administrative monetary penalties | Outlier Compliance Group

DPMS Compliance Program Tools Update – October 2026

If you are a dealer in precious metals and stones (DPMS) using Outlier’s online on-demand tools to develop your compliance program, it’s time to make updates.

We’ve made updates and improvements to the online financial crime compliance materials:

Updates based on Bill C-12: administrative monetary penalty (AMP) amounts are updated to reflect changes that came into force earlier this year. Canada’s anti-money laundering (AML) regulator is expected to release updated guidance on AMPs, so some additional changes may follow. The documents also reflect the requirement for compliance programs to be reasonably designed, risk-based, and effective.
Updates to the glossary and recordkeeping requirements list to reflect more detailed definitions and specifications.
Updates to the information sources detailed in the Risk Assessment and Risk Assessment methodology.

We have also made fixes to user-reported bugs, including checkbox lists that weren’t staying checked when users moved to a new page. Sorry about that, and thank you for letting us know that this was happening!

While these updates are not expected to materially change your day-to-day compliance processes, they do reflect stricter AML regime requirements and increased expectations for compliance program effectiveness. Please review them to understand the changes and consider whether any adjustments are needed within your operations.

At your earliest convenience, please log in here, and download the latest versions of your compliance program documents.

Thank you!
Outlier Compliance Group

Your Real Estate Business Can’t Afford ‘Just-in-Time Compliance’

Written with Heidi Unrau

In the past two years, 13 real estate brokerages faced a total of $1,041,936 in administrative monetary penalties (AMP) from FINTRAC, the federal agency that regulates anti-financial crime compliance and analyzes financial intelligence in Canada. That works out to an average fine of $80,148 per brokerage, with the single largest AMP reaching approximately $150,000.

Real estate brokers, sales representatives, and developers have legal responsibilities under Canada’s anti-money laundering rules prescribed by the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA). These rules are designed to prevent, detect and deter real estate transactions from being used to hide proceeds of crime, to fund terrorist activity, or evade sanctions.

Yet too many brokerages still treat anti-money laundering (AML) compliance as a cost centre instead of a core risk management function. And what we’re seeing is a lot of “just-in-time compliance” behaviour, resulting in major deficiencies with up to six-figure penalties.

Compliance within the real estate industry has never been as important as it is right now. Not only is the regulator penalizing companies for compliance failures, but the monetary penalties are now 40 times higher than they were before. That emphasizes the level of effort that needs to be paid to your compliance program before FINTRAC calls.

Why is FINTRAC Cracking Down on Real Estate?

Real estate is an attractive target for money laundering because one deal can move a significant amount of illicit funds. Real estate transactions are especially vulnerable because they are used at the integration stage of money laundering, after the funds have already moved through accounts, businesses, third parties, family members, or international transfers to obscure the origin.

By the time those funds reach real estate, the warning signs are much harder to identify, but the compliance expectations do not change. Given the size, complexity, and risk profile of real estate transactions, you need to apply greater scrutiny to the people, funds, and circumstances behind each deal.

Weak controls around identification, record keeping, training, and suspicious transaction reporting expose your business to unnecessary financial and reputational risk.

The Problem With ‘Just-in-Time Compliance’

Just-in-time compliance happens when you ignore your AML compliance obligations throughout the year, or worse, a longer period of time, then scramble to fix everything after FINTRAC makes contact. By then, it’s too late.

Once FINTRAC calls, the exam has already started. Everything done after that point becomes last-minute compliance. It’s better than doing nothing, but it doesn’t prove you had those controls in place during the period FINTRAC is reviewing.

The regulator is looking at whether you had a functioning program in place during the period under review. If your procedures, training, records, and review processes were missing or outdated during that period, fixing them after FINTRAC contacts you will not undo the deficiency.

A FINTRAC examination can disrupt regular business operations if you’re scrambling to track down missing records, update stale policies, complete overdue training, or fix program gaps while still trying to serve clients and close deals.

FINTRAC publishes all administrative monetary penalties on its website. A public enforcement action can damage trust with clients, lenders, referral partners and other stakeholders, causing serious reputational harm that can negatively affect your bottom line.

