Why This Matters
Canada recently received its strongest FATF evaluation in years, with six substantial effectiveness ratings and no low ratings. However, the assessment reveals a critical gap: supervisory frequency and intensity don't consistently match sector risk.
For compliance teams at fintechs and MSBs, this isn't just regulatory commentary. Your regulator's next examination cycle may differ significantly from the last. The risk rating you assigned your business line six months ago could now trigger heightened scrutiny. Beneficial ownership controls you thought were adequate may not meet FATF's expectations for Canada.
The evaluation also highlights Canada's struggle to prosecute complex money-laundering cases without an underlying predicate offense. This increases the pressure on your suspicious activity reporting: FINTRAC and law enforcement need actionable intelligence, not just volume.
What You Need Before Starting
Before adjusting your risk-based supervision approach, gather these inputs:
Current Risk Assessment Documentation: Pull your enterprise-wide risk assessment, customer risk segmentation model, and any sector-specific risk analyses. You need a baseline to compare against FATF's concerns.
Supervisory Examination History: Collect your last three years of regulatory examinations, findings, and remediation plans. Note the frequency, scope, and any risk-based adjustments examiners mentioned.
Beneficial Ownership Verification Workflows: Map your current process for identifying and verifying beneficial owners, including data sources, verification steps, refresh cycles, and escalation paths for complex structures.
SAR Quality Metrics: If you track SAR outcomes (law enforcement feedback, case referrals, follow-up requests), compile that data. If not, note that gap now.
Product and Channel Risk Ratings: List every product, service, delivery channel, and customer segment with its assigned risk rating and the date of the last rating review.
You'll also need access to Bill C-12 reforms and any recent guidance from FINTRAC or your provincial regulator on risk-based supervision expectations.
Step-by-Step Implementation
Step 1: Recalibrate Your Enterprise Risk Assessment
Review your enterprise-wide AML/CFT risk assessment against the sectors FATF flagged. The evaluation didn't name specific sectors, but supervisory intensity concerns typically arise in MSBs, virtual asset service providers, and professional services.
For each business line, ask:
- When did we last update this risk rating?
- What risk factors did we consider? (Customer type, transaction volume, geographic exposure, product complexity, delivery channel)
- Does our supervisory frequency match the rating? (If you rated a channel "high risk" but only review it annually, there's a mismatch.)
Document any misalignments. If your crypto product line is rated medium risk but handles cross-border transactions in high-risk jurisdictions, that rating may be outdated.
Step 2: Strengthen Beneficial Ownership Controls
FATF identified beneficial ownership transparency as a concern. Your verification process must go beyond collecting a name and address.
Review your current beneficial ownership identification workflow:
- Data Collection: Do you collect beneficial ownership information at onboarding for all legal entity customers? Do you identify individuals who own or control 25% or more, plus those exercising control through other means?
- Verification: Are you verifying beneficial owner identity using reliable, independent sources? Or are you relying solely on customer attestation?
- Complex Structures: When encountering multi-tiered corporate structures, trusts, or nominee arrangements, do you escalate for enhanced due diligence? Do you document your reasonable measures to identify beneficial owners even when verification is difficult?
Create a decision tree for complex cases. For example, if a customer presents a holding company structure with three layers, specify what additional documentation you require, who reviews it, and what triggers a decision to decline the relationship.
Step 3: Align Supervisory Intensity with Risk
Risk-based supervision means your monitoring frequency, testing depth, and resource allocation must vary by risk level.
Build a supervision matrix:
| Risk Rating | Transaction Monitoring Review | CDD Periodic Review | Internal Audit Testing | Escalation Threshold |
|---|---|---|---|---|
| High | Monthly scenario performance review | Every 12 months | Annual deep-dive | Any alert $5K+ |
| Medium | Quarterly scenario performance review | Every 24 months | Biennial sample testing | Alerts $25K+ or pattern |
| Low | Annual scenario performance review | Every 36 months | Triennial sample testing | Alerts $50K+ or pattern |
Adjust the thresholds and frequencies to fit your risk profile, but the principle holds: higher risk must trigger more frequent and intensive oversight.
Step 4: Improve SAR Quality and Actionability
FATF emphasized the need to translate financial intelligence into action. Review your last 50 SARs and score them on actionability:
- Does the narrative explain the suspicious activity clearly, or does it just describe what triggered the alert?
- Did you include relevant transaction details, timelines, and supporting documentation?
- Did you explain why the activity is suspicious in the context of the customer's expected behavior?
If your SARs read like alert summaries rather than investigative narratives, revise your SAR writing guidance. Train your analysts to answer: What happened? Why is it suspicious? What do we know about the customer that makes this activity anomalous?
Consider implementing a SAR quality checklist before submission. Require analysts to confirm they've included customer background, transaction pattern analysis, and any relevant external intelligence (adverse media, sanctions screening results, geographic risk factors).
Step 5: Update Monitoring for Emerging Threats
FATF's evaluation comes as Canada introduces measures targeting illicit MSBs, crypto ATMs, and sanctions evasion. Review your transaction monitoring rules and name screening processes:
- Do your scenarios detect structuring through multiple MSBs or crypto ATMs?
- Are you screening beneficial owners and related parties, not just direct customers?
- Do your sanctions controls freeze assets without delay when you identify a match?
If you operate crypto ATMs or offer virtual asset services, add specific monitoring for:
- Rapid conversion of fiat to crypto and immediate withdrawal
- Customers using multiple ATMs in short timeframes
- Transactions just below your reporting threshold
Validation, How to Verify It Works
After implementing these changes, test whether your risk-based supervision actually responds to risk.
Run a Risk-Rating Audit: Select 20 customer relationships across different risk tiers. Have a second reviewer independently assess their risk using your updated criteria. If the ratings don't match, your criteria aren't clear enough.
Measure Supervisory Intensity: For the next quarter, track how much time your team spends on high-risk vs. low-risk oversight. If high-risk accounts represent 15% of your portfolio but consume only 10% of your review time, your supervision isn't risk-based.
Test Beneficial Ownership Verification: Pull 10 legal entity customers onboarded in the last six months. Can you produce verified beneficial ownership information for each within 24 hours? If not, your controls have gaps.
Evaluate SAR Outcomes: If FINTRAC or law enforcement contacts you for follow-up information on a SAR, that's a positive signal. If you never receive feedback or follow-up requests, your SARs may lack investigative value.
Ongoing Tasks
Risk-based supervision isn't a one-time project. Build these tasks into your compliance calendar:
Quarterly: Review your risk assessment for any business line that launched a new product, entered a new market, or experienced significant growth. Adjust risk ratings and supervisory intensity accordingly.
Semi-Annually: Analyze your transaction monitoring alert distribution by risk tier. If high-risk customers aren't generating proportionally more alerts, your scenarios may not be calibrated correctly.
Annually: Update your beneficial ownership verification procedures to reflect any changes in corporate registry access, data sources, or regulatory guidance. Canada's ongoing reforms mean this process will evolve.
Ongoing: Monitor FINTRAC guidance, Bill C-12 implementation updates, and any follow-up from Canada's FATF evaluation. When supervisory expectations shift, your risk-based approach must shift with them.
The FATF evaluation shows that Canada's compliance framework has matured, but the operational details, matching supervisory intensity to risk, verifying beneficial ownership in complex cases, and turning intelligence into action, remain works in progress. Your ability to close those gaps will determine whether your next regulatory examination is a routine check or a deep investigation.
