On October 11, 2024, mortgage brokers, administrators and lenders became reporting entities under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA). Many brokerages spent that autumn writing anti-money laundering (AML) policies, appointing compliance officers and building identity verification into onboarding. Two years later, the next obligation has arrived: the first effectiveness review of those programs.
The timing is not the only reason to pay attention. Since March 26, 2026, the Act has required every reporting entity’s compliance program to be “reasonably designed, risk-based and effective.” At the same time, the maximum administrative penalties rose fortyfold. For a mortgage brokerage, the two-year AML effectiveness review is now both a regulatory requirement and, once completed, evidence that its program meets the new standard.
This article sets out what the law requires, where FINTRAC’s expectations go further, what enforcement in a neighbouring sector reveals, and what brokerages should do this quarter.
What the law actually requires
Section 156 of the Proceeds of Crime (Money Laundering) and Terrorist Financing Regulations (PCMLTFR) sets out the essential elements of a compliance program:
a compliance officer;
written policies and procedures;
a documented risk assessment;
an ongoing training program and plan; and
a documented plan for the AML effectiveness review.
The AML effectiveness review must test the effectiveness of the brokerage’s AML policies, the risk assessment, and the training program, and it must be carried out and documented every two years. The report must cover any updates made to the brokerage’s AML policies during the review period and the status of implementing them.
The two-year AML effectiveness review must be conducted by an internal or external auditor or, where no auditor exists, by the brokerage itself. FINTRAC further recommends that the reviewer possess sufficient knowledge of the PCMLTFA and associated regulations and is not directly involved in the operation of the AML compliance program.
For smaller mortgage brokerages, where the compliance officer may also perform day-to-day brokerage functions, achieving this separation can present practical challenges. Engaging a qualified external AML professional or another suitably knowledgeable and impartial reviewer may provide an appropriate solution. Regardless of the approach selected, the brokerage remains accountable for ensuring that the review is sufficiently rigorous, appropriately documented and proportionate to its business activities and associated risks.
October 2026 is the timing benchmark, so mortgage brokerages that have not yet begun their AML effectiveness review may already be behind schedule. A useful AML effectiveness review that FINTRAC would expect goes well beyond reading the compliance manual. In a mortgage brokerage, that means:
Sampling client files for complete identity verification, politically exposed person (PEP) determinations, third-party determinations, and beneficial ownership on corporate borrowers
Checking receipt-of-funds records
Testing whether the risk assessment was applied to individual files
Interviewing agents about how they would spot and escalate unusual activity
Reviewing declined and abandoned deals, because attempted suspicious transactions are reportable
“Effective” is now a legal standard
Bill C-12, the Strengthening Canada’s Immigration System and Borders Act, added a requirement for firms to ensure their compliance program is “reasonably designed, risk-based and effective.” Failing to meet that standard is now a serious violation.
The change is subtle but significant. Before March 2026, a brokerage could argue that it had every required element in place. Now FINTRAC can ask whether those elements work together and reduce risk.
FINTRAC’s compliance program guidance was last modified in late 2024, so it predates the new standards. FINTRAC has said it will be updating its guidance to outline its expectations. That gap is the real reason brokerages cannot simply follow the existing guidance.
The penalty ceilings moved up dramatically at the same time. For violations on or after March 26, 2026, the maximum for a minor violation rose from $1,000 to $40,000, and for a serious violation from $100,000 to $4 million. For a very serious violation it rose from $500,000 to $20 million for an entity, or $4 million for an individual. It is important to note that these are maximums per violation, not typical amounts, and FINTRAC now considers ability to pay when setting a penalty. For violations that occurred entirely before March 26, 2026, FINTRAC will continue to use the existing administrative monetary penalties policy.
Where AML compliance programs break down
FINTRAC has not yet published enforcement findings for the mortgage sector, but the real estate sector offers a close parallel. Twenty-four administrative monetary penalties against real estate brokerages totalled approximately $2.66 million. Among the penalized firms:
92% had deficient policies and procedures
88% had deficient risk assessments
63% had deficiencies in their prescribed AML effectiveness review
63% had deficiencies in training
63% had deficiencies in record keeping
38% had governance problems
29% had failed to file suspicious transaction reports
More than half had no documented two-year AML effectiveness review at all
Despite these numbers, programs rarely fail because a document is missing. They fail because the document does not fit the business, nobody is clearly responsible, or there is no evidence the required steps were taken. Four themes stand out for mortgage brokerages.
Source of funds is the soft spot. A file can contain valid identification, a signed gift letter and a complete application, and still not explain where a large down payment came from. FINTRAC treats source of funds as how the money was acquired, not which account it came from. Warning signs include a down payment out of line with stated income or assets, a third-party funder whose relationship to the borrower is unclear, and funds that pass through several accounts before closing. None of these elements proves wrongdoing, but each should be a prompt to ask questions and record the answers. A suspicious transaction report is required where there are reasonable grounds to suspect AML activity.
