What an outsourced compliance officer does
Under the PCMLTFA, a business that FINTRAC regulates must appoint a compliance officer who is responsible for implementing its compliance program. FINTRAC's guidance expects that person to have the authority, and the access to resources and senior management, needed to do the job.
An outsourced compliance officer fills that role, or supports the person who holds it, from outside the business. It's common for money services businesses, virtual currency dealers, payment companies and foreign businesses entering Canada, which need experienced compliance judgment but not a full-time senior hire.
The work is practical and ongoing. Customers are onboarded every day, transactions need watching, reports have deadlines measured in days, and the rules and your business both change. We do that work with your team, inside your systems, so your program works in practice and not only on paper.
What's included
The scope covers your AML and compliance obligations as a whole. These are the parts most clients use their hours on.
Second-line customer onboarding review
Your front line collects customer information. As the second line, we review it: how identity was verified, beneficial ownership, politically exposed person and head of international organization determinations, third-party determinations, sanctions and listed person screening results, and the customer's risk rating. We approve or escalate files, apply enhanced measures where the risk is high, and sample completed files to check that the process holds up.
Advisory
Questions don't wait for a review cycle. A new product, a new market, a new agent, a payment partner's due diligence questionnaire, a bank asking about your program, or a letter from FINTRAC. We give you a clear answer, explain the reasoning, and record the decision so you can show it later.
Regulatory reporting
We prepare and file the reports your business has to make to FINTRAC, including suspicious transaction reports, electronic funds transfer reports, large virtual currency transaction reports and large cash transaction reports. Each one has its own threshold and deadline:
| Report | When it applies | Deadline |
|---|---|---|
| Suspicious transaction report (STR) | Reasonable grounds to suspect a transaction is related to money laundering or terrorist financing. No minimum amount. | As soon as practicable |
| Large cash transaction report (LCTR) | Cash of $10,000 or more, in one transaction or several within 24 hours. | 15 calendar days |
| Electronic funds transfer report (EFTR) | International electronic funds transfers of $10,000 or more, in one transfer or several within 24 hours. | 5 working days |
| Large virtual currency transaction report (LVCTR) | Virtual currency worth $10,000 or more, in one transaction or several within 24 hours. | 5 working days |
| Terrorist property and listed person reports | Property you know or believe is owned or controlled by a terrorist, terrorist group or listed person. | Immediately |
Amounts are in Canadian dollars. Under FINTRAC's 24-hour rule, several smaller transactions can together reach the $10,000 threshold and become reportable.
Policy maintenance
Your compliance policies and procedures have to be kept up to date. We update them when the regulations change, when FINTRAC publishes new guidance, and when your business launches something new, and we keep a record of what changed and why.
Business risk assessment
Your program rests on a documented assessment of your money laundering and terrorist financing risks: your clients and business relationships, your products, services and delivery channels, where you operate, and new technologies. We write it, keep it current and make sure your controls follow from it.
Client risk assessments
Every client gets a risk rating that drives how closely you monitor them. We set the methodology, review ratings and make sure high-risk clients get the enhanced measures they need.
How the engagement runs
- Consultation. Your business, your customers, your volumes and what you already have in place.
- Written scope. What we'll do, how many hours to start with, and how we'll report the time to you.
- Set-up. Access to the systems we need, such as your onboarding and screening tools and your FINTRAC reporting account, and a handover of open items.
- Ongoing work. Onboarding reviews, reporting, advice and maintenance, with regular check-ins with your management.
- Scaling. As volumes grow, add blocks of hours, or hand the work to an in-house compliance officer we help you hire and train.
How many hours you might need
It depends on how many customers you onboard, how many alerts and reports you generate, how many products and markets you serve, and whether you deal in cash or virtual currency. A business preparing to launch needs far fewer hours than one onboarding hundreds of customers a month.
We estimate a starting number of hours with you in the consultation, then adjust once real volumes are clear. Hours are bought in blocks of 10, so the cost follows your workload rather than a fixed salary.
Your responsibilities, and ours
Outsourcing the work doesn't outsource the obligation. Your business remains the reporting entity, and your senior management stays accountable for the program. We make that workable: decisions are documented, escalations reach the right people, and you always know what was done in your name.
- You provide access, information and timely decisions.
- We carry out the agreed work, flag risks early and keep records you can show an examiner.
- We agree in writing who signs off on what, including reports and policy changes.
MLRO, compliance officer or CCO?
The titles differ by country. In the UK and Europe the role is usually called the MLRO, or money laundering reporting officer. Canada's PCMLTFA framework uses "compliance officer", and many firms use "chief compliance officer" too. If you're entering Canada from abroad and looking for an MLRO, the Canadian compliance officer is the equivalent role, with Canada's own reports, thresholds and deadlines.
Sources: FINTRAC, Compliance program requirements; Reporting suspicious transactions; Reporting electronic funds transfers; Reporting large virtual currency transactions; Reporting large cash transactions; The 24-hour rule. Checked 11 October 2026. General information, not legal advice.