Canadian MSB Compliance Officer as a Service — CAMLO, FINTRAC Reporting and Governance from €1,500 per Month
Every money services business registered with FINTRAC must appoint a compliance officer and implement a five-element compliance programme — whether or not it processes a single transaction. Equilex provides that function on a fractional basis: a named compliance officer, reporting to FINTRAC, a written programme, an annual risk assessment, staff training and the two-year effectiveness review, for a fixed monthly fee starting at €1,500. The programme applies to active and dormant registrations alike.
Reviewed by Oksana Krasilnikova, Head of AML Compliance
Last reviewed:
Entry price
From €1,500 per month
Onboarding
From 10 business days
At a glance
| Item | Detail |
|---|---|
| Service | Outsourced Chief Anti-Money Laundering Officer (CAMLO) function and FINTRAC compliance programme |
| Regulator | FINTRAC — Financial Transactions and Reports Analysis Centre of Canada |
| Legislation | Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) and its regulations |
| Entry price | From €1,500 per month |
| Minimum term | 12 months, billed quarterly |
| Onboarding time | From 10 business days |
| Suitable for | Registered MSBs and foreign MSBs, operating, pre-launch or dormant |
| Deliverables | Named compliance officer, written policies, risk assessment, training, reporting, two-year effectiveness review |
| Not included | Legal representation, audit opinion, tax and accounting, transaction-monitoring software licences |
What is a CAMLO, and why does FINTRAC require one?
A CAMLO (Chief Anti-Money Laundering Officer) — the Canadian equivalent of an MLRO in the UK and the EU — is the individual a reporting entity appoints to implement its anti-money-laundering compliance programme. The appointment is neither voluntary nor a formality: FINTRAC treats the absence of an effective compliance officer as a violation in itself, and examines the programme that officer is supposed to lead.
Under the PCMLTFA, a compliance programme has five required elements. All five must exist, be documented, and be capable of surviving an examination:
| # | Element | What FINTRAC expects to see |
|---|---|---|
| 1 | Appointed compliance officer | A named individual with the authority and resources to implement the programme |
| 2 | Written policies and procedures | Documented, current, and approved by senior management |
| 3 | Risk assessment | Documented assessment of clients, products, delivery channels, geography and new technologies, informed by the National Risk Assessment |
| 4 | Training programme | Written, ongoing, delivered to everyone who handles transactions or clients |
| 5 | Effectiveness review | A review of the whole programme carried out at least every two years |
Dormant does not mean exempt
This is the point most MSB owners get wrong, and it is expensive.
A registered MSB that has not processed a single transaction still carries ongoing obligations. The registration must be maintained and renewed every two years. Changes to registration information must be reported to FINTRAC promptly. A compliance programme must be in place, documented and maintained. The risk assessment must be kept current. The effectiveness review still falls due every two years. An inactive registration does not put an entity outside FINTRAC's scrutiny.
Reporting is the only part that genuinely goes quiet: with no transactions there is nothing to report, and FINTRAC does not require nil returns. Everything else continues.
| Obligation | Frequency | Applies to a dormant MSB? |
|---|---|---|
| Registration kept current and renewed | Every two years | Yes |
| Notify FINTRAC of changes to registration information | On change | Yes |
| Appointed compliance officer in place | Continuous | Yes |
| Written policies and procedures kept up to date | Continuous, reviewed annually | Yes |
| Risk assessment | Maintained and updated | Yes |
| Training programme | Ongoing | Yes, scaled to headcount |
| Effectiveness review | Every two years | Yes |
| Record keeping | Five years | Yes, for whatever records exist |
| Transaction reports (STR, LCTR, EFTR, LVCTR) | Per transaction | Only if transactions occur |
The practical consequence: an MSB registered or acquired and then left idle for eighteen months while banking is arranged is not dormant in FINTRAC's eyes. It is a reporting entity with an unmaintained compliance programme.
Can the compliance officer function be outsourced?
Partly, and the distinction matters — so here is the honest version rather than the marketing one.
The reporting entity, not the service provider, remains responsible for its compliance programme. That responsibility cannot be contracted away. What can be arranged is who performs the work and who is appointed to the role. Equilex operates two models:
| Model | How it works | When it fits |
|---|---|---|
| Appointed CAMLO | An Equilex compliance specialist is formally appointed as the entity's compliance officer, with a written mandate, defined authority and direct reporting to the board or owner. | Entities with no suitable internal candidate — typically dormant, pre-launch or small operations |
| CAMLO support / deputy function | Your own director or manager holds the appointment. Equilex runs the programme underneath: policies, reporting, risk assessment, training, review preparation and regulator correspondence. | Entities with an owner or director willing to hold the role but no compliance capacity |
In both models the mandate, the escalation path and the division of responsibilities are set out in writing at the start — which is itself one of the documents FINTRAC will ask to see.
