Episode 59 — Broker Armour #1: FINTRAC One Year Later (Are You Protected?)

SERIES LAUNCH: Broker Armour

HOSTS:  Dean Lawton & Justin Noda (Chief Compliance & Operations Officer, ABW)

What This Episode Covers

Episode 59 kicks off Broker Armor, a brand-new series built specifically to help Canadian mortgage brokers stay protected, prepared, and compliant in a rapidly tightening regulatory environment. Dean sets the stage for what this series will become: a monthly (or more) “compliance home base” covering FINTRAC, provincial regulators, and upcoming changes—especially in BC with the MSA/BCFSA evolution.

This first episode is deliberately “foundational.” Dean and Justin focus on one of the biggest points of confusion in the industry: FINTRAC’s requirements are primarily aimed at the brokerage (the reporting entity), not the individual agent—yet agents still carry meaningful responsibility inside each file. The conversation walks through a practical checklist that clearly separates brokerage responsibilities vs. broker responsibilities, with real-world examples of what gets missed, what triggers risk, and what could cause major issues during an audit.

A downloadable checklist is mentioned in the show notes as a take-home tool that brokers and owners can use to self-audit their readiness.

The Big “Aha”: Brokerage vs. Agent Responsibilities

Justin makes it crystal clear early: FINTRAC refers to “reporting entities,” and that means the brokerage. This matters because the brokerage must register, access the FINTRAC web reporting system, build programs, train agents, keep records, and file reports. Agents should not be filing reports directly. Instead, agents are expected to follow the brokerage’s procedures, complete the KYC steps correctly, and escalate anything suspicious.

This single distinction can expose a huge gap in many brokerages. If a broker doesn’t know who their compliance/AML lead is, doesn’t know where the policies are, or hasn’t been trained beyond the initial rollout in October 2024, that’s not just an education issue—it’s a risk issue.

Broker ArmoUr Checklist — What Needs to Exist (and Who Owns It)

1. Appointed Compliance / AML Officer (Brokerage Responsibility)

A major theme: this role can’t be an afterthought anymore. Justin explains that many firms historically treated compliance as part-time admin work. In today’s environment, that approach is dangerous. The compliance lead needs to be someone who is genuinely engaged, capable, and supported—because the workload is real, audits are coming, and the expectations are rising.

Broker responsibility: know who this person is, respect the process, and actually use them as a resource. A simple self-check mentioned in spirit: Do you know your compliance officer’s name today?

2. Written Policies & Procedures Manual (PPM) — Brokerage Builds It / Brokers Follow It

The PPM is effectively the brokerage’s FINTRAC “playbook.” It lays out how the brokerage interprets the rules and how brokers are expected to operate inside the program (ID methods, enhanced due diligence, documentation, escalation, etc.). Justin makes a key point: FINTRAC rules are clear, but the “how” can vary—so each brokerage must define their approach and then operate consistently.

Broker responsibility: read it, acknowledge it, follow it. (And if your brokerage can’t easily provide it, that’s an immediate red flag.)

3. Risk-Based Assessment (RBA) — Brokerage Defines Risk Appetite / Brokers Need to Understand It

Justin distinguishes two commonly confused items:

• RBA (Risk-Based Assessment): brokerage-level document that defines the firm’s risk appetite and approach
• Client Risk Assessment: file-level decision brokers make (high/medium/low risk)

The RBA informs how the brokerage wants risk measured and what steps are required when risk increases. Justin explains how ABW built tools (like a scorecard approach) to drive consistent risk ratings and reduce “gut-feel only” decisions—because inconsistency creates exposure in audits.

Broker responsibility: understand the risk factors and collect the info needed to rate a file properly.

4. Ongoing Training Program (Brokerage Must Run It / Brokers Must Complete It)

This episode strongly reinforces: training isn’t a one-time rollout. Brokerages need an annual training program, documented and trackable, so they can prove education happened if issues arise later. Justin notes many firms haven’t built this properly yet because “the year felt far away”—but FINTRAC’s expectations are now moving into the “you should know this by now” stage.

Broker responsibility: complete the training and apply it in real files.

The subtext is important: ignorance won’t be a defensible position going forward.

5. Two-Year Effectiveness Review (Brokerage Responsibility — and It’s Coming Fast)

This one is a major “heads up.” FINTRAC requires a formal effectiveness review every two years, where an appropriately qualified reviewer evaluates whether the brokerage program actually works. It can’t be done by the same person who built the program, and it’s often not cheap—Justin notes it can run well into five figures depending on scope and size.

Broker responsibility: none directly—other than cooperating if asked and adapting to changes that follow the review.

