Written with Heidi Unrau
FINTRAC’s New Assessment Approach – It’s Not Just Exams Anymore
Every request, meeting, form, or call with the Financial Transaction and Reports Analysis Centre of Canada (FINTRAC), Canada’s anti-money laundering (AML) regulator and financial intelligence unit (FIU), is a potential assessment activity. If your business is subject to the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA), the regulator could contact you at any time. In 2025, FINTRAC significantly expanded and diversified its compliance assessment toolkit.
FINTRAC’s assessment activities are not limited to full-blown compliance examinations, and the regulator is increasingly using other assessment tools. These include a wider range of formal and informal touchpoints, each of which can carry consequences and should be taken seriously. Here’s what you need to know to prepare, respond, and stay one step ahead when FINTRAC contacts you.
Yes, These Are All Assessment Activities
Many organizations are surprised to learn that not every FINTRAC interaction is labelled as an “examination,” although a range of activities are used to assess FINTRAC reporting entities. While some of these activities may be more informal than examinations, they are not unimportant.
In 2025, common FINTRAC assessment activities include, but are not limited to:
Data Hide and Seek
- Information Requests
- Supervisory Risk Assessment Questionnaires (SRAQs)
- Compliance Self-Attestations
- Monitoring Meetings
- Action Plans
- Examinations
Each of these activities serves as an opportunity for FINTRAC to understand and evaluate how well your organization is meeting its AML compliance obligations. Responding late, incorrectly, or incompletely can impact your risk score, trigger follow-up activities including examinations, or even result in penalties.
Information Requests
FINTRAC can request a wide range of information from reporting entities related to AML compliance. Where no personal information (PI) is being requested, these requests may be delivered by email rather than by more secure channels such as Canada Post’s secure messaging system.
However, reporting entities that prefer to respond via a secure channel can request this, and FINTRAC will generally accommodate their request. If an information request is unclear or if the timeframes are not feasible for your business, it is important to contact FINTRAC as soon as possible to resolve the issue.
Supervisory Risk Assessment Questionnaires (SRAQs)
SRAQs are Excel forms sent through Canada Post’s secure platform, often after a call or meeting with FINTRAC to explain the process. They include detailed questions about your business structure, risk levels, and electronic funds transfers.
Some fields may be pre-filled by FINTRAC, but must be reviewed. The SRAQ will generally have questions about your risk assessment, and you may be asked whether your risk assessment aligns with Canada’s National Risk Assessment (NRA).
Compliance Self-Attestations
These detailed PDF forms are also delivered securely, either with a SRAQ or on their own, and may follow a call or meeting with FINTRAC to explain the process. The self-attestation form asks about your Compliance Officer, AML policies and procedures, risk assessment, training, and compliance effectiveness reviews (audits). The responses must be specific (tailored to your business, documentation, and processes), and questions often overlap with the SRAQ.
The self-attestation questionnaire commonly asks who approved your policies, and whether compliance effectiveness reviews (audits) led to action plans. The final section of the attestation form requires sign-off from the person completing it, attesting to the accuracy and completeness of the information provided.
Monitoring Meetings
Monitoring meetings are common for larger or higher-risk businesses and are used to follow up on issues like reporting errors, self-declared non-compliance, or action plan progress. Be ready to explain past issues and decisions, particularly where FINTRAC is actively monitoring the remediation of an issue, including deficiencies observed by FINTRAC through examinations or other assessment activities. Detailed records help keep these meetings focused and efficient.
Action Plans
FINTRAC may request an action plan to correct deficiencies observed in the course of its assessment activities, or subsequent to a voluntary self-declaration of non-compliance. An action plan describes the deficiencies, the steps that are being taken to address and correct the issues, and the expected timelines. In some cases, FINTRAC may request updates to action plans in conjunction with monitoring meetings.
Examinations
FINTRAC selects businesses for examinations based on factors like risk score, past findings, or industry trends. Examinations may be in-person or remote, and full-scope (covering a broad range of AML compliance requirements) or targeted (covering only a narrow scope, such as high-risk customers and enhanced due diligence activities).
The examination process generally begins with a notification call, followed by a formal letter, document review, interviews, and concludes with a findings report. As PI and other sensitive information is exchanged with FINTRAC in this process, written communication is usually through Canada Post’s secure online portal. If serious deficiencies are discovered, FINTRAC may issue a Notice of Violation, which accompanies an administrative monetary penalty (AMP).
