PROCESSING...

Anti-Money Laundering
Consulting Services & Strategies

0 Items - Total: $0.00 CAD

Proposed 2023 AML Changes: Mortgage Lenders and Armoured Car Services

Background

February seems to be the month for proposed legislative changes.

On February 18, 2023, draft amendments to the regulations under the Proceeds of Crime Money Laundering and Terrorist Financing Act (PCMLTFA), and a net-new draft regulation, were published in the Canada Gazette. If you’re the type that likes to read original legislative text, you can find it here. We (thanks Rodney) also created a redlined version of the regulations, with new content showing as tracked changes, which can be found here.

These changes are meant to renew and improve Canada’s anti-money laundering (AML) and Counter Terrorist Financing (CTF) regime, adapting to new money laundering (ML) and terrorist financing (TF) risk. One of the most significant changes, in our opinion, is the introduction of two new regulated entity types, mortgage lenders and armoured car companies.

Currently, mortgages issued by financial entities are captured under the PCMLTFA but these amendments would make all entities involved in the mortgage lending process (brokers responsible for mortgage origination, lenders responsible for underwriting the loan, and administrators responsible for servicing the loan) reporting entities. The intent here is to level the playing field between regulated and unregulated mortgage lenders, and to deter misuse of the sector for illicit activities.

While the activity of transportation is not currently supervised for AML purposes per se, armoured car carriers provide services largely to regulated entities. Given the flow of funds that is typically seen in this sector, reconciliation and identification of the origin of funds can sometimes be challenging, and allows funds to move with some degree of anonymity, which is an ML/TF vulnerability.

The draft regulations also introduce new requirements for correspondent banking relationships, and additional requirements related to the Money Services Business (MSB) registration. There are also some technical amendments related to existing reporting requirements and changes related to Administrative Monetary Penalties (AMPs).

Lastly, a new regulation would introduce a prescribed formula for the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) to assess the expenses it incurs in the administration of the PCMLTFA against reporting entities. Such models are seen from other regulators, such as the Office of the Superintendent of Financial Institutions (OSFI) and the Financial Consumer Agency of Canada (FCAC). Currently, FINTRAC is funded through appropriations.

In the following sections, we have summarized what we feel are the most important requirements to note.

Armoured Car Companies

The proposed changes would require a company that engages in “transporting currency or money orders, traveller’s cheques or other similar negotiable instruments” (except for cheques payable to a named person or entity) to be considered an MSB. As such, the following obligations will have to be met:

  • Development of a compliance program;
  • Maintaining an up-to-date MSB registration with FINTRAC;
  • Conducting compliance effectiveness reviews;
  • Reporting certain transactions;
  • Identifying customers;
  • Record keeping;
  • Risk ranking customers and business relationships;
  • Conducting transaction monitoring and list screening;
  • Conducting enhanced due diligence and transaction monitoring for high-risk customers and business relationships; and
  • Follow ministerial directives and transaction restrictions.

One record keeping obligation to note, which is new for armoured car companies, is the requirement to record the following information when transporting CAD 1,000 or more of cash or virtual currency, or CAD 3,000 or more in money orders or similar negotiable instruments:

  • The date and location of collection and delivery;
  • The type and amount of cash, virtual currency or negotiable instrument transported;
  • The name and address of the person or entity that made the request, the nature of their principal business/occupation and, in the case of an individual, their date of birth;
  • The name and address, if known, of each beneficiary;
  • The number of every account affected by the transport, the type of account, and the name of the account holder;
  • Every reference number that is connected to the transport, and has a function; equivalent to that of an account number; and
  • The method of remittance.

An additional requirement that will apply to armoured car companies is in relation to PEP determinations (existing PEP requirements for MSBs still apply). Specifically, a PEP determination is required whenever a person requests that the MSB transport more than CAD 100,000 in cash or virtual currency, or in an amount that is not declared.

Under the proposed regulations, there are some exemptions for reporting that are noteworthy. Large Cash and Large Virtual Currency reporting requirements will not apply where there is an agreement of transportation between:

  • The Bank of Canada and a person or entity in Canada;
  • Two financial entities;
  • Two places of business of the same person or entity; or
  • Canadian currency coins for purposes of delivery under the Royal Canadian Mint.

It is noteworthy, based on the definition, that there may be more than just armoured car companies that are captured under these new requirements. This will be clarified in guidance from FINTRAC that will follow publication of the legislation.

