CANADIAN AML / ATF · REVIEW & TESTING
FINTRAC Effectiveness Review & AML Audit for Canadian MSBs
An effectiveness review checks whether your AML procedures are being followed, where controls are falling short and what needs to change.
We help Canadian money services businesses (MSBs), foreign MSBs (FMSBs) and other applicable reporting entities assess their compliance programs. Reviews include file and transaction testing, a written report and recommendations your team can act on.
Subsequent reviews start within 24 months of the previous review's start.
Review policies, risk, training and operating controls relevant to the business.
Entities have specific written reporting requirements within 30 days after completion.
REVIEW TIMING
Is your two-year review due?
For a subsequent effectiveness review, FINTRAC requires the next review to start within 24 months of the previous review’s start date. The earlier review must be completed before the next begins. The deadline is not calculated from the date the final report was delivered.
Your next review should begin by June 15, 2026. Keep both the start date and completion date of each review on record.
For subsequent reviews only. Confirm the earlier review was completed before the next one starts.
ABOUT THE REVIEW
What an effectiveness review checks beyond your AML manual.
A written procedure tells staff what to do. Reviewers also need to see the decision trail: what triggered a check, who handled it, what action followed and which record shows it happened. Selected real cases help answer those questions.
MSBs, FMSBs and applicable reporting entities
We focus on Canadian remittance, foreign-exchange and virtual-currency businesses, as well as foreign MSBs serving Canadian clients. Other FINTRAC reporting entities can enquire about a review for their sector.
A business subject to the Bank of Canada’s RPAA is not automatically a FINTRAC reporting entity. The obligations depend on the activities it performs.
Who can conduct the review?
FINTRAC allows an internal auditor, external auditor or, if no auditor is available, the reporting entity itself to carry out and document the review. The reviewer must understand the applicable requirements.
To support impartiality, FINTRAC recommends that the person conducting the review not be directly involved in the activities being tested. Potential self-review conflicts and safeguards should be discussed before an engagement is agreed.
TESTING SCOPE
What does a FINTRAC effectiveness review test?
The table shows areas we may examine and the records used to test them. The final scope depends on the obligations that apply to your business, not a fixed audit checklist.
Confirm the appointed officer, escalation paths and evidence that responsibility is exercised.
Appointment record, governance reporting, documented decisions
Compare current written procedures with applicable obligations, real transaction flows and employee practice.
Approved versions, change log, operational walkthroughs
Challenge material risk ratings and mitigation; test whether current products, channels, geography and new technology are reflected.
Risk methodology, risk register, higher-risk case files
Test selected onboarding events, beneficial ownership, third-party and PEP/HIO determinations where applicable.
Selected client files, decision records, exceptions
Trace selected risk ratings to monitoring frequency, alerts, reviews and enhanced measures.
Monitoring activity, escalations, high-risk review records
Test sampled potentially reportable events, decision trails, report accuracy and timeliness for applicable report types.
Transaction population, STR decisions, EFT/cash/virtual-currency reports as applicable
Examine whether required records exist, are reliable and can be retrieved under the applicable rules.
Transaction records, retention controls, sample retrievals
Compare role-specific training plans with delivery records and, where useful, staff understanding.
Training plan, attendance, materials, interviews
Test Travel Rule, agent/mandatary oversight and relevant Ministerial Directive controls where they apply.
Transfer records, partner arrangements, procedures and exception trails
Verify status of earlier issues and whether regulatory or business changes led to updated controls.
Previous review, remediation log, revisions, closure evidence
BEFORE YOU BOOK
Documents to prepare for your AML review.
Start by gathering the records below. We confirm the detailed request list after agreeing on the review period, scope and available data.
Foundational documents
- Current AML/ATF policies and procedures with effective dates
- Enterprise and customer risk assessments
- Compliance officer appointment and governance records
- Training plan, materials, delivery and attendance records
Operational evidence
- Transaction and client populations for the proposed period
- Examples of KYC and beneficial-ownership files
- Monitoring alerts, high-risk cases and escalation records
- Reporting registers and supporting decisions, where applicable
Past reviews and changes
- Previous effectiveness review and written management report
- Remediation register and proof of closure
- New products, technologies, channels or jurisdictions introduced
- Relevant agent or mandatary records, where applicable
Missing documents do not prevent an initial discussion. Tell us what is available; gaps in the records can be addressed during the review.
OUR REVIEW PROCESS
How we conduct your effectiveness review.
We agree who will coordinate document requests, which teams may need interviews and when your business can respond to draft observations before the report is finalized.
Define scope
We confirm the reporting entity, review period, business model and applicable obligations. We set the rationale for risk areas, methods and planned sample sizes.
Gather evidence
We send a document request after agreeing on the testing period and scope. Client and transaction records are shared through a secure channel.
