AML Policies and Procedures: What to Write Down

PCMLTFA s. 9.6 requires every reporting entity to establish a compliance program that is reasonably designed, risk-based, and effective. PCMLTFR ss. 156 and 157 set out the elements that program must contain: an appointed compliance officer, written policies and procedures, a documented risk assessment, ongoing training, and a review of the program's effectiveness every two years.

The policies-and-procedures element is where most of the practical writing happens. FINTRAC's compliance program guidance expects those documents to be written down, kept current, and formally approved — the current guidance describes the approval expectations in detail. A program that exists only in the compliance officer's head, however well it runs day to day, does not meet the written standard the regulations describe.

A policy states what the business must do and why: "we identify every client before providing a service, because the law requires it and our risk assessment rates onboarding as a key control point." A procedure states how staff actually do it: which verification method, which system, which fields to check, what to do when a check fails, and who to escalate to.

The most common documentation gap is a well-written high-level policy with nothing underneath it — no operating procedure for onboarding, monitoring, or reporting that a new hire could actually follow. A payroll platform that briefly holds employer funds may have a policy committing it to monitor transactions, but if no document says which reports get pulled, how often, and what an analyst does with a hit, the commitment has no operating substance. A useful test: hand the procedure to someone who has never done the task. If they cannot complete it without asking questions, the procedure is a policy in disguise.

The question an examiner or auditor eventually asks is not "do you have a policy?" but "which version of the policy applied on this date, and what did it say?" Many businesses update their documents diligently and still cannot answer, because each update overwrote the last.

A simple system closes the gap: give every document a version number and an effective date; keep a one-page change register recording what changed, who approved it, and when; and retain every prior approved version instead of overwriting the file. None of this requires special software — a naming convention, a register, and an archive folder are enough, provided they are used every single time a document changes.

A policy without an owner is hard to operate and hard to evidence. Control ownership means every requirement in the program carries four things: a named owner (a person or role, not a department), an evidence standard (the artifact that shows the control ran), a frequency (how often it runs or is checked), and an escalation path (what happens when it fails or the owner is unavailable).

Map owners across the whole program — KYC, transaction monitoring, reporting, training, and records — and confirm each owner actually knows what they own. An owner who first learns of the assignment during an examination is, in practice, no owner at all. A one-page control register listing each requirement with its owner, evidence, frequency, and escalation route turns the policy binder into something the business can operate and demonstrate.

Documents drift. The business launches a product, changes a vendor, or quietly adjusts a workflow, and the written procedure ends up describing a process nobody follows. Drift is worse than a known gap, because it means the documented program and the operated program are two different things.

The two-year effectiveness review required by the regulations is the formal backstop that tests whether the documents still match operations, but well-run programs do not wait for it. They treat product launches, new customer segments, and regulatory changes as triggers to re-read the affected procedures and issue a versioned change where needed. When a review does find drift, the fix is recorded the same way as any other change: what changed, who approved it, and when it took effect.