The requirements applicable to armoured car companies will come into force eight months after final publication in the Canada Gazette.

Mortgage Lending

The proposed regulations would require mortgage lenders, brokers, and administrators (mortgage participants) to put in place compliance regimes, similar to that of other regulated entities, which include the following:

  • Development of a compliance program;
  • Conducting compliance effectiveness reviews;
  • Reporting certain transactions;
  • Identifying customers;
  • Keeping records;
  • Risk ranking customers and business relationships;
  • Conducting transaction monitoring and list screening;
  • Conducting enhanced due diligence and transaction monitoring for high-risk customers and business relationships; and
  • Follow ministerial directives and transaction restrictions.

It is noteworthy, that many mortgage brokers already have existing voluntary AML compliance programs and already apply AML measures. This is in part due to various securities regulations and lending partners.

The requirements applicable to mortgage lending will come into force six months after final publication in the Canada Gazette.

Cost Recovery

As part of this round of regulatory changes, there is a net-new regulation, the Financial Transactions and Reports Analysis Centre of Canada Assessment of Expenses Regulations. This regulation will allow FINTRAC to pass on expenses, to reporting entities, that it incurs in the administration of the PCMLTFA. Only the following prescribed entity types are affected by this:

  • Banks and authorized foreign banks;
  • Life insurance companies;
  • Trust and loan corporations; and
  • Every entity that made more than 500 threshold reports during the previous fiscal year.

The regulations provide a formula that FINTRAC would use to calculate the assessment amounts payable by reporting entities on the basis of their annual asset value, and the volume of all threshold transaction reports submitted. For clarity, threshold transaction reports include Large Cash Transaction Reports (LCTRs), Large Virtual Currency Transaction Reports (LVCTRs), Electronic Funds Transfer Reports (EFTRs), and Casino Disbursement Reports (CDRs).

The requirement would come into force on April 1, 2024. This means FINTRAC would commence recovering costs from the 2024-2025 fiscal year and forward.

Other Changes

Enhancing MSB registration

Under the proposed amendments, as part of MSB registration, MSBs would now need to include the telephone numbers and email addresses of its president, directors and every person who owns or controls 20% or more of the MSB. This is in addition to current required information. Additionally, the number of the MSB’s agents, mandataries and branches in each country will be added (currently, only those within Canada are required).

This requirement will come into force twelve months after final publication in the Canada Gazette.

Streamlining requirements for sending AMPs

Under the proposed amendments, FINTRAC would be allowed to serve a reporting entity solely by electronic means when issuing an AMP. Currently, FINTRAC would also have to send an additional copy by registered mail.

This requirement would come into force on registration.

What Next?

There is a 30 day comment period (ending March 20, 2023) for the proposed regulations. It is strongly recommended that industry, and potentially impacted companies, review carefully and provide feedback. Comments can be submitted online via the commenting feature after each section of the proposed changes, or via email directly to Julien Brazeau, Associate Assistant Deputy Minister, Financial Sector Policy Branch, Department of Finance, 90 Elgin Street, Ottawa, Ontario K1A 0G5.

We’re Here To Help

If you have questions related to the proposed changes, or need help starting to plan, you can get in touch using the online form on our website, by emailing us directly at info@outliercanada.com, or by calling us toll-free at 1-844-919-1623.

New Illegal Wildlife Trade Indicators

FINTRAC has published a new Operational Alert on the Illegal Wildlife Trade.

The alert includes diagrams of known fund flows, both into and out of Canada (though the latter is most common). Three categories of indicators are included:

  • General wildlife trade,
  • Import into Canada, and
  • Export from Canada.

As a Compliance Officer, it’s important to think through where these indicators might be visible to you and your team. For instance, if you are offering remittance or payment services, and there is an available memo or purpose of payment field, there are several keywords in the indicators that should be added to your monitoring parameters (if they haven’t been already).

All Canadian reporting entities must use this information to:

  • Update the indicators in training materials,
  • Update the indicators in policies and procedures, and
  • Update transaction monitoring mechanisms (where applicable) to detect relevant indicators.

Of course, if you require assistance, Outlier Compliance is here to help. Please feel free to contact us.

Suspicious Transaction Reporting Updates

FINTRAC has published updated resources related to upcoming changes to suspicious transaction reports (STRs) on its Draft Documents page. This includes updated draft guidance on STRs, expected to come into force in September 2023.