Generic risk assessments do not survive scrutiny. The penalized real estate brokerages often relied on checklists with no explanation of why risks were rated as they were or how they were mitigated. A firm’s assessment should describe its actual business: its mix of prime, alternative and private lending, its exposure to corporate borrowers, the referral sources it relies on, remote onboarding, and its geography and property types.
The compliance officer must have real authority. Nine of the 24 penalized real estate firms either had no compliance officer, or had one in name only. FINTRAC expects the role to come with the authority and resources to make changes, knowledge of the business and its money-laundering risks, and a clear line to management.
Records must meet the legal requirements, not just the deal file. A copy of a bank draft is a common receipt-of-funds record, but it rarely shows the account number, account type or account holder names that the Regulations require. Brokerages that rely on drafts should check what their records actually contain.
The provincial picture
Because the federal definition of a mortgage broker depends on authorization under provincial legislation, provincial rules shape who the federal regime covers. Only British Columbia has gone further and added AML-related duties of its own. Elsewhere in Canada, FINTRAC is generally the only AML layer, with some nuances in Saskatchewan and Ontario. Alberta is watching B.C.’s approach and has flagged private mortgage lending as unregulated.
There is no dedicated mortgage broker licensing regime in Prince Edward Island, Yukon, the Northwest Territories, or Nunavut. Mortgage brokers operating there should use FINTRAC’s mortgage-sector self-assessment tool rather than assume they fall inside or outside the federal regime, since they may still be covered as lenders or administrators.
What to do this quarter
For most mortgage brokerages, the immediate task is the first AML effectiveness review. Use the results of the review to fix the weaknesses that enforcement keeps finding. Finally, keep watching for changes. FINTRAC is expected to update its penalty policy and compliance guidance to reflect the March 2026 amendments, and universal enrolment will follow once its regulations are published.
The mortgage brokerages in the strongest position will be those that can show what they tested, what they found and what they changed. Two years in, that record is the clearest evidence a brokerage can offer that its AML compliance program is effective.
Next Steps with North Star Compliance
North Star Compliance supports registered and regulated firms, including mortgage brokers and securities dealers and advisers, across the full lifecycle of their business, from incorporation and governance through capital raising, regulatory transactions, and disclosure, with advice that reflects how the business actually operates today. Whether you need ad hoc compliance guidance on a securities, AML, or compliance matter, an AML effectiveness review or securities mock audit, ongoing outsourced compliance capacity, or hands-on support remediating your compliance program, our team helps you move forward with clarity and confidence. Our sister company, North Star Legal, provides the legal support for our clientele.
Reach out to us today at info@northstarcompliance.com.
About the Authors
Manish Advani (MBA, CAMS, FIS) is a Senior AML Consultant at North Star Compliance, bringing more than 15 years of experience in financial crime risk management, including anti-money laundering (AML), anti-terrorist financing (ATF), and sanctions compliance. Before joining North Star Compliance, Manish held senior compliance roles at leading Canadian financial institutions, including CIBC, TD Bank Group, Laurentian Bank, Scotiabank, and BMO, where his work spanned AML/ATF advisory, program governance, regulatory remediation, risk assessments, and independent testing of AML and sanctions controls. At CIBC’s AML Centre of Excellence, he led a large team for a regulatory remediation program involving approximately 200,000 business clients.
In addition to his AML compliance expertise, Manish is a Registered Real Estate Salesperson in Ontario, advising clients on residential real estate transactions and helping them make informed buying, selling, and investment decisions aligned with their financial objectives. His combined experience in financial services and real estate enables him to bring a broader financial perspective to property-related decisions. Read Manish’s full bio
Martha Rafuse (B.A. Western, LL.B. Osgoode, LL.M. London School of Economics) is the Head of Compliance at North Star Compliance, bringing more than two decades of securities regulatory experience across the financial industry, private legal practice, and government. Before joining North Star Legal, Martha led large compliance teams for both Canadian and U.S. firms, including RBC Phillips, Hager & North Investment Counsel Inc., RBC Dominion Securities Inc. (Retail), and RBC Royal Mutual Funds. Her earlier experience in big law firm private securities practice led to her experience with the Ontario Securities Commission, where she developed novel legal solutions and led significant policy initiatives. Read Martha’s full bio
North Star Group | 140 Yonge Street, Suite 200, Toronto, Ontario M5C 1X6 | info@northstarcompliance.com | 416-915-4219
This article is provided for general informational purposes only and does not constitute legal advice.