What a compliance program is
A compliance program is the set of written rules, roles and checks that show FINTRAC you are managing money laundering, terrorist financing and sanctions evasion risk. Money services businesses (MSBs) must have one under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act and its regulations. FINTRAC's compliance program guidance sets out the elements it will look for in an examination.
Registering as an MSB does not satisfy this duty. Registration lets you operate. The program shows you can do it responsibly. If you are not yet registered, start with our guide to FINTRAC MSB registration.
The five required elements
1. Appoint a compliance officer
Someone must be responsible for implementing the program. Choose a person with enough authority and time to do the job, and record the appointment in writing. In a very small business the owner often fills the role, but the duty does not disappear just because there is one person.
2. Write and maintain policies and procedures
Your policies must be written, kept up to date and, for an entity, approved by a senior officer. They should describe what your staff actually do: how clients are identified, how transactions are monitored, when reports are filed, how records are kept and how a suspicious transaction is escalated. Copying a generic template without adapting it is a common weakness.
3. Document a risk assessment
The risk assessment is where you explain which parts of your business are more exposed. FINTRAC expects you to consider, at a minimum:
- your clients and business relationships
- the products and services you offer
- how you deliver them (in person, online, through agents)
- the geographic areas you deal with
- new technologies and developments that affect your business
- your affiliates, if any
- the government's national risk assessment
The assessment must be documented, and it should lead to controls that match the risk. Higher-risk clients or corridors need stronger measures.
4. Train your people
You need a written, ongoing training program and a plan for delivering it, covering anyone who deals with clients, transactions or records. A sole proprietor with no employees is not required to have a training program, but the other elements still apply.
5. Review how well the program works
You must plan for and carry out an effectiveness review at least every two years. An internal or external auditor can do it, and the reviewer should test whether your policies and controls work in practice. Within 30 days of finishing, a written report goes to a senior officer covering the findings, any policy updates made during the review period and the status of implementation.
Reports you may need to file
Your policies should name each report type, who prepares it and the deadline. The main ones for MSBs are below. Always confirm current details on the linked FINTRAC pages, since forms and wording change.
| Report | Trigger | Timing |
|---|---|---|
| Suspicious Transaction Report (STR) | Reasonable grounds to suspect a money laundering, terrorist financing or sanctions evasion offence, including attempted transactions. No dollar threshold. | As soon as practicable after your measures are completed |
| Large Cash Transaction Report (LCTR) | $10,000 or more in cash, in a single transaction or under the 24-hour rule | Within 15 calendar days |
| Large Virtual Currency Transaction Report (LVCTR) | $10,000 or more in virtual currency, single or 24-hour rule | Within 5 working days |
| Electronic Funds Transfer Report (EFTR) | International transfer of $10,000 or more, single or 24-hour rule | Within 5 working days |
| Listed Person or Entity Property Report | Property of a listed person or entity in your possession or control | Immediately upon discovery |
See FINTRAC's pages on suspicious transaction reporting for the detailed test and process.
Know your client: identification and records
The thresholds that trigger identity verification depend on the type of activity. FINTRAC lists them for MSBs, including $10,000 for cash or virtual currency, $3,000 for foreign exchange, money orders, traveller's cheques and cheque cashing, and $1,000 for certain transfers. There is no threshold for suspicious transactions: if something looks wrong, verification and reporting rules still apply.
Accepted methods include government-issued photo ID, a credit file that is at least three years old, a dual-process method and reliance on another regulated entity. Each method has its own record-keeping requirements, which should be written into your procedures. Our FINTRAC compliance services include building these procedures around how your business actually takes payments.
Keep records for at least five years and be ready to produce them to FINTRAC within 30 days of a request. A copy of each STR is also kept for five years.
What penalties can look like
FINTRAC can issue administrative monetary penalties (AMPs). For violations before March 26, 2026, the ranges were $1 to $1,000 for a minor violation, $1 to $100,000 for a serious violation and, for a very serious violation, $1 to $100,000 for an individual or $1 to $500,000 for an entity. Penalties apply per violation and can add up.
Amendments in force from March 26, 2026 changed the regime. FINTRAC states that maximums can be up to 40 times the previous limits and that it can use mandatory compliance agreements and compliance orders for prescribed violations. For current amounts and how they apply to your business, check FINTRAC's penalty guidance or ask an adviser, because this area is still developing.
The penalty published against one MSB in a recent case cited problems that many small firms share: late EFTRs, no written policies and procedures, a risk assessment that did not use the prescribed factors, no two-year effectiveness review and failure to follow a Ministerial Directive.
A practical readiness checklist
- Name the compliance officer and record it.
- Write policies that match your real workflow, and have a senior officer approve them.
- Complete a documented risk assessment using all required factors.
- Set up a training plan and keep attendance records.
- Schedule the two-year effectiveness review and decide who will do it.
- Build report templates and calendar the deadlines.
- Test your record retrieval: can you find a five-year-old file in a day or two?
- Re-read your program whenever your products, corridors or technology change.
Where to start
If you are building a cross-border payments or currency business, plan the program before your first client transaction, not after. You can review FINTRAC's MSB information alongside our overview of international payments, then contact us for help scoping what your program needs.