October 2026 marks two years since the mortgage sector became subject to the Proceeds of Crime (Money Laundering) and Terrorist Financing Act and its regulations.

Under the Act and associated regulations, reporting entities are required to implement and maintain a compliance program consisting of five key components. Together, these components form the foundation of an effective anti-money laundering (AML) and anti-terrorist financing (ATF) compliance framework.

One of these components is reviewing and testing the compliance program's effectiveness every two years at a minimum.

The purpose of the review is to identify gaps or weaknesses that could affect your ability to detect and mitigate money laundering, terrorist activity financing and sanctions evasion risks. It will help you determine whether:

  • your business practices reflect what is written in your compliance program documentation
  • your risk assessment appropriately identifies and mitigates risks related to clients, affiliates (if applicable), products, services, delivery channels, new technologies and geographic locations
  • you are meeting all your requirements under the Act and associated regulations

Start planning now

You must establish and document a plan for the two-year effectiveness review of your compliance program. This plan should describe:

  • the scope of the review, covering all the elements of your compliance program
  • the rationale that supports the areas of focus
  • the time period of the review
  • the evaluation methods
  • sample sizes, where applicable

The evaluation methods can include interviewing staff, sampling records and reviewing documentation.

Documentation and reporting requirements

Your effectiveness review should document:

  • the review date, review period and reviewer
  • the results of the tests that were performed
  • the conclusions, including any deficiencies, recommendations and action plans

Mortgage administrators, brokerages and lenders must submit a written report to a senior officer (principal broker or representative) no later than 30 days after the completion of the effectiveness review. The report must include:

  • the findings of the review (deficiencies, recommendations, action plans)
  • any updates made to the policies and procedures during the reporting period (the period covered by the two-year review) that were not made because of the review itself
  • the status of the implementation of the updates made to your policies and procedures

Don’t wait until it’s too late!

Planning and completing your effectiveness review can help identify issues early and support ongoing compliance with your legislative obligations.

Learn more:

Subscribe to the FINTRAC mailing list and FINTRAC Supervision mailing list to receive updates on FINTRAC activities, publications, guidance, reporting mechanisms and reporting requirements.