Uncategorized | Outlier Compliance Group

Written with David Vijan

A year has passed since the Bank of Canada (BoC)’s operational framework for payment service providers (PSPs) came into force under the Retail Payment Activities Act (RPAA) and Retail Payment Activities Regulations (RPAR) – collectively referred to as Retail Payments Supervision (RPS). A year ago, the focus for many PSPs was documenting operational risk and creating incident response and safeguarding frameworks. The first year has made something else clear, RPS compliance is not a one-time implementation project. It is an ongoing operating discipline and there are still PSPs without the appropriate processes in place.

A reminder: if your business performs any of the five payment functions listed below, the RPAA applies to your business, and you should already be registered with the BoC and have an operational risk and incident response framework in place.

The provision or maintenance of a payment account;
The holding of end-user funds until withdrawn or transferred;
The initiation of a payment at the request of an end-user;
The authorization of an electronic funds transfer, transmission, reception, or facilitation of a payment message;
The clearing or settlement of payment transactions.

Registered PSPs have now completed the first annual reporting cycle, and the Bank has begun publishing enforcement decisions and conducting supervisory activities. As PSPs enter year two, the priority shouldn’t be whether you have a framework but rather, whether you can demonstrate that the framework is implemented, tested and working.

PSPs remain responsible for maintaining an operational risk and incident response framework that addresses their payment activities, associated systems, data, information and business processes. PSPs that hold end-user funds must also maintain compliant safeguarding arrangements if they hold customer funds (which still seems to be a gap for many PSPs).

BoC has updated its FAQs, which reinforce that responsibility rests with each PSP in the payment chain. An organization is not relieved of its obligations because another party is registered, because it earns no revenue from the payment function, or because a related payment passes partly through an excluded or designated system. The scope needs to be assessed at the level of the payment functions actually performed.

What Should PSPs Plan For In Year Two?

Testing and Internal Review

First, for any PSPs (registered or on the application list) that do not yet have an operational risk and incident response framework in place, you should address this immediately.

For PSPs with frameworks in place, year two is about demonstrating that they remain current and effective. One of the most immediate year-two requirements is the annual internal review. Under section 8 of the Retail Payment Activities Regulations, PSPs must review their operational risk and incident response framework at least once each year and before making material changes to their operations or risk-management systems, policies, procedures, processes or controls.

The review must assess regulatory compliance, the framework’s effectiveness, and the adequacy of technology, human and financial resources. If your business is subject to a SOC 2 audit, this will help test your business continuity and disaster recovery plans. Some PSPs have opted for a gap analysis review of their framework with a third party in order to analyze areas for improvement. Regardless of how you conduct this review, it must get done on an annual basis.

Annual Reporting

PSPs that completed the first annual reporting cycle should already be planning for the next one. As the first report covered only a partial compliance period, the next report will provide a more complete picture of each PSP’s compliance.

The first reporting cycle highlighted the importance of collecting regulatory data throughout the year. Depending on the PSP’s business, annual reporting covers five main areas:

Operational risk and incident management, including risk categories, reliability targets, resources and incident-response capabilities;
Safeguarding of end-user funds, including the safeguarding method and any shortfalls identified during the year;
Significant changes and incidents, including material changes to operations, technology, outsourcing or safeguarding arrangements;
Ubiquity and interconnectedness metrics, including payment volumes, end users, funds held and services provided to other PSPs; and
Financial information and record-keeping, including revenue, operating expenses and equity.

The practical lesson is straightforward: annual reporting should be treated as an output of the compliance framework, not a once-a-year data call. PSPs should assign responsibility for each reporting area, document their methodologies and scope decisions, and reconcile reported information against their operational systems and previous regulatory submissions.

Enforcement

In June 2026, BoC began publicly enforcing the RPS through the first notice of violation seen under the regime. These initial decisions involved PSPs performing retail payment activities without being registered. Although this is classified as a very serious violation and can attract a penalty of up to $10 million, the initial cases resulted in $0 penalties. In several cases, the Bank noted that the PSP had taken steps to comply and mitigate potential harm by submitting a registration application.