That’s exactly why AML compliance has to be treated as an ongoing business function. You already understand this concept in other areas of your business. You do not wait until tax season to create a full year of bookkeeping from scratch. You do not wait until a lawsuit to decide if your contracts were properly drafted. AML compliance works the same way. The work needs to be done before the regulator asks for proof.

Start With Your Baseline AML Obligations

Trying to build a perfect AML program right out of the gate can be overwhelming. In reality, you should start by meeting the baseline requirements. That means ensuring your real estate business has the fundamentals in place, such as written policies and procedures, a designated Compliance Officer, training, risk assessment, record keeping, suspicious transaction escalation and reporting processes, and the required two-year compliance effectiveness review.

Beyond these baseline requirements, FINTRAC states you must implement a compliance program that can effectively verify the identity of the persons and entities involved in transactions, conduct ongoing monitoring when a business relationship is formed, obtain and take reasonable measures to confirm beneficial ownership information for entities, make third-party determinations when required, and take reasonable measures to determine whether clients are politically exposed persons or heads of international organizations.

Your policies and procedures should clearly explain what your business is supposed to do. Risk assessments identify where your business is most exposed. Your training ensures staff and agents understand their obligations. Your records prove what happened. And your suspicious transactions process shows how concerns are escalated, reviewed, documented, and reported.

Why The Two-Year Effectiveness Review Is Critical

The two-year effectiveness review is especially important because it reveals where your program is working and where it’s weak. We recommend starting here because it provides a look at your AML compliance program as a whole, identifies the biggest problem areas, and prioritizes the highest risk gaps. It is very important that the person completing your review has adequate experience and understands the industry, as well as your business. This should not be a “check the box” compliance exercise.

If you have not yet completed an effectiveness review, that should be the top priority.

Where Real Estate Entities Commonly Fail

Many real estate compliance failures are basic program deficiencies that are entirely preventable. The most serious gaps usually fall into three main areas: not having an AML program at all, failing to complete the required two-year effectiveness review, and unreported suspicious transactions. The regulator can, and does, penalize failures in the compliance process itself, including missed reporting, poor documentation, and weak program controls.

It is complex, but it is not impossible. If your written program does not reflect how your brokerage actually operates, fix it. If your training is outdated, that needs attention. If your team is unsure what to collect, when to escalate concerns, or when a report may be required, those deficiencies should be fixed before FINTRAC identifies them for you.

No AML Program At All

The most common failure is having nothing in place. That means no written policies and procedures, no designated compliance officer, no training, and no clear internal process for meeting AML obligations.

These are the foundation of a compliance program. Without them, your business has no consistent way to identify risk, collect required information, train agents, escalate concerns, keep records, or prove to the regulator that the business is taking its obligations seriously.

The Two-Year Effectiveness Review Not Done

Another major gap is the two-year effectiveness review. It’s often skipped entirely, even though it is one of the most important tools you have to determine if your compliance program is actually working. Without it, you may not know where your business is exposed until FINTRAC identifies the problem first.

Missed Suspicious Transaction Reporting

A single unreported suspicious transaction can result in a financial penalty well over $100,000. Yet, this remains one of the most common compliance failures.

FINTRAC has given reporting entities a laundry list of suspicious indicators. And that laundry list is what they’re using to assess your transactions. If a transaction presents red flags, it needs to move through a clear internal process so you can show the regulator what the final decision was. Specifically, that there were reasonable grounds to suspect (RGS) the transaction was related to financial crime and reported as a suspicious transaction to FINTRAC, or there was not RGS and the rationale is clearly documented.

‘Suspicious’ Does Not Automatically Mean a Dead Deal

A common point of confusion is the distinction between a high-risk transaction, a suspicious transaction, and a transaction you cannot legally participate in.

A transaction can be high risk without being illegal. A client might have foreign funds, a complex ownership structure, have a holding company involved, or have a third party helping with the purchase. Those details can have legitimate explanations. They also require more questions, documentation, and scrutiny.

A transaction is suspicious when you have reasonable grounds to suspect, which is a lower threshold than to believe, that it is linked to criminal activity. You do not need proof, but you do need to explain why you feel it is suspicious based on facts, context, indicators, what you know about the client, and the nature of the transaction.

