Bill C-12 received Royal Assent on March 26, 2026, raising FINTRAC penalties 40x and rewriting the compliance standard. Here's what every Canadian mortgage broker and principal broker needs to know and do.
On March 26, 2026, Bill C-12 - the Strengthening Canada’s Immigration System and Borders Act - received Royal Assent. Most of the public attention landed on the immigration provisions. Buried in Part 9 of the same statute was a full rewrite of Canada’s anti-money laundering regime, and it applies directly to every mortgage broker, agent, and administrator in the country.
Maximum AMPs for FINTRAC violations are now 40 times higher than they were a month ago. The compliance program standard has been rewritten. Compliance agreements are mandatory, and when a brokerage breaches one, FINTRAC must publish the order publicly with the brokerage’s name on it.
We wrote this for both principal brokers and individual agents. The rules cut across both roles, and where something applies mainly to one audience we flag it. This is not legal advice. If your compliance program needs a formal review, engage a firm that does AML work for a living.
| Violation tier | Old maximum | New maximum under Bill C-12 |
|---|---|---|
| Minor | $1,000 | $40,000 |
| Serious | $100,000 | $4,000,000 |
| Very serious | $500,000 | $20,000,000 |
The cumulative cap for multiple violations is now the greater of $20 million or three percent of the reporting entity’s gross global revenue, calculated at group level.
The “very serious” category was also expanded to include all compliance-program-related requirements - your policies, your risk assessment, your effectiveness testing. Gaps in any of those can now attract a maximum of $20 million.
This is the change most brokers will miss because it doesn’t produce a dollar figure. It matters more than the penalty increase.
Under the old regime, your compliance program had to be “intended to ensure” compliance. Under Bill C-12, it must be “reasonably designed, risk-based and effective.” FINTRAC can now penalize you when your program technically ticks every formal box but isn’t producing the outcomes the law expects.
Practically: policies on paper are no longer enough. Risk assessments have to be documented, current, and specific. Training has to be delivered and logged. Screening, monitoring, and reporting have to produce auditable records. Effectiveness testing - can your program actually catch what it’s supposed to catch? - is now something FINTRAC will look for.
When FINTRAC finds a prescribed violation, they must now require the reporting entity to enter into a compliance agreement identifying what went wrong, the corrective steps, and a deadline.
Refuse the agreement or miss the deadline and the Director of FINTRAC must issue a compliance order. Under subsection 73.17(4), that order must be made public - FINTRAC will publish it on their website with your brokerage’s name, the violation details, and the remediation required.
For a business whose primary marketing channel is referrals and reputation, this is catastrophic. Violating the compliance order itself triggers a maximum penalty of the greater of $30 million or three percent of gross global revenue.
Historically only money services businesses had to register. Bill C-12 extends the requirement to every reporting entity, including all mortgage brokers, agents, and administrators. FINTRAC will maintain a public roll. The statutory authority is now in place; the regulations prescribing the exact timing are not yet in force. Expect them within 12 to 18 months. Start preparing now.
This is where most brokers need practical guidance. FINTRAC’s written guidance is dense. Here’s the workable version.
Standard KYC applies to 85 to 90 percent of mortgage files. Verify the client’s identity using one of FINTRAC’s approved methods:
Record the method used, the supporting evidence, the date, and the person who performed the verification. Retain for five years. Make a third-party determination (is someone else providing instructions or funds?) and document the answer, even when no.
Under the new effectiveness standard, the quality of your records and your ability to retrieve them matters more than before.
EDD is triggered when the client falls into a higher-risk category:
Foreign PEPs (automatic), their family members, and close associates. Foreign PEPs are current or former holders of prominent public positions in foreign countries - heads of state, senior government officials, senior executives of state-owned enterprises, senior judicial officials, high-ranking military officers, senior party officials.
Domestic PEPs and heads of international organizations (HIOs) assessed as high-risk. Unlike foreign PEPs, not every domestic PEP triggers EDD - only those you assess as high-risk based on the circumstances.
Clients or relationships your risk assessment flags as high-risk for other reasons. Unusual geographic exposure, opaque ownership, transactions that don’t match the client’s profile, source of funds that can’t be explained.
