Every reporting entity in Canada, money services businesses included, has to have the effectiveness of its compliance program reviewed at least once every two years. It is one of the plainest obligations in the regime and one of the most commonly missed, because nothing in day-to-day operations prompts anyone to open the file. It is also, reliably, one of the first documents a FINTRAC examiner asks for.
This article covers what the two-year effectiveness review actually is, who is independent enough to perform it, what it has to cover, what a report that survives an examination looks like, and the five ways MSBs get it wrong.
What the two-year effectiveness review is
Under the PCMLTFA and its regulations, your AML/ATF compliance program has to be reviewed for effectiveness at least once every two years. At a minimum the review covers the written policies and procedures, the risk assessment, and the training program. The review is commissioned by you, paid for by you, and owned by you. It is not something FINTRAC performs and it is not triggered by anything FINTRAC does.
The word carrying the weight is effectiveness. The question is not whether the documents exist. It is whether they describe what your business actually does and whether the people in it follow them. A policy that says every high-risk client gets enhanced due diligence is effective only if the client files show that happening. This is why a review that reads the policy binder and stops there tells you nothing: the program has to be tested against the evidence it leaves behind.
Who needs one, and when the clock starts
Every registered MSB and foreign MSB, regardless of size, volume, or whether it is trading at all. The obligation attaches to your registration and your compliance program, not to your transaction count. A business that registered with FINTRAC two years ago and has not onboarded a single client still owes a review, and dormant businesses miss this far more often than active ones.
The clock runs from the point the compliance program was implemented, and then from each completed review. Two years is the outer limit rather than a schedule to aim for. Review sooner when something material changes:
- You add an MSB activity, a new product, or a new corridor.
- Ownership or control changes, including after an acquisition.
- A banking partner's relationship review turns up problems.
- An examination leaves you with findings to close.
- The rules move under you, as they did across 2025 and 2026.
On that last point: the enforcement package that received Royal Assent on March 26, 2026 redefined what counts as an adequate compliance program and rewrote the penalty framework around it. We covered the detail in FINTRAC regulatory updates 2026. A program last reviewed against the old standard is, by definition, reviewed against a standard that no longer applies.
Who can perform it, and what "independent" means
The regulations let the review be done by an internal or external auditor, or by the business itself if it has no auditor. FINTRAC's guidance then adds, as a best practice, that the reviewer should not be someone directly involved in the program. In practice that points away from your CAMLO, your MLRO, and anyone who wrote the policies or operates the day-to-day controls.
Independence here is about the reporting line and the conflict, not about credentials. A well-qualified analyst who reports to the CAMLO is not independent of the CAMLO's program, because the finding that matters most is the one that embarrasses their manager. Most MSBs have nobody internal who clears that bar, which is why the work normally goes outside.
The same logic constrains your service providers. If a firm acts as your outsourced CAMLO or MLRO, it should not also perform your effectiveness review. Reviewing a program you run yourself defeats the purpose of the review, and an examiner will say exactly that. A provider who offers to do both on the same engagement is telling you something useful about how seriously they take the rest of it.
What the review has to cover
The regulations name policies and procedures, the risk assessment, and training as the minimum. In practice a review that stops at the minimum leaves the parts an examiner actually tests untouched. A defensible scope reaches the records:
- Written policies and procedures, tested against current FINTRAC guidance rather than the guidance in force when they were drafted.
- The risk assessment, and whether the mitigation measures match the risks you have rated.
- Client identification and beneficial ownership records.
- Ongoing monitoring of business relationships.
- The reporting record, including STRs, LCTRs, LVCTRs and EFT reports, tested for timeliness and quality, not just for existence.
- Record keeping and retention.
- The training program, and the evidence that it was actually delivered to the people handling transactions.
- Ministerial directives and sanctions screening.
- Whether the compliance officer holds the authority and resources the program claims they hold.
Sampling is what separates a review from a reading. A reviewer who pulls twenty files and follows each one from onboarding to the last transaction will find the gap between the written program and the operating one. That gap is the entire point of the exercise.
What the report has to contain
The report is the artifact. It is what you hand FINTRAC, what a bank asks for, and what a buyer's counsel reads in due diligence, so its contents are not a matter of style.
Scope and methodology
What period the review covered, what was examined, how much was sampled and on what basis, and what could not be tested and why. The unglamorous parts are what make the rest credible.
Findings, rated
Each deficiency stated plainly, with a severity rating attached. Unrated findings let everyone quietly agree that nothing was urgent.
A remediation plan with owners and dates
Every finding gets a named owner and a deadline. "To be addressed" is not a plan, and an examiner who reads one knows the finding is still open.
Management's response
Recorded alongside the findings, including any finding management disagrees with and why. The findings have to be reported in writing to a senior officer within 30 days of the review; a review that never reached the people who can authorize the fixes did not do its job.
The status of the last review's findings
The fastest way to show a program is being managed, and the fastest way to expose one that is not. A finding that appears in two consecutive reviews unchanged is worse than the original deficiency.