You can still proceed with high risk and suspicious transactions. Your obligation is to assess the concern, document what happened, escalate internally, and report to FINTRAC when required.

However, if a client is asking you to help them break the law or evade sanctions, then you absolutely cannot proceed with the transaction.

Next Steps

For real estate brokerages, compliance is no longer something to address only when an exam is looming, the biggest risk is waiting too long.

If your real estate business does not have an AML compliance program, you need to implement one as soon as possible. Get support from a qualified compliance provider that can help create policies and procedures customized to the specific type of real estate business you conduct. Generic compliance templates are no longer effective because they are not tailored to align with your specific day-to-day operations.

If you have an AML compliance program, but have not yet completed your two-year effectiveness review, start there. It will tell you where your program is working and where it’s not. Then use that information to prioritize what needs to be fixed first.

Need an effectiveness review or support building, reviewing, or updating your AML compliance program? Contact Outlier to get clear, practical guidance on your obligations and next steps.

Securities Dealers See Rising FINTRAC Penalties

We’re seeing FINTRAC ramp up Administrative Monetary Penalties against all sectors, however, for securities dealers we’re starting to see some heavy hits, something we haven’t seen before, signaling a graduated approach to compliance assessments by FINTRAC.

On July 3, 2025, FINTRAC announced an Administrative Monetary Penalty of $544,500 against an investment dealer headquartered in Vancouver, British Columbia. Additionally, on February 13, 2025, FINTRAC announced an Administrative Monetary Penalty of $66,000 against, a Wealth Management Securities Dealer in Ontario.

Securities dealers must fulfill specific obligations as required by the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) and associated Regulations, to help combat money laundering and terrorist activity financing in Canada. As defined under the PCMLTFA, a securities dealer means a person or entity authorized under provincial legislation to engage in the business of dealing in securities or any other financial instruments or to provide portfolio management or investment advising services.

FINTRAC has the legislative authority to issue administrative monetary penalties (AMPs) to reporting entities that are found to be non-compliant with the PCMLTFA and associated Regulations. For more information, see Penalties for non-compliance.

Between the two notices, it was found that following compliance examinations, the following failures were found, which resulted in the AMPs:

Failure to develop and apply written compliance policies and procedures that are kept up to date; and, in the case of an entity, are approved by a senior officer. Specifically, the firm did not sufficiently develop and document its compliance policies and procedures in relation to know your client and record keeping requirements.
Failure to assess and document the risk of a money laundering or terrorist financing offence, taking into consideration prescribed factors. Specifically, the firm’s risk assessment was incomplete, as it did not clearly outline the risks associated with its clients and did not contain assessment of all the required categories. In addition, the risk assessment did not document an adequate methodology for the assessment of its money laundering and terrorist financing risks.
Failure to institute and document the prescribed review of its policies and procedures, risk assessment and training program. Specifically, the scope of a review did not cover the firm’s risk assessment. Additionally, the review did not specify how the organization ensured that its compliance program was tested for effectiveness.
Failure to submit suspicious transaction reports where there were reasonable grounds to suspect that transactions or attempted transactions were related to a money laundering or terrorist activity financing offence.
Failure to take the prescribed special measures for high risk.

Of all the findings, the ones that netted the highest AMP were related specifically to:

Failure to submit suspicious transaction reports where there were reasonable grounds to suspect that transactions or attempted transactions were related to a money laundering or terrorist activity financing offence.
Failure to take the prescribed special measures for high risk.

Failures in suspicious transaction reporting continue to be a big focus for FINTRAC and a trend with the larger value AMPs that we’ve been seeing.

