Auditor General Audit of FINTRAC 2026: Self-Attestations, Reporting Scorecards, the MSB Registration Backlog and What FINTRAC Agreed to Change

On October 29, 2026, Auditor General Karen Hogan tabled a performance audit of FINTRAC in the House of Commons. It covers how FINTRAC supervises the businesses that report to it and how it produces financial intelligence, from January 1, 2023 to February 28, 2026. FINTRAC agreed with all eight recommendations. Here is what the report says about the supervision you are subject to.

What the Auditor General Concluded

The report's conclusion reads: FINTRAC "did not carry out compliance oversight and the generation of actionable financial intelligence in an effective manner to fulfill its mandate under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act."

On the intelligence side, the audit found that FINTRAC took an average of 112 days (nearly 4 months) to produce and distribute financial intelligence after receiving a voluntary information record from a law enforcement or national security agency, between January 2023 and June 2025. Half of the recipients who answered the Auditor General's survey said the disclosures arrived too late to be useful for their work.

On the supervision side, the auditors reviewed a representative sample of 50 supervisory assessments, out of 666 completed between January 2023 and June 2025. They found that FINTRAC "had a formal, well-organized approach for doing its supervision work." The findings that follow concern the type of assessment FINTRAC relied on, the feedback it sent you, and the MSB registry.

Light-Touch Assessments and Self-Reported Information

By the end of the audit period, approximately 36,000 reporting entities were under FINTRAC's supervision, after virtual currency dealers (2020), crowdfunding platforms and certain payment services providers (2022), the mortgage sector and armoured cars (2024), and acquirers for private ATMs, title insurers, cheque cashing businesses, financing and leasing entities and factors (2025) were added.

The report says FINTRAC "adapted its supervisory framework to perform more light-touch assessments, such as self-attestations and risk questionnaires." It found that these assessments "relied largely on reporting entities providing accurate and honest information," and that without a more in-depth assessment, FINTRAC "had limited ability to verify the information it received."

Exhibit 7 of the report ranks four assessment types by the confidence each gives FINTRAC that a reporting entity is compliant:

The report also notes that FINTRAC reported conducting 1,300 supervisory assessments in 2024-25, a 40% increase from the previous year, and that this figure alone did not show whether overall compliance with the act had improved, "particularly because supervisory assessments vary in depth and level of assurance."

Recommendation 57: FINTRAC "should develop and implement procedures to verify the information submitted by reporting entities in higher-risk sectors."

FINTRAC agreed. Its response says "the responses to self-assessments, risk questionnaires and to information demands, including responses that deviate from expectations or demonstrate other red flags, are leveraged to inform decisions around risk, follow-up supervisory activity or enforcement action." It adds: "FINTRAC will strengthen its existing approach to verifying information submitted by reporting entities, including developing and implementing a formal procedure to further standardize these verification activities." The response gives no date.

FINTRAC's Reporting Scorecards

According to the report, FINTRAC introduced scorecards in 2025. FINTRAC generated them automatically from the reports of financial transactions that reporting entities submitted, to assess "whether the required information was complete and accurate," and sent them to reporting entities as feedback on the quality of their mandatory reporting and to identify issues requiring correction.

The auditors found that the scorecards "did not clearly explain what reporting entities needed to fix." The report gives two examples. One scorecard flagged a late reporting issue and referred to a problem with the "received date" without explaining what was wrong with the date or how to correct it. In another case, a reporting entity received a scorecard flagging more than 210 of its reports, with error codes it could not understand. When it contacted FINTRAC, FINTRAC responded only that it was aware issues had been incorrectly flagged.

Recommendation 58: FINTRAC "should verify the accuracy of scorecards before distribution and provide a clearly articulated explanation for any identified non-compliance."

FINTRAC agreed. Its response describes the scorecards as a pilot that establishes "an expectation to address these promptly and implement corrective measures," and says the majority of businesses had made the necessary corrections or begun the required changes before meeting with a FINTRAC official. FINTRAC says it will "reconsider aspects of the scorecard initiative" and improve its verification processes and the rationales it provides.

Comply+ validation is built to catch missing information before production submission, and the platform tracks submission history, corrections and internal review notes. Our page on common FINTRAC filing mistakes covers the data gaps that cause rework.

The MSB Registration Backlog

Money services businesses must register with FINTRAC under section 11.1 of the Act. Section 11.19 adds: "A registered person or entity shall renew their registration in the prescribed form and manner every two years or within any longer prescribed period."

