Weak or Outdated AML Policies
Copy-paste templates or unreviewed manuals that do not reflect your actual business — its risks, services, client types, or reporting thresholds.
Policies must match your actual business model. Review and update your program at least annually, or immediately when your business model or regulations change.
No Risk Assessment — or a Generic One
A one-size-fits-all risk form will not satisfy FINTRAC. A generic risk assessment tells examiners you have not actually assessed your business.
Develop a tailored risk-based assessment covering: products & services, delivery channels, geographic exposure, new technologies, and client types. Keep it current and relevant to what you actually offer.
No Ongoing AML Training — or Lack of Documentation
A single onboarding session does not build a culture of compliance. And undocumented training — as far as FINTRAC is concerned — did not happen.
Run annual AML/ATF training for all relevant staff. Track training dates, topics covered, and names of attendees. Maintain a training log regardless of delivery format.
Missing or Incomplete Record-Keeping
FINTRAC expects MSBs to retain records for five years — including reports, client ID, and transaction logs. Many MSBs cannot produce key records when asked.
Store STRs, LCTRs, EFTRs (with submission confirmation), client ID records, and transaction logs for at least five years. Download copies of all submitted reports from FINTRAC’s FWR portal and store them on your own system.
Inadequate Transaction Reporting
MSBs often misapply reporting thresholds or reporting windows for LCTRs, LVCTRs, and EFTRs — creating compliance gaps that surface during examination.
Know your triggers precisely and ensure they align with your written policies. If your 24-hour rule defines a day as midnight to midnight, your report must cover 00:00:00 to 23:59:59 with no flexibility.
No Clear Escalation Procedure
Staff spot suspicious activity but do not know what to do with it — who to notify, how to document it, or when to file an STR.
Document a clear, step-by-step escalation path. Train employees on who to notify, how to document concerns, and when an STR is required. Escalation should be second nature — not guesswork.
No Independent AML Review
Many MSBs assume a FINTRAC examination counts as an independent review. It does not. This is one of the most common — and costly — misunderstandings in MSB compliance.
An independent AML review must be conducted at least every two years by someone not involved in daily operations — or by an external expert. Document findings, address deficiencies, and retain the review report.
Most AML Failures Are About Missing Structure — Not Bad Intent
If your AML program needs a review, update, or better structure, C&G Professional Services Inc. specialises in building bulletproof AML programs for MSBs, PSPs, and fintechs across Canada. Let’s make sure your business is audit-ready and regulator-resilient.