MSB Risk Assessment in Canada: What FINTRAC Expects

FINTRAC's public list of penalties currently holds 26 notices against money services businesses (MSBs) and foreign MSBs. Fifteen of them include the same violation: failure to assess and document the risk of money laundering and terrorist financing. Some of those businesses had no risk assessment at all. Others had a document that skipped factors the Regulations require, or a rating method that nobody in the business actually applied.

The risk assessment is the part of a compliance program that everything else depends on. It decides which clients get enhanced due diligence, how often their files are refreshed, which transactions are watched more closely and what your staff are trained to spot. This guide covers what the law requires of an MSB, how FINTRAC suggests you build the assessment, the situations where the rules set the rating for you, and the specific failures FINTRAC has penalized. For the rest of the program, see our guide to AML/KYC compliance for Canadian MSBs.

What the law requires of an MSB

Under section 9.6 of the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA), every MSB must run a compliance program, and that program must include policies and procedures to assess the risk of a money laundering or terrorist financing offence in the course of its activities. Where the risk is high, the business must take special measures. Since March 26, 2026, the Act also requires the program to be “reasonably designed, risk-based and effective”. FINTRAC has said it will update its guidance to explain what it expects under that standard; the wider changes are covered in our overview of FINTRAC's 2026 regulatory updates.

Section 156 of the Regulations spells out what the assessment has to take into account, and FINTRAC's guidance and examination manual add the rest. In one place:

Factor	Where it comes from	What it means for an MSB
Clients and business relationships	Regulations, s. 156(1)(c)(i)	Who your clients are, what they do, where they are and how they transact, assessed one by one or in logical groups.
Products, services and delivery channels	Regulations, s. 156(1)(c)(ii)	Currency exchange, funds transfers, virtual currency, payment services; cash or electronic; in person, online or through agents.
Geographic location of your activities	Regulations, s. 156(1)(c)(iii)	Where you operate, the corridors you serve, and your clients' connections to higher-risk jurisdictions.
New developments and new technologies	Regulations, s. 156(2)	A new service, corridor, location, onboarding tool or monitoring system, assessed and documented before you introduce it.
Any other relevant factor	Regulations, s. 156(1)(c)(v)	Staff turnover, your business model, reliance on third parties and service providers, sanctions.
Risks for your sector in the national risk assessment	FINTRAC compliance program guidance	What the government's latest assessment says about MSBs and about your business model in particular (see below).
Ministerial directives	FINTRAC risk assessment guidance and assessment manual	Directives are in force for North Korea, Iran and Russia. Each requires every transaction from or to that country to be treated as high risk.

Two notes on scope. The Regulations also list risks from affiliates, but that factor applies to financial entities, life insurance companies and securities dealers, not to MSBs. And while the Act frames the assessment around money laundering and terrorist financing, FINTRAC's compliance program guidance expects you to assess sanctions evasion risk alongside them.

FINTRAC does not prescribe a methodology. It does require that the assessment is documented, reflects the reality of your business, covers every prescribed element and explains the rationale for each rating.

Business-based and relationship-based: the two halves

The model in FINTRAC's risk assessment guidance splits the work into two parts. You can do them together, but both have to be there.

The business-based assessment

This looks at the MSB as a whole: the combination of products, services and delivery channels, the places you operate, new developments and technologies, and other relevant factors. FINTRAC's sample worksheet has three columns: the risk factor, its rating, and the rationale for that rating. Among the higher-risk indicators its guidance lists, the ones that most often apply to MSBs are electronic funds transfers, e-wallets, prepaid cards, mobile payments and virtual currency; delivery through agents or without the client being physically present; a location near a border crossing or in a high-crime area; and high turnover among client-facing staff.

Agents deserve a line of their own. Under the PCMLTFA you are accountable for what your agents do, and FINTRAC treats reliance on an agent to verify client identity as a source of higher inherent risk.

The relationship-based assessment

This rates your clients, individually or in groups with similar characteristics, using the products and channels they use, their geography and their behaviour. FINTRAC's examples of factors that raise a client's risk include an unknown source of funds, an unknown beneficiary, unusual speed, volume or frequency of transactions, unexplained complexity, third parties with no obvious link to the client, activity that doesn't match the client's profile, a non-resident client, offshore interests without a clear reason, and a cash-intensive business.

Groupings are allowed, but they have to be logical and specific enough to reflect your actual client base. And a single higher-risk indicator does not automatically make a client high risk. FINTRAC names three exceptions: a foreign PEP, a client whose property you have reported in a Listed Person or Entity Property Report, and an entity whose ownership you cannot obtain or confirm (more on these below). Many MSBs serve walk-in clients with no ongoing relationship; for them the assessment can rely on the transaction and context in front of you, but high-risk clients still belong in it. FINTRAC's example is a client you have reported in a suspicious transaction report.

