Every Canadian mortgage brokerage needs a FINTRAC-compliant compliance program. The five required pillars, what each contains, and a practical template for brokerages building from scratch.
Every Canadian mortgage brokerage now needs a FINTRAC-compliant compliance program. The regulation came into force October 11, 2024. Bill C-12, which received Royal Assent in March 2026, raised the stakes by rewriting the program standard from “intended to ensure compliance” to “reasonably designed, risk-based and effective.”
Many mortgage brokerages are still building their programs for the first time. Others have programs in place but haven’t stress-tested them against the new effectiveness standard. This post is the practical template.
The five pillars, what each contains, how they fit together, and where the most common gaps are. Written for the compliance officer or principal broker building or refreshing a program, not as legal advice - if you need a formal program review, engage a Canadian AML-specialist firm.
Every FINTRAC-compliant compliance program is built on the same five components. Miss any of them and the program is deficient.
We’ll walk through each, what’s required, and where most brokerages get it wrong.
The compliance officer is the named person with authority and responsibility for the program. For most Canadian mortgage brokerages, this is the principal broker or a senior staff member who reports directly to the principal broker.
Requirements:
Common gaps:
For smaller brokerages: the principal broker often serves as compliance officer. This is fine, but the dual role means the principal broker must actually perform compliance officer duties, not just hold the title. Documented calendar time spent on compliance matters, oversight of screenings, response to alerts - all of this needs to be real.
For larger brokerages: a dedicated compliance officer role makes sense once the brokerage reaches 30+ agents. Before that, a combined principal broker / compliance officer role is typical.
The written framework every person in the brokerage follows. This is the single document (or set of documents) that describes how the brokerage meets every FINTRAC requirement.
Required coverage:
Common gaps:
Version control matters. FINTRAC will want to see current policies and previous versions. Keep a version history showing when policies were updated, what changed, and who approved the change.
Your brokerage’s specific understanding of the money laundering and terrorist financing risks it faces. Not a generic checklist. A specific analysis of your specific business.
Required coverage:
The risk assessment isn’t a snapshot. It’s an ongoing process. When your business changes - new product offerings, new client segments, new geographic markets - the risk assessment should update.
Common gaps:
Among real estate brokers that received FINTRAC AMPs, 88 percent failed to conduct risk assessments that met the standard. This is the pillar where brokerages are most vulnerable.
Training for everyone in the brokerage with compliance responsibilities. In practice, this means training for all agents and administrative staff who touch client files.
Required coverage:
Required documentation:
Common gaps:
Practical note: Many networks (DLC, Mortgage Architects, Mortgage Alliance, etc.) provide compliance training to their affiliated brokers. This is a starting point, not a complete program. Brokerage-specific training on brokerage-specific policies is still required.
An independent assessment of your compliance program, required at least every two years.
Requirements:
Common gaps:
Cost and logistics: Expect $5,000-$25,000 for a prescribed review depending on brokerage size and complexity. Budget every two years. Schedule the next review at the conclusion of the current one.
The five pillars aren’t independent; they reinforce each other.
A program where one pillar is weak tends to weaken the others. Strong risk assessment without strong policies is an analytical exercise that doesn’t operationalize. Strong policies without strong training become a binder no one reads. Strong training without a strong compliance officer becomes annual theatre.
For a brokerage without an existing program, or one that needs significant overhaul:
Six months is aggressive but realistic for a brokerage committed to building a strong program. Slower than six months leaves the brokerage exposed during the buildout. Faster than six months usually means corners got cut on the risk assessment or training.
The compliance program is a program, not a piece of software. But software changes how operational and examinable the program is.
Continuous screening and ongoing monitoring can’t be done manually at scale - software like BrokerPlus handles this automatically, producing the audit trail the prescribed review will expect. Centralized client data makes file retrieval at examination a non-issue. Integrated PEP identification with automatic classification prevents the manual-error gap that plagues generic CRM approaches.
None of this replaces the five pillars. All of it makes the five pillars easier to implement and easier to demonstrate working.
A compliance program is the five-pillar framework: the officer, the policies, the risk assessment, the training, the review. Compliance software is a tool that supports specific operational elements of the program (screening, monitoring, record retention). A brokerage needs both. Software without a program is insufficient documentation; a program without software is usually unworkable at scale.
No. The risk assessment specifically must reflect your brokerage. Policies and procedures can be adapted from templates but must be tailored to your operations. FINTRAC examiners can spot a generic program within minutes of opening it. A borrowed-and-pasted program is worse than no program because it creates a false sense of coverage.
Rough annual ranges by brokerage size: Solo broker / 1-5 agents: $2,000-$8,000/year. Mid-size brokerage (10-30 agents): $15,000-$40,000/year. Larger brokerage (50+ agents): $50,000-$150,000/year. Includes compliance officer time, software, training, and prescribed review amortized. Does not include legal fees if you’re dealing with an active examination or AMP.
Yes. The regulation doesn’t distinguish by brokerage size. A solo broker needs a scaled-down but complete program: designated compliance officer (you), written policies, risk assessment, training (for yourself), and prescribed review. The total effort is smaller than a multi-agent brokerage’s but the requirement is the same.
An independent party qualified to evaluate AML compliance programs under the PCMLTFA. This is typically a law firm’s AML practice, a compliance consultancy, or in some cases an internal audit function separated from the compliance function (which works for larger brokerages but not smaller ones). The reviewer should have Canadian AML experience specifically.
At minimum when the business changes materially (new products, new markets, new client segments, new regulatory environment). Many brokerages update annually as part of their standard review cycle. After Bill C-12, every Canadian brokerage should refresh their risk assessment to reflect the new effectiveness standard.
Continuous monitoring and ongoing screening infrastructure. Whether through integrated platform software or standalone vendors, the brokerage needs a demonstrable ongoing monitoring function. Post-Bill C-12, this is the operational gap most likely to show up at examination.
Canadian mortgage brokers came into FINTRAC's regulatory perimeter in October 2024. The examination cycle is now. Here's what a FINTRAC examination actually looks like and how to prepare.
A working guide to AML, PEP, and sanctions screening for Canadian mortgage brokers post-Bill C-12. How the lists work, what the obligations are, and how to build a defensible workflow.
A practical guide to identifying politically exposed persons in Canadian mortgage broker client files. Foreign vs domestic, family members, close associates, and when EDD actually applies.
A 45 minute walkthrough, lead intake to lender package. Nothing to install and nothing to prepare.
Get Ann's Digest, a bi-weekly read on the Canadian mortgage market written for brokers. Rate moves, lender changes, and book opportunities that matter, in about five minutes.
BrokerPlusCanadian-built. Canadian-hosted.