Sanctions in an AML Program: Screening, Evasion and Listed Property

Sanctions list-screening is not itself mandated by the PCMLTFA or its regulations. The freeze, dealings-prohibition and duty-to-determine obligations flow from other federal law: regulations under the United Nations Act, the Special Economic Measures Act (SEMA), the Justice for Victims of Corrupt Foreign Officials Act (JVCFOA) and the Criminal Code. What the PCMLTFA does is bolt FINTRAC reporting onto that regime in two places — s. 7.1(1) for disclosures involving listed persons and their property, and s. 7(c) for suspicious transaction reports on suspected sanctions evasion.

The practical consequence: a business cannot find its screening duty by reading the PCMLTFR alone. The prohibitions on dealing with listed persons bind under those other statutes, while the FINTRAC reporting layer attaches to the reporting entities listed in PCMLTFA s. 5. Screening is the operational control businesses typically build to satisfy both at once — it is how you discover that a prohibition or a reporting trigger applies before you move funds.

The design of a screening control lives in the compliance program. PCMLTFA s. 9.6(1) requires every s. 5 person or entity to establish and implement a compliance program, s. 9.6(2) requires policies and procedures to assess money laundering and terrorist financing risk in the course of their activities, and PCMLTFR s. 156(1)(c) requires assessing and documenting that risk against prescribed factors: clients, business relationships and correspondent banking relationships; products, services and delivery channels; the geographic location of activities; affiliate risk for financial entities under PCMLTFA paragraphs 5(a) to (g); and any other relevant factor. Screening scope and re-screening frequency are typically calibrated to exactly those factors — who your clients are, which rails you use, and where money comes from and goes. Note that a new standard arrives on March 26, 2026: PCMLTFA s. 9.6(1.1) will require the program to be "reasonably designed, risk-based and effective."

Document the design choices, not just the hits: which lists you screen against, at what moments (onboarding, list updates, before releasing a transaction), how a potential match is adjudicated, and who can clear or escalate one. Where risk is assessed as high, PCMLTFA s. 9.6(3) requires the special measures in PCMLTFR s. 157: written policies for enhanced identity verification and other enhanced mitigation, including keeping client identification and beneficial-ownership information up to date and conducting ongoing monitoring of business relationships at a frequency appropriate to the risk.

When screening surfaces a true match — the business holds or controls property of a listed person, or is asked to transact for one — the underlying statutes drive the freeze, the refusal to deal, and a disclosure to the bodies those statutes designate. The PCMLTFA then adds a parallel report to FINTRAC: s. 7.1(1) requires reporting entities to report whenever they must make a disclosure under Criminal Code s. 83.1 (terrorist property), an order or regulation under the United Nations Act (this FINTRAC reporting leg came into force March 1, 2025), an order or regulation under Part 1 of SEMA, or JVCFOA s. 7(2) (the SEMA and JVCFOA legs came into force October 1, 2025). The two tracks run together — filing one does not discharge the other.

For the form, content and timing of the FINTRAC report, check the current FINTRAC guidance. Either way, record the adjudication: what matched, why it was treated as a true match or cleared as a false positive, and who made the call.

Evasion reporting works differently from a list match. PCMLTFA s. 7(c) requires a suspicious transaction report where there are reasonable grounds to suspect a transaction is related to the commission or attempted commission of a sanctions evasion offence — a term defined in PCMLTFA s. 2(1) by reference to the United Nations Act, Part 1 of SEMA and the JVCFOA. No list hit is required: suspicion can arise from the shape of the activity, such as routing through intermediaries in third countries or ownership structures that obscure who ultimately benefits, even when every named party screens clean.

Three ministerial directives issued under PCMLTFA s. 11.42 sharpen this in practice: North Korea (in force December 9, 2017), Iran (in force July 25, 2020, amended February 15, 2024 and November 15, 2025 — and as of November 15, 2025 it applies to every person or entity referred to in PCMLTFA s. 5) and Russia (in force February 24, 2024). Their common core: treat every transaction originating from or bound for those countries, regardless of amount, as high-risk for the purposes of s. 9.6(3); verify the identity of anyone requesting or benefiting from it; apply due diligence with particular attention to sanctions evasion risk — source of funds or virtual currency, purpose, beneficial ownership; and keep a record regardless of amount. The Iran directive additionally requires reporting all such transactions to FINTRAC and imposes correspondent-banking measures on PCMLTFA s. 9.4(1) entities.

None of this is rail-specific. A virtual currency transfer bound for a directive country is high-risk regardless of amount, and the directives expressly point due diligence at the source of the virtual currency. For a business dealing in virtual currency, screening typically extends beyond names to transaction context — where funds are coming from and going to — folded into the products, delivery-channel and geography factors of PCMLTFR s. 156(1)(c), with high-risk findings escalated into the s. 157 special measures: up-to-date identification and beneficial-ownership information and ongoing monitoring at a risk-appropriate frequency.

Adding a virtual currency product or a new transfer rail is the kind of change PCMLTFR s. 156(2) is built for: a documented risk assessment before the new development or technology goes live. Two provisions are commonly confused here — s. 156(2) is the pre-launch assessment, not the high-risk rule (that is s. 157), and s. 156(3) is the two-year compliance-program effectiveness review. For wallet-screening indicators and escalation specifics, check the current FINTRAC guidance.