmentSets out who needs training, the topics they need, timing and the records used to evidence delivery.
Training program / planConnects policy requirements to the teams, systems, records and escalation points that operate them.
RACI / workflow / control mapPrioritizes changes, owners, dependencies and the proof needed to demonstrate controls are operating.
Action plan with owners and statusChoose the right scope
Build a new framework, or repair the one you already have?
The right answer depends on whether the current program still reflects the business and whether the underlying controls can be evidenced.
Start from first principles when the program is missing or the operating model is fundamentally new.
- New MSB or FMSB launch
- No complete written framework
- New regulated activity or Canadian operating model
- Existing documents cannot be mapped to real controls
Update the framework when the business has moved ahead of its documentation or testing has exposed gaps.
- New product, channel, geography or technology
- Risk assessment no longer reflects exposure
- Policy and workflow do not match
- Review, banking or examination findings require remediation
How the engagement moves
A compliance program project should move from business facts to operating controls.
Discovery
Understand services, clients, geography, funds flow, systems, people and current documentation.
Gap map
Compare the operating model and existing controls with the program requirements that apply.
Design
Draft or revise policies, risk logic, training structure and governance materials within scope.
Operationalize
Tie the written program to systems, records, role ownership, escalation and evidence.
Handoff
Leave the compliance function with priorities, implementation steps and a maintainable framework.
Questions that affect program design
FINTRAC compliance program FAQ.
These answers summarize the program-level requirement. Specific procedures still depend on the reporting entity, its activities, systems and risk profile.
What is a FINTRAC compliance program?
It is the framework a reporting entity establishes and implements to meet the compliance-program requirements that apply under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act and associated Regulations. It supports how the business handles reporting, records, client identification, risk and related know-your-client obligations.
What are the five core elements?
The core elements are an appointed compliance officer, written and current policies and procedures, a documented risk assessment, an ongoing training program and plan, and an effectiveness review carried out at least every two years.
Do MSBs and FMSBs both need a compliance program?
Yes. MSBs and FMSBs are reporting entities and must establish and implement the compliance-program requirements that apply to them. The level of detail should reflect the business model, complexity, activities and risk exposure.
How often should policies and the risk assessment be updated?
There is no single annual refresh rule for every document. Policies should remain current, and the program should be updated when relevant legislation, internal processes, products, services, delivery channels, technology, business model or risk exposure changes.
How often is the effectiveness review required?
At least every two years. FINTRAC guidance states that the next review must start no later than 24 months from the start of the previous review, and the previous review must be completed before the next one begins.
Does a sole proprietor need to train themselves?
FINTRAC guidance states that a sole proprietor with no employees, agents or other individuals authorized to act on their behalf is not required to maintain a training program or plan for themselves.
Can a compliance officer delegate duties?
Certain duties can be delegated, but the appointed compliance officer remains responsible for implementation of the program and the reporting entity remains responsible for meeting its legal obligations.
Does a compliance manual mean FINTRAC has approved the program?
No. A privately prepared compliance manual is not a FINTRAC approval or Government of Canada endorsement. The reporting entity remains responsible for the program, and FINTRAC can assess whether it is documented, implemented and maintained.
Primary sources
Use regulator guidance as the final reference point.
Rules and guidance can change. These links keep the page grounded in the current regulator material used to verify the program framework.
Regulatory content reviewed September 2026. Independent professional services only.
Scope the program work
Tell us where the compliance framework is breaking down.
Useful first-step context is the business model, current program status, recent changes and the control problem you are trying to solve. The engagement can then be scoped around documentation, risk, implementation, testing readiness or remediation.
Keep government ID, criminal-record checks, customer records, transaction files, banking credentials, private keys and other confidential records out of the initial inquiry.