Guide
FINTRAC obligations for Canadian accounting firms
Accountants, bookkeepers and CPA firms in Canada are reporting entities under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act when they perform triggering activities. This guide covers what the Act requires, how to build a five-part compliance programme, and how to keep the records FINTRAC expects.
When does FINTRAC apply to accountants?
Under the PCMLTFA, accountants and accounting firms are reporting entities only when they carry out triggering activities on behalf of a client. If your firm limits itself to preparing financial statements and tax returns, the Act does not apply.
The five triggering activities
You are a reporting entity when you, on behalf of any person or entity, carry out any of the following:
- Receiving or paying funds, securities or other financial instruments
- Purchasing or selling securities, real property or business entities or assets
- Transferring funds or securities by any means
- Giving instructions on behalf of a client for any of the activities above
- Acting as a signatory or co-signatory on an account
Claim boundary. FigsFlow evidences the FINTRAC compliance programme — it does not file suspicious transaction reports or large cash transaction reports to FINTRAC and does not make a firm compliant. The obligation and the decisions sit with your firm.
The five-part compliance programme
Every reporting entity must establish and maintain a compliance programme with all five components. Missing one is a deficiency FINTRAC can act on.
Compliance officer
Appoint a person responsible for the programme's implementation. In a small firm this is typically a partner; in a larger practice it may be a dedicated compliance role.
Written policies and procedures
Document how your firm identifies clients, assesses risk, monitors business relationships, reports to FINTRAC and keeps records. Review and update as the business changes.
Risk assessment
Assess and document the money laundering and terrorist financing risks your firm faces, considering clients, services, geography and delivery channels.
Training programme
Train all staff involved in triggering activities on your policies, their obligations, and how to recognise and report suspicious activities.
Two-yearly effectiveness review
Review the programme at least every two years — or when a significant change occurs — and document the findings. The review must test whether policies and procedures are followed in practice.
Client identification and verification
Before you carry out a triggering activity, you must verify the identity of the individual or entity. For individuals, this means confirming identity using one of the methods prescribed by FINTRAC: a government-issued photo ID, a credit file, or dual-process verification.
Know your client
Beyond identification, you must take reasonable measures to determine whether the client is a politically exposed person (PEP), a head of an international organisation, or a family member or close associate of either. Enhanced scrutiny applies where the answer is yes.
Beneficial ownership
For entities, determine and verify the identity of all persons who own or control 25% or more of the entity, and take reasonable measures to understand the ownership and control structure.
Record keeping
Records must be kept for at least five years from the date of the last business transaction, or five years after the day the account is closed. FINTRAC may request access to these records at any time during the retention period.
What you must keep
- Client identification records and the method used to verify identity
- Records of every triggering activity, including the amounts, dates and parties involved
- Business relationship records and the purpose and intended nature of the relationship
- Risk assessment documentation
- Copies of all reports made to FINTRAC
- Compliance programme documentation, including training records and effectiveness reviews
See how FigsFlow tracks your compliance programme
Policies, risk assessments, client identification and five-year records — evidenced on the client record, not in a folder.
Book a demo