The six steps of FINTRAC's risk-based approach

Identify your inherent risks. The risk before any controls, across both halves of the assessment.
Set your risk tolerance. Decide which regulatory, reputational, legal and financial risks you will accept after mitigation and which you will not, with senior management approval where you have it. A high tolerance does not switch off any legal obligation.
Put controls in place. Document controls for every element rated high, monitor all business relationships, and apply the prescribed special measures to high-risk clients.
Evaluate the residual risk. If what remains is above your tolerance, go back to step 3. FINTRAC's own examples of extra controls include limits on transfers to specific jurisdictions, additional internal approvals, and closer monitoring to catch structuring, such as a $12,000 transfer split into two of $6,000.
Implement it. Apply the assessment day to day, exactly as documented. Senior management or the owner remains accountable for it.
Review it. The two-year effectiveness review must test the risk assessment, and FINTRAC expects an update whenever the business changes.

Rating the risk: scales, rationale and the likelihood matrix

The scale has to fit the business. FINTRAC says a very small MSB with occasional, straightforward transactions may only need to separate low from high risk, while larger businesses are expected to use more developed scales and to rate different business lines separately.

To place a factor or a client on the scale, FINTRAC's guidance offers a likelihood and impact matrix: likelihood is the chance that the risk is present, impact is the damage if it materializes, and each is rated low, medium or high. Its own example: two clients are both rated medium likelihood and both have electronic funds transfers on file. One hasn't sent a transfer in months, and the earlier ones went to family abroad; the other sends them regularly and you know little about the recipients or the reasons. The second client moves to high impact, becomes high risk, and the decision and its rationale are documented.

The rationale is what examiners read. If FINTRAC's guidance treats an element as higher risk and you rate it lower, you need a reasonable explanation on file. A checklist or a table of ratings without a written analysis does not meet the requirement: FINTRAC says plainly that a table of risk factors is not, in itself, a risk assessment.

Where the rules set the rating for you

In a few situations your scoring model has no say: the rules require high-risk treatment, and your examiner will check that your model produces it.

Situation	What is required	Source
Foreign politically exposed person (PEP), or their family member or close associate	Treat as high risk	FINTRAC PEP guidance
A client whose property you reported in a Listed Person or Entity Property Report	The client becomes high risk	FINTRAC risk assessment guidance
An entity whose beneficial ownership you cannot obtain, keep up to date or confirm	Treat as high risk: take reasonable measures to verify the identity of its chief executive officer (or the person in that role) and apply the special measures for high-risk clients	FINTRAC risk assessment guidance; beneficial ownership guidance
A transaction from or to North Korea, Iran or Russia	Treat every such transaction as high risk, whatever the amount, and apply the additional measures each directive sets out	Ministerial directives

Two other situations are often described as automatic high risk. They are not, but they have to be assessed, and the outcome recorded:

Situation	What is required	Source
Domestic PEP, head of an international organization, or their family member or close associate	Determine whether there is a high risk of money laundering or terrorist financing; if there is, treat the person as high risk	FINTRAC PEP guidance
A client you have reported in a suspicious transaction report	FINTRAC's guidance says the client should be assessed as posing a higher risk; if you rate them otherwise, document a reasonable rationale	FINTRAC risk assessment guidance

What a high rating sets in motion

A high rating is not a label; it switches on obligations. Under section 157 of the Regulations, you must have written policies and procedures for enhanced measures to verify identity based on the risk, and for other enhanced measures, including keeping client identification and beneficial ownership information up to date, and monitoring the business relationship, at a frequency that matches the risk. FINTRAC's examples of what that can look like:

Obtaining additional information on the client, including from public databases and the internet.
Establishing the source of funds or the source of wealth.
Asking for, and recording, the reasons for attempted or completed transactions.
Reviewing the client's transactions on an approved schedule with management sign-off.
Setting limits or parameters that trigger an early warning and a mandatory review.

There is a further step for corporations. Since October 1, 2025, when you assess a corporation incorporated under the Canada Business Corporations Act as high risk, you must check its beneficial ownership against Corporations Canada's register of individuals with significant control, both when you identify the relationship and during ongoing monitoring. A material discrepancy has to be reported to Corporations Canada within 30 days unless it is resolved within that time.

The rating drives the routine work too. FINTRAC's ongoing monitoring guidance expects your policies and procedures to state how often you review each client or group of clients, based on the risk assessment. A model that rates clients but leaves the monitoring frequency unchanged has not been implemented.

