Anti-Money Laundering Compliance Programs: The Basics for Regulated Ontario Businesses

If your Ontario business falls into one of the sectors regulated under federal anti-money laundering law — money services, real estate, certain insurance activities, and others — having a compliance program isn't optional paperwork. It's a legal requirement, and regulators expect the program to actually function, not just exist on paper.

This article walks through the components a baseline anti-money laundering compliance program typically needs to include, so you know what you're building toward before you start.

Who Needs One

Businesses in the sectors that Canada's anti-money laundering framework designates as "reporting entities" — a defined list that includes money services businesses, certain real estate professionals, life insurance companies and intermediaries, securities dealers, casinos, and several other categories — are generally required to maintain a compliance program. If you're not sure whether your business falls into a regulated category, resolve that question first; the specifics of the program only matter once you know it applies to you.

The Core Components of a Baseline Program

A functioning compliance program generally needs to address each of the following:

• [ ] A designated compliance officer — a specific individual, which in a small business may be the owner, responsible for the program.
• [ ] Written compliance policies and procedures — documenting how your business identifies clients, assesses risk, and reports as required, rather than relying on informal practice.
• [ ] A documented risk assessment — an honest assessment of where your specific business is most exposed to money laundering or terrorist financing risk, considering your clients, products, delivery channels, and geography.
• [ ] An ongoing training program — for anyone in the business who deals with clients or transactions covered by the rules, not just a one-time onboarding session.
• [ ] A periodic effectiveness review — a review of whether the program is actually working, generally expected at a set interval and, depending on the size of the business, carried out by someone independent of the program's day-to-day operation.

Why "Written and Filed Away" Isn't Enough

Regulators reviewing a compliance program tend to ask not just whether a policy document exists, but whether it's actually being followed. A program that exists only on paper — never updated, never trained on, never tested — creates the appearance of compliance without the substance, and that gap is precisely what a regulatory review is designed to find.

Building a Program That Fits Your Business

A compliance program should be proportionate to your business's actual size and risk — a two-person money services business and a large multi-branch operation will reasonably have very different programs, even though both need to cover the same core components. Steps that generally help:

1. Confirm your reporting-entity status and which specific obligations apply to your sector.
2. Assign the compliance officer role explicitly, in writing.
3. Draft policies that reflect what your business actually does, rather than adapting a generic template you don't fully understand.
4. Schedule training and the periodic effectiveness review as recurring items, not one-time tasks.
5. Revisit the whole program whenever your business changes — new services, new locations, or new ownership can all change your risk profile.

Getting Help Building or Reviewing a Program

Many regulated businesses use a combination of legal advice, to confirm status and review the legal sufficiency of policies, and a compliance consultant, to help implement day-to-day procedures and training. For a business building its first program, starting with a lawyer to confirm scope and legal requirements is usually the more efficient first step.

Frequently asked questions