While the updated forms are not yet in use, it is important that you communicate these changes to your information technology (IT) teams and service providers. The documentation published this week includes JSON schemas and API endpoints.

For reporting entities that complete STR reporting manually through FINTRAC’s online reporting portal, it is also important to familiarize yourself with updated structured reporting fields, including:

  • URL,
  • Type of device used,
  • Username,
  • Device identifier number,
  • Internet protocol address, and
  • Date and time in which online session request was made.

These can be reviewed in the draft STR form.

Of course, if you require assistance, Outlier Compliance is here to help, please contact us.

New Terrorist Financing Indicators

FINTRAC Registration

FINTRAC has published updated indicators related to terrorist activity financing.

These are subdivided into three broad types of violent extremism:

  • religiously motivated violent extremism (RMVE),
  • politically motivated violent extremism (PMVE), and
  • ideologically motivated violent extremism (IMVE).

Each subtype has distinct characteristics and indicators. While it can be tempting to think that these types of things don’t happen here, unfortunately, they can and do happen here in Canada. As a Compliance Officer, it’s important to think through where these indicators might be visible to you and your team.

All Canadian reporting entities must use this information to:

  • Update the indicators in training materials,
  • Update the indicators in policies and procedures, and
  • Update transaction monitoring mechanisms (where applicable) to detect relevant indicators.

Of course, if you require assistance, Outlier Compliance is here to help, please contact us

First AML Compliance Effectiveness Review Timing

As a company that gets to work with a lot of startups, and existing companies entering the Canadian market, we get to help folks understand the regulatory landscape in Canada. One of the required elements of a Canadian compliance program is an AML Compliance Effectiveness Review. These reviews must be completed every two years at a minimum. You can think of it like an audit, but for compliance.

The purpose of an effectiveness review is to determine whether your AML compliance program has gaps or weaknesses that may prevent your business from effectively preventing, detecting and deterring money laundering and terrorist financing. Recently, we have seen an increased focus on Effectiveness Reviews during FINTRAC examinations. Specifically, on whether the review really tested the effectiveness of the compliance program as a whole (not just what you say you’re doing, but also what you’re actually doing). This has led to FINTRAC examiners requesting the working papers for completed effectiveness reviews where the report did not clearly describe how the effectiveness was tested and assessed. This is the main reason Outlier has started providing our working papers with the final report. This also provides a pretty good reference point for making sure you are meeting your regulatory expectations.

First Time for Everything

In previous engagements, Outlier has operated on the theory that the clock for when your first review was due stemmed from the MSB’s FINTRAC registration date. However, we were incorrect. It wasn’t until a recent conversation where the registration date preceded any customer transactions by six months, that really spurred on an official clarification from the regulator. The trigger for the 2-year clock to start ticking is not registration but “a registered MSB is required to create a compliance program once it engages in one or more of the MSB-related activities.” This means that the clock starts ticking after the MSB has conducted their first transaction.

Here is a PDF version of the policy interpretation we received from FINTRAC that you can keep for your records.

Potential Corrections

If we have completed a review for you in the past that has a commencement date prior to your first customer transaction, please feel free to reach out so we can amend your report to the proper date.

Upcoming Effectiveness Reviews

While this article talks about your first review, you must also be sure to initiate all subsequent reviews within 2 years of the start date of your previous review. Please note that this is based on the previous commencement date, not the date of completion or issuance of the final report.

Need a Hand?

If you are looking for an idea of pricing for an upcoming review or have questions about a review that is currently underway, please feel free to contact us.

FINTRAC MSB Registration Expired?!?

FINTRAC Registration

Over the past few months, we have heard from several money services businesses (MSBs) that have experienced issues in renewing their MSB registrations with the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC). In most cases, these issues are easily resolved. However, if MSB registration issues are not addressed promptly, administrative monetary penalties (AMPs) or criminal charges may ensue.

It is likely that registration-related issues have become more common as FINTRAC is increasingly requesting additional information or clarifications from MSBs as part of the initial registration and registration renewal process. These requests are sent via email to the contact person listed in the MSB registration form.

