FINTRAC compliance program requirements for MSBs

What is a FINTRAC compliance program?

A FINTRAC compliance program is the people, written rules and checks an MSB uses to meet Canada's anti-money laundering law. It's the base of MSB compliance: identifying clients, keeping records and reporting all run through it.

The rules are in section 156 of the Proceeds of Crime (Money Laundering) and Terrorist Financing Regulations. FINTRAC's guidance groups them into five parts, set out below.

Payment providers ask for it too. When an MSB applies to us for payment rails for money service businesses, we read its compliance program before we decide.

What are the five parts of a compliance program?

The five parts are a compliance officer, policies and procedures, a risk assessment, a training program and plan, and an effectiveness review. Every part applies to every MSB. Only the level of detail changes with your size and risk.

Use this table as a quick self-check before you read each part below.

Who can be a FINTRAC compliance officer?

Your compliance officer is responsible for implementing the program. They need the authority and the resources to do the job.

Who it should be depends on your size. In a small business, the owner or operator can take the role, or a senior manager. A sole proprietor can appoint themselves.

A larger business should appoint someone senior with direct access to senior management and the board. As a best practice, that person shouldn't handle the receipt, transfer or payment of funds.

The officer can hand tasks to other staff, but stays responsible for the program.

What should your policies and procedures cover?

Your policies must be written and kept up to date. In a company, a senior officer approves them. Everyone who acts for your business should be able to read them.

At a minimum, they cover whichever of these apply to you:

• your compliance program itself;
• know your client: verifying identity, politically exposed persons, beneficial ownership and third parties;
• business relationships and ongoing monitoring;
• record keeping;
• reporting transactions to FINTRAC;
• the travel rule for electronic funds and virtual currency transfers;
• ministerial directives.

For each one, say when it applies, what you record or report, how you do it and by when. A template is a start, but FINTRAC expects you to tailor it to your business.

How do you write an MSB risk assessment?

Your risk assessment records how exposed your business is to money laundering and terrorist financing. It must consider:

• your clients and business relationships, including their activity patterns and locations;
• your products, services and delivery channels;
• where you operate;
• new developments and technologies, before you introduce them;
• the risks for your sector in Canada's latest National Risk Assessment;
• anything else relevant, such as staff turnover.

Where the risk is high, you must take enhanced measures and write them into your policies. Examples include asking for more client information, the source of funds or wealth, and the reason for a transaction.

You also update client information and monitor high-risk clients more often.

Who needs FINTRAC compliance training?

If employees, agents, mandataries or anyone else can act for you, you need a written, ongoing training program. You also need a documented training plan, and you must deliver the training.

Train the people who deal with clients, take part in transactions or handle cash, funds or virtual currency. Train the people who run or oversee the program too: your compliance officer, senior managers, IT staff and internal auditors.

A sole proprietor with no employees, agents or other authorized people doesn't need a training program for themselves.

What is a FINTRAC effectiveness review?

It's a test of whether your program works. At least every 2 years, you test your policies and procedures, your risk assessment, and your training program and plan.

Each review must start no later than 24 months after the previous one started. An internal or external auditor carries it out, or you do it yourself if you have no auditor. As a best practice, use someone who isn't involved in running the program.

What to document

• a plan for the review: its scope, the period it covers, its methods and its sample sizes;
• the date of the review, the period it covered and who carried it out;
• the result of each test, your conclusions and any deficiencies;
• your recommendations and an action plan to fix what you found.

A company reports the findings in writing to a senior officer within 30 days of finishing the review.

Which reports does an MSB file with FINTRAC?

Your policies must say how you meet each reporting duty. These are the main reports for MSBs.

FINTRAC also has a report for property you hold that belongs to a listed person or entity. It can ask for your records too, and you must provide them within 30 days.

Our guide to LVCTRs and the travel rule covers the virtual currency reports in more detail.

Can a small MSB keep its program simple?

FINTRAC's guidance has no separate, lighter program for small businesses. It does expect yours to fit your size, structure and complexity, and your exposure to risk.

Some rules change with size. A sole proprietor can be their own compliance officer. They need no training program if no employees, agents or other authorized people act for them.

The five parts stay the same for everyone, in writing, with a review at least every 2 years.

What happens if your program falls short?

FINTRAC can issue administrative monetary penalties to businesses that don't comply. It must make every penalty it imposes public.

A weak program can also cost you your payment relationships, because providers read it before they onboard you.