Securities dealers are responsible for the following requirements under the PCMLTFA and associated Regulations:

Compliance program:
1. Appoint a compliance officer who is responsible for implementing the program. The Compliance Officer must always have access to management and the authority to carry out their duties.
2. Develop and apply written compliance policies and procedures that are kept up to date and, in the case of an entity, are approved by a senior officer. Policies and procedures must be detailed and reflect the reporting entities business model.
3. Conduct a risk assessment of your business to assess and document the risk of a money laundering or terrorist activity financing offence occurring in the course of your activities. The categories that must be assessed are outlined in guidance.
4. Develop and maintain a written, ongoing compliance training program for your employees, agents or mandataries, or other authorized persons.
5. Institute and document a plan for the ongoing compliance training program and deliver the training (training plan).
6. Institute and document a plan for a review of the compliance program for the purpose of testing its effectiveness, and carry out this review every two years at a minimum (two-year effectiveness review). The review must test all parts of your compliance program as well as operations.
Know your client:
1. verifying client identity,
2. politically exposed persons, heads of international organizations, their family members and close associates, beneficial ownership, and
3. third party determination.
Transaction reporting:
Record keeping;
Foreign branches, foreign subsidiaries and affiliates; and
Ministerial directives

What Happens After You Submit a Suspicious Transaction Report?

When it comes to AML compliance, submitting a Suspicious Transaction Report (STR) to FINTRAC is just the beginning, not the end.

In this short video presentation, Divya Bhaktha from Outlier Compliance Group breaks down exactly what you need to do after an STR is filed, and the consequences if you don’t follow-up correctly.

Reference Links

Public notice of administrative monetary penalties

Reporting suspicious transactions to FINTRAC

Guide on harm done assessment for suspicious transaction reports violations (section 2.3.4)

Need help navigating STR obligations? Email us at info@outliercompliance.com or get in touch here.

Unpublished FINTRAC Penalties

Today’s guest blogger is Jonathan Krumins, Vice-President, AML Risk & Compliance, at vCAMLO Solutions Inc. vCAMLO provides anti-money laundering (AML) and anti-terrorist financing (ATF) support to Canadian credit unions. You can learn more about vCAMLO at www.vcamlo.ca.

Background

Reporting entities (REs) often ask us about penalties, in particular when they are published publicly. Since 2009, The Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) has issued Administrative Monetary Penalties (AMPs) against persons and entities that were found to have violated the Proceeds of Crime (Money Laundering) and Terrorist Financing Act, and its associated Regulations. In many cases up to 2013, FINTRAC has published details on its website about each penalty, including the name of the person or entity, the dollar amount of the AMP, as well as the cited deficiencies. The AMP area of their website has two sections – a list of all published penalties, as well as a running total of AMPs imposed since December 30, 2008, divided by sector.

As of June 26, 2013, FINTRAC changed its policy regarding public notice of AMPs, so that they would be published if one or more of the following criteria are met:

The person or entity has committed a very serious violation; or
The base penalty amount is equal to or greater than $250,000, before adjustments are made in consideration of the person or entity’s compliance history and ability to pay; or
Repeat significant non-compliance on the part of the person or entity.

AMPs can only be published once the appeals process is exhausted, which can take years to complete. This process can include an appeal to FINTRAC’s director, and a subsequent appeal to the Canadian Federal court.

Understanding this context is vital for RE Compliance Officers. While trend information related to published and unpublished penalties is not likely of interest to frontline staff, understanding these patterns is useful in fielding questions from Senior Management and the Board of Directors.

We have conducted an analysis of data published on the FINTRAC’s website which shows a trend of an increasing number of unpublished AMPs since 2013. These unpublished AMPs were primarily imposed on the Credit Union/Caisse Populaire and Money Service Business (MSB) sectors.

Methodology

We have made all calculations using information available as of April 20, 2015. We examined publicly available information on FINTRAC’s webpage, using the running total of AMPs by sector and the list of public AMPs. We also examined a summary of AMPs as of October 2014 obtained by Outlier through an Access to Information request. Our analysis focuses only on the sectors that have received AMPs, either published or unpublished: Credit Unions (including Caisses Populaires), MSBs, Real Estate Brokers, Securities Dealers and Casinos.

In addition, we accessed “cached” versions of FINTRAC’s website to review past versions in order to include six public AMPs that were issued between August 19, 2009 and April 26, 2010. In accordance with FINTRAC policy, these were removed from FINTRAC’s website after the five year public notice period had expired. We have included this historical data in order to provide a full view of the penalties issued. It is noteworthy that there are likely additional penalties in the process of being appealed (this information cannot be made available until the appeals process is complete).