Check Your MSB registration Status

You can view the status of your MSB registration by searching for your business on the public MSB registry. While this article is about the MSB registration status, anytime you are on this page, it is a useful practice to check to ensure that all of the information is up to date. There are several possible options for the “Registration status of MSB” field:

Registered: this is the status that is displayed for active MSBs. The detailed view will also show the expiry date of the registration.

Ceased: this status is displayed when an MSB has cancelled their registration (e.g. because the business is no longer conducting MSB activity or is only performing MSB activity as the agent of another MSB).

Expired: this status is displayed when an MSB has not submitted an MSB registration renewal on time, has not responded to requests for information from FINTRAC, or has not provided sufficient information to FINTRAC to complete the renewal process.

Revoked: this status indicates that FINTRAC has revoked an MSB’s registration.

If the Expiry Date is Coming Up Soon

If you notice that your MSB’s registration is expiring soon, there are several steps that you should take proactively. First, make sure that you have your login credentials and access FINTRAC’s secure MSB Registration portal. On the left-hand side of the screen, you may see an option to submit your renewal application. If this option is not yet present, it is still a useful practice to select “view completed form” and review the MSB information to ensure that everything is up to date. If there is anything that needs to be updated, you can update the form (information must be updated within 30 days of any changes; do not wait for the renewal date to make updates).

If the renewal can be processed at this time, make sure that you take the time to look at all data fields. Are these fields complete and accurate? Does the information related to the MSB’s beneficial ownership match what will be found in any corporate registries (if not, additional information and/or correction may be required before the registration can be processed). FINTRAC may request additional information by email, and your registration will not be renewed until these queries have been satisfied.

If the Registration is Expired

If you notice that your registration has expired, you should immediately access FINTRAC’s secure MSB Registration portal to renew it. It may be that you have simply missed a deadline, or that you did not notice an error message or request for additional information from FINTRAC. Whatever the cause, you should work to resolve the issue and renew the registration as soon as possible.

If you are not able to renew the registration, contact FINTRAC immediately by emailing guidelines-lignesdirectrices@fintrac-canafe.gc.ca and MSBRegistration@fintrac-canafe.gc.ca immediately with the subject line “URGENT – MSB Renewal Issue – Renewal Date Passed”.

  • In the body of the email, let them know:
  • The company name and MSB number
  • That you have been attempting to renew the MSB registration
  • If you have responded to any requests for additional information, the details of these correspondences (attach copies if possible)
  • Ask what information is needed at this stage to renew the MSB registration

Keep a copy of this and all communications with FINTRAC.

You may also want to consider making a voluntary self-declaration of non-compliance (VSDONC) to FINTRAC. For help with disclosures, check out our previous blog post.

If you receive a “Notice of Violation”

Where an MSB registration is expired, and the MSB continues to perform MSB activities (other than as an agent for another MSB), a penalty may be assessed, and a “Notice of Violation” may be issued. At this stage, a law firm should be engaged (we’re happy to recommend competent firms if this is something that you need). There are specific and relatively short timeframes for all response steps, and this should be treated as urgent.

We’re here to help.

If you are not sure what to do next or need assistance with compliance, please get in touch.

Effectiveness Reviews for Dealers in Virtual Currency

Effective June 1, 2020, dealers in Virtual Currency activities were considered as Money Services Businesses (MSBs) and as such, must comply with MSB obligations under amendments made to the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA). One obligation is to have an AML effectiveness review at least once every two years. MSBs must start their effectiveness review no later than two years from the start of their previous review or in the case of dealers in Virtual Currency, no later than June 1, 2022, the date they were considered to be MSBs under law.

Such reviews must test your compliance program and effectiveness of your operations. Our reviews follow a similar format to examinations conducted by the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC), which you can read more about in a previous Blog Post.

We’re Here To Help

If you have not yet engaged or commenced your review, there are still a couple of weeks to be compliant. If you would like to engage Outlier to conduct your AML Compliance Effectiveness Review or have questions regarding this obligation, please get in touch.

Amendments To The Proceeds of Crime (Money Laundering) and Terrorist Financing Regulations – 2022

Background

On April 27, 2022 amendments to the Proceeds of Crime (Money Laundering) and Terrorist Financing Regulations were published in the Canada Gazette. To make reading these changes a little easier, we (thanks Rodney) have created a redlined version of the regulations, with new content showing as tracked changes, which can be found here.

