The Five-Year Rule: Retention and Production

PCMLTFA s. 6 sets the general duty: every reporting entity "shall keep records in accordance with the regulations." The retention period itself lives in PCMLTFR s. 148 — a persistent citation error places it at s. 146, which is actually the ongoing-monitoring record requirement (and s. 147 is the provision permitting electronic storage, so long as a paper copy can readily be produced).

Under s. 148(1), records must be kept for at least five years after one of three dates: (a) the day the account they relate to is closed, for account records such as signature cards and account applications; (b) the day the last business transaction is conducted, for records like information records and corporate or partnership documents; or (c) the day the record was created, in any other case — which is the default for MSB transaction records. The practical consequence is that a single business holds records on very different clocks: an account record for a fifteen-year relationship is retained until five years after closure, while a one-off transaction record runs five years from the day it was made. One relief valve exists — s. 148(2) releases an individual from retention after their employment or contract ends, where the records belong to the employer or counterparty.

The same structure now reaches recently covered sectors. Mortgage administrators, brokers and lenders came under FINTRAC requirements on October 11, 2024; cheque-cashing businesses, factors, and financing or leasing entities on April 1, 2025; acquirers of private automated banking machines and title insurers on October 1, 2025. A newly covered business only has records to retain from the date its obligations began — but from that date the five-year clocks run the same way as for everyone else.

A retention schedule is only as good as the record inventory behind it. For an MSB, the main triggers are: a large cash transaction record for $10,000 or more in cash received in a single transaction (PCMLTFR s. 31, with an exception for funds from a financial entity or public body); a large virtual currency transaction record at the same $10,000 threshold (s. 32); EFT records at $1,000 or more for initiation, intermediary sending, and final receipt of international transfers (s. 36(d)–(f)); records for transmitting or remitting $1,000 or more by non-EFT means (s. 36(c.1), (c.2)); and records for virtual currency transfers of $1,000 or more, including receipt for remittance to a beneficiary (s. 36(g), (h)). Foreign MSBs have parallel provisions at ss. 34 and 35.

Two thresholds are routinely misstated. First, foreign exchange: a foreign currency exchange transaction ticket is required for every exchange transaction, regardless of amount (s. 36(i)) — the widely repeated "$3,000 trigger" is wrong. The $3,000 figure only appears in the s. 1(2) ticket definition: at $3,000 or more the ticket must additionally record the requester's name, address, principal business or occupation and, for a person, date of birth. Virtual currency exchange tickets work the same way — required for every VC exchange (s. 36(j)), with the enhanced-information threshold at $1,000. Second, negotiable instruments: issuing traveller's cheques or money orders for $3,000 or more, and redeeming money orders totalling $3,000 or more, each require a record (s. 36(b), (c)), and since cheque cashers became MSBs on April 1, 2025, cashing cheques totalling $3,000 or more does too (s. 36(b.1)). One caution when building citations: s. 36.1 is the crowdfunding platform services record provision — it does not belong in an ordinary MSB record inventory.

PCMLTFR s. 149 requires every record kept under the Regulations to be kept in such a way that it can be provided to an authorized person within 30 days after a request to examine it under PCMLTFA s. 62. Note the framing: this is a manner-of-keeping obligation. A business that technically possesses every record but needs six weeks of archaeology across old laptops, a former processor's portal and a departed employee's inbox is offside the way the rule is written, even though nothing was destroyed.

Businesses typically satisfy this by indexing records by type, date and a common reference number, so the transaction record, the associated identity verification, and any related filing evidence can be pulled together; by keeping an inventory of where each record type physically lives, including records held by vendors or payment processors; and by periodically testing that a sample of records approaching the five-year mark can actually be retrieved and exported. Document who owns retrieval for each system — the 30-day window is short when the person who knew the archive has left.

Retention is not only about transactions. PCMLTFR s. 156(1) requires documented program artifacts: an appointed compliance officer, written policies and procedures kept up to date, a documented risk assessment, a written training program for employees, agents or mandataries with a documented plan and delivery, and a documented plan for the effectiveness review — which s. 156(3) requires to be carried out, with results documented, every two years by an internal or external auditor. An examination looks for these artifacts as records in themselves.

Agent files gained a hard retention rule of their own. PCMLTFA s. 9.93 requires an MSB to obtain and review criminal-record documents for each agent or mandatary (for entities: the CEO, president, directors and 20%-plus owners) before engaging them, and again within 30 days after the second anniversary of the most recent review; documents not in an official language need an attested translation. PCMLTFR s. 37.1 adds that the documents must have been issued no more than six months before the review and must be retained for five years after they are obtained. These agent-eligibility requirements came into force October 1, 2025. Two related points are commonly confused: no provision prescribes a written agency agreement as a required record (FINTRAC's compliance-program guidance says the effectiveness review should cover agent agreements, but that is guidance, not regulation), and s. 37's service-agreement records concern client entities with ongoing service relationships, not agent engagement. Agents and branches must, however, appear in the MSB's FINTRAC registration information, with changes notified to the Centre.

When a report goes to FINTRAC, the submission confirmation is the contemporaneous evidence of what was filed and when. Treat confirmations and copies of submitted reports as records in their own right: under the s. 148(1)(c) default, a record is kept for five years from the day it was created, and filing evidence naturally follows the same discipline as the transactions it documents. For the precise record requirements attached to each report type, check the current FINTRAC record-keeping guidance rather than relying on habit.

Operationally, two habits close the loop. First, reconcile on a set cycle: compare the transactions that met a reporting trigger against the reports actually confirmed as submitted, so a missed filing surfaces in weeks rather than at examination. Second, store the confirmation identifier with the underlying transaction record, so a single s. 149 production request returns the transaction, the identification, and the proof of filing as one package instead of three separate searches.