What is included
The compliance officer function
- A named compliance specialist assigned to your entity, with a documented mandate and defined authority
- Direct point of contact for FINTRAC correspondence and information requests
- Escalation and decision record for suspicious activity and high-risk client decisions
- Quarterly compliance report to the board or owner
Programme documentation
- Written AML/CFT policies and procedures tailored to your services and jurisdictions, kept current
- Documented risk assessment covering clients, products, delivery channels, geography and technology
- Ministerial directives, sanctions and PEP screening procedures
- Record-keeping and retention procedures on the five-year standard
Reporting and monitoring
- Preparation and submission of reports to FINTRAC through your reporting account
- Transaction monitoring rules and alert-handling procedure (software licensed separately)
- Sanctions and adverse-media screening workflow
- Reporting log and audit trail maintained for examination
Governance and upkeep
- Registration monitoring, change notifications and two-year renewal
- Written, ongoing training programme with delivery records
- Two-year effectiveness review, either performed independently or prepared for an external reviewer
- Examination support: document pack, response drafting and remediation planning
Reports we prepare and file
| Report | Trigger | Deadline |
|---|---|---|
| Suspicious Transaction Report (STR) | Reasonable grounds to suspect ML/TF, completed or attempted | As soon as practicable after the assessment is complete |
| Large Cash Transaction Report (LCTR) | CAD 10,000 or more in cash, including the 24-hour rule aggregation | Within the prescribed period after the transaction |
| Electronic Funds Transfer Report (EFTR) | International EFT of CAD 10,000 or more, in or out | Within the prescribed period |
| Large Virtual Currency Transaction Report (LVCTR) | Virtual currency received of CAD 10,000 or more, with 24-hour aggregation | Within the prescribed period |
| Terrorist Property Report (TPR) | Property owned or controlled by a listed person or entity | Immediately |
Deadlines above are summarised; the operative timing rules are set out in the PCMLTFA regulations and in FINTRAC guidance, and are applied case by case.
The two-year cycle
Two separate obligations run on a two-year clock, and they do not run in step. Missing either is a documented FINTRAC violation, and both are easy to miss when nobody owns the calendar.
| Cycle | What is due | What Equilex does |
|---|---|---|
| Registration renewal | Renewal of the MSB registration with FINTRAC, plus notification of any change to registered information | Tracks the date, prepares and submits the renewal, keeps the registration record current |
| Effectiveness review | A review testing whether the compliance programme actually works, at least every two years, started no later than 24 months after the previous one began | Performs the review, or prepares the entity and its documentation for an independent reviewer |
Source: FINTRAC MSB registration
What non-compliance actually costs
FINTRAC publishes the administrative monetary penalties it imposes, and the amounts have moved sharply. Recent MSB penalties range from tens of thousands of dollars for a handful of violations to CAD 176.9 million imposed on Xeltox Enterprises Ltd. (Cryptomus) in 2025 for over 2,500 violations. Legislative changes given royal assent in 2026 raised the ceiling for very serious violations dramatically, into the tens of millions for entities.
The exposure that matters for a small or dormant MSB is not the headline number. It is that penalties are assessed per violation, that a missing compliance programme generates several violations at once, and that FINTRAC names penalised entities publicly — which ends banking relationships faster than the fine itself.
Who this service is for
- Owners of registered Canadian MSBs that are not yet trading and need the registration kept clean and examination-ready
- MSBs that have just been acquired and inherited an undocumented or out-of-date compliance programme
- Operating MSBs whose compliance officer has resigned, or whose founder is holding the role without the time to do it
- Foreign money services businesses (FMSBs) directing services at Canadian clients
- Crypto and payment firms holding a Canadian MSB registration alongside licences in other jurisdictions
- Groups holding several registrations that want one provider, one calendar and one reporting standard across all of them
Pricing
| Plan | For | Price |
|---|---|---|
| Maintenance | Registered but dormant or pre-launch. Programme upkeep, registration cycle, training records, annual risk-assessment refresh, examination readiness. | From €1,500 / month |
| Operating | Live transaction flow. Everything in Maintenance plus ongoing reporting, alert handling, client escalations and quarterly board reporting. | From €2,700 / month |
| Enhanced | Higher-risk profiles — virtual currency, high volume, complex geography. Dedicated officer time, expanded monitoring and more frequent governance reporting. | From €4,500 / month |
One-off engagements
| Engagement | Price |
|---|---|
| Compliance programme build from scratch (policies, risk assessment, training and related documents) | From €2,500 |
| Two-year effectiveness review | From €1,900 |
| Compliance health check and gap analysis | From €700 |
| FINTRAC examination support and remediation | Quoted per case |
| MSB registration or renewal handled as a standalone task | From €11,900 / €700 |
Multi-entity discounts apply. Full price list on request.
