Managing a FINTRAC Document Request

The starting point is PCMLTFA s. 6: every reporting entity must keep records in accordance with the regulations. The part that shapes document requests is PCMLTFR s. 149 — every record must be kept in such a way that it can be provided to an authorized person within 30 days after a request to examine it is made under s. 62 of the Act. Read that carefully: it is a manner-of-keeping obligation, not a deadline that begins when you feel ready. If producing a record would take a data-engineering project, you were arguably offside before FINTRAC ever wrote to you.

Retention sits in PCMLTFR s. 148 — a rule often miscited to s. 146, which is actually the ongoing-monitoring record requirement (s. 147 is what permits electronic records, provided a paper copy can readily be produced). Under s. 148(1), records are kept at least five years after: the account closes (account records), the last business transaction (information records, corporate documents), or the day the record was created — the default for MSB transaction records. Under s. 148(2), individuals are relieved of retention after their employment or contract ends where the records belong to the employer.

Examination readiness is mostly an inventory exercise: for each record type, know the provision that requires it, the trigger threshold, the system it lives in, the person who can export it, and whether an export has actually been tested. A one-page table answering those five questions is the difference between a calm production and a scramble.

For an MSB, the trigger map looks like this: large cash records at $10,000+ (PCMLTFR s. 31) and large virtual currency records at $10,000+ (s. 32); EFT records at $1,000+ for initiation, intermediary sending, and final receipt (s. 36(d)–(f)); non-EFT remittance and transmission records at $1,000+ (s. 36(c.1), (c.2)); virtual currency transfer records at $1,000+ (s. 36(g), (h)); money-order issuance and redemption records at $3,000+ (s. 36(b), (c)); and cheque-cashing records at $3,000+ (s. 36(b.1), in force April 1, 2025). One trap: the foreign exchange transaction ticket is required for every FX transaction regardless of amount (s. 36(i)) — the $3,000 figure only sets when the ticket needs enhanced requester details. The virtual currency exchange ticket works the same way, with its enhanced-information threshold at $1,000 (s. 36(j)).

Most examination requests open with the program documents, so keep them assembled as a standing pack mapped to PCMLTFR s. 156(1): the compliance officer appointment (a), written policies and procedures kept up to date (b), the documented risk assessment (c), the written ongoing training program for employees, agents or mandataries (d), the documented training plan and evidence it was delivered (e), and the documented plan for the effectiveness review (f). Under s. 156(3), that review must be carried out — and its results documented — every two years by an internal or external auditor.

If you operate through agents, add three things. First, your registration information: the PCMLTF Registration Regulations (SOR/2007-121, Schedule 1, Part C) require each agent, mandatary, and branch to be listed with name, address, services, and relationship, and s. 4 requires notifying FINTRAC of changes. Second, agent criminal-record documents: PCMLTFA s. 9.93 and PCMLTFR s. 37.1 require obtaining and reviewing them before engagement and again within 30 days after the second anniversary of the last review — documents issued no more than six months before the review, retained five years (in force October 1, 2025 per FINTRAC). Third, the agency agreements themselves: no provision prescribes them as a record, but FINTRAC's compliance-program guidance says the effectiveness review should include a review of agent agreements, so examiners expect to see them.

When the request lands, convert it into a line-item tracker the same day: the examiner's item number, a plain-language description, the provision it maps to, the source system, one named owner, status, delivery date, and the exact file name delivered. One person owns the tracker and all communication with FINTRAC; everyone else feeds them. Where an item is ambiguous, ask the clarifying question in writing and record the answer in the tracker rather than guessing scope.

Deliver exactly what was asked — no more, no less — and keep an immutable copy of the complete package as sent, with dates. Six months later, when a follow-up letter references "the transaction listing provided," you want to open the identical file, not reconstruct which export version went out.

Closing a finding takes four proofs, not one: what changed (the revised policy or procedure, versioned, with the old text retrievable), who approved it (a dated management decision), who was retrained (attendance records under the s. 156(1)(e) training plan), and evidence the fix operates (a sample of transactions or files processed under the new procedure). A revised policy alone shows intent; the sample shows the finding is actually closed. For how FINTRAC expects follow-up on prior examination results to be handled, check the current FINTRAC compliance-program guidance.

Management minutes are the connective tissue: record approvals of the risk assessment and policy updates, decisions on the effectiveness-review results and management's responses, resourcing decisions for the compliance function, and decisions to restrict or exit high-risk relationships. Minutes are not themselves prescribed records in most cases, but they are what turns "we considered it" into something you can hand over within the 30 days s. 149 assumes.