What must a FINTRAC compliance training program include?

What does the law say about training?

Two pieces of law sit behind the rule. The Act requires every person or entity it covers to establish and implement a compliance program, and says the program must be reasonably designed, risk-based and effective³. The Regulations then say what the program is made of.

Paragraph 156(1)(d) is the training program. Paragraph 156(1)(e) is the plan for it and the delivery of the training¹.

The Regulations ask for a written, ongoing training program and a documented plan to deliver it: one session is not enough¹.

FINTRAC defines a training program as a written and implemented program outlining the ongoing training for your employees, agents or other individuals authorised to act for you². A sole proprietor with no employees, agents or other authorised individuals does not need a training program or plan for themselves².

What must the written training program explain?

FINTRAC's guidance says the program should explain what your people need to know and understand². It lists five areas:

• Your requirements under the Act and the Regulations²
• Background on money laundering and terrorist activity financing, including methods²
• How your business or profession could be vulnerable, with indicators and examples²
• Your own compliance policies and procedures, including reporting, record keeping and know your client²
• Their own roles and responsibilities, including when something looks suspicious²

The guidance also says the program and plan should be tailored to your business's size, structure and complexity, and its exposure to risk².

What must the training plan include?

The plan is the "how, who, what and when". FINTRAC says it should cover how you will deliver the training, with the steps that make sure people get a level of training that suits their duties and position, on an ongoing basis². It should name four things: recipients, topics and materials, methods, and frequency².

• Recipients: people who deal with clients, are involved in client transactions, handle cash, funds or virtual currency, or oversee the program, such as the compliance officer and senior management².
• Methods: for example self-directed learning, information sessions, face-to-face meetings, classroom, conferences or on-the-job training. You can use 1 or more, in-house or external².
• Frequency: regular intervals, set events, or both². The next guide covers this in who must be trained, and how often.

Where is each requirement written?

Who approves what?

The Regulations say the written policies and procedures must be kept up to date and, for an entity, a senior officer must approve them¹. FINTRAC says the policies should cover the compliance program requirements, which include the training program and plan².

The effectiveness review is reported in writing to a senior officer, within 30 days after the review is completed¹. The compliance officer can delegate duties but stays responsible for implementing the program².

The pages we read do not say that a senior officer must approve the training program or plan as a separate document. If your business needs a clear answer, ask FINTRAC. This guide is general information and not legal advice.

How will FINTRAC check your training?

FINTRAC's assessment manual says it looks at who receives training, what topics are covered, when and how often training takes place, how the program is put in place and how it is delivered⁴. It may review your plan and materials, and interview employees and agents about their understanding⁴. It pays close attention to training on spotting suspicious transactions⁴.

Keep a record of each session: the date, the list of attendees and the topics covered². The FINTRAC kit gives you editable documents for the program, the plan and the record. If your team also pays supplier invoices, the same habit works for fraud: see how to check a change to a supplier's bank details and the payment fraud kit.

Frequently asked questions