The report sets out what happened to that process after FINTRAC's March 2024 cyber-incident:

• FINTRAC had no backup system and set up a temporary process that required significantly more manual work. It began offering workaround solutions on May 17, 2024, 10 weeks after the incident.
• New businesses were unable to register, and delays in renewals created a challenge for banks that needed to verify an MSB's registration status before providing services such as business bank accounts.
• In April 2025, FINTRAC adopted a temporary measure allowing businesses with expired registrations to keep operating if they had applied for renewal.
• In August 2025, 17 months after the incident, FINTRAC set up a special team to clear the backlog.
• At the time of publication, FINTRAC told the auditors that about 2,500 registration requests were waiting to be processed, and FINTRAC was resolving about 150 cases per week.

FINTRAC decided to build a new permanent registration system instead of restoring the original, and expects it in the 2027-28 fiscal year. The Auditor General wrote that with universal enrolment set to take effect, there is a risk that an enrolment backlog could emerge unless FINTRAC urgently enhances its system.

Recommendation 51: FINTRAC "should urgently complete the development and implementation of its new IT system for registering money services businesses." FINTRAC agreed, committed to implementing the new system by fiscal year 2027-28, and said it has deployed an updated secure document transfer system for receiving registration information and communicating with MSBs.

Section 11.13(1) of the Act still requires a registered MSB to notify FINTRAC of any change to the information in its application within 30 days after becoming aware of it. For MSB reporting, see our MSB solutions page.

STR Guidance on Stereotypes and Implicit Bias

Section 7 of the Act requires you to report every financial transaction, completed or attempted, where "there are reasonable grounds to suspect" it is related to a money laundering, terrorist activity financing or sanctions evasion offence. The report notes that suspicious transaction reports "depend on the reporting entity's judgment."

The auditors found that FINTRAC gives reporting entities guidance and indicators for identifying suspicious transactions, but no guidance on identifying, mitigating or avoiding the influence of stereotypes or unconscious bias when filing STRs. Canada's National Risk Assessment identified that risk in 2023 and again in 2025.

Recommendation 63: FINTRAC should develop specific guidance for reporting entities "on identifying, mitigating, and avoiding stereotypes and implicit bias to help with the exercise of judgment when analyzing and preparing suspicious transaction reports for submission." FINTRAC agreed. It will review its guidance in 2026-27 to identify areas where it "may be updated to discourage overreporting of suspicious transaction reports, such as those that contain stereotypes and implicit bias." The response says the guidance would be published in the 2027-28 fiscal year.

For the current STR requirements, see our 2026 STR filing guide.

All Eight Recommendations and FINTRAC's Timelines

Each recommendation is numbered by the paragraph where it appears in the report. FINTRAC agreed with all eight.

What FINTRAC Said

In a statement published the same day, FINTRAC said it is "pleased that the Office of the Auditor General of Canada recognized that the Centre has a formal, well-organized approach for doing its supervision work." It said it has finalized and implemented a new Supervision Framework and strengthened its risk tools, questionnaires and sector profiles.

The statement repeats figures from FINTRAC's annual report: 35 notices of violation in 2025-26, up 52% from the previous year, for more than $247 million. We covered those numbers in our 2025-26 annual report article. FINTRAC also cites a $37 million increase in its supervisory-related resources over the next two years and refers to the 38,000 businesses subject to the Act, a higher count than the approximately 36,000 the Auditor General reported at the end of the audit period.

Seven Questions to Test Your Program Against the Audit

1. Can you produce the records behind each answer you gave on a FINTRAC self-attestation or risk questionnaire? Section 6 of the Act requires you to "keep records in accordance with the regulations," and FINTRAC's response to recommendation 57 commits to a formal procedure to standardize verification.
2. Is your compliance program "reasonably designed, risk-based and effective"? Subsection 9.6(1.1) of the Act.
3. Does each report you file carry complete and accurate required information? Paragraph 55 of the audit: scorecards assess "whether the required information was complete and accurate."
4. If you received a scorecard, have you corrected each flagged issue and recorded the correction? FINTRAC's response to recommendation 58 describes "an expectation to address these promptly and implement corrective measures."
5. If you are an MSB, is your renewal filed within two years of your last registration? Section 11.19 of the Act.
6. If you are an MSB, have you notified FINTRAC of every change to your application information within 30 days? Subsection 11.13(1) of the Act.
7. Can you show the facts that gave you reasonable grounds to suspect for each STR? Section 7 of the Act sets the threshold, and paragraph 62 of the audit says STRs "depend on the reporting entity's judgment."

Bottom Line

The Auditor General concluded that FINTRAC did not carry out compliance oversight effectively over the audit period, found it relied more on self-attestations and risk questionnaires, and recommended verification of self-reported information in higher-risk sectors. FINTRAC agreed with all eight recommendations.

In FINTRAC's words: "FINTRAC will strengthen its existing approach to verifying information submitted by reporting entities."