FINTRAC Industry Day 2026: The Shift from AML Documentation to Operational Effectiveness

Platino Consulting had the pleasure of attending FINTRAC’s July 2026 Industry Day event, where FINTRAC did not introduce sweeping legislative changes or new regulatory requirements.

Instead, it provided something arguably more valuable.

It gave reporting entities insight into how FINTRAC is currently evaluating AML compliance programs during examinations.

Looking across the themes presented during Industry Day, one message emerged consistently.

FINTRAC is placing increasing emphasis on operational effectiveness.

Having policies, procedures and risk assessments in place is no longer enough. Reporting entities are expected to demonstrate that those controls remain current, are applied consistently, reflect the organization's actual risks and continue to operate as intended.

For organizations preparing for future compliance examinations, that distinction is significant.

A Common Theme Across Every Topic

Although FINTRAC discussed a wide range of subjects, including risk assessments, ongoing monitoring, training, sanctions, effectiveness reviews and emerging financial crime typologies, each topic pointed toward the same underlying expectation.

Compliance programs should evolve alongside the business.

Whether discussing risk assessments, transaction monitoring or staff training, FINTRAC repeatedly emphasized that documentation must reflect the organization's current operations rather than historical assumptions.

This reflects an important shift in regulatory thinking.

Increasingly, compliance examinations are assessing whether organizations can demonstrate how AML controls function in practice, not simply whether they have been documented.

Risk Assessments Continue to Drive the Entire Compliance Program

One of the strongest themes throughout Industry Day was the importance of maintaining an accurate and current enterprise-wide risk assessment.

This is not a standalone document.

It informs nearly every other component of an AML compliance program.

Where FINTRAC identifies deficiencies in a firm's risk assessment, those weaknesses often extend into enhanced due diligence, ongoing monitoring, suspicious transaction reporting and training.

Common observations included inconsistent methodologies, outdated risk assessments, insufficient documentation of controls and weak connections between identified risks and the mitigating controls intended to address them.

Organizations should periodically ask themselves a simple question:

Does our risk assessment still describe the business we operate today?

If the answer is uncertain, it may be time for a review.

Ongoing Monitoring Was a Major Focus

FINTRAC also devoted considerable attention to ongoing monitoring.

The message was clear.

Risk-based monitoring does not mean infrequent monitoring.

Organizations retain flexibility regarding review frequencies and trigger events, but those decisions must be supported by their documented risk assessment and applied consistently across the business.

FINTRAC also highlighted concerns relating to:

• inconsistent client reviews;

• inadequate documentation;

• transaction monitoring backlogs;

• insufficient prioritization of higher-risk alerts;

• poor communication between manual and automated monitoring teams.

These observations reinforce that monitoring should be viewed as a continuous operational process rather than a periodic compliance exercise.

Generic Training No Longer Meets Expectations

Another notable takeaway involved specialized AML training.

FINTRAC specifically highlighted deficiencies where organizations relied on generic or outdated training materials.

Effective training should reflect:

• the reporting entity's sector;

• its products and services;

• its documented risks; and

• the responsibilities of the individuals receiving the training.

In practice, this means a mortgage brokerage, MSB and real estate brokerage should not all be delivering identical AML training.

Policies Must Keep Pace with Regulatory Change

Since amendments introduced sanctions evasion obligations into Canada's AML framework, FINTRAC indicated that policies and procedures should now reflect those requirements where applicable.

Organizations should review whether their policies adequately address:

• sanctions evasion indicators;

• suspicious transaction escalation;

• documentation standards;

• reporting thresholds;

• emerging financial crime typologies.

Policies that have not been reviewed in several years may no longer reflect current legislative expectations.

The Two-Year Effectiveness Review Continues to Be Misunderstood

Perhaps the most important message of Industry Day related to the prescribed two-year effectiveness review.

FINTRAC made it clear that the purpose of an effectiveness review is not simply to confirm that required documents exist.

It is intended to determine whether an organization's compliance controls actually operate effectively.

Meaningful testing should evaluate:

• whether controls function as designed;

• whether deficiencies have been identified and remediated;

• whether testing remains aligned with current business risks; and

• whether sufficient evidence supports the conclusions reached.

This aligns closely with recent FINTRAC enforcement activity, where reporting entities have been penalized not only for substantive deficiencies but also for failing to complete the prescribed review altogether.

What Reporting Entities Should Take Away

Industry Day did not fundamentally change Canada's AML obligations.

What it did provide was valuable insight into where FINTRAC's attention currently appears to be focused.

Across every topic discussed, a consistent pattern emerged.

FINTRAC expects compliance programs to be:

• current;

• risk-based;

• consistently applied;

• appropriately documented; and

• regularly tested.

Organizations that continue to treat AML compliance as a static documentation exercise may find themselves increasingly out of step with regulatory expectations.

Those that continuously assess, challenge and improve their compliance programs will likely be far better positioned when the next examination begins.

One of the most useful aspects of FINTRAC Industry Day was that it reinforced something we have observed across recent examinations and enforcement actions.

The conversation has shifted.

Regulators are asking fewer questions about whether compliance documentation exists and more questions about whether compliance controls are operating effectively.

For reporting entities, that is an important distinction, and one worth considering well before the next FINTRAC examination.

Be prepared for your next FINTRAC examination, contact Platino Consulting today and our experts will ensure your compliance program is effective.