A working guide to AML, PEP, and sanctions screening for Canadian mortgage brokers post-Bill C-12. How the lists work, what the obligations are, and how to build a defensible workflow.
Until October 2024, most Canadian mortgage brokers had never run an AML screen in their life. The industry was outside FINTRAC’s regulatory perimeter, and client identity verification was something lenders worried about, not brokers.
That changed 18 months ago, and it changed again when Bill C-12 received Royal Assent in March 2026. Maximum penalties for AML violations are now 40 times higher, the compliance standard has been rewritten to require programs that are “reasonably designed, risk-based and effective,” and FINTRAC now publishes compliance orders publicly. Screening is no longer optional, and it’s no longer something you can do once at onboarding and forget.
This is a working guide for brokers and principal brokers who need to build a defensible screening workflow.
When a broker platform runs an AML screen, it checks the client against several data sources. The three that matter most:
Government and international lists naming individuals, entities, and sectors that financial institutions cannot do business with. For Canadian brokers the relevant regimes include:
A hit on an active sanctions list is not a judgment call. The transaction cannot proceed. You also have reporting obligations under the Listed Persons and Entities Property Reporting regime.
PEPs aren’t people you can’t do business with - they’re people who require enhanced due diligence because their position creates elevated money laundering and corruption risk.
FINTRAC distinguishes:
For foreign PEPs, EDD is automatic. For domestic PEPs and HIOs, EDD is required only when you assess the client as high-risk based on specific circumstances.
News coverage that might indicate financial crime, corruption, or reputational risk. Credible coverage of fraud, money laundering, or serious misconduct is a flag even when no formal sanctions or PEP designation exists.
FINTRAC guidance doesn’t explicitly mandate adverse media screening. But under the new “effectiveness” standard in Bill C-12, a program that ignores it is weaker than one that includes it. Basic adverse media covers major sources and formal proceedings. Extensive covers civil proceedings, investigative journalism, and international outlets.
This is the question most brokers get wrong. Not just at onboarding. Ongoing, at a frequency proportional to risk.
The PCMLTFA uses “ongoing monitoring commensurate with the risk.” In practice:
The most operationally efficient approach is continuous automated monitoring, where your software checks every active client against updated lists daily or weekly. Good systems produce an audit trail automatically and alert you only when a new hit appears. Under Bill C-12’s effectiveness standard, an 11-month gap between annual rescreens is not a defensible position.
A screening result typically comes back in one of four states:
Clear. No hit. Document, file, move on.
Possible match. Name matches but other identifiers don’t. The most common result - common names produce false positives. Investigate: confirm date of birth, nationality, residence. Document the investigation and conclusion.
Confirmed sanctions match. Stop. Transaction cannot proceed. Engage counsel immediately.
Confirmed PEP match. Classify the type. Foreign PEP triggers automatic EDD. Domestic PEP or HIO triggers EDD only if your risk assessment flags high risk.
The quality of your documentation on possible-match and PEP cases is what defines an effective program under the new standard. These are the cases a FINTRAC examiner will scrutinize.
When EDD is triggered, obligations escalate:
Step 1: Senior management approval. Before establishing or continuing the relationship. Not a rubber stamp. The approver sees the risk assessment, screening results, investigation notes, and context. Approval is documented and retained.
Step 2: Source of funds. Where is the money for this transaction coming from? Employment income? Sale of an asset? Inheritance? Each answer requires supporting evidence.
Step 3: Source of wealth. Broader question. How did the client accumulate the wealth being deployed? A mid-career Canadian professional with standard income is one thing. A client whose stated source is “family business in Eastern Europe” requires more detailed inquiry and substantial evidence.
Step 4: Enhanced ongoing monitoring. Standard monitoring isn’t sufficient. Transactions reviewed more frequently. Sanctions and PEP data rechecked more often. Any changes in client circumstances trigger fresh assessment.
Step 5: Documentation. Every step generates a record. Retained for at least five years, retrievable on request. Under Bill C-12’s public disclosure regime, a brokerage whose EDD documentation can’t withstand scrutiny is courting a published compliance order.
The workflow in a well-built broker platform:
Principal broker sees a dashboard of overall compliance posture: files awaiting review, EDD cases in progress, senior approvals, open flags.
This is how BrokerPlus handles it. Initial screening is automatic. Ongoing monitoring runs continuously in the background. Agents only see alerts when they need to act. Principal brokers see the rollup. Records retain themselves.
