How often is an effectiveness review required?
At least every two years. FINTRAC requires every reporting entity to review the effectiveness of its compliance program, covering its policies and procedures, risk assessment and training program, at a minimum once every two years. The review tests whether the program works, not only whether the documents exist.
Who can carry out the review
FINTRAC's guidance says the review is carried out by an internal or external auditor or, if the business has no auditor, by the business itself. Whoever does it should know the requirements of the PCMLTFA and its regulations. An external review gives you independence and a fresh view.
What a review tests
- whether your policies and procedures reflect current requirements and your current business;
- whether your risk assessment covers your clients, products, channels and geography, and whether your controls follow from it;
- whether training happened, reached the right people and matches your risks;
- samples of client files, monitoring and reports to FINTRAC, to see the program working in practice.
Effectiveness review or FINTRAC examination?
An effectiveness review is your own check of your program. A FINTRAC examination is FINTRAC's assessment of your compliance. A recent, honest review, with its findings being fixed, is one of the best ways to prepare for an examination.
Sources: FINTRAC, Compliance program requirements. Checked 11 October 2026. General information, not legal advice.