Dealers In Precious Metals and Stones (DPMS): a FINTRAC auditor calls to schedule an exam, it is a real enforcement reality.
When a FINTRAC comes to your business for an examination, they are not there to browse the inventory (despite how lovely or valuable it may be). They are there for a purpose: to ensure that your business can demonstrate on paper (and prove effectively) that it is following its AML responsibilities.
FINTRAC Enforcement Against Precious Metals and Stones Dealers Is Rising
FINTRAC has been ramping up enforcement issuing approximately $206 million over 43 penalties in the last two years’ alone. And in the DPMS sector, both large scale and smaller establishments have been the subject of FINTRAC examinations and penalties.
What stands out in recent DPMS enforcement activity isn't unique or hard to catch. It's the typical compliance basics that are lapsing - including documentation gaps that any business, whether a two-person shop or a coast-to-coast retail chain, could close well before an inspector walks through that showroom door.
In the last year and a half, 4 penalties have been issued across both smaller and larger entities. And with Bill C-12’s new AMP structure that promises 40x the penalty dollar amounts - DPMS’ need to get their compliance programs in line with expectations, so that when FINTRAC comes knocking, they are ready and can mitigate damaging financial and reputational risk.
Top Considerations for an Audit-Ready DPMS Compliance Program
Your compliance program should be in a state where it can be produced on request, not assembled under pressure. If your risk assessment or policies and procedures take a few days of digging around to find, that’s worth fixing now, before you are put to the test.
And remember, more than ever it’s important to have a record of and be aware of your compliance program and risk factors, as under Bill C-12 (which is now law) compliance programs must not only be presentable on paper, they must be proven effective in practice. Have examples ready for your auditor on how you apply your policies and procedures and risk assessments in practice and how it helps your business mitigate Money Laundering/Terrorist Financing (ML/TF) risk.
This leads us to an important discussion: what are the top considerations for ensuring your compliance program is audit ready?
1. A Written Compliance Program: Current, and Signed Off
FINTRACs expectations require a written compliance program with policies and procedures that are kept up to date and formally approved by senior management. If there have been any notable changes to your business, for example you operate in new locations, have new payment methods, new products and services, a shift in how you sell (i.e. physical retail to online retail), your policy document must reflect that. An outdated manual carries little more weight than no manual at all with a FINTRAC auditor. For many sectors, FINTRAC has come down hard on the use of “templated” compliance programs…ensuring yours is customized to your industry and its specific risk factors is an essential step.
2. A Documented Risk Assessment: Not Just an Understanding
Can you produce a document showing your money laundering risk? Your analysis should include which products, clients, delivery channels, supply chain partners and geographies that carry elevated risk and why. Know Your Customer (KYC) is not the same as a documented risk assessment - FINTRAC requires a dated, written analysis that works through your unique prescribed risk factors. And remember, DPMS supply chains can be quite complex spanning geographies. FINTRAC knows this is a vulnerability, so you need to be prepared to know exactly what risks all your channels, vendors or products pose.
3. A Completed, Documented Effectiveness Review
A Compliance Effectiveness Review is required by FINTRAC every two years and may be carried out by an internal or external reviewer. Recently, some DPMS penalties have been in part result of a missed Compliance Effectiveness review - this is an easy rule to follow and remember, a review that shows gaps or areas for improvements is not necessarily an issue that will result in an AMP, provided you document the steps you will take to fix or remediate the identified gaps. The start date of your next review must occur no later than two years after the start date of your current review. For example, if the review started September 5, 2026, the next review must start on or before September 5, 2028.
Get a review on the calendar or outsource to an external consultancy group like The AML Shop to take care of. Learn more about Compliance Effectiveness reviews.
4. Consistent Practice at the Point of Sale
Policies and Procedures must be followed by your sales team and in store, as sometimes FINTRAC examiners will ask front-line staff how a transaction is handled.
It’s crucial for frontline staff to carry out:
🔶 client identification on qualifying transactions.
🔶 understand the reporting of large transactions exceeding the $10,000 threshold (including clients who purchase $10,000 or more in several transactions over 24 hours, following the “24 hour rule”) and escalate transactions as required to the compliance team.
