Compliance · British Columbia

FINTRAC Compliance IT Support for BC Reporting Entities

Hexafusion delivers the IT-side controls behind FINTRAC compliance for BC reporting entities. Record retention with immutability, secure reporting channels, identity verification IT, audit trails, encrypted storage, and incident response built to survive both a ransomware event and a FINTRAC examination.

Written by Alex Barari, founder of Hexafusion and a former PCI DSS Internal Security Assessor (ISA). Hexafusion is an IT and security firm, not an AML compliance advisor. We deliver the technical controls that an AML compliance program depends on, in coordination with your compliance officer or advisor.

Who is a FINTRAC reporting entity

FINTRAC (Financial Transactions and Reports Analysis Centre of Canada) regulates entities under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA). If you operate in one of these categories you are a reporting entity:

What FINTRAC compliance involves

Five core obligations apply to every reporting entity. The bullet list is the regulatory shape; the IT controls behind it are where Hexafusion does the work:

1. Compliance program. Appointed compliance officer, written policies and procedures, ongoing training, risk assessment, two-year effectiveness review.
2. Know your client (KYC) and identity verification. Verify identity at prescribed thresholds with prescribed methods (government photo ID, credit file, dual-source, affiliated entity, or reliance methods). Retain the records.
3. Beneficial ownership and politically exposed person (PEP) determinations. For corporate clients, identify beneficial owners. For prescribed triggering activities, determine whether a person is a PEP, head of an international organisation, or close family member.
4. Reporting. Submit LCTRs, LVCTRs, EFTs, STRs, TPRs, and SERs through FINTRAC Web Reporting (FWR) or API. Each report has prescribed content and timing.
5. Record retention. Five years minimum on transaction records; five years from last business relationship transaction on identification records.

The IT controls behind a working compliance program

Where Hexafusion concentrates the work:

Report types and timing

FINTRAC examinations: what they look like in practice

FINTRAC conducts compliance examinations periodically. Risk-based selection: higher-risk sectors (MSBs, real estate, casinos) see more frequent examination. The examination typically runs 1-3 days on site or virtual, with pre-engagement document requests and post-engagement findings.

What the examination team asks for on the IT side:

• Evidence that records are retained for the required period.
• Sample of records reproduced from storage on request.
• Evidence of access controls and audit logs.
• Evidence of backup and recovery capability.
• Evidence of secure transmission of reports.
• Evidence of identity verification methods documented and applied consistently.
• Risk assessment documentation including IT risk components.

An audit-ready evidence package, refreshed continuously, is far cheaper than producing one under examination deadline pressure. We maintain it as part of every FINTRAC engagement.

Common pitfalls we see in BC reporting entities

• Records on local file shares with no immutability. A ransomware event can encrypt or delete five years of KYC. Immutable cloud storage with object lock is the working pattern.
• KYC documents in personal email folders. Compliance officers sometimes hold scanned ID in their own mailbox. This breaks the access controls, audit logging, and retention schedule. Consolidate to a structured store.
• No backup of the AML platform. Several BC AML platforms hold transaction records and risk assessments. If the platform vendor changes hands or goes out of business, the records still need to be accessible for the five-year retention. We maintain exportable copies.
• FINTRAC Web Reporting account on shared credentials. Each submitter should have a named account. Shared credentials break the audit trail.
• Mortgage entities not realising they are now covered. The October 2024 amendments brought mortgage administrators, brokers, and lenders in. Many BC firms in this category are still building the program.
• Treating the IT program as separate from the AML program. The compliance officer's policies should reference the IT controls and the IT controls should produce the evidence the compliance program assumes exists. We coordinate to keep the two aligned.

FAQ

Related compliance topics

Part of our broader compliance coverage for Vancouver and BC businesses.