The Regulatory Impact Statement for these changes state the following:

Crowdfunding platforms and some payment service providers are not currently covered by the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (the Act) and therefore have no money laundering and terrorist financing obligations under federal statute. This lack of oversight presents a serious and immediate risk to the security of Canadians and to the Canadian economy. This risk was highlighted in early 2022, when illegal blockades took place across Canada that were financed, in part, through crowdfunding platforms and payment service providers. Allowing these gaps to continue represents a risk to the integrity and stability of the financial sector and the broader economy, as well as a reputational risk for Canada.

Amendments to the Proceeds of Crime (Money Laundering) and Terrorist Financing Regulations, and consequential amendments to the Proceeds of Crime (Money Laundering) and Terrorist Financing Administrative Monetary Penalties Regulations, will help prevent the financing of illegal activities through these types of financial services.

What’s Changed?

The changes are substantial and sudden. They will affect many companies that have not been previously under the purview of AML regulation in Canada. These changes are effective immediately and there is no comment period, which is not the norm for such changes.

To help digest these changes, we have summarized what we feel are the most important changes below:

The definition for an electronic funds transfer has been removed and the corresponding section within the body of the regulations was amended. Previous exemptions related to remitting or transmitting from one person or entity to another by Credit or Debit Card, or Prepaid Payment Product if the beneficiary has an agreement with the payment service provider that permits payment for the provision of goods and services, has been revoked for money services businesses, which as we mentioned now includes Payment Service Providers.

The definitions section was amended by adding the following:

  • crowdfunding platform means a website or an application or other software that is used to raise funds or virtual currency through donations. (plateforme de sociofinancement)
  • crowdfunding platform services means the provision and maintenance of a crowdfunding platform for use by other persons or entities to raise funds or virtual currency for themselves or for persons or entities specified by them.

With these changes, crowdfunding platforms and payment service providers will now be subject to existing money services businesses requirements. These obligations include:

  • Registration with FINTRAC;
  • Developing a compliance program;
  • Customer identification and due diligence;
  • Transaction monitoring and customer risk scoring;
  • Reporting certain transactions to regulators and government agencies;
  • Complying with Ministerial Directives; and
  • Keeping records.

Specific to record keeping, crowdfunding platforms that provide services to persons or entities in Canada where a person donates an amount of CAD 1,000 or more in funds or virtual currency will need to:

(a) keep an information record in respect of the person or entity to which they provide those services;

(b) keep a record of the purpose for which the funds or virtual currency are being raised; and

(c) if the person or entity for which the funds or virtual currency are being raised is different from the person or entity referred to in paragraph (a),

      1. keep a record of their name, and
      2. take reasonable measures to obtain their address, the nature of their principal business or their occupation and, in the case of a person, their date of birth, and keep a record of the information obtained.

What Next?

Due to these changes, FINTRAC will need to revise its interpretation of existing requirements to include crowdfunding platforms and payment service providers. There is no set date for when we can expect guidance from FINTRAC. Additionally, various FINTRAC policy interpretations will no longer be able to be relied upon (i.e. policy interpretations related to merchant services as well as payment processing for utility bills, mortgage and rent, payroll, and tuition being exempt from AML obligations). The hope is FINTRAC will issue new policy interpretations, but for now the industry is left with many questions.

We’re Here To Help

If you would like assistance in understanding what these changes mean to your business, or if you need help in creating or updating your compliance program and processes, please get in touch.

Fraud & Reasonable Grounds to Suspect

One of the themes that was prevalent in Canadian AML for 2021 was the relatively low bar represented by “reasonable grounds to suspect” (RGS) and the types of transactions for which FINTRAC expected suspicious transaction reports (STRs) to be filed. One of our astute colleagues worked with us to craft some specific scenarios (the full version, including FINTRAC’s response, can be viewed here), and FINTRAC’s response seems to confirm a significant shift in position from previous discussions. Specifically, STRs are expected in cases of fraud, including cases in which the reporting entity’s client is believed to be the victim of fraud.

Here is a scenario that we asked about:

Scenario 2

A client reaches out to notify us that they sent the virtual currency to another party who promised them a generous short-term return. The client never received the promised funds and believes they have been defrauded. We review the customer account activity and do not find any anomalous activity either prior to or after the client sent the virtual currency to the wallet provided by the fraudster. The client appears to have sent their own funds to the fraudster and there is no account activity corresponding to any irregular transactions, including money mule indicators. Our client is simply a victim of fraud.