The alternative is manual: spreadsheets tracking rescreens, email threads managing EDD, paper files for records. This worked in 2023. It doesn’t work under Bill C-12.
Rough benchmarks for the Canadian market:
On a brokerage with 500 active clients, full continuous monitoring runs $20 to $100 per month depending on depth and vendor. The cost of a single FINTRAC violation under Bill C-12 is orders of magnitude higher. The math is not close.
BrokerPlus includes the first 10 standard screenings per agent at no additional cost, with standard screenings at 75 cents each after and extensive at $1.50 each. Continuous ongoing monitoring is included in the flat subscription.
Yes, as of October 11, 2024, mortgage brokers, agents, and administrators are reporting entities under the PCMLTFA. Every business relationship requires identity verification, and FINTRAC’s guidance strongly indicates screening against sanctions and PEP lists is part of meeting those obligations. Whether “screening” in the strict software sense is a technical requirement is a nuanced legal question, but the practical answer is: running a proper AML and PEP screen at onboarding is the industry standard, the easiest defensible way to meet your obligations, and far cheaper than a FINTRAC penalty.
Standard covers the core databases: sanctions, PEP, and basic adverse media. Extensive adds deeper adverse media coverage (more news sources, civil proceedings, investigative journalism) and sometimes additional watchlists. For most standard-risk clients, standard screening is sufficient. For higher-risk clients, EDD cases, or any file where your risk assessment flags elevated concern, extensive screening is a better fit. Many brokerages use standard as the default and escalate to extensive when indicated.
No. For foreign PEPs, EDD is automatic. For domestic PEPs and HIOs, EDD is required only when you’ve assessed the client as high-risk based on specific circumstances. A mid-level domestic civil servant dealing in a standard refinance is different from a senior domestic political figure with international business connections. Your risk assessment - documented - determines which path applies. If in doubt, escalate.
Under Bill C-12, a failure to meet screening obligations can be classified as a “very serious” violation, which carries a maximum AMP of $20 million. Actual penalties depend on scale, the brokerage’s overall compliance posture, and whether the failure was systemic or isolated. The more immediate concern is the mandatory compliance agreement framework: FINTRAC must now require a compliance agreement after a prescribed violation, and breaching that agreement produces a public order with your brokerage’s name on FINTRAC’s website. Reputational damage compounds the financial penalty.
Five years from when the record was created or obtained. Applies to all FINTRAC-required records, including screening results, KYC documentation, third-party determinations, and EDD materials. Under the new effectiveness standard, “retained” also means retrievable - if you have the records but can’t produce them in a reasonable timeframe during an examination, that’s a deficiency.
Depends on the platform. Finmo has FINTRAC-ready workflows built into origination, including digital ID verification and PEP screening. Most other Canadian mortgage broker CRMs don’t include integrated screening, so brokerages using them either layer on a separate compliance tool or pay a compliance vendor per screen. BrokerPlus integrates screening alongside the deal intelligence features. The right answer depends on the existing stack; the wrong answer is assuming your current tools handle this when they don’t.
Three things. Continuous monitoring detects changes (new sanctions designations, new PEP flags, new adverse media) within days rather than months. It produces a richer audit trail - every check logged, every change timestamped. And it removes the operational burden from agents, who would otherwise need to remember to rescreen on a schedule. Under Bill C-12’s effectiveness standard, continuous monitoring is easier to defend because you can show the program doesn’t depend on a manual action that might be forgotten.
Canadian mortgage brokers came into FINTRAC's regulatory perimeter in October 2024. The examination cycle is now. Here's what a FINTRAC examination actually looks like and how to prepare.
Bill C-12 received Royal Assent on March 26, 2026, raising FINTRAC penalties 40x and rewriting the compliance standard. Here's what every Canadian mortgage broker and principal broker needs to know and do.
Most Canadian mortgage broker outreach fails because it's generic, untimed, and stops after one email. Here's how to build outreach that actually converts, and why the follow-up logic matters more than the first email.
A 45 minute walkthrough, lead intake to lender package. Nothing to install and nothing to prepare.
Get Ann's Digest, a weekly read on the Canadian mortgage market written for brokers. Rate moves, lender changes, and book opportunities that matter, in about five minutes.
BrokerPlusCanadian-built. Canadian-hosted.