FINTRAC Effectiveness Review for MSBs: What to Test, Prepare and Report

Our mission is to help Canadian fintech companies get registered, go live, and stay compliant.

If your business is a money services business (MSB) registered with FINTRAC, Canada's anti-money laundering regulator, you must review your anti-money laundering compliance program (AML program) at least once every two years. That review is called an effectiveness review (ER) — the industry often calls the same exercise an AML audit. It tests whether your policies, risk assessment, and training actually work in practice, not just whether they exist on paper. An outside auditor is not automatically required under FINTRAC's rules.

This guide covers when the review is due, what it must cover, the documents to get ready, how a reviewer tests your controls, who is allowed to run it, and what the final report must contain. One clarification first: an effectiveness review is your own periodic review, and it is different from a FINTRAC examination, where the regulator inspects you. If you would rather hand the whole process off, see our AML effectiveness review and audit services.

What changed in 2026?

The two-year requirement itself has not changed: a FINTRAC-registered MSB still owes an effectiveness review of its AML program at least every two years. What changed is the standard your program is measured against. The 2026 amendments to Canada's AML law (the PCMLTFA) raise the bar: your compliance program must now be "reasonably designed, risk-based and effective" — with the emphasis on effective. A program that only looks good on paper is no longer enough. The 2026 amendments also elevate certain compliance-program violations from serious to very serious; the classification depends on the specific contravention.

That raises the stakes for your review in four practical ways:

• Your review has to show the program works in practice, not just that the documents exist.
• The two-year clock runs start-to-start, not as a loose "every couple of years."
• The reviewer can be internal or external, within limits.
• The written results must go to a senior officer on a set timeline.

What is a FINTRAC effectiveness review, and when is it due?

An effectiveness review is an independent check of whether your AML program is well designed and working in practice. It is not a FINTRAC examination; it is the review you must arrange yourself. FINTRAC expects it at least once every two years, and you should treat both the start date and the completion date as things to track.

The two-year cycle runs start-to-start: your next review must begin no later than 24 months after the previous one began, and the previous review must be finished before the next one starts. In practice, that means you cannot let a review drift open indefinitely, and you cannot skip a cycle because last time ran long. Tracking the date each review opened and closed is the simplest way to stay inside the window.

If you have only recently become subject to FINTRAC's compliance-program obligations, treat your first review date carefully. The clock is tied to when your compliance-program obligation applies, so confirm your own start date rather than assuming it is simply two years after you appear on the FINTRAC registry. Note also that FINTRAC MSB status is a registration, not a licence, so the review is about program quality, not keeping a permit alive.

A change of control is where this often trips people up. Take a company we'll call Meridian Remit — a European remittance business that acquired a small Canadian MSB to establish a Canadian presence. The acquisition felt like a clean slate, but buying or taking control of an MSB does not reset the two-year clock: the obligation carries over with the existing program rather than restarting on the deal date. The lesson is to confirm the real start date you inherited, not the one the transaction seems to create — and, as we explain below, that timing was not even what ultimately forced Meridian's hand.

Before testing begins, the reviewer should set a documented review plan: the scope, the review period, the rationale for what is and is not covered, the methods used, and the sample sizes. That plan is what lets you and the reviewer agree on what "done" looks like.

What must your MSB's AML effectiveness review cover?

At a minimum, the review must cover your written policies and procedures, your risk assessment, and your ongoing compliance training program and plan. A credible review then goes further and tests whether day-to-day operations actually match those documents. The point is to see your compliance program in action, not just on the shelf.

How far the review reaches depends on your business model and risk. A cash-heavy remittance MSB and a virtual-currency dealer will not be tested on the same reporting streams, so applicability is always case by case. The table below shows how a reviewer typically moves from a document to a practical test.

Do not assume every reporting type applies to you. The reviewer tests only the obligations your actual activity triggers.

What documents should you prepare before the review?

Pull your records together before the review starts; readiness is the single biggest driver of how long the process takes. Group the materials rather than hunting for one file at a time. Expect the reviewer to later ask for underlying source files to validate the specific cases they sampled, so keep those retrievable.

• Corporate and business basics: a short description of your business model, corporate records, and operating-address proof.
• AML policies: your current AML/CTF policy and any earlier versions in force during the review period.
• Risk assessment: your enterprise-wide risk assessment and any supporting risk matrices.
• Compliance officer: appointment or approval records and a roles-and-responsibilities chart.
• Training: your training program, plan, materials, and completion logs.
• Clients and monitoring: sample KYC/KYB files across risk levels, plus monitoring alerts and investigation records.
• Reporting: logs of STRs, LCTRs, LVCTRs and EFTRs filed during the period, where applicable.
• History: your previous review or examination findings and a remediation log.
• Third parties: agent, mandatary, and vendor arrangements where you use them.

Two practical points. First, there is a real difference between "a policy exists" and "evidence shows the policy was followed," and the review turns on the second. Second, where files contain client personal information, share them securely and redact with unique identifiers where you can; reviewers can ask for the full detail later on the specific cases they test.

Checklist of the nine document groups to prepare before a FINTRAC effectiveness review.

How does the reviewer test whether your AML program works?

A reviewer does not just read your policy and sign off. They gather your records, walk through how your processes actually run, test a sample of files and reporting decisions, clarify anything that looks off, and then document their conclusions. The sequence matters because each step narrows what the next step needs to look at.