6. Client ID + Beneficial Ownership (Shared Responsibility)

This is where brokers feel FINTRAC most day-to-day.

• Client ID must follow an approved method (and must be valid/current). Justin shares examples of how things go sideways when brokers treat ID casually.

• Beneficial ownership becomes critical in business-for-self files or corporate entities, especially where someone owns 25%+ but isn’t on the mortgage. That’s not an automatic “no”—it’s a documentation and transparency requirement.

Brokerage responsibility: define acceptable methods and provide tools/process

Broker responsibility: execute correctly, document properly, and do it early (not at the end)

7. PEP / HIO Screening + Sanctions (Shared Responsibility)

This is another major pillar: screening for Politically Exposed Persons (PEPs) and Heads of International Organizations (HIOs), plus sanctions checks. Justin explains that the brokerage must provide the mechanism (forms, platform tools, or paid screening options), but brokers must actually run it and escalate when results require extra due diligence.

A key nuance highlighted: foreign vs. domestic PEPs are treated differently, and when a potential match appears, brokers may need to do deeper confirmation (e.g., verifying it’s a different person with the same name).

Justin shares that the work can get unexpectedly serious—examples included links to sanctioned geographies, adverse media, and crypto-related laundering attempts. The point is clear: these aren’t theoretical risks anymore.

8. Ongoing Monitoring + Suspicious Activity (Mostly Brokerage, But Brokers Must Be Alert)

Justin explains ongoing monitoring is largely brokerage-driven and is typically tied to the risk rating: high-risk clients may require more frequent re-checks. Brokers don’t run monitoring programs, but brokers absolutely impact them by assigning accurate risk levels at the start and flagging anything unusual.

For suspicious activity: brokers are the “front line.” If something feels off, brokers should escalate internally—never ignore it, never try to quietly push a file through.

9. Record Keeping (5+ Years) — Shared Responsibility

This is straightforward but critical: brokerages must securely store required documents for 5+ years, and brokers must ensure the documentation is complete and uploaded properly. A future audit will compare what’s in your PPM/RBA against what’s in your actual files.

10. Reporting to FINTRAC (Brokerage Only)

Justin reinforces a common misconception: brokers do not file FINTRAC reports directly. Broker responsibility is to raise concerns internally using the brokerage’s process (internal STR form, escalation workflow, etc.). The brokerage then decides whether to file official reports through the FINTRAC reporting system.

11. FINTRAC Examinations / Audits (They’re Already Starting)

This is the tone-setter near the end: audits have begun, and while the early phase may not be “hammer down,” FINTRAC is making expectations known. Justin also notes proposed legislative changes that could massively increase penalties—making today’s discipline the difference between a manageable process and a catastrophic one later.

Dean adds a key industry-level point: if someone gets made an example of, it’s not just bad for them—it’s bad for the entire channel.

11. FINTRAC Examinations / Audits (They’re Already Starting)

Justin notes most brokers now understand the “standard pillars” (ID, PEP, sanctions, basic risk rating), but where gaps show up is in the deeper risk logic—things like:

• Beneficial ownership and corporate control
• Third-party involvement (who is really directing the transaction)
• High-risk industries or unusual sources of funds
• Risk patterns that don’t show up in the obvious checklist items

His framing is useful: these risks always existed—brokers are just being forced to see them clearly now.

Action Steps for Brokers This Week

If you want this episode to actually protect you (not just educate you), here’s the practical follow-through that aligns with what Dean and Justin are pushing:

• Download the checklist and walk through it with your brokerage in mind
• Confirm you know your compliance/AML lead and how to escalate concerns
• Ask where your PPM + RBA live and whether you’ve acknowledged them
• Make sure your ID method is brokerage-approved (and documented correctly)
• Stop treating risk assessment like “gut feel”—collect the facts that support the rating
• Escalate anything that feels off early (before it becomes a “cleanup after the fact” situation)

Justin also openly invites brokers and broker owners to reach out confidentially if they’re unsure whether their current setup is truly compliant.

Why You Should Listen

This episode is a reality check—and a protection plan. If you’re treating FINTRAC as a “box-checking exercise,” you’re exposed. Justin breaks down what FINTRAC actually expects, what your brokerage must have in place, what you personally must execute inside the file, and why audits (and penalties) are only getting stricter from here.

If you want to keep your license safe, avoid becoming the brokerage that gets made an example of, and understand compliance in a way that’s practical—not theoretical—Episode 59 is required listening.

For weekly market updates, sign up for the ABW Tuesday Mortgage Memo. If you’re a broker considering a network change or looking to grow, reach out to us to explore how we can support your success.