🔶 Notifying the compliance team of a potential suspicious transaction. The compliance team may determine a suspicious transaction report should be filed, when there are reasonable grounds to suspect the transaction could be associated with ML/TF risk.
DPMS Compliance for Small Jewellers vs. National Chains
Obligations apply equally to independent jewellers and regional and national chains in Canada, however the failure points tend to look different at each scale.
For the smaller shop: the risk is usually employee capacity. One person is often wearing the owner, sales, and compliance officer hats, and the two-year review or the policy refresh is the first thing to slip when the business gets busy.
What can you do to stay on track?
A simple recurring system such as:
Put the review on your calendar in advance
Keep a standard risk assessment framework in your files - but be sure to update it as your risk factors change or your business materially changes (for examples, changes to geographies worked with, products and services and taking on new client types)
For the national chain: Consistency of applying compliance within a corporate structure is a typical challenge. For example, a compliance policy can be current and well-written at head office and still fail in practice if location managers, seasonal staff, or staff from a newly acquired banner or brand aren't trained to the same standard. An operationalized compliance program is essential for a multi-location business with training, transaction monitoring and reporting lines that reach every outlet in every location. A compliance program must exist and apply at all of your businesses locations, nationally and globally.
The Real Cost of FINTRAC Non-Compliance
The reputational impact of a public penalty from FINTRAC is a cost in itself as it can impact your optics as a business and future business opportunities. Receiving an AMP cannot be viewed as a cost of doing business as its impacts reach far beyond the one-off cost. Your banking partners, supply chain vendors and even your customers may lose trust in your business, leading to future lost revenue.
Remember, you do not need fancy technology or compliance software to be compliant or drive positive change within your business’ compliance program. What FINTRAC is really looking for is basic adherence to your compliance obligations. Ensure your compliance program is accounted for, current and ready to produce at any moment should a FINTRAC inspector come knocking.
Need help building or refreshing a compliance program that would hold up under FINTRAC scrutiny? contactus@theamlshop.ca to talk through where your program stands today.
We Help Keep FINTRAC Happy 🇨🇦
FAQs
-
A dealer in precious metals and precious stones (DPMS) is subject to the PCMLTFA and its associated Regulations when it engages in the purchase or sale of precious metals, precious stones or jewellery in an amount of $10,000 or more. This threshold applies to the transaction, and includes sales made on consignment.
-
Not automatically. DPMS have specific client identification requirements, including when they receive $10,000 or more in cash, receive $10,000 or more in virtual currency, or are dealing with a suspicious transaction. Suspicious transactions trigger identification requirements regardless of the transaction amount.
-
The fact that individual payments are below $10,000 does not necessarily mean the transactions can be treated separately. The 24-hour rule can require transactions to be aggregated when determining whether the $10,000 reporting threshold has been reached. Structuring is also a serious criminal activity. Reporting entities must consider whether the customer is deliberately structuring their payments below the cash reporting threshold to avoid AML obligations like identity verification and reporting.
-
The answer depends on the circumstances and timing of the transactions. DPMS must consider the applicable 24-hour rule and whether transactions are connected. Deliberately structuring transactions to avoid reporting or identification requirements can itself be a serious AML concern and require suspicious transaction reporting consideration.
-
No. $10,000 is not the suspicious transaction reporting threshold. As STR is required where there are reasonable grounds to suspect that a transaction or attempted transaction is related to a money laundering, terrorist financing or sanctions evasion offence. There is no minimum dollar amount for an STR.
-
Yes. Suspicious transaction reporting is not subject to a $10,000 minimum. A transaction or attempted transaction of any value can potentially require a suspicious transaction report where the required suspicion threshold is met.
-
FINTRAC selects businesses for examination using a risk-based assessment model that evaluates factors such as transaction volume, past compliance history, reporting patterns, and sector-wide risk trends. There is no set schedule a business can count on — any DPMS displaying elevated risk factors or reporting anomalies can be examined at any time
The article is provided for informational purposes only and is based on The AML Shop's understanding of the regulatory and legislative standards that were in place at the time that the session was held and the article was written. Those standards and FINTRAC's enforcement of them vary and change over time. The AML Shop is not a law firm and this article does not constitute legal advice. This summary also may not be applicable to your specific situation.