How onboarding works
| Step | What happens | Typical duration |
|---|---|---|
| 01 Review | You share the registration details, corporate structure, intended or actual activity and any existing compliance documents. | 2–3 days |
| 02 Gap analysis | Equilex maps what exists against the five required elements and reports what is missing or out of date. | 3–5 days |
| 03 Proposal and mandate | Plan, fee and model — appointed CAMLO or support function — are confirmed and the written mandate is signed. | 2–3 days |
| 04 Remediation | Missing policies, risk assessment and training material are produced; registration data is corrected. | 2–4 weeks |
| 05 Steady state | Monthly operation begins: reporting, monitoring, calendar management, quarterly governance reporting. | Ongoing |
Why Equilex
- We register and sell Canadian MSBs, so we know what the file looks like from the day it is created — and what FINTRAC finds when nobody has touched it since.
- Lawyers and compliance specialists in-house; the policies you receive are drafted, not downloaded.
- Licensing and compliance work across 19 jurisdictions, including Canadian MSB, US MSB, MiCA CASP, Hong Kong MSO and EU payment institutions.
- Offices in Hong Kong and Warsaw, serving clients across the EU, North America and Asia.
- One provider for the registration, the entity and the ongoing compliance function — no handover gap between the two.
Related: register a Canadian MSB, crypto licensing across 19 jurisdictions and CASP as a Service in the EU.
Frequently asked questions
A CAMLO is the Chief Anti-Money Laundering Officer — the individual a Canadian reporting entity appoints to implement its compliance programme under the PCMLTFA. It is the Canadian equivalent of the MLRO used in the UK and EU.
Yes. The obligation attaches to the registration, not to transaction volume. A registered MSB with no activity must still have an appointed compliance officer, a documented programme, a current risk assessment, training and a two-year effectiveness review.
The work can be outsourced and an external specialist can be appointed to the role, but responsibility for the compliance programme stays with the reporting entity. Equilex documents the mandate and the division of responsibilities in writing at the outset.
From €1,500 per month for a dormant or pre-launch registration, covering the compliance officer function, programme upkeep, training records, risk-assessment refresh and the registration cycle. Operating entities are priced on volume and risk profile.
At least every two years. FINTRAC expects the next review to begin no later than 24 months after the previous one started, so the clock runs from the start date, not the completion date.
Every two years, and changes to registered information must be reported to FINTRAC promptly. A lapsed registration means the business is no longer registered — which is itself a serious problem if it is still holding itself out as an MSB.
No. FINTRAC does not require nil returns. Reporting obligations are transaction-driven; the programme, registration, training and review obligations are not.
Suspicious Transaction Reports, Large Cash Transaction Reports, Electronic Funds Transfer Reports, Large Virtual Currency Transaction Reports and Terrorist Property Reports, filed through your FINTRAC reporting account.
Equilex assembles the document pack, drafts responses, attends the process alongside you and prepares any remediation plan. Examination support is included in the monthly plans for issues arising from the period we have been engaged.
No. FINTRAC does not impose a residency requirement on the compliance officer, but it does expect the officer to have genuine authority, availability and knowledge of the business. Equilex confirms the workable arrangement for your structure during the review stage.
Yes. Most engagements start with an inherited or lapsed programme. The gap analysis in step 02 establishes what is usable and what has to be rebuilt.
Yes. Multiple entities are run on one calendar and one documentation standard, with per-entity records kept separate. Multi-entity pricing applies.
Ready to get started?
Discuss your license and timeline with our team. We'll get back to you within 24 hours.
Latest on compliance
All articlesAML & Compliance
AUSTRAC Registration Requirements: Who Needs to Register in Australia in 2026
August 13, 2026 · 8 min read
AML & Compliance
EU AMLR Applies from July 2027: What EMIs, Payment Institutions and CASPs Must Change in the Next 12 Months
July 16, 2026 · 8 min read
AML & Compliance
APRA Governance Standards: New Rules Proposed for Australia's Financial Sector
June 17, 2026 · 5 min read