English
If you're a FINTRAC MSB in Canada, you must review your anti-money laundering (AML) program at least once every two years — the effectiveness review, often just called an AML audit.
Renno & Co provides independent AML audits and FINTRAC effectiveness reviews for Canadian MSBs, foreign MSBs, and payment and crypto businesses subject to FINTRAC's AML requirements. Our Canadian legal and compliance team reviews your compliance program, tests how it operates in practice, and delivers a written findings report with practical recommendations.
.svg)
An effectiveness review often surfaces legal questions — about your obligations, your risk exposure and how to fix gaps. Our effectiveness reviews are conducted by Canadian legal and compliance professionals who understand both the regulatory requirements and the practical realities of operating a FINTRAC-regulated business.
Our effectiveness reviews have been accepted by banks and financial institutions used by our clients. We understand the information these providers typically expect to see in an AML audit report, and we structure our reviews with those practical requirements (and FINTRAC expectations) in mind.
Many reviewers hand you a list of problems and walk away. We can also help you remediate — rewriting policies, updating your risk assessment, and strengthening controls — so the review becomes a path to compliance, not just a report in a drawer.
We've heard horror stories from clients who got bad advice from foreign providers that don't understand Canadian rules. This is particularly key for an effectiveness review — where your business is being judged against Canadian AML laws. We're physically in Canada and governed by Canadian law societies (Ontario and Québec).
2026 changes to Canada's AML law raise the bar: your compliance program now has to be "reasonably designed, risk-based and effective" — emphasis on effective. A box-checking exercise that only looks good on paper is no longer enough. A proper review checks your whole program on paper and in practice: we examine your documents, then test whether what's written is actually being done.
We review your written AML compliance policies and procedures to check they're complete, current, and matched to the services you actually offer.
We check your enterprise-wide risk assessment — clients, products, geographies and delivery channels — and whether your controls match the risks you've identified.
We test how you identify clients, verify their identity, and keep an eye on activity over time — including enhanced measures for higher-risk clients.
We check that required reports (such as suspicious transactions, large virtual currency transactions, and electronic funds transfers) and records are being made, filed and kept correctly.
We look at your training program and whether staff actually receive it, plus the role of your compliance officer and senior-management oversight.
We sample real files and transactions to test whether controls work in practice, then set out findings and the fixes we recommend.
We send a Letter of Engagement (which you can share with your bank as proof the review is underway), confirm your business model and the period under review, and give you a secure folder and a clear document request — so you know exactly what to provide.
We review what you upload — your policies and procedures, risk assessment, training records, KYC files and reporting records — against what FINTRAC requires for a business like yours, and flag anything missing or unclear.
We sample real client files and transactions, run client-identification testing and, where useful, interview your team — to check your program works in practice. We then prepare a draft report with findings and recommended fixes.
You review the draft and can suggest reasoned, factual corrections or added context (which we may implement). We then issue the final report.
We can scope your review, tell you what it will involve, and discuss timing and pricing.
Book an AML Review Consultation →The point of the review is a usable result, not just a tick-box. Here's what you walk away with.
A clear report covering scope, what we reviewed and tested, and what we found — the document you keep on file as evidence the review was done.
For each gap, a specific recommendation on how to fix it — prioritized so you know what matters most.
If you're an entity, the findings, updates and their implementation status must be reported in writing to a senior officer within 30 days of the review being completed. We help you get that right.
If you want, we can help implement the fixes — updating policies, your risk assessment and controls — so you're in good shape before your next review.
FINTRAC requires effectiveness reviews at least once every two years. Your next review must begin no later than 24 months after your previous review began, and your previous review must be completed before the next one starts. For newly regulated businesses, the initial review schedule should be assessed based on when the compliance-program obligation applied.
For what FINTRAC expects from the review, see our guide to AML effectiveness reviews.
Recent amendments to the PCMLTFA (Canada's AML law) require your compliance program to be "reasonably designed, risk-based and effective" — not just something that exists on paper. FINTRAC treats falling short of this standard as a "very serious" violation. Your banks and account providers will likely have similar expectations. That's why a real review tests whether your controls actually work in practice, and why fixing what it finds matters.
Yes. "Effectiveness review" is FINTRAC's legal term for the mandatory two-year review of your compliance program. "AML audit" or "AML compliance audit" is what the industry usually calls the same exercise. They refer to the same review against the same obligations.
No. FINTRAC permits effectiveness reviews to be conducted internally, externally, or by the business itself where it has no auditor. As a best practice, the reviewer should not be directly involved in the compliance-program activities being assessed.
In our experience, banks and account providers often prefer reviews conducted by independent third parties. An external reviewer like Renno can provide additional objectivity, particularly for businesses with complex AML operations.
It depends on the size and complexity of your business, how many products you offer, and how well-documented your program already is. That said, if you're reasonably responsive to our initial document request and to follow-up RFIs, we usually complete the review within about 10 weeks. We scope every engagement up front and give you timing and pricing before you commit, so there are no surprises.
Missing a deadline happens — what matters is how you respond. Once you have missed the required review timeline, the priority is to arrange a review promptly and document the corrective steps. Acting quickly reduces the period of non-compliance and shows that you have taken the gap seriously. We can run the review promptly and help you document the catch-up. See our guide on a missed effectiveness review deadline.
Yes. If you're registered as a foreign MSB (fMSB), you carry the same AML program and effectiveness-review obligations as a Canadian MSB.
Yes. Because we have legal and compliance capabilities in-house, we can help remediate what the review turns up — including rewriting policies, updating your risk assessment, and strengthening controls. If we also provide your outsourced AML support, we structure the engagement to preserve appropriate independence in the review.
Speak with our Canadian fintech legal and compliance team about your business, your review timing, and what the engagement involves.
Contact Renno & Co →