Based on strictly these facts, context and indicators, we have not reached reasonable grounds to suspect any money laundering or terrorist financing offences by our client. There may be downstream suspicion related to the wallet where the fraudulently obtained funds were sent but we do not have any suspicion based solely on our client’s transactions which include the transmission of virtual currency to that other wallet. We do not have any information or suspicion related to the other wallet except for the knowledge that our client’s virtual currency was sent to it.

Given the above, we believe no STR would be required. Could you please confirm our position? If the position taken here does not seem correct, please provide an underlying rationale.

And an excerpt from FINTRAC’s response:

In scenario 2, an STR should be submitted if the reporting entity reached reasonable grounds to suspect that the transaction or attempted transaction is related to fraud.

Not Just for Virtual Currency

While the scenario that we’ve provided is specific to virtual currency, the implications of this policy interpretation are not limited to transactions that involve virtual currencies. Every reporting entity type will deal with suspected and confirmed cases of fraud that touch their business models.

Why Does It Matter

To really get to why this matters so much, we need to first look at the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA), which is where the requirement is first defined in Section 7:

Transactions if reasonable grounds to suspect

7 Subject to section 10.1, every person or entity referred to in section 5 shall, in accordance with the regulations, report to the Centre every financial transaction that occurs or that is attempted in the course of their activities and in respect of which there are reasonable grounds to suspect that

(a) the transaction is related to the commission or the attempted commission of a money laundering offence; or

(b) the transaction is related to the commission or the attempted commission of a terrorist activity financing offence.

This is important as the provision of the PCMLTFA (the section number) is what’s listed in the Proceeds of Crime (Money Laundering) and Terrorist Financing Administrative Monetary Penalties Regulations, where potential penalties are defined. Violations of Section 7 of the PCMLTFA are considered “very serious”. In turn, a “very serious” violation can lead to a penalty of up to $500,000 – for each instance.

If you’re a quantitative type quietly working out the rough number of fraud cases that your reporting entity has had recently, multiplying by $500,000, and feeling a bit nervous, you are not alone.

What’s Next?

While guidance and policy interpretations do not carry the force of law, this is often a distinction without a difference. Might a reporting entity take an appeal to federal court and win? Perhaps…though under the existing rules, that reporting entity’s name will be published (required where the violation is considered to be “very serious”), which for some reporting entities would have significant consequences, including the loss of vital banking partner relationships. Further, the cost of competent representation in a federal appeal process is well beyond the means of most small and mid-sized reporting entities.

Industry associations will, no doubt, continue to lead important conversations with FINTRAC and seek clarification for their members.

In the meantime, for most Canadian reporting entities, the most pragmatic decision will likely be to devise internal guidelines that include reporting STRs related to fraud cases.

Need a Hand?

If you want to make updates to your compliance program to reflect this new policy interpretation, or assistance with Canadian AML generally, please contact us.

Don’t Share STRs or STR Data

Recently the Compliance Officer from a small reporting entity reached out to me to ask an uncomfortable question: should they provide copies of the Suspicious Transaction Reports (STRs) that they had filed with the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) to their financial services providers such as a credit union or bank?

This was a difficult situation for the reporting entity’s Compliance Officer because they were afraid of pushing back too much with the financial services provider. Like most non-bank reporting entities, they rely heavily on the services provided by the bank in order to be able to operate their business. Financial service providers, such as banks and credit unions, have the ability to close the accounts of businesses in Canada (often called de-risking), and it can be difficult for some types of reporting entities to establish new banking or payments relationships. The financial services provider in this situation has significantly more power than the reporting entity that is dependent on them.

My gut reaction was that the reporting entity should not disclose the contents of their STR reports, or provide copies. In Canadian legislation, disclosing the fact that an STR was made, or disclosing the contents of such a report, with the intent to “prejudice a criminal investigation” can be punishable as a criminal offence, with penalties of up to 2 years imprisonment (this is also known as “tipping off”). While there did not appear to be any intent to prejudice a criminal investigation in this case, it still seemed like a bad idea. I did a quick check-in with fellow AML geeks on LinkedIn. There are some great comments here, and I had a number of conversations in DMs and by phone. No one seemed to think that the reporting entity should be providing copies of STRs.

