With the release of the latest National Risk Assessment in Canada, now is the perfect time to ensure your Risk Based Approach (RBA) is in good order ✨
Recently, the Government of Canada published the 2025 Assessment of Money Laundering and Terrorist Financing Risks in Canada (aka the National Risk Assessment).
All businesses regulated under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) have an obligation to assess and document their Money Laundering and Terrorist Financing Risks.
What does this mean?
Your company requires a Risk Based Approach (RBA) as part of your overall AML compliance plan and it should be informed by the latest National Risk Assessment (and of course the specifics of your own business and inherent risks involved…but we will get more into that later!).
And remember - your RBA must be effective - it’s not enough just to have an RBA “on paper”, you need to demonstrate that your RBA is effective in practice.
2025 National Risk Assessment Highlights
The updated 2025 National Risk Assessment for Canada was created based on historical data, strategic intelligence and sector specific guidance and comes with notable updates, including:
🟠 A focus on residual risk.
Although the National Risk Assessment focuses on Canada’s inherent risk, the 2025 update notably highlights the importance of “Residual Risk”. Determining the appropriate Residual Risk of a nation provides a true picture of faced risk and is the foundation for making effective policy and resource decisions.
So, what is residual risk and how is it determined?
In the National Risk Assessment, the residual risk of Money Laundering and Terrorist Financing (ML/TF) risk is determined by:
✅ first, highlighting the inherent ML/TF risk that exists within Canada
✅ then, analyzing existing mitigation measures that are in place to respond to this risk
✅ and finally, noting the residual risk levels that remains after mitigation measures and controls are put in place.
This process helps inform the nation’s overall approach to ML/TF risk, and regulators expect that reporting entities will use this blueprint in determining their own RBA.
Determining your residual risk is the cornerstone of a sound compliance program, as it will give you the clearest scope of the ML/TF risk your business faces. FINTRAC requires that all reporting entities document their RBA, including noting all mitigation measures to control risk and then, establishing the residual risk that remains after those controls are put in place.
Failure to document this end-to-end process and demonstrate the effectiveness of your RBA and residual risk assessment is a big error…and a common and costly deficiency cited in FINTRAC penalty actions!
🟠 There are Sector Specific changes to assessed risk,
Below are a few examples of Sectors and Industries that have been highlighted in the National Risk Assessment:
📄 Mortgage Companies: Mortgage Fraud has been flagged as a high-risk vulnerability. Given this, the expectation will be that mortgage businesses will need to have stronger processes in place to mitigate risks. This is already evident as seen in the implementation of Beneficial Ownership Discrepancy reporting obligations, which became effective October 1st under the PCMLTFA. The Mortgage Industry is one of the industries that will need to comply with this update.
🏡 Real Estate: with more ways than ever to conceal cash through a seemingly valid economic transaction, there will be a greater expectation for real estate companies to assess risk appropriately and demonstrate that their RBA is sound. Of critical importance will be identifying the possible misuse of funds in large cash transactions, anonymous ownership structures, over or under valuations, exploitation of assignment clauses and other real estate transactions that could potentially involve illegal funds. We are seeing more FINTRAC oversight in 2025 within the real estate transaction and this will continue to trend. For example, 2025 PCMLTFA requirements have recently expanded when it comes to client identification obligations and the addition of more newly regulated industries like Title Insurers (who are a vital player in real estate transactions).
💰MSBs (this includes Crypto and Virtual Currency companies!) will face increasing scrutiny due to a high level of inherent risk because of high transaction volumes, speed of transactions, cross-border dealings and risk of sanctioned persons and geography clients. For these sectors, stronger AML processes, effective RBA’s and ensuring transparency in transactions with proper record keeping and filing of STRs, is more crucial than ever. In 2025 for non-compliant MSBs, we have seen record penalties issued by FINTRAC – to the tune of nearly $176 Million against FMSB (registered in British Columbia) Crypto MSB Xeltox (operating as Cryptomus) – and FINTRAC’s priority is to continue ramping up on enforcements here.
How exactly does FINTRAC approach enforcement and penalties when it comes to RBA’s?
As, far as enforcement and penalties go - FINTRAC does not take a prescribed or linear approach when it comes to expectation of a risk assessment and how they penalize non-compliance; but what is certain is that avoiding enforcement and penalties requires an effective, proven RBA in your AML compliance plan (it is not enough just to have documentation stating your RBA, your actions must demonstrate adherence to your RBA).
FINTRAC will be ensuring reporting entities are considering the National Risk Assessment within their RBA’s – and deficiencies in implementing these guidelines can result in sky-high penalties and reputational damage.
How Can We Help?
Taking a Risk Based Approach is essential for your overall compliance health.
Our team can help upgrade your RBA by:
🔶 Assessing your company’s inherent risks, including your client base, geographic risk, technology or factors specific to your business that might indicate Money Laundering or Terrorist Financing Risk
🔶 Determining an acceptable level of risk for your organization and establishing thresholds within your compliance program
🔶 Implementing compliance processes and strategies to help you determine risk including, Enhanced Due Diligence processes, KYC (Know Your Customer) Protocols, Record Keeping, Transaction Monitoring and Reporting, application of ministerial directives and ongoing monitoring of ML/TF risk and effectiveness.
What are your next steps?
Get valuable expert help!
Our team has routinely engaged with clients that need their RBA refreshed and we have been present for hundreds of FINTRAC exams – we KNOW what regulators are looking for and what is truly valuable within a compliance program.
In this risk-focused regulatory landscape, now is the time to reach out to us and learn about how our experts can help with your RBA. Contact us via the form below or email contactus@theamlshop.ca
We Help Keep FINTRAC Happy.