While these first few cases resulted in $0 penalties, these decisions should not be viewed as a grace period. They remain public for five years and may affect a PSP’s reputation and regulatory history, and could influence future enforcement even with other agencies (i.e. FINTRAC). This is clearly sending a message that BoC is ready to enforce.

BoC has also contacted many PSPs directly to request documentation and other information demonstrating compliance with their operational risk and safeguarding obligations. It has further demonstrated that it will act urgently where end-user funds may be at risk, temporarily stopping one PSP from performing retail payment activities because of safeguarding concerns.

Independent Reviews

While there is some time, PSPs should begin planning for the independent reviews that may be required by September 2028. PSPs that hold end-user funds must obtain an independent review of their safeguarding compliance at least once every three years. A three-year independent review of the operational risk and incident response framework is also required where the PSP has an internal or external auditor.

Ahead of the first formal independent review, PSPs are encouraged to conduct an internal gap analysis to confirm that their frameworks address all regulatory requirements, include expected methodologies, and to resolve any deficiencies before commencing an independent review. Such gap analysis should confirm the PSP’s methodology for identifying material incidents, particularly as BoC has indicated that it is receiving fewer incident reports than expected.

In preparation for an independent review, PSPs may want to source external auditors who can perform this service for them, budget accordingly, and ensure they secure their place to commence the review within the required timeframe.

This review must cover how the PSP identifies and manages risks, monitors its systems and payment activities, responds to incidents, oversees third parties, trains staff, and reviews and tests the framework. PSPs that hold end-user funds must also have an independent review of their safeguarding arrangements at least every three years, including how funds are protected, tracked and made available to end users, and how any shortfalls are identified and addressed.

In Summary

RPS has moved from implementation to supervision. For PSPs, the work now is to make the framework part of daily operations, and to be ready to demonstrate that it works and has been implemented effectively when the Bank asks. Ensure that any inquiries from BoC are responded to within the requested timeframe.

If you haven’t already finalized your framework, need advisory on internal testing/gap analysis, or want to start planning for your independent review, Outlier is here to help, so please get in touch.

This month, Outlier celebrates 13 years in business. When we founded Outlier, the goal was simple: build a firm that provided practical, senior-level compliance advice with integrity, independence, and technical excellence. Since then, we’ve had the privilege of supporting hundreds of organizations as the regulatory landscape has continued to evolve.

Thirteen years have taught us a few things.

First, culture matters. We hire people we admire and strive to create an environment where expertise, collaboration, and respect come first.

Second, not every opportunity is the right opportunity. Over the years, we’ve become more selective about the work we take on, allowing us to focus on clients who value compliance as a strategic advantage, rather than simply a regulatory obligation.

Finally, continuous improvement never stops. The regulations change, risks change, and our clients’ businesses grow. We believe our firm should too.

That same commitment to growth and continuous improvement has led us to one of the most exciting milestones in Outlier’s history: the launch of our sister company, Outlier USA.

While we’ve supported clients domiciled in many jurisdictions with Canadian compliance matters, we’re now establishing a dedicated U.S. practice with its own team of experienced U.S. compliance professionals. Outlier Canada and Outlier USA will each be led by experts in their respective jurisdictions (we don’t believe in global experts), while sharing the same values, practical approach, and commitment to exceptional client service.

To mark this milestone, we’ve refreshed our logo and moved our website to outliercompliance.com (don’t worry, outliercanada.com still gets you to us). While our brand and reach are expanding, our mission remains the same: providing practical, senior-level regulatory expertise that helps organizations navigate an increasingly complex regulatory environment.

For our Canadian entity, we have changed our legal name from Outlier Solutions Inc. to Outlier Compliance Canada Inc. This change better reflects our expanding operations as we continue to grow. Note this is a legal name change only, your existing agreements and primary contacts will remain unchanged.

To our clients, partners, and colleagues, thank you for your trust over the past 13 years.

We’re excited to announce the promotion of Maria Shamou to AML Project Coordinator!

Since joining Outlier, Maria has been an integral part of our team, providing exceptional support to both our clients and consultants. In her expanded role, she will continue her administrative responsibilities while also coordinating our AML projects, helping ensure seamless project delivery and a better, more seamless client experience.

