The Compliance Operating Rhythm: Calendar and Regulatory Change

PCMLTFA s. 9.6 requires a compliance program that is reasonably designed, risk-based, and effective, and PCMLTFR ss. 156–157 name its elements: an appointed compliance officer, written policies and procedures, a risk assessment, ongoing training, and a review of the program's effectiveness at least every two years. None of those elements is a one-time deliverable. A risk assessment written at launch decays as products change; training completed at onboarding fades as staff turn over; policies drift out of date as guidance moves.

In practice, small teams keep the program alive with two connected controls. A compliance calendar gives the program its pulse — it converts the standing obligations into scheduled, owned, recurring work. A regulatory change-management process keeps the calendar itself correct when FINTRAC guidance or the legislation changes. Each is weaker without the other: a calendar that never absorbs new obligations schedules the wrong work, and a change process with no operating rhythm has nowhere to land its updates.

The calendar's job is to make sure nothing depends on someone remembering. Typical monthly items: a reporting quality check (sample recent reports for completeness and timeliness), and a review of open remediation items so identified gaps actually close. Typical quarterly items: training progress against the plan, a check on registration details and renewal timing, and reviews of vendors that touch compliance functions such as identity verification or screening.

Slower cycles matter most, because nothing in daily operations prompts them. The calendar should carry the risk-assessment refresh (and the triggers that force an earlier one, such as a new product or corridor), the periodic policy-and-procedure review, and — critically — the two-year effectiveness-review clock, scheduled far enough ahead that scoping and independence questions are settled before the deadline arrives.

Every entry needs two fields beyond a date: an owner and a pointer to completion evidence. A payroll platform that briefly holds employer funds might run this as a shared task list where each item links to the artifact produced — the QA sample, the training records, the signed-off review. An item marked done with nothing behind it is a wish list, not a control.

Regulatory change management is a five-step loop: notice the change, assess its impact, assign an owner, update the affected controls, and keep evidence. The first step is the one most small businesses lack entirely — a deliberate way to learn that FINTRAC guidance or the legislation has moved, such as a named person responsible for reviewing FINTRAC's published updates and checking the current consolidations on Justice Laws.

Assessment asks three questions: does the change alter who is covered, what must be reported or recorded, or how existing controls must operate? The answer drives the update: policies and procedures, training content, the risk assessment, and sometimes registration itself. Assigning a named owner with a deadline is what separates a process from a news feed — a change that everyone read but nobody owns changes nothing.

Keep evidence at every step, including when the conclusion is "no impact on us." A short change log — what changed, when it was noticed, the assessment, the decision, and the updates made — is the record that the loop actually ran.

The past few years show how obligations arrive between effectiveness reviews. Businesses transporting currency or certain negotiable instruments (armoured-car services) became reporting entities effective July 1, 2024. Acquirer services for private automated banking machines became a registerable MSB/FMSB activity in force October 1, 2025. And change runs both directions: FINTRAC withdrew its long-standing PI-7670 policy positions on merchant servicing and payment processing effective April 27, 2022, so businesses that had structured their analysis around that interpretation needed to reassess against the current statutory tests.

Each of these is a different species of change — new sector coverage, a new registration trigger, and a withdrawn interpretation — and none of them would surface through the calendar alone. A business that checks its obligations only when it first registers, or only at the two-year review, can run a stale program for months without knowing it.

The working set is small: the calendar itself with owners, due dates, and completion status; the evidence each completed item points to; the change log with impact assessments and resulting updates; and notes from any meeting where a change decision was made. Version-date policy documents so it is clear which version was in force when.

This documentation pays for itself twice. Day to day, it is how a two-person team hands work across vacations and turnover without dropping obligations. At the two-year effectiveness review required by PCMLTFR ss. 156–157, it is the raw material: the reviewer can see what was scheduled, what was done, what changed in the regulatory environment, and how the program responded. A program that can show its operating rhythm is answering the effectiveness question with records rather than recollection.