FINTRAC Risk-Based Supervision in 2026: An $85 Million Budget, Universal Enrolment, and the Risk Assessment FINTRAC Expects You to Document

On October 9, 2026, FINTRAC's Deputy Director of Supervision, Tina Matos, spoke to compliance professionals at The Assembly Canada in Toronto. Her speaking notes, published by FINTRAC the same day, set out how FINTRAC's supervision budget is growing, which sectors it will supervise more closely, and what it expects to see in your risk assessment.

The speech builds on the FATF evaluation of Canada, which we covered in our October 7 article. Matos said FINTRAC will use the evaluation's findings "to accelerate and guide our modernization."

The Supervision Budget: $60 Million to $85 Million

According to the speaking notes, the Minister of Finance and National Revenue approved an increase in FINTRAC's cost-recovered supervision envelope. From base funding of roughly $60 million in 2025-26, the funded amount will increase by approximately $25 million this fiscal year, to an overall envelope of $85 million. Matos called it "a generational change for my team."

The speech lists four uses for the increase:

• Deeper supervision in key sectors, naming financial institutions, virtual currencies and online gaming.
• Supervision of newer sectors, naming mortgage lenders, leasing and financing companies, and factoring companies. See our pages for mortgage, financing and leasing and factoring businesses.
• New programs from Bill C-12, including a new administrative monetary penalty framework and a universal enrolment program.
• A modernized IT platform to support the expansion.

Matos said her intention is "to focus on key vulnerabilities in higher-risk areas: to dig deeper where it matters most." On universal enrolment, she said it "will be a game changer for us." The speech does not give a date for universal enrolment.

What FINTRAC Will Use to Rate Your Risk

The speech lists the information FINTRAC intends to bring together to understand risk "at both the sector and entity level":

• what it learns through examinations;
• the effectiveness of compliance controls;
• reporting and data-quality concerns;
• enforcement history;
• voluntary disclosures of non-compliance;
• intelligence and information from its partners.

Matos described how supervisory intensity will scale. Where risk is lower, the approach "may focus on compliance promotion, guidance or monitoring." As risk increases, "the depth of our supervisory engagement will as well." Where FINTRAC identifies "significant or persistent non-compliance," it will have stronger enforcement tools available. We covered those tools in our Bill C-12 penalties article and in what happens after a FINTRAC examination.

She also said FINTRAC wants to be "predictable, transparent and fair," and that it "must be intrusive where the level of risk requires it."

What FINTRAC Expects From Your Risk Assessment

Matos made this request of reporting entities: "I ask all businesses to know your risks, document them clearly and make sure they are driving your compliance program."

Matos said your risk assessment should "reflect the realities of your business and provide a clear picture of your exposure to money laundering, terrorist financing and sanctions evasion risks." FINTRAC expects you to "demonstrate a clear and defensible connection between the risks you have identified and the measures you have put in place to address them."

The speech names the ways businesses in the same sector can differ. Paragraph 156(1)(c) of the Regulations names the factors your documented assessment must take into consideration. Side by side:

Subsection 9.6(1.1) of the Act requires your compliance program to be "reasonably designed, risk-based and effective." Subsection 9.6(3) requires the special measures in the Regulations when you consider the risk to be high.

Seven Questions to Test Your Risk Assessment

1. Is your risk assessment documented? Paragraph 156(1)(c) requires "assessing and documenting" the risk.
2. Does it cover your clients, business relationships and, where you have them, correspondent banking relationships? Subparagraph 156(1)(c)(i).
3. Does it cover your products, services and delivery channels? Subparagraph 156(1)(c)(ii).
4. Does it cover the geographic location of your activities? Subparagraph 156(1)(c)(iii).
5. If you are an entity in paragraphs 5(a) to (g) of the Act, does it cover risk from your affiliates? Subparagraph 156(1)(c)(iv).
6. Did you assess and document the risk of each new development or technology before introducing it? Subsection 156(2).
7. Can you show the connection between each risk you identified and the measure that addresses it? The speech asks you to "demonstrate a clear and defensible connection."

Bottom Line

FINTRAC's supervision envelope rises to $85 million this fiscal year, with deeper supervision of financial institutions, virtual currencies and online gaming, supervision of mortgage lenders, leasing, financing and factoring companies, and a universal enrolment program under Bill C-12.

In Matos's words: "know your risks, document them clearly and make sure they are driving your compliance program."