This promotion reflects Maria’s hard work, dedication, and commitment to excellence. Please join us in congratulating her. We’re excited to see her continue to grow with the Outlier team!

The Outlier Compliance Group team is thrilled to welcome two of our newest members, Jasbir Dhillon and Wioletta Traynor.

Jasbir brings deep money services business (MSB) and real estate experience to the team, and Wioletta brings deep jewelry sector expertise and is a CPA.

Jasbir’s Bio

Jasbir is a compliance and financial crime professional with over 15 years of experience in regulatory oversight, anti-money laundering (AML), and risk management across the banking, money services business, and consulting sectors. She has extensive experience supporting organizations in meeting their obligations under Canadian regulatory frameworks, including FINTRAC requirements, the PCMLTFA, and PIPEDA.

Her work focuses on regulatory audits, AML/ATF investigations, risk assessments, and the development of robust compliance programs that help organizations navigate complex regulatory environments while maintaining strong operational integrity.

Wioletta’s Bio

Wioletta Traynor, CPA, CGA brings more than 13 years of leadership experience in the precious metals, e-commerce industry, with a background in AML/ATF compliance, risk and finance management, and private accounting.

Prior to joining Outlier Compliance Canada Inc., Wioletta has served in a senior leadership role, including Chief Deputy Compliance Officer, Financial Controller, and CFO, helping businesses with compliance and accounting frameworks, internal controls, and internal compliance systems and investigations. Her experience includes AML/ATF Compliance Effectiveness Reviews, GAP Analysis, policy development, AML/ATF risk assessments, internal investigations, fraud prevention, and general compliance.

Over the years, she has contributed to multiple fraud related investigations involving suspicious transactions and financial misconduct, including the widely publicized Project Bridle Path mortgage fraud case.

Wioletta is passionate about helping organizations go beyond the “tick box” AML/ATF checklist and building effective programs to protect businesses from financial and reputational risk.

Please join us in welcoming Jasbir and Wioletta!

As with all our consultants, both Jasbir and Wioletta have deep subject matter expertise of more than 10,000 hours and support Outlier’s mission statement “good compliance can enable good business”.

Opening remarks from Outlier Compliance Group Co-Founder and Chairperson Amber D. Scott at TCAE 2025 Toronto Compliance & AML Conference

Many of us remember exactly where we were on this day 24 years ago.

Imagine this scenario: I was a new compliance analyst at Manulife, having started my first role after university just a month before in the Waterloo head office. I had been at my desk since 7 am when a colleague, her face streaked with tears, came by to tell our team to assemble for instructions in one of the conference rooms. There was little information, but what was known was devastating; America was under attack, on home soil.

Financial markets closed. Staff were sent home to await further instructions. When I went to my desk to pick up my handbag, my phone was ringing and I answered. It was a colleague in Toronto with mobility issues, who was not able to navigate the crowds at Union Station. So she had gone back to the office, which was now mostly empty, to wait, and she was terrified. We talked for two hours, until some of the crowds cleared.

While we were on the phone, my colleague and I would set our physical handset phones aside, and walk over to nearby meeting rooms to see if there were any updates on the news on the TVs there. It was 2001 – we couldn’t just Google it.

So much has changed since then. I think it’s fair to say that at the time, the idea of compliance was academically interesting, but if you asked me what I did – or why it mattered – neither money laundering, nor counter terrorism would have been top of mind.

But some things strike me as being eerily similar – we talked to each other that day about what was happening and what it meant. In the days that followed, the most common question asked was what can we do to help? In the months and years that followed, how do we make sure that this doesn’t happen again? We refused to be paralyzed by fear, and sought to build more resilient systems, even if these were sometimes inconvenient.

Today, while I have many more sources of information at my fingertips, I am still very reliant on people in my network when I need to understand something at a deep level. While I don’t have to put down a handset and go to the meeting room next door to see what’s on the news, I am every bit as reliant on colleagues and contacts to parse information, understand implications, and find truth.

Finding truth, in my estimation, is one of the greatest challenges of the modern era. The importance of truth cannot be overstated at a time when we are under continuous attack, pummeled with misinformation and disinformation, on a seemingly unending basis, from every possible direction, via every possible channel. On that score, I owe a huge debt to some of the folks in the room today, who have been unerring sources of insight, and of truth.