Test how controls work
We compare policy with practice through records, selected samples, relevant transaction events, walkthroughs and interviews as appropriate to the scope.
Discuss and validate findings
Potential gaps are checked against evidence. We distinguish confirmed exceptions, documentation weaknesses and items requiring management clarification.
Report and hand off
We provide the report, discuss material findings and identify the information management needs for its written reporting obligations.
REVIEW REPORT
What you receive after the review.
The report should be useful to the people responsible for correcting issues. It separates documented exceptions from areas where evidence was unavailable, and sets out decisions or further work for management.
A typical effectiveness review report package covers:
Period reviewed, entity, applicable requirements, approach, sample choices and limitations.
Tests performed, selected evidence, results and exceptions, with an appropriate audit trail.
Clear description of deficiencies, impact, supporting evidence and practical next actions.
Information needed to report findings, policy updates during the reporting period and implementation status.
Suggested ownership, dependencies and evidence required for corrective action; implementation and retesting are separately scoped if requested.
Example review observation: higher-risk customer controls
- Observation
- In a selected set of high-risk client files, documentation did not consistently demonstrate that the enhanced measures required by the business's procedures were completed.
- Why it matters
- Even where staff believe the checks occurred, the reporting entity may be unable to demonstrate consistent application of its controls.
- Recommended action
- Clarify the trigger and responsible role, make completion evidence retrievable, train affected staff and test subsequent cases.
- Potential closure evidence
- Updated workflow, staff training record and results of subsequent sample checks.
WHEN TO BOOK
When businesses request an AML review.
These situations affect the timing, information and support you may need. Tell us which one best describes your business.
“We missed the review date.”
Confirm the missed deadline and available review history, then arrange the overdue review. Document any gaps and corrective actions using their actual dates.
“We have never done one.”
We look at when the business became subject to FINTRAC requirements and what program and review work has been completed since.
“We had few transactions.”
We adapt sampling to the activity available and examine other areas such as policies, training, governance and operational readiness.
“Our bank wants an AML report.”
Ask your bank what period, report format and testing scope it expects. We can use those requirements to inform the proposed review.
“Last review found problems.”
We revisit outstanding findings, retest completed fixes where agreed and distinguish closed items from work still in progress.
“Our products and channels changed.”
We account for new services, payment channels, systems and customer risks when selecting the areas to test.
COST & SCOPE
How much does a FINTRAC effectiveness review cost?
We quote against an agreed review period and testing plan, rather than a standard package price. The proposal sets out the work included, the report you will receive and whether additional remediation or retesting is part of the engagement.
REVIEW OR EXAMINATION?
Effectiveness review vs FINTRAC examination.
These two processes have different purposes. One is arranged by your business; the other is carried out by FINTRAC.
Two-year effectiveness review
Commissioned by the reporting entity to assess its own compliance program. The scope, timing, documented methods and findings should meet applicable requirements. Management remains responsible for acting on the results.
FINTRAC examination
FINTRAC conducts its own examinations, requests relevant records, evaluates compliance and may take regulatory action based on its findings.
If you need help creating or updating policies, see our FINTRAC Compliance Program service. For MSB registration support, visit our homepage.
FREQUENT QUESTIONS
Practical questions about the review service.
Answers about timing, records and how the work can be arranged.
How long does a FINTRAC effectiveness review take?
The timetable depends on the number of entities involved, the review period, available records and the amount of testing required. After an initial discussion and document review, we can propose dates for fieldwork, draft observations and the final report.
Can one review cover several locations or legal entities?
Several locations within one reporting entity may be covered through a coordinated review with suitable sampling. Separate legal entities have their own compliance responsibilities, so the scope and findings need to be clear about which entity each conclusion relates to.
Are outsourced KYC or transaction-monitoring services tested?
Where those services support obligations within the agreed review scope, we can examine how the reporting entity oversees the provider, handles exceptions, accesses records and confirms that required controls are performed. Outsourcing a task does not by itself remove the entity’s compliance responsibility.
What if some transaction or client records are missing?
We identify the missing records, check whether suitable alternative evidence is available and explain any limitation on the testing performed. An area that could not be properly tested should not be presented as verified. Corrective work can be planned separately.
Can the effectiveness review be conducted remotely?
Many document checks, walkthroughs, interviews and sample tests can be completed remotely when secure access to the required records is available. Certain activities may call for on-site work, which can be discussed when setting the scope.
REQUEST AN AML REVIEW
Get a scope and quote for your review.
Tell us what your business does, when your last review began and what prompted this request. We will use those details to recommend a scope and provide a quote.
We only need basic business information at this stage. Detailed documents can be shared securely once the engagement is agreed.
Request a review scope & quote
FINTRAC REFERENCES
Check the rules directly with FINTRAC.
Guidance checked: October 2026. Review requirements depend on the business and period being assessed.