FINTRAC just sent me a Notice of Deficiencies. What do I do now?
How will FINTRAC communicate its finding?
FINTRAC communicates their findings in a deficiencies letter. The deficiencies letter will cite the section of the legislation that they believe you contravened, a description of what that section requires, and a brief explanation of why they believe you didn’t meet the standard imposed by that section. In the case of reviews of client files and prescribed reports, they usually refer to the number of files or reports they reviewed, and how many of them were identified by FINTRAC as being deficient. That letter includes a fair bit of standard language, including the statement that “…independent of other compliance actions, deficiencies such as those cited in this letter could lead to civil or criminal penalties.” Very few examinations result in letters with no cited deficiencies. Although not required by the legislation, FINTRAC requests an action plan be filed within 30 days of the date of the deficiencies letter.
What are the potential consequences that FINTRAC can impose?
Deficiencies reported by FINTRAC can lead to a penalty or criminal charge. Penalties can range in severity from $1,000 per violation to $500,000 per violation. A violation can be something as simple as forgetting to collect identification from a client, to something as complex as not properly assessing and documenting your company’s risk of money laundering. The biggest FINTRAC penalty reported by the press to-date involved a near $700,000-notice served to the British Columbia Lottery and Gaming Corporation. FINTRAC can publish the penalties it assesses (once they are paid, or all appeal avenues have been exhausted). The negative attention of those penalties can impair your relationships with clients and financial services providers (particularly if you’re a money services business). Read more about Penalties
But that’s not all. FINTRAC has referred over 30 cases of non-compliance to prosecutors to proceed criminally – where they can seek jail terms of up to 5 years, and fines of up to $2 million. The law permits criminal charges to be brought against employees, officers and directors of a company. Read more about Criminal Charges. These penalties, in turn, may have a substantial negative impact on your organizations business relationships and its ability to remain viable.
Should you confirm FINTRAC’s findings?
Examinations take place over the course of a day or two, and there is potential that the reported deficiencies are not correct. By way of example, information FINTRAC reported as missing may have been in another system. There are also a number of areas of ambiguity in the legislation. Occupation is one of those areas: FINTRAC’s rejection of a particular occupation description may not be consistent with the interpretation of a court or general industry practices. We suggest that you begin by confirming the validity of their findings, particularly with the assistance of compliance experts who have a deep understanding financial services and the legislation.
What are the implications of an action plan?
As mentioned, there is no legislative basis for FINTRAC to require an action plan. FINTRAC has been clear though, that an action plan is the tool they use to gauge the extent to which a reporting entity is committed to compliance. Filing an action plan can be an opportunity to explain areas of disagreement in the deficiencies letter, demonstrate your commitment to compliance, and make the case for why an penalty should not be applied in your circumstances. However, poorly worded action plans might inadvertently support the position of a penalty, and make entering into a compliance agreement all the more difficult. If an action plan is filed, it should be specific about how deficiencies are going to be addressed, and the timeframe for those actions.
When does a compliance agreement come into play?
FINTRAC has the discretion to either issue a Notice of Penalty, or enter into a Compliance Agreement with a Notice of Penalty (so if you’ve received a Notice of Penalty, the window for a compliance agreement may have closed). With legal counsel, the receipt of a letter setting out significant deficiencies might be the opportunity to begin a dialogue with FINTRAC to entering into a compliance agreement.
Plugging the holes and checking for leaks
Once you have committed to an action plan or compliance agreement, the key is to work with your AML compliance expert to resolve the structural deficiencies (like issues with your training program, risk assessment, policies and procedures, and compliance review) and to put in place operational processes. We also typically recommend a self-assessment of compliance as a final stage of an action plan.
How we can help
The FEDs can help in assessing the severity of the deficiencies letter you received (compared to your peers, and based on FINTRAC’s past actions), and developing a strategy that suits the situation. We can also help in drafting and implementing the action plan, conducting compliance reviews, and approaching FINTRAC for you to limit your exposure to penalties and the reputation risk of publicized penalties.