Take Every Request Seriously, The Consequences Are Real
A single poorly handled request can escalate to a formal examination or enforcement action, up to and including an AMP. For example:
- Information Requests might ask for detailed operational data, like wallet addresses, transaction volumes, geographic reach, etc., that must be provided within specific timeframes.
- SRAQs and Self-Attestations often probe the strength and scope of your compliance program, training, policies, and controls.
- Monitoring Meetings may seem routine, but they serve as real-time evaluations of progress or issues.
Even if you think your compliance program is strong, you can’t rest on your laurels. Giving too much, too little, or the wrong kind of information can still cause problems.
Timing & Scope Matter, So Speak Up Early
One of the most preventable mistakes? Not raising concerns early. If you receive a request that:
- Requires more time than you realistically have
- Involves an impractical volume of data
- Touches on sensitive or operationally risky areas (like sending wallet addresses via unencrypted email, for example)
- Is unclear or difficult to fulfill, or
- Seems misaligned with your actual business structure…
Reach out to FINTRAC right away! They may allow accommodations like a secure file upload option or deadline extensions. FINTRAC will also be able to clarify or refine the scope of their request, but you have to ask early. Proactive communication helps avoid mistakes and shows a good-faith effort to comply.
Documentation is Protection
Formal or informal? It doesn’t matter. If you interact with FINTRAC, document everything:
- The requests received and your interpretations,
- Deadlines and communication
- What data you provided and how
- Who internally approved or reviewed the responses
Keep a central record, like a shared folder or internal compliance log, to track all relevant information. Where there is something unusual about your business or processes, consider whether or not it makes sense to include explanations either in writing or during a meeting with FINTRAC.
Common Errors to Avoid
These are the biggest issues that trip up even experienced teams:
- Not answering the question asked: Too much or too little detail can both be problematic, and providing information that doesn’t address the question makes you seem disorganized at best.
- Assuming foreign compliance standards apply: FINTRAC’s mandate is to ensure compliance with Canadian requirements, and straying from this focus can imply that you’re not well-versed when it comes to the Canadian AML framework.
- Underestimating the data lift: Raw data is often messier and harder to extract than expected. Plan accordingly and start pulling data and organizing your response early.
- Auditor independence: If your auditor is also your AML program creator, expect scrutiny for lack of independence.
Make an Action Plan, Even if You’re Not Asked
There is some variance in terms of whether or not action plans are requested after FINTRAC examinations. Today, they’re becoming an unspoken expectation, though you may not be asked for your action plan until the next time that you’re faced with an assessment activity. Best practice? Develop an internal action plan, even if FINTRAC doesn’t ask for one. Examiners, auditors, and your leadership team will expect to see how you’ve addressed gaps. Your action plan should:
- Outline findings and fixes
- Assign owners and timelines
- Track milestones and updates
If you’ve already had an examination or audit and didn’t document an action plan, it’s not too late. Your plan can include work already completed to address any deficiencies.
Is This Really From FINTRAC? How to Tell
Some recent FINTRAC requests look different from what businesses are used to, which has caused confusion. And to make matters worse, there have been documented cases of scammers impersonating FINTRAC and other regulators. Here’s how to tell if the request is legitimate:
- Check the Sender: Legit emails come from @fintrac-canafe.gc.ca or @fintrac-canafe.canada.ca.
- Look for legal references: Real requests often cite the PCMLTFA (for example, section 63.1(2) of the PCMLTFA).
- Expect formal language: Clear instructions, deadlines, and specific data requests are standard.
- Templates included: FINTRAC may attach Excel or PDF forms to complete. These will not be in a “zipped” format or other format that cannot be scanned for malicious elements.
- No contact name? Still valid: Some are signed by the team or department without a specific person named.
- Delivery method: Sensitive items may come through Canada Post’s secure epost system, but where this is the case, reporting entities will generally receive a phone call first.
If you’re unsure, don’t ignore it. Verify through FINTRAC’s official contact channels, not by replying to a suspicious email.
Final Reminder: Treat Every Touchpoint as an Evaluation
A call. An email. A simple questionnaire or data request. It’s all part of a broader assessment process. These activities carry weight, can impact your risk profile, and may lead to further scrutiny if not handled correctly.
Treat every request seriously and respond with care. If something is unclear, the scope seems off, or if you need more time, speak up early! Proactive communication prevents misunderstandings and protects your organization from costly consequences.
Need a Hand?
If you’re unsure how to interpret a request, need help crafting a response, or want to strengthen your overall compliance approach, Outlier Compliance Group is here to help. Please get in touch.