What Happens After a FINTRAC Examination in 2026: Findings, Mandatory Compliance Agreements, and Compliance Orders

Every FINTRAC penalty release opens with the same six words: following a compliance examination. The examination is the event that produces the penalty, the public notice, and the sector headline. It is also the part of the process that reporting entities understand least, and the part that changed most in 2026.

On September 3, FINTRAC announced penalties against two Atlantic Canada gaming corporations. Both releases ended the same way: the penalty was paid in full and the case is closed. For examinations now being scoped, that ending is no longer available. Under the amended framework, a penalty for a prescribed violation comes with a mandatory compliance agreement attached, and the file stays open until the remediation in it is done.

The date that decides which rules apply to you

Bill C-12, the Strengthening Canada's Immigration System and Borders Act, received Royal Assent on March 26, 2026 and amended the PCMLTFA penalties regime. The question every reporting entity should be asking is not what the new rules say. It is which set of rules their next examination will be judged under.

FINTRAC answered that directly. Its guidance states that review periods falling entirely before March 26, 2026 continue to use the existing penalties policy, and that violations occurring on or after that date fall under the new legislative framework. Critically, FINTRAC also says it will scope examination review periods so they fall entirely within one legislative framework.

Work through the timing. It is now more than five months past the cutover. An examination scoped today to a recent review period sits wholly on the far side of March 26, which means the new framework applies in full. The penalties published through the summer of 2026 were, in the main, the last generation of the old model working its way through. The examinations being scoped this quarter are the first wave of the new one.

What the new framework adds

FINTRAC describes four substantive changes. It will define prescribed violations and compliance order violations subject to penalties. It can apply increased maximum penalty amounts, up to 40 times the previous limits. It can consider ability to pay when determining an amount. And reporting entities that commit prescribed violations after March 26, 2026 will be required to enter into mandatory compliance agreements, with compliance orders available as an additional enforcement tool.

Applying FINTRAC's own multiplier to the former statutory ceilings gives the figures that legal analysis of the amendments has set out. They are worth seeing side by side, because the change in magnitude is the part that reframes how an examination should be resourced.

The bottom row is the one that deserves a second read. Contravening a compliance order is designated as a violation in its own right, carrying its own penalty. A reporting entity that mishandles the remediation stage can be penalized a second time, on a scale that is no longer anchored to a fixed ceiling at all.

The examination no longer ends when the cheque clears

Under the model most reporting entities have in their heads, the sequence runs: examination, findings letter, notice of violation, penalty, payment, public notice, done. The public notices FINTRAC published on September 3 follow exactly that arc, and both say the case is closed.

Section 73.16(1) of the Act changes that ending. Once penalty proceedings end for a prescribed violation, FINTRAC shall require the reporting entity to enter into a compliance agreement. The wording is mandatory, so this is an obligation on the Centre rather than an option it weighs.

A compliance agreement is a forward commitment: specified remedial measures, delivered on a timeline FINTRAC sets. Paying the penalty settles the conduct the examination found. The agreement governs what you do next, and it begins where the payment ends. In one line: the fine closes the past, the agreement opens the future.

Refusing to enter the agreement, or entering it and missing its deadlines, opens the door to a compliance order. Contravening that order is a separate violation carrying its own penalty, capped for an entity at the greater of $30 million or 3% of gross revenue. A reporting entity can therefore be penalized twice from a single examination: once for what the examiner found, and again for how the remediation was handled afterwards.

Two qualifiers matter here. A prescribed violation is a narrower category than any violation carrying a penalty: section 73.13 defines it as a contravention designated by regulation. And the trigger date is the day the violation occurred. The date of the examination does not control it. Because FINTRAC scopes each review period to sit entirely inside one framework, a review period covering recent activity puts the whole examination on the new side of the line.

For a compliance officer, the practical consequence is about evidence over time. The old model rewarded an entity that could survive a point-in-time review. The new one requires an entity that can demonstrate sustained, documented remediation months after the examiner has left, on a schedule someone else set. Those are different capabilities.

It is also worth being precise about what is not yet settled. FINTRAC states that it is updating its penalties policy and developing new guidance on compliance agreements, compliance orders, and penalty calculation. Which violations are prescribed, and the mechanics of how agreements are structured, are still being published. The direction is clear; the detail is not final.

Why the preparation window closes earlier than people think

FINTRAC opens an examination by contacting the compliance officer, with the scoping and document request following. From that point the entity is producing evidence about a review period that has already happened. Nothing done after the call changes what the records show.

That is the uncomfortable arithmetic of examination preparation. The work that determines the outcome happened months earlier, in the ordinary handling of alerts, filings, and reviewer decisions. By the time the notification arrives, the entity is not preparing a compliance program. It is retrieving one.

The failures that show up repeatedly in FINTRAC public notices are retrieval failures as much as judgment failures. Unreported suspicious transactions where the indicators were visible in the data. Policies that were never approved by a senior officer or never updated for a ministerial directive. Risk assessments that existed as a conversation rather than a document. In each case the question at examination is not whether the entity acted reasonably, but whether it can show what it did and why.

Seven things to test before the call comes

1. Know which framework your next review period sits in. Establish the date of your last examination and assume the next review period falls entirely on or after March 26, 2026. Brief senior management on the revised exposure before, not after, the notification.
2. Time your own data extraction. Pick a past quarter and reconstruct the full transaction population, the reports filed against it, and the supporting records. Measure how many days and how many people it takes. That is your real examination readiness number.
3. Reconcile filings against the population. Compare reportable activity to what was actually submitted and accepted. Unexplained gaps between the two are the single most common finding in published notices.
4. Document the decisions not to report. Alerts reviewed and closed without a filing need a written rationale, a named reviewer, and a date. An empty closure record is indistinguishable from an unnoticed indicator.
5. Check policy currency and approval. Confirm a senior officer approved the current version, that the approval is dated, and that ministerial directives are documented and applied. Both are recurring findings.
6. Confirm the risk assessment is enterprise-level. It must be written, cover the prescribed factors across all business activities and channels, and connect to the controls actually in use.
7. Plan for the remediation phase. Assume an adverse finding leads to committed remedial measures on a deadline. Identify now who owns that work and what evidence would prove it was completed on time.

Bottom line

The examinations being scoped this quarter are the first to run entirely under the amended framework. Maximum penalties are an order of magnitude higher, ability to pay is now a factor in the calculation, and a penalty for a prescribed violation carries a mandatory compliance agreement rather than a closing date. Contravening the compliance order that can follow is a separate violation with its own exposure.

None of that changes what a good compliance program looks like. It changes what it costs to be unable to prove you have one, and it extends the period over which you have to keep proving it.

Examination readiness is not a document you assemble when the call comes. It is whether a normal week of your reporting work would survive being read back to you two years later.