AML Remediation & Lookback Exercises

When a finding lands or a historical gap surfaces, what you do next determines the exposure. Both situations reward moving early and documenting properly.

09
🔁 Post-Finding Support Start Remediation

When FINTRAC issues an adverse finding, a notice of violation, or an administrative monetary penalty, the clock starts immediately. What the regulator is watching from that point is not just whether you fix the deficiency, but whether your response demonstrates that the underlying cause has been addressed.

C&G designs and executes structured remediation programs that do both. We trace findings back to root cause, build a remediation plan with milestones and evidence requirements, and manage it through to closure with reporting the regulator can follow.

Lookback exercises are the other half of this work. Where a reporting entity discovers historical gaps in transaction reporting, KYC records, or STR filings, a lookback establishes the scope of the gap and produces the record needed to address it. Where appropriate, we manage the voluntary self-declaration of non-compliance to FINTRAC, a step that can materially reduce exposure when taken before the regulator finds the gap independently.

What the engagement includes

  • Root cause analysis of examination findings and identified deficiencies
  • Structured remediation plan with milestones, owners, and evidence requirements
  • Regulator-ready remediation progress reporting
  • Transaction lookback reviews across STR, LCTR, EFTR, and LVCTR obligations
  • KYC and CDD lookback for historical customer file deficiencies
  • Retroactive report filing and correction management
  • Voluntary self-declaration of non-compliance advisory and submission support
  • Policy and procedure remediation aligned to FINTRAC expectations
  • Remediation programme management and management reporting
  • Post-remediation mock assessment to confirm the fix holds
How it works

How the engagement runs

STEP 01

Scope and root cause

We establish the true extent of the deficiency, which is frequently wider than the finding states, and identify why it occurred rather than only what failed.

STEP 02

Remediation planning

A plan with milestones, owners, evidence requirements, and realistic dates, structured so progress can be demonstrated to the regulator at any point.

STEP 03

Lookback execution

Where historical gaps exist, we define the review population, work through it systematically, and document the methodology and results to a standard that withstands challenge.

STEP 04

Filing and declaration

Retroactive reports are prepared and filed, and where appropriate we advise on and manage a voluntary self-declaration of non-compliance.

STEP 05

Verification

A post-remediation assessment tests whether the fix actually holds, because a remediation that fails on re-examination is worse than the original finding.

Who this is for

Businesses we deliver this for

FAQ

Remediation & Lookback Exercises: common questions

A structured review of a defined historical period to identify transactions, customer files, or reports that should have been handled differently under your obligations. The output is a documented population, a methodology, findings, and where required, the retroactive reports that close the gap.
A mechanism by which a reporting entity proactively discloses non-compliance to FINTRAC before it is discovered through examination. Disclosing voluntarily, with a credible remediation plan attached, is generally viewed more favourably than the same deficiency found by an examiner. Whether to declare, and how to frame it, is a judgement call worth taking advice on.
Do not file them piecemeal without establishing scope first. The right sequence is to define the review population, work through it systematically, quantify the gap, then file and consider self-declaration as a coherent package. Ad hoc filing creates an incomplete record that is difficult to explain later.
It depends on the findings and the size of any lookback population. Documentation and procedural remediation typically runs one to three months. A remediation involving a substantial transaction or KYC lookback commonly runs three to nine months, which is why establishing scope early matters for setting realistic dates with the regulator.
We prepare responses, remediation plans, and progress reporting, and we support you in your dealings with FINTRAC. The reporting entity remains the accountable party throughout, which is as it should be, but you are not drafting the response alone.
It cannot guarantee that outcome. What it does is address the factors that shape the response: whether the deficiency was corrected, whether the root cause was fixed, and whether the entity acted promptly and in good faith. Entities that remediate credibly and early are in a materially better position than those that do not.
The period is set by the nature of the gap, not by a fixed rule. It runs from the point the deficiency began to the point it was corrected, which means the first task is establishing when the control actually failed. Record-keeping retention periods under the Act give a practical outer boundary. Defining the period defensibly, and documenting why you defined it that way, matters as much as the review itself.
Usually one of four things: a FINTRAC finding or undertaking requiring one; an internal discovery that reports were not filed or were filed incorrectly; an independent review that surfaces a systemic control failure rather than an isolated error; or a change of ownership or compliance leadership where the new team finds a gap in the historical record. The trigger shapes the scope, so it is worth being precise about which one applies.
It depends on the gap. Where the failure is systemic and every transaction in the period is potentially affected, a full population review is usually the defensible answer. Where the issue is narrower, a properly designed, documented, statistically defensible sample can be appropriate, with the option to expand if the sample shows a higher error rate than expected. What is not defensible is an undocumented sample chosen for convenience.
You generally have an opportunity to make representations before a penalty is finalised, and avenues to seek review afterwards, both time-limited. In parallel, and regardless of which route you take, remediate. Demonstrating that the deficiency is fixed and the root cause addressed strengthens every other option available to you and reduces the risk of a repeat finding, which is treated far more seriously than a first one.
Often, but not reflexively. Voluntary self-declaration made proactively, with a credible remediation plan attached, is generally viewed more favourably than the same deficiency found at examination. But the decision turns on the nature and scope of the gap, and a declaration made before you have established scope can create more difficulty than it resolves. Establish the scope first, then decide, and document the reasoning either way.
Keep reading

Related services

Service 06

FINTRAC Examination Assistance

 Service 01

AML Independent Review

 Service 03

Compliance Program Implementation

Insights on this topic

Insight

Why Attempted Suspicious Transactions Still Trigger STRs

 Insight

How to Prepare for a FINTRAC Examination: 2026 Guide

 Insight

Updating Your Info with FINTRAC: What MSBs Need to Know

Findings letter or historical gap?

The response window is short and the sequence matters. Talk to us before you start filing.

Start Remediation Book a Call