This is not an indictment of my own skills or abilities, but a call to the importance of communities, and knowledge sharing. Any one of us can be strong on our own, but no one can achieve a true level of badassery without community.

It is fitting then, that I am standing on this stage today with Souzan Ismaili, because no one builds community better than she does. Souzan is tireless in her quest to bring people together, to educate, and to create connections.

I don’t think that the importance of this work can be understated – but this is not just Souzan’s work. This is a call to action to every person here today, to build community, to find your sources of truth, and to be that Northstar for your colleagues when you can. It won’t always be easy, in fact, sometimes it will be hard – but we will always be stronger together.

The Outlier Compliance Group team is excited to welcome our newest member, Maria Shamou, as our administrative ninja.
Maria brings broad compliance knowledge complemented by over eight years of comprehensive customer service experience, paired with a strong foundation in administrative support and a strong interest in compliance along with a background in administrative support. She earned a Bachelor’s degree in Business Administration, and later completed a post-graduate program in Financial Services Compliance Administration at Seneca College. Through this program, she expanded her knowledge in anti-money laundering (AML) administration, risk management, privacy management, and financial services product knowledge. Her interest in financial services products led her to complete the Canadian Securities Course (CSC).

Maria is proud to support Outlier’s mission statement: “Good compliance is good business.”

Today marks another milestone for us – 12 years since Outlier Compliance Group was founded.

What began as a bold and novel idea, building a consulting firm made up exclusively of seasoned compliance professionals with deep in-house experience, has grown into a thriving, trusted partner for clients navigating Canada’s ever-changing regulatory landscape.

Our name, inspired by Malcolm Gladwell’s “Outliers, the Story of Success” which espoused the notion that to be truly proficient in a skill, 10,000 hours of practice is required. That was the bar that was set, met, and most often exceeded by every compliance professional that joined our team over the years.

Over the years, we’ve grown, evolved, but have stayed true to our roots. We’ve learned that success comes from surrounding ourselves with exceptional people, from listening closely to our clients, and from being willing to adapt in the face of change. We’ve discovered the value of curiosity when navigating complexity, and the power of collaboration when tackling the most challenging problems.

Through it all, our mission has remained the same “good compliance is good business”. It’s the principle that guides our work, shapes our advice, and underpins every solution we deliver.

As the Canadian regulatory environment becomes increasingly complex, our mission and our learnings will play to our continued success and growth as we continue to provide top tier compliance and risk management services.

To our amazing team, past, present and future, thank you for your passion, expertise and resilience. To our clients, partners and industry peers, thank you for your trust and collaboration. Lastly, but by no means least, a special thank you to our CEO, David Vijan, and our Chairperson, Amber D. Scott, for keeping us on our toes and steering the ship with vision and purpose.

Here’s to 12 years of achievement and to the future.

We’re seeing FINTRAC ramp up Administrative Monetary Penalties against all sectors, however, for securities dealers we’re starting to see some heavy hits, something we haven’t seen before, signaling a graduated approach to compliance assessments by FINTRAC.

On July 3, 2025, FINTRAC announced an Administrative Monetary Penalty of $544,500 against an investment dealer headquartered in Vancouver, British Columbia. Additionally, on February 13, 2025, FINTRAC announced an Administrative Monetary Penalty of $66,000 against, a Wealth Management Securities Dealer in Ontario.

Securities dealers must fulfill specific obligations as required by the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) and associated Regulations, to help combat money laundering and terrorist activity financing in Canada. As defined under the PCMLTFA, a securities dealer means a person or entity authorized under provincial legislation to engage in the business of dealing in securities or any other financial instruments or to provide portfolio management or investment advising services.

FINTRAC has the legislative authority to issue administrative monetary penalties (AMPs) to reporting entities that are found to be non-compliant with the PCMLTFA and associated Regulations. For more information, see Penalties for non-compliance.

