Canadian anti money laundering compliance is increasingly being tested by what an organization actually does rather than the number of procedures it can produce. FINTRAC's account of the Strengthening Canada's Immigration System and Borders Act says the legislation received Royal Assent on March 26, 2026 and introduced significant changes to the Proceeds of Crime (Money Laundering) and Terrorist Financing Act. Among them are requirements for compliance programs to be reasonably designed, risk based and effective, together with changes to the administrative monetary penalty framework.
This matters because a written policy can be internally coherent and still fail to address the transactions a business actually encounters. A financial services provider, a real estate reporting entity and a business dealing in virtual currency operate in different circumstances. Each must begin with its own statutory obligations and risk assessment. Treating an imported checklist as an adequate compliance program becomes particularly difficult where staff cannot explain how the program deals with a foreseeable exposure or why a client relationship has been classified in a particular way.
FINTRAC says the 2026 amendments raise maximum penalties for prescribed violations, introduce ability to pay as a consideration in calculating administrative monetary penalties and provide for compliance orders and more extensive use of compliance agreements. Certain compliance program violations will be classified more seriously. These powers do not mean that every breach automatically receives the maximum available penalty. The regulatory response will depend on the applicable provisions, transitional rules and facts. Businesses should distinguish what took effect on March 26 from guidance that FINTRAC is still preparing.
One particularly important distinction concerns enrolment. The changes contemplate universal enrolment for reporting entities not otherwise required to register, but FINTRAC describes implementation as dependent on regulations to be developed and published. A company should not announce that every contemplated enrolment requirement is already operational. Conversely, the absence of final regulations for that step does not suspend the compliance program obligations identified as already effective.
The legal significance extends beyond the regulated firm's compliance department. A board or senior manager overseeing an affected business needs reliable reporting about the design of the program, the quality of staff training, evidence of review and the circumstances in which unusual activity is escalated. Those records may become relevant if a regulator questions whether the organization identified and addressed known risks. Clear accountability is especially important where transaction screening or customer identification is outsourced to a third party but statutory responsibility remains with the reporting entity.
The provincial and federal dimensions should not be confused. FINTRAC's regime is federal, while licensing, privacy obligations, corporate duties and professional regulation vary across Canada. A federally regulated compliance requirement can apply alongside provincial rules without replacing them. Before revising client onboarding or disclosure processes, counsel should identify the business category, the precise legal provision and the date on which that obligation became operative.
The larger shift is toward evidence of functioning controls. A compliance program should reflect the business it governs, be maintained as that business changes and leave a record of the judgments that mattered. Those disciplines are useful long before an enforcement notice arrives.
Source: FINTRAC, Modernization and upcoming changes impacting reporting entities.