AML Training That Holds Up: Plan, Content, and Evidence

Under PCMLTFA s. 9.6, reporting entities must establish a compliance program, and PCMLTFR ss. 156 and 157 set out its elements: an appointed compliance officer, written policies and procedures, a risk assessment, training, and a review of the program's effectiveness every two years. Training sits inside that structure — it is not an HR courtesy layered on top of the real program, it is one of the elements FINTRAC examines directly.

FINTRAC's compliance program guidance treats the training program and the training plan as related but separate elements. The program is the content staff learn; the plan is the written layer that says who learns it, when, how often, and how completion is tracked. A business can fail on either one independently, and in practice the plan is the piece more often missing.

Effective content is role-based. The person reviewing transactions, the engineer building the onboarding flow, and the support agent answering customer messages all touch money-laundering risk differently, and a single generic deck serves none of them well. For each role, the content should answer four questions: what should this person notice, when should they escalate, what records should they keep, and how does their work connect to the business's FINTRAC obligations.

Concrete beats abstract. A payroll platform that briefly holds employer funds might train its support team that a request to redirect a payout to a new beneficiary account is an escalation trigger, not a routine ticket — and train its engineers that identity-verification steps in onboarding exist because of specific record-keeping obligations, so they are not quietly optimized away. Training that names the actual products, the actual red flags seen in that business, and the actual escalation path is the kind that changes behaviour.

The training plan is the who/when/how-often document. It typically names the audiences (by role), the content each audience receives, the frequency (at hire, then on an ongoing cadence, plus when products or procedures change), and the method used to track completion. It does not need to be long — a page that maps roles to content, cadence, and a tracking mechanism covers the core of what FINTRAC's guidance describes.

The typical gap is having training materials but no plan: a folder of slides exists, sessions happened at some point, but nothing in writing shows who was supposed to be trained, on what schedule, or whether everyone actually completed it. When the plan is missing, even genuinely good training is hard to demonstrate after the fact.

Three categories of records do most of the work. First, attendance and completion: who took which training, on what date — a simple log or LMS export is enough. Second, the content itself: keep dated versions of the materials so you can show what a given cohort was actually taught at a given time. Third, testing: quiz results, sign-offs, or another assessment showing the material landed, not just that a session was scheduled.

The practical test is whether you could answer a specific question from records rather than memory — for example, showing that a support hire from last spring completed the escalation module before handling live customers. If the answer lives only in someone's recollection, the evidence element is not yet in place.

Training is an ongoing obligation, not a launch-day event. Businesses commonly pair onboarding training with a periodic refresher, and retrain when something material changes — a new product, an updated risk assessment, or a revised escalation procedure. The cadence should be written into the plan rather than left to whenever someone remembers.

The two-year effectiveness review required as a program element is also where training gets tested: a review that finds staff missing escalation triggers, or completion records with gaps, points directly at what the next training cycle should fix. Feeding review findings back into training content and the plan is how the element stays honest over time — check the current FINTRAC guidance for the full description of what the review covers.