A desk globe on a leather-topped desk in a wood-panelled study

What the 2025 national risk assessment says about MSBs

FINTRAC's guidance asks you to consider the risks for your sector set out in the latest national risk assessment. That is the Department of Finance's 2025 Assessment of Money Laundering and Terrorist Financing Risks in Canada, and its picture of the MSB sector is blunt:

The sector's vulnerability is rated medium to very high. Nearly 3,000 MSBs were registered as of April 2025, and the assessment names two types as the most vulnerable: retail multi-service MSBs, which offer wire transfers, currency exchange and monetary instruments to a client base that includes PEPs, clients in vulnerable businesses or occupations, and people whose activities are conducted in high-risk jurisdictions; and informal value transfer systems such as hawala, where settlement runs through brokers whose records may not be available for scrutiny in Canada.
Payment service providers are rated high. The typologies listed include blending funds, smurfing, invoice fraud, offshore accounts that hide beneficial owners, front and pass-through companies, and funnel accounts that process card payments for businesses without their own merchant accounts.
Crypto assets are rated very high, and crowdfunding platforms high.
The most common MSB deficiencies it reports are gaps in compliance policies and procedures, inaccurate or out-of-date registration information and, among smaller MSBs, failure to report.

Supervision follows that rating. In 2025–26, MSBs accounted for 433 of the 625 targeted examinations FINTRAC reports, and more than 55% of all its assessment activities, according to FINTRAC's results for the year. Your assessment should show that you have read the section on your own business model and say how each risk applies to you, or why it doesn't.

What FINTRAC examiners check

FINTRAC's assessment manual describes how examiners test a risk assessment. They verify that it is documented and covers every required element, that it fits the type, size and complexity of the business, and that each element has a rationale. They may then:

Sample client and transaction records to see whether the ratings are reasonable and consistent with your risk profile and procedures.
Check that special measures were actually applied to everything rated high.
Confirm that your controls match your ratings, and that your policies, training and two-year review address the areas you rated higher.
Check that you assessed new developments and technologies before introducing them.
Ask how you use publicly available information, and interview the people responsible for the assessment.

Their stated focus: whether you considered and rated every aspect of the business, gave reasons for your decisions, and applied special measures where the risk is high. For the examination as a whole, see FINTRAC audit: what to expect and how to prepare.

How MSBs have failed: what 15 penalty notices show

Penalty notices stay on FINTRAC's website for five years. As of November 3, 2026, 26 of them concern MSBs or foreign MSBs, and 15 of those include a violation for failing to assess and document risk. Read together, they show five ways an assessment fails.

1. There is no risk assessment

In two 2025 notices against currency exchange businesses, FINTRAC found that the MSB did not assess and document its risks at all: no assessment of products, services, delivery channels, geography, new technologies or other factors, and no process for rating clients. The same violation appears in the record $176 million penalty imposed on a virtual currency MSB in October 2025.

2. The document skips required factors

In a 2026 notice, FINTRAC called an MSB's risk assessment “incomplete”: it failed to evaluate the products and delivery channels, geographic locations, clients and business relationships, and other risks specific to its operations.

3. The method exists only on paper

In 2024, one MSB had a documented process for rating its business relationships but was not applying risk ratings to any of them in practice, including many clients connected to or located in Iran. Another was not applying its client risk assessment process, and its monitoring records showed no documented investigation, special measures or mitigation. In 2026, FINTRAC found that mitigating measures an MSB had written down were not carried out in practice.

4. The template doesn't fit Canada or the business

A foreign MSB penalized in 2025 had risk assessment procedures that were not tailored to Canadian legislation, and the rating method for its Canadian business relationships was only finalized and put in place after the examination period. Another 2025 notice describes an assessment that existed but was not tailored to the business's operations or updated over time, and did not mitigate the factors it rated high.

5. Geography is missing where it matters most

A 2024 notice concerns an MSB whose primary clients had connections to, or were based in, Iran, with no analysis of the risk by client type and no assessment of its geographic risk. In another 2024 case, 32 electronic funds transfers fell under the Iran directive, which requires every one to be treated as high risk; the MSB had rated 27 of them low and five medium, and was penalized separately for breaching the directive. In 2026, FINTRAC found an assessment that did not adequately cover the risks of high-risk jurisdictions and occupations.

The common thread: FINTRAC tests the assessment against the client files. A document that looks complete but doesn't match how clients were rated, monitored and escalated fails the same way as no document at all.

What getting it wrong costs

Under the Administrative Monetary Penalties Regulations, failing to assess and document risk, including the assessment required before a new development or technology, is now a very serious violation, with a range of $1 to $20 million per violation. That applies to violations committed after March 26, 2026, and a business penalized under the new framework must also enter into a compliance agreement. For review periods that fall entirely before that date, FINTRAC continues to apply its previous policy, under which this was a serious violation with a range of $1 to $100,000.

The fine is rarely the only cost. FINTRAC's own harm assessment guide notes that a business that fails to assess its risk can fail to identify high-risk clients, and that this can lead to missed suspicious transaction reports, which are violations in their own right. The notice is public for five years, where anyone doing due diligence on your business can read it.