The question then became how to best empower the reporting entity to push back effectively. I submitted the following request to FINTRAC and to the Office of the Privacy Commissioner (OPC), both of which have mechanisms to allow Canadians and Canadian companies to ask the regulators to opine on matters free of charge:

One of our clients, a Canadian Money services business (MSB) has been asked by their financial services provider (bank/credit union) to provide copies of the suspicious transaction reports (STRs) and Attempted Suspicious Transaction Reports (ASTRs) that have been filed with the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) on an ongoing basis. This struck us as being an overreach in terms of the information that should be disclosed to a service provider, and we are reaching out for an opinion on the appropriateness of these requests.

The financial service provider appears to be of the opinion that this is a reasonable request, and that they may close the MSB’s bank account if the STRs and ASTRs are not provided by the MSB.

I let both FINTRAC and OPC know that I had submitted requests to both. So far, only FINTRAC has responded. Their response is below in full (TL:DR: reporting entities should not share copies of STRs reported to FINTRAC).

Thank you for contacting the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC), Canada’s independent agency responsible for the receipt, analysis, assessment and disclosure of information in order to assist in the detection, prevention and deterrence of money laundering and the financing of terrorist activities in Canada and abroad.

I am writing further to your email of July 16th, 2020, wherein you requested clarification regarding the sharing of suspicious transaction reports (STRs) submitted to FINTRAC.

As you know, section 8 of the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) states that no person or entity shall disclose that they have made, are making, or will make a report under section 7, or disclose the contents of such a report, with the intent to prejudice a criminal investigation, whether or not a criminal investigation has begun.

The PCMLTFA sets out a regime in which the information contained in financial transaction reports sent to FINTRAC (including STRs) is protected from disclosure except in very limited circumstances. The Act also includes specific provisions aimed at protecting the personal information under FINTRAC’s control. For example, as you may be aware, the PCMLTFA is founded on a prohibition on disclosure (s. 55(1), PCMLTFA). Any disclosure of information or intelligence by FINTRAC must fall under one of the exceptions to this prohibition. Outside of these exceptions, FINTRAC is prohibited from disclosing the contents of financial transaction reports, or even acknowledging their existence.

While reporting entities (REs) are not subject to the same prohibitions, FINTRAC strongly believes that STRs should be regarded as highly sensitive documents, given the role FINTRAC plays in the fight against money laundering (ML) and terrorist activity financing (TF) in Canada, and the fact that STRs are a key source of FINTRAC’s intelligence holdings. From FINTRAC’s perspective, it is not in the public interest for REs to disclose financial transaction reports and the information contained therein. Even beyond this, the collection or disclosure of financial transaction reports, including STRs, without a valid purpose and authority, may infringe on legislated privacy protection obligations. Almost all information within financial transaction reports is personal information about an identifiable individual and is considered financial intelligence by

FINTRAC, collected for the sole purpose of reporting to FINTRAC. The potential harm that could occur from the disclosure of the information in these financial transactions reports is great, and includes compromising: (1) police and national security investigations that are both ongoing or could be undertaken in the future; (2) sources of the information/intelligence within the reports, placing those sources at risk of retaliation; and (3) FINTRAC’s compliance activities, given that data provided by REs is always provided in confidence and that confidence is expected to be maintained by all parties. FINTRAC relies on the information included within STRs to support disclosure of financial intelligence to police and other law enforcement and national security organizations, in the interest of detecting, preventing and deterring ML and TF.

Therefore, while your client (MSB) is not prohibited from sharing the STRs it has submitted to FINTRAC with its service provider (Bank/CU), unless it is with the intent to prejudice a criminal investigation, strong consideration should be given to the above.

If you would like a PDF copy of the complete question and policy position for your due diligence files, or to provide to an external party that is requesting copies of your STRs, or information about their content, you can download it here.

Response from FINTRAC – Re_ Sharing Copies of STRs_ASTRs

A version of this Q&A is also now posted on FINTRAC’s website (PI-10662).

The response from OPC, in contrast, was underwhelming. In essence, they will investigate specific complaints, but they will not issue advanced rulings. That said, if any service provider is insisting that copies of STRs must be shared with them, a complaint to the OPC may be an option.

Response from the Office of the Privacy Commissioner of Canada – INFO-084075

Need a hand?

If you have AML or privacy-related questions, we can help. You can get in touch using our online form, by emailing info@outliercanada.com, or by calling us toll-free at 1-844-919-1623.

Return to Blog Listing