AML/CTF operating playbook for Canadian accounting firms

FINTRAC's guidance for accountants sets out the activities that trigger obligations under the Act: receiving or paying funds or virtual currency, purchasing or selling securities, real property, or business assets or entities, or transferring funds, virtual currency, or securities on a client's behalf. The same guidance also notes limited exemptions, including for accountants authorized to manage an insolvent or bankrupt client's affairs under specific authority, and for activities carried out only as part of an audit, review, or compilation engagement. Check each service line against this before assuming the Act does or doesn't apply.

• Review each service line your firm offers against FINTRAC's list of triggering activities
• Check whether the limited exemptions for insolvency-related work or audit, review, and compilation engagements apply
• Re-check this whenever your firm adds a new service line

Done when: Your firm's service lines have been checked individually against FINTRAC's triggering-activity list, not assumed

FINTRAC: accountants as a reporting sector

FINTRAC's compliance program guidance sets out six elements: a compliance officer responsible for implementing the program, written compliance policies and procedures kept up to date, a documented risk assessment, a training program, a training plan for delivering it, and an effectiveness review of the program conducted at least every two years. A sole proprietor with no employees, agents, or other authorized individuals is not required to have the training program or training plan, but still needs the other four elements.

• Appoint a compliance officer responsible for the program
• Put written, current policies and procedures, a documented risk assessment, and a training program and plan in place
• Schedule an effectiveness review at least every two years

Done when: All six compliance program elements are in place, with only the narrow sole-proprietor training exemption applied where genuinely applicable

FINTRAC: compliance program requirements

Once a triggering activity applies, identify and verify the client using one of FINTRAC's accepted methods, and keep the resulting records for the periods FINTRAC's guidance sets, generally five years, with the exact start date depending on the record type. Treat these as one connected sequence for each engagement rather than three separate processes running on their own schedules.

• Identify and verify the client using a FINTRAC-accepted method once a triggering activity applies
• Keep the resulting records for the period FINTRAC's guidance sets for that record type
• See the separate guides on verification methods and record retention scheduling

Done when: Client due diligence and record-keeping for a triggering activity are treated as one sequence, not separate untracked processes

See setting a record retention schedule