A simple way to picture the flow:

1. Collect records and data for the review period.
2. Interview staff and walk through key processes.
3. Test samples of client files and reporting decisions.
4. Clarify exceptions and request follow-up detail.
5. Document findings, conclusions, and recommendations.

The most useful findings come from gaps between policy and practice. A few illustrative examples: a client is flagged as high-risk for enhanced monitoring, but there is no record the monitoring happened; a policy says alerts must be escalated and resolved, but there is no documented resolution; or training is required on paper, but delivery logs are incomplete. These are the kinds of gaps a reviewer looks for. They are illustrations of common control gaps, not findings about any particular business.

How a reviewer evaluates each control — testing design, everyday practice, and evidence before logging a finding or confirming the control works.

Who can perform the review? Is an independent external AML auditor required?

FINTRAC lets the review be done by an internal auditor, an external auditor, or the reporting entity itself if it does not have an auditor. There is no blanket rule that you must hire an outside firm. What FINTRAC does expect is competence and enough testing to reach a reliable conclusion.

Impartiality is the real constraint. As a best practice, the reviewer should not be directly involved in the compliance-program activities being assessed, because they cannot objectively grade their own work. In practice, banks and account providers often prefer a review by an independent third party, and an external reviewer can add objectivity — but that is a commercial and practical expectation, not a universal FINTRAC requirement.

Be especially careful where one provider both operates your compliance function and offers to act as your independent reviewer. That can work, but only with an engagement structure that genuinely separates the two roles. If you want help keeping controls healthy between reviews, our fractional AML compliance support sits separately from the review itself.

What should the final effectiveness review report include?

The final report should record the period and dates reviewed, who the reviewer was, the scope and methodology, the testing results, the overall conclusion, the deficiencies found, and recommendations with an action plan. Think of it as the evidence trail that shows the review was real and reached a defensible conclusion.

A report is not a cure. Identifying a deficiency is step one; fixing it is separate work, and the report should name owners, priorities, and evidence of remediation so a reader can see what is actually being done. A finding left open is still a finding.

If your reporting entity is an "entity" (for example, a corporation), the review's findings must be reported in writing to a senior officer within 30 days of the review being completed. That written report should set out the findings, any updates made to your policies and procedures during the review period that were not prompted by the review, and the status of putting them into effect. Keep this obligation separate from any bank request: a banking partner may ask to see the report as part of its due diligence, but not every bank does, and that request is not the same as FINTRAC's rule.

What about banking and Canadian presence?

Banking is often the hardest part of operating as a Canadian MSB, and your effectiveness review feeds straight into it. Banks and account providers routinely ask to see your latest review report as part of their due diligence — so a clean, current report is often what stands between you and getting (or keeping) an account. That makes the review more than a FINTRAC legal requirement: it is a practical gate on your ability to get banked.

Here is how that plays out in practice. Meridian Remit — the European remittance company above, which had acquired its way into Canada — had an AML program recent enough that the two-year FINTRAC clock had not run out. What forced its timeline was not the regulator at all: its Canadian account provider made a completed effectiveness review a condition of finalizing the entity's bank account. The review happened because the bank asked for it. That is the practical lesson for cross-border groups — plan your review around whoever asks first, and note that some account providers expect one annually rather than every two years.

Showing real AML compliance and some form of Canadian presence, which banks and FINTRAC both tend to expect, only strengthens that case. If banking is your pressure point, see how we help clients with bank account onboarding for Canadian MSBs, or book a call to talk it through.

Frequently asked questions

Is an AML effectiveness review the same as a FINTRAC examination?

No. An effectiveness review is the internal, periodic review you must arrange yourself at least every two years to check your own AML program. A FINTRAC examination is separate: that is when FINTRAC, the regulator, inspects your business directly. Passing one does not replace the other, and your review should be ready to show if FINTRAC later examines you.

Does a brand-new or inactive MSB still need to plan a review?

Usually yes, if the compliance-program obligation applies to you. There is no blanket exemption just because you are new or currently have low activity. What changes is scope and timing: a business with little activity has less to test, but it still needs a plan, a start date tied to when its obligation applies, and a documented conclusion. The same goes if you arrived by acquisition: as Meridian Remit found, a change of control does not restart the clock, so confirm the timeline you inherited rather than assuming the deal reset it — or that you are exempt.

Can the compliance officer conduct the review?

It depends, and the deciding factor is impartiality. The reviewer needs to be competent and able to test the program objectively. A compliance officer who runs the day-to-day program generally should not grade their own work, so the best-practice expectation that the reviewer is not directly involved in the compliance-program activities being assessed points away from that. A smaller MSB with no auditor may review itself, but it should still structure the work to keep the reviewer at arm's length.

What if we missed our two-year effectiveness review?

Act quickly: start the review, document why the gap happened, and get back inside the cycle. A missed deadline is a compliance problem, but it is one you can get ahead of by moving now rather than waiting for a bank or FINTRAC to raise it. For the catch-up steps and what to expect, see our guide on what to do if your AML effectiveness review deadline was missed.

Ready to plan your review?

Preparing for your MSB's two-year effectiveness review? Book a call with Renno & Co to map your scope, the evidence to gather, and your timeline, or fill out our form and we will get in touch. If you would rather we run the review end to end, see our AML effectiveness review and audit services.

This content is for informational purposes only and does not constitute legal advice.