Published AMPs vs. Unpublished AMPs

By analyzing the list of published penalties, compared to the running total of AMPs, it appears that there have been a significant number of unpublished penalties:

Credit Unions

Credit Unions have received the largest number of unpublished penalties, both in terms of number and dollar amount. Credit unions have received 3 published AMPs, totalling $246,690. They have also received an additional 11 unpublished AMPs, totalling $405,855.

Trend analysis: This appears to be a significant increase in overall enforcement action by FINTRAC in the Credit Union sector. The total number of penalties against Credit Unions have increased sharply to 14, which means that Credit Unions now have the second largest number of listed AMPs (published and unpublished), behind MSBs. All penalties against Credit Unions since 2013 were unpublished. This data can also be interpreted to mean that FINTRAC’s enforcement efforts against Credit Unions have increased since 2013, however it is important to remember that AMPs are listed on FINTRAC’s website after they are finalized, which can mean a significant gap between when an AMP was issued and when it is listed, especially if there is an appeal involved.

Money Service Businesses (MSBs)

MSBs have received 22 published penalties, totalling $527,510. They also have received eight unpublished penalties, totalling $68,520. Interestingly, a $12,880 penalty that was published against an MSB on July 11, 2013 no longer appears on FINTRAC’s website.

Trend analysis: MSBs continue to be the leading sector in terms of receiving AMPs, although similar to the other sectors examined, the majority of AMPs that were against MSBs from late 2013 through to 2015 were unpublished.

Real Estate Brokers

Real Estate Brokers have received three published penalties totalling $40,520 compared to three unpublished penalties totalling $25,960.

Trend Analysis: Real Estate Brokers have received relatively few published and unpublished penalties in comparison to the Credit Union and MSB sectors. The number of unpublished penalties (compared to the number of published penalties) is consistent with trends across all sectors.

Securities Dealers

Securities Dealers have received four published penalties totalling $565,180 compared to one unpublished penalty of $21,480.

Trend Analysis: Securities Dealers have received relatively few published and unpublished penalties in comparison to the Credit Union and MSB sectors.

Casinos

Casinos have never received a published AMP, however FINTRAC’s website shows an unpublished AMP of $56,700 issued against a casino. This may be surprising to anyone that has read about BC Lottery Corporation, however, AMPs are not part of these records until the appeals process has been exhausted (and there have been successful appeals).

Trend analysis: It is difficult to establish a trend based on a single data point, however this unpublished AMP shows that the Casino sector is no longer unaffected by FINTRAC penalties.

What Does This All Mean?

Note: The dates on the above graph represent when FINTRAC’s website was analyzed to calculate the total number of penalties, with the exception of October 2014, which is the “as of” date of an AMP listing received in a Freedom of Information request. Data for unpublished AMPs is only available since 2013.

As of June 2013, FINTRAC began to apply the updated standard for publicly listing AMPs. Since this change, unpublished penalties comprise approximately 42% of all issued AMPs by amount and 43% by number. While this is excellent news for REs that are concerned with the negative media and other reputational risk related to published penalties, it will make it more difficult to assess the reasons that REs are receiving penalties. The specific violations that led to a penalty are only made public by FINTRAC when the AMP is published. In order to ensure that our Credit Union clients are well-informed about industry trends related to penalties, vCAMLO will be requesting additional information and performing trend analysis. Stay tuned!

Your Best Defence

To avoid AMPs, it is essential to constantly test for weaknesses in your compliance regime. Conduct rigorous effectiveness testing (this is required at least every two years), and consider more frequent testing. Finally, ensure that immediate steps are taken to remediate deficiencies received in FINTRAC exams. Deficiencies that re-appear in follow-up exams are taken seriously by FINTRAC, and can lead to penalties, published or not.

Need a Hand?

vCAMLO: If you are a credit union or MSB, and have any questions related to financial compliance, or if you are interested in AML Support Services, please contact us for a complimentary 30 minute compliance discussion.

Outlier: If you need assistance reviewing your technology solution or FINTRAC reporting to be certain that you’re meeting the standard described in this blog, or just someone to chat with to make sure that you’re on the right track, please contact us.

Anti-Money Laundering
Consulting Services & Strategies