Between the two notices, it was found that following compliance examinations, the following failures were found, which resulted in the AMPs:

Failure to develop and apply written compliance policies and procedures that are kept up to date; and, in the case of an entity, are approved by a senior officer. Specifically, the firm did not sufficiently develop and document its compliance policies and procedures in relation to know your client and record keeping requirements.
Failure to assess and document the risk of a money laundering or terrorist financing offence, taking into consideration prescribed factors. Specifically, the firm’s risk assessment was incomplete, as it did not clearly outline the risks associated with its clients and did not contain assessment of all the required categories. In addition, the risk assessment did not document an adequate methodology for the assessment of its money laundering and terrorist financing risks.
Failure to institute and document the prescribed review of its policies and procedures, risk assessment and training program. Specifically, the scope of a review did not cover the firm’s risk assessment. Additionally, the review did not specify how the organization ensured that its compliance program was tested for effectiveness.
Failure to submit suspicious transaction reports where there were reasonable grounds to suspect that transactions or attempted transactions were related to a money laundering or terrorist activity financing offence.
Failure to take the prescribed special measures for high risk.

Of all the findings, the ones that netted the highest AMP were related specifically to:

Failure to submit suspicious transaction reports where there were reasonable grounds to suspect that transactions or attempted transactions were related to a money laundering or terrorist activity financing offence.
Failure to take the prescribed special measures for high risk.

Failures in suspicious transaction reporting continue to be a big focus for FINTRAC and a trend with the larger value AMPs that we’ve been seeing.

Securities dealers are responsible for the following requirements under the PCMLTFA and associated Regulations:

Compliance program:
1. Appoint a compliance officer who is responsible for implementing the program. The Compliance Officer must always have access to management and the authority to carry out their duties.
2. Develop and apply written compliance policies and procedures that are kept up to date and, in the case of an entity, are approved by a senior officer. Policies and procedures must be detailed and reflect the reporting entities business model.
3. Conduct a risk assessment of your business to assess and document the risk of a money laundering or terrorist activity financing offence occurring in the course of your activities. The categories that must be assessed are outlined in guidance.
4. Develop and maintain a written, ongoing compliance training program for your employees, agents or mandataries, or other authorized persons.
5. Institute and document a plan for the ongoing compliance training program and deliver the training (training plan).
6. Institute and document a plan for a review of the compliance program for the purpose of testing its effectiveness, and carry out this review every two years at a minimum (two-year effectiveness review). The review must test all parts of your compliance program as well as operations.
Know your client:
1. verifying client identity,
2. politically exposed persons, heads of international organizations, their family members and close associates, beneficial ownership, and
3. third party determination.
Transaction reporting:
Record keeping;
Foreign branches, foreign subsidiaries and affiliates; and
Ministerial directives

What Happens After You Submit a Suspicious Transaction Report?

When it comes to AML compliance, submitting a Suspicious Transaction Report (STR) to FINTRAC is just the beginning, not the end.

In this short video presentation, Divya Bhaktha from Outlier Compliance Group breaks down exactly what you need to do after an STR is filed, and the consequences if you don’t follow-up correctly.

Reference Links

Public notice of administrative monetary penalties

Reporting suspicious transactions to FINTRAC

Guide on harm done assessment for suspicious transaction reports violations (section 2.3.4)

Need help navigating STR obligations? Email us at info@outliercompliance.com or get in touch here.

It has come to our attention that FINTRAC may not be sending out reminders to MSBs regarding upcoming renewals of MSB registrations.

Is your MSB registration due for renewal?

You can check the status (and expiry date) of your MSB registration here.

MSB must renew their MSB registration with FINTRAC every two years. We recommend renewing your registration at least one month before the expiration date, as it can take some time for FINTRAC to process the renewal request form. For your reference, keep a copy of the form before you submit.

Once the form is submitted, watch your inbox for additional requests from FINTRAC. We recommend whitelisting *@fintrac-canafe.gc.ca addresses, so that they don’t get caught in your spam filters.

For those who prefer video content, Outlier’s Divya Bhaktha walks through the MSB registration renewal process in this short video — click here to watch.

Need a hand?

If you need assistance with your MSB registration or other compliance matters, please get in touch here, or email us at info@outliercompliance.com

Anti-Money Laundering
Consulting Services & Strategies