When EDD is triggered:
For every new file:
The PCMLTFA uses “ongoing monitoring” rather than “continuous.” The obligation is risk-based. The practical reality is that continuous automated monitoring is the easiest way to satisfy the obligation defensibly. Relying on manual rescreens every six or twelve months means more work for a weaker audit trail.
Continuous AML screening, auditable record-keeping, documented risk-based workflows, and PEP identification at the file level used to be optional. Under Bill C-12, they’re operational baseline. This is why BrokerPlus integrated FINTRAC screening directly into the platform from day one. Every client gets screened at import and continuously after. Alerts route to the agent and principal broker. Records are retained in a format designed to survive a FINTRAC examination.
It won’t replace your compliance program - no software does - but it closes the biggest operational gap most Canadian brokerages face after Bill C-12.
The Bill received Royal Assent on March 26, 2026. Most AML provisions, including the increased penalty maximums and the new effectiveness standard, took effect immediately. Universal enrolment is enacted in statute but the regulations setting out exact mechanics and timing are not yet in force. Expect those regulations within 12 to 18 months.
For violations alleged before March 26, 2026, the previous version of Part 4.1 of the PCMLTFA continues to apply, meaning the old maximums govern. For violations on or after March 26, the new maximums apply. There’s a gray zone for ongoing violations that started before and continued after - most legal analysis suggests the new maximums apply only to the portion occurring on or after March 26, but this hasn’t been tested in court yet.
Standard KYC is identity verification using one of FINTRAC’s approved methods, a third-party determination, documented and retained. EDD adds senior management approval before the relationship is established, investigation of source of funds and source of wealth, and enhanced ongoing monitoring. Standard KYC takes minutes per file. EDD can take hours and produces a substantially larger documentation trail. The trigger is either a PEP designation or a high-risk flag from your own risk-based procedures.
Not yet. The statutory authority exists but the regulations aren’t in force. You should prepare: identify your compliance officer, update program documentation, make sure the information FINTRAC will ask for is ready. When the regulations come, you’ll want to enrol quickly rather than scramble.
A foreign PEP is someone who currently holds or has ever held a prominent public position in a foreign country. FINTRAC’s definition includes heads of state, senior government officials, senior executives of state-owned enterprises, senior judicial officials, high-ranking military officers, and senior party officials. The definition extends to family members (spouse, parents, children, siblings) and close associates (business partners, joint beneficial owners). Domestic PEPs are Canadian counterparts. HIOs are senior executives of bodies established by two or more states.
The PCMLTFA requires monitoring “commensurate with the risk.” For standard-risk clients, periodic rescreening is sufficient in theory - quarterly or semi-annually. In practice, the easiest defensible approach is automated continuous screening where your software checks every client against updated lists daily or weekly. For higher-risk clients including EDD cases, monitoring must be more frequent and more thorough, and results must be documented.
A compliance order is triggered when you refuse to enter into a compliance agreement or fail to comply with one. The order is made public on FINTRAC’s website with your brokerage’s name, the violation details, and the corrective measures required. Violating the compliance order itself triggers penalties of the greater of $30 million or three percent of gross global revenue for an entity. If FINTRAC requires a compliance agreement, engage legal counsel immediately and treat the remediation as your top operational priority.
This article is informational and does not constitute legal advice. If your brokerage needs a formal compliance program review, engage a Canadian AML-specialist law firm or a compliance consultancy with PCMLTFA experience.
Canadian mortgage brokers came into FINTRAC's regulatory perimeter in October 2024. The examination cycle is now. Here's what a FINTRAC examination actually looks like and how to prepare.
A working guide to AML, PEP, and sanctions screening for Canadian mortgage brokers post-Bill C-12. How the lists work, what the obligations are, and how to build a defensible workflow.
Most Canadian mortgage broker outreach fails because it's generic, untimed, and stops after one email. Here's how to build outreach that actually converts, and why the follow-up logic matters more than the first email.
A 45 minute walkthrough, lead intake to lender package. Nothing to install and nothing to prepare.
Get Ann's Digest, a weekly read on the Canadian mortgage market written for brokers. Rate moves, lender changes, and book opportunities that matter, in about five minutes.
BrokerPlusCanadian-built. Canadian-hosted.