The call or letter arrives with little warning: FINTRAC has selected your company for a compliance examination. For many virtual asset service providers (VASPs), this is the moment they realize their AML program looks better on paper than in practice. FINTRAC examinations of VASPs have increased significantly since the 2021 amendments to PCMLTFA formally brought crypto businesses into the reporting entity regime — and the programs that fail are rarely the ones with no policies. They are the ones where policies do not match what actually happens on the ground.

What FINTRAC Examiners Actually Request

A FINTRAC examination is not a theoretical quiz. Examiners arrive with a structured information request list that typically covers:

• Your written AML/ATF compliance policies and procedures — current versions only; “draft” copies do not satisfy the requirement
• Customer risk assessment methodology and completed risk ratings for a sample of accounts
• Transaction monitoring parameters — the rules or thresholds that generate alerts, and the logic behind them
• A sample of alert dispositions: what was reviewed, by whom, and why the file was cleared or escalated
• All Suspicious Transaction Reports (STRs) and Large Cash Transaction Reports (LCTRs) filed during the review period
• Travel Rule records: originator and beneficiary information for virtual currency transfers of $1,000 or more
• Employee training records and training content delivered in the past 24 months
• Your most recent effectiveness review or independent AML compliance audit
• Enhanced due diligence (EDD) files for high-risk customers

The review period is typically the prior 12 to 24 months. Examiners will pull a sample of transactions and trace them against your documented processes. If the documentation is not there, the process did not happen — at least not in their view.

Where VASPs Consistently Fall Short

FINTRAC’s published examination findings and enforcement actions point to the same gaps, year after year:

Risk ratings that exist on paper but are not applied. Many VASPs have a risk model in their compliance manual but have not operationalized it. Customer files show no risk rating, or every customer is rated “low” regardless of jurisdiction, transaction volume, or product type. Examiners expect to see evidence that risk ratings actually drive monitoring thresholds and EDD decisions — not just a methodology document sitting in a shared folder.

Alert review without documentation. Transaction monitoring that generates alerts is only half the picture. FINTRAC expects a documented rationale for every alert disposition — why the alert was cleared, who reviewed it, and what information was consulted. A list of “alert closed” entries without supporting narrative will not survive scrutiny.

Travel Rule gaps for crypto transfers. Since June 2023, VASPs must collect and transmit originator and beneficiary information for virtual currency transfers of $1,000 or more. Many VASPs have a policy, but the operational workflow is missing: How is information collected from counterparty VASPs? What happens when a counterparty does not respond? Examiners pull actual transfer records — if the data is not there, the policy is irrelevant.

No independent effectiveness review. PCMLTFA requires reporting entities to review the effectiveness of their compliance program periodically. For most VASPs, this means an annual independent review — not a self-assessment written by the same person who designed the program. This is one of the most frequently cited deficiencies in FINTRAC examinations, and one of the easiest to address before the examiner arrives.

Outdated policies. If your compliance manual still reflects the pre-2021 regime, has not been updated for crypto-specific typologies, or does not address your current product set, that is a finding before the examiner has looked at a single transaction.

Why an Independent AML Audit Changes the Equation

An independent AML compliance audit serves two purposes: it satisfies the regulatory requirement for periodic effectiveness testing, and it gives you a defensible record of where your program stands before FINTRAC arrives. A well-structured review covers governance and accountability, policy gap analysis against current FINTRAC obligations, transaction monitoring coverage testing, KYC and EDD file sampling, Travel Rule operational testing, and training adequacy assessment.

Typical timelines run six to ten weeks from kickoff to final report, depending on entity size and product complexity. For a mid-sized VASP, expect costs in the range of $15,000 to $40,000 CAD — less than a single administrative monetary penalty, which can reach seven figures for serious or repeated violations.

Critically, an external audit creates a contemporaneous record that your organization identified and addressed gaps. If FINTRAC examines you after a documented remediation cycle, having a written gap-closure plan matters — it is the difference between a finding that is noted and one that escalates to an enforcement referral. Our AML & regulatory compliance services include structured effectiveness reviews designed for the specific obligations VASPs and MSBs carry under PCMLTFA.

A Pre-Examination Self-Assessment: Seven Questions

Whether or not an examination has been scheduled, start here:

• Are your compliance policies dated within the last 12 months and formally signed off by your compliance officer?
• Does every customer in your system have a documented risk rating — not just a methodology on paper?
• Can you produce written alert disposition records with rationale for the past 24 months?
• Do you have Travel Rule records for all virtual currency transfers of $1,000 or more in the past 12 months?
• Can you demonstrate that high-risk customers received EDD, with documentation to support it?
• Has your compliance program been reviewed by someone independent of the person who built it, within the past year?
• Does your compliance officer have a direct reporting line to senior management or the board?

If you are uncertain about more than two of these, you have material gaps. The time to find them is before the examiner does.

Need guidance? Reach out to our team — no pressure, no jargon.