When to update it

Before a new product, service, channel, corridor, location or technology goes live. This is a legal requirement, not a best practice: the assessment of a new development or technology has to be documented before you introduce it.
When the business model changes or you take on a new portfolio of clients, as FINTRAC's guidance expects.
When the outside picture changes: a ministerial directive is issued or amended, sanctions are expanded, or a new national risk assessment is published. This is our recommendation rather than a rule, but examiners will compare your assessment with what was public at the time.
When monitoring shows you something the model missed, such as a cluster of suspicious transaction reports from a client group you rated low.
At least every two years, when the effectiveness review tests it. If your program needs one, see our effectiveness review service.

Building yours: a working checklist

List every product and service you offer, how clients reach each one, and whether agents are involved.
Map your geography: your locations, the corridors you serve, and where your clients live and transact.
Segment your clients into logical groups, and decide which you assess individually.
Bring in outside sources: the 2025 national risk assessment, ministerial directives, sanctions and FINTRAC's indicators for your sector.
Rate the inherent risk of every factor and client group, with a written rationale for each rating.
Set your risk tolerance and have it approved by senior management.
Map a control or enhanced measure to every element rated high, and write it into your policies and procedures.
Evaluate the residual risk and confirm it is within your tolerance.
Wire the ratings into onboarding, monitoring frequency and escalation, so the system does what the document says.
Record when the assessment was approved and what triggers the next update.

The person who owns this work is your compliance officer. If you don't have one with MSB experience, see what a CAMLO does.

Frequently asked questions

Does FINTRAC require a specific risk assessment template?

No. FINTRAC does not prescribe a methodology. Its risk assessment guidance offers example worksheets and a likelihood and impact matrix that you can adapt or replace. What it does require is a documented assessment that covers the prescribed factors, reflects how your business actually operates and explains the rationale for each rating. FINTRAC also says that a table of risk factors on its own is not a risk assessment.

How often does an MSB have to update its risk assessment?

The Regulations set two firm points. You must assess and document the risk of a new development or new technology before you introduce it, and your two-year effectiveness review must test the risk assessment. FINTRAC also expects an update when your business model changes or you acquire a new portfolio. In practice, we recommend a documented review at least once a year and whenever your services, corridors, channels or client base change.

Can a small MSB rate risk as just low or high?

Yes. FINTRAC says the law does not require a low, medium and high scale, and a very small business with occasional, straightforward transactions may only need to distinguish low from high risk. Larger businesses are expected to use more developed scales, with separate ratings for different lines of business.

Can we outsource our risk assessment to a consultant?

Yes, but the responsibility stays with you. FINTRAC states that if a service provider performs the risk assessment, you remain ultimately responsible for meeting the obligation, and examiners may interview the people responsible for it. Whoever runs compliance in your MSB has to understand the assessment and be able to defend it.

Do we need a client-level risk assessment if we have no ongoing business relationships?

FINTRAC says that if you have no business relationships, you do not need a relationship-based worksheet for your low and medium risk clients. High-risk clients outside a business relationship should still be included; FINTRAC's example is a client you have reported in a suspicious transaction report.

Is a foreign politically exposed person always high risk?

Yes. FINTRAC's guidance says you must treat foreign politically exposed persons, and their family members and close associates, as high risk. Domestic politically exposed persons, heads of international organizations and their family members and close associates are treated as high risk only if your assessment finds a high risk of money laundering or terrorist financing.

What is the penalty for not having a proper risk assessment?

Failing to assess and document money laundering and terrorist financing risk is a violation under the Administrative Monetary Penalties Regulations. For violations committed after March 26, 2026 it is classified as very serious, with a range of $1 to $20 million per violation, and a penalized business must also enter into a compliance agreement. Before that date it was a serious violation with a range of $1 to $100,000.

Can BEMSB prepare our MSB's risk assessment?

Yes. We build the business-based and relationship-based assessment around how your MSB actually operates: your services, corridors, delivery channels, agents and clients, with a rating method and written rationale your compliance officer can defend in an examination, and with the enhanced measures written into your policies and procedures. It is part of our AML/ATF compliance program service, and we also test existing risk assessments as part of a two-year effectiveness review.

The short version

An MSB's risk assessment has to cover its clients, its products, services and channels, its geography, new developments and technologies, and anything else relevant, including the national risk assessment and ministerial directives. Every rating needs a written reason, every high rating needs a control that is actually carried out, and the client files have to show it. That is exactly what FINTRAC tests, and exactly where 15 of the 26 MSB penalty notices on its website found the gap.

Need a risk assessment that holds up in an examination?

We build it around how your MSB actually operates, with the rationale, the enhanced measures and the policies that make it work in practice.

Book a free 30-minute consultation and we'll tell you where your current assessment stands.

Explore AML/ATF compliance programs

MSB risk assessment in Canada: how to build one FINTRAC will accept