A short document with a column of green checkmarks says that nobody looked. A report that names real deficiencies, rates them honestly, and shows what was done about them says the opposite, even when the findings are unflattering.
What FINTRAC does with your review
Examinations routinely open with a request for the last effectiveness review, which makes it the first impression of your program that the regulator forms. If there is no review, or what you produce is superficial, that is a finding in itself, and it colours everything that follows. An examiner looking at a thin review has good reason to assume the rest of the program got the same attention, and will look harder at all of it. We walk through the rest of that process in what to expect from a FINTRAC audit.
The review is also not examination preparation, and the two get confused. Preparation looks forward, at the regulator's upcoming visit, and is not independent by design: the point is to help you. The effectiveness review looks backward at what your program actually did, and only the second one discharges the two-year obligation. Useful work, both, but only one of them is mandatory.
The cost of the gap has gone up. Between the redesigned administrative monetary penalty framework, the new "ability to pay" factor, and compliance agreements and compliance orders as enforcement tools, a missing or hollow review is no longer a paperwork problem you can settle informally after the fact.
Five ways MSBs fail this requirement
1. Never doing one
Most common in businesses registered for two or three years that are still pre-revenue, and in dormant registrations kept alive for optionality. Nothing operational reminds you, and the deadline passes silently.
2. The CAMLO reviewing their own program
Usually done in good faith, by the person who knows the program best. It runs against FINTRAC's best-practice guidance on impartiality, and an examiner spots it from the signature block.
3. Filing examination prep as the review
A readiness assessment from your consultant is not an independent backward-looking review, however thorough it is. The obligation stays open.
4. A review that finds nothing
No program is clean. A report with no findings tells the reader that the reviewer did not sample anything, and it removes the one defence a genuine review gives you: proof that you look for problems yourself.
5. Findings that never close
The review happens, the report lands, nobody owns the remediation, and two years later the same deficiencies are restated. This is worse than not reviewing, because you have documented that you knew.
One more, which is in a category of its own: never produce a report dated in the past to cover a missed cycle. That converts a fixable compliance gap into a records problem you cannot argue your way out of, and it changes how an examiner reads every other document you hand over.
It is not only the regulator who asks
Banks ask for the effectiveness review during periodic relationship reviews, and for an MSB the banking relationship is usually the fragile one. A current review with closed findings is a cheap way to answer a question that otherwise gets answered by an account closure; we wrote about how thin that ice is in MSB banking in Canada.
It surfaces again when you sell. The review history is among the first items a buyer's counsel requests in MSB due diligence, and a documented record of deficiencies found and closed reads as a well-run business. An empty file reads as undisclosed risk, and it gets priced accordingly.
Effectiveness review FAQ
How often does a Canadian MSB need an effectiveness review?
At least once every two years. The clock runs from the point your compliance program was implemented, then from each completed review. Two years is the outer limit, not a target: a material change in the business, a new MSB activity, or findings from a bank review are all reasons to go sooner.
Can our own CAMLO perform the review?
Not ideally. The regulations allow a self-review when there is no auditor, but FINTRAC's guidance recommends, as a best practice, that the reviewer not be directly involved in the program. That points away from the CAMLO, the MLRO, and anyone who wrote the policies or runs the controls. Independence is about the reporting line, not the credentials.
Does a dormant MSB still need one?
Yes. The obligation attaches to your registration and your program, not to volume. A dormant review is quicker because there are fewer records to test, but it still has to happen and still has to be documented.
Is it the same as a FINTRAC audit?
No. The effectiveness review is yours: you commission it, you own the report, you decide how to act on it. A FINTRAC examination is the regulator reviewing you, on their schedule, with enforcement available. Your review is one of the first things an examination looks at, but it neither substitutes for one nor shields you from one.
What if we have never done one?
Commission one now and document the gap honestly. A missing review is a deficiency, but a known and fixable one, and a business that finds and remediates it sits in a very different position from one that hides it.
How long does it take?
It depends on how much activity there is to test. A dormant or low-volume MSB is a matter of weeks; an active business with several products, multiple corridors and a large reporting record takes longer, mostly in sampling. What sets the timeline in practice is how quickly you can produce records, not how quickly a reviewer can read them.
The short version
Every Canadian MSB owes an effectiveness review at least every two years, ideally performed by someone independent of the program, covering the policies, the risk assessment and the training, and tested against the records rather than the binder. The report needs scope, methodology, rated findings, a remediation plan with owners and dates, and the status of last time's findings. Done properly, it is the cheapest evidence you have that the program is real, and the document that makes an examination uneventful. Skipped, it is the first thing FINTRAC notices.
Due for your two-year review?
We perform independent AML/ATF effectiveness reviews for Canadian MSBs: we work from your records rather than a questionnaire, rate what we find, and hand you a remediation plan you can actually execute.
Book a free 30-minute consultation and we will tell you when your review is due and what it would cover.
Explore the effectiveness review