Outsourcing AML: What You Can Delegate and What You Still Own

Under PCMLTFA s. 9.6, every reporting entity must establish a compliance program that is reasonably designed, risk-based, and effective. The regulations (PCMLTFR ss. 156 and 157) spell out the required elements: an appointed compliance officer, written policies and procedures, a documented risk assessment, ongoing training, and an effectiveness review every two years. Nothing in the Act or regulations transfers those obligations to a vendor. The duty sits with the reporting entity, and when FINTRAC examines the business, its questions go to the business — not to the consultant who drafted the manual.

That is the whole test in one sentence: you can pay someone else to do the work, but you cannot pay someone else to be responsible for it. Everything else in this playbook is about making that distinction visible in your records.

Outsourcing parts of an AML program is common and often sensible, especially for small teams. Businesses routinely hire external help to draft or update policies and procedures, facilitate the risk assessment, configure screening and transaction-monitoring tools, deliver training, and conduct the two-year effectiveness review — a task where an external reviewer's independence is often a genuine advantage. A three-person money services business hiring a consultant to write its first policy manual is doing something normal, not something suspect.

The compliance officer role deserves care. Appointing a compliance officer is one of the required program elements, and while a business can bring in outside expertise to support that person, the appointment and the authority that goes with it belong to the entity. Check the current FINTRAC guidance on compliance program requirements for how the role is expected to function in practice.

Decisions stay in-house. Whether a policy accurately describes how your business actually operates, whether the risk assessment's conclusions are accepted, whether a review finding gets fixed or formally accepted as a residual risk, whether a client relationship continues — these are judgments the reporting entity makes and owns. A vendor's deliverable is an input; the outcome is yours.

This matters most when the vendor's product is generic. A policy manual that describes a template business rather than your product — say, a payments startup whose manual discusses cheque cashing it has never offered — signals that no one inside the company read and challenged the draft. Using an external consultant for drafting or testing does not transfer responsibility for the result, so someone internal has to read, question, and approve every deliverable before it becomes part of the program.

For each outsourced task, your records should answer four questions. First, what does the vendor do — scoped in an engagement letter or contract that names the deliverables, timelines, and access to working papers. Second, what does the business review — a named internal reviewer, with dated sign-off showing the deliverable was examined rather than filed. Third, what evidence is retained — versions of deliverables, review notes, and a tracker showing what happened to each finding. Fourth, how do issues escalate — who the vendor tells when it finds a problem, within what timeframe, and who inside the business decides what to do about it.

The escalation path is the piece most often missing. Define it before the vendor finds anything: if the effectiveness review surfaces a gap in record keeping, the reviewer should know exactly who receives that finding and the business should be able to show what management decided in response.

Keep the engagement scope and contract, each deliverable with its version history, evidence of internal review and approval, management's written response to any findings, and the remediation tracker through to closure. For an outsourced two-year effectiveness review in particular, the reviewer's report is only half the record — the other half is the entity's documented response to it.

In an examination, FINTRAC assesses the reporting entity's program, and "our consultant handled that" is not an answer the file can stand on by itself. What a well-run outsourced arrangement looks like on paper is the same thing an in-house one looks like: the work, the review of the work, and the decision that followed — each dated, each attributable to a person, each retrievable.