A policy manual that hasn't been touched since it was written isn't a compliance document anymore. It's an artifact of whenever the last update happened to be.
Key takeaways
A policy manual is not a document a brokerage writes once and files away. It is supposed to be a live record of how the brokerage actually complies with the law that governs it today — which means it needs its own maintenance schedule, not just an initial drafting date.
RECO’s own staff-training resource names the governing statute directly: brokerage staff training exists to help people “understand the law regulating the real estate sector in Ontario, Trust in Real Estate Services Act, 2002 (TRESA) and its implications for brokerages.” That same page states plainly that while administrative staff support compliance day to day, “brokers of record bear ultimate responsibility.” A policy manual that has not been checked against TRESA and RECO’s current rules in some time is, functionally, describing an earlier version of the law.
FINTRAC’s five-element compliance programme requirement is explicit about currency, not just existence. Element two requires a business to “develop and apply written compliance policies and procedures that are kept up to date and… are approved by a senior officer.” Element five requires the business to “institute and document a plan for a review of the compliance program for the purpose of testing its effectiveness, and carry out this review every two years at a minimum.” Read together, those two elements mean the manual is not compliant simply by existing — it has to be revisited on a documented cycle, with sign-off from someone senior, and the review itself has to be written down even if it concludes nothing needs to change. FINTRAC’s own penalty guide treats skipping that review altogether as complete non-compliance, carrying a base administrative penalty of $100,000 before any mitigating factors are weighed — the same order of exposure as never writing the policies in the first place.
Ontario’s Annual Financial Filing regime is a concrete, dated example of exactly the kind of change a manual has to absorb. RECO states the regime is effective October 1, 2026, and its own submission page gives the precise trigger: “Annual financial filings for fiscal year ends on or after August 1, 2026, are due no later than 90 days after the brokerage’s fiscal year end date,” with “an attestation by the broker of record to confirm that all information submitted is factual and accurate.” A manual last updated before this regime existed does not describe the brokerage’s actual current filing obligation, and the attestation requirement means the broker of record is personally signing off on accuracy — a strong reason not to be working from an outdated internal process when that deadline arrives.
FINTRAC’s effectiveness-review cycle and RECO’s continuing-education cycle both run on two years, which invites confusing the two — they are not the same requirement. RECO states registrants must complete “two mandatory annual update courses… [and] two elective courses” across each two-year registration cycle, a personal licensing requirement tied to an individual registrant’s renewal date. FINTRAC’s two-year clock is a business-level requirement to test and document the effectiveness of the brokerage’s AML compliance programme as a whole, tied to whenever the last review was completed. A manual that tracks only one of the two, or merges them into a single “every two years” note, will miss whichever one it dropped.
The maintenance discipline that actually works treats the manual as the single home for both cycles: a dated log of the last FINTRAC effectiveness review and its documented conclusion, and a separate note of where each registrant sits in their own CE cycle. Complaint-handling procedures — see handling a client complaint at the firm level — and record-retention schedules — see a deal-file retention schedule — belong in the same document for the same reason: a manual that only states the rules but never records when it was last checked against them is not distinguishable, from the outside, from one nobody has opened in years.
A manual is not only a compliance artifact — it is usually the first document a new registrant or staff member is actually handed. See a brokerage onboarding programme for how that first exposure sets the standard a new hire assumes is current practice; handing someone a manual that predates the Annual Financial Filing regime, or a FINTRAC review that never happened, teaches the wrong baseline from day one, in a way that is far harder to correct later than it would have been to simply keep the document current.
A brokerage documented its last FINTRAC effectiveness review on September 14, 2024. Applying the “every two years at a minimum” rule, the next review is due no later than September 14, 2026 — a date worth calendaring the moment the prior review is filed, not tracked from memory two years later.
Separately, the same brokerage’s fiscal year ends December 31, 2026 — a fiscal year end on or after August 1, 2026, so the new Annual Financial Filing regime applies. Ninety days after December 31, 2026 lands on March 31, 2027. The two dates — September 14, 2026 for the compliance-programme review, and March 31, 2027 for the financial filing — sit less than six months apart but answer to two entirely different obligations, one federal and AML-focused, one provincial and financial. A manual that tracked only one would leave the brokerage current on paper and still exposed on the other.
The pages checked live don't name a mandated manual template — RECO's own brokerage resources point to a trust-reconciliation tutorial video, a reconciliation template, and a monthly compliance checklist (see RECO’s brokerage administration resources), which are components a manual should reference rather than a full manual format RECO itself publishes.
For the AML/compliance-programme section specifically, FINTRAC requires the written policies to be “approved by a senior officer”; for the rest of the manual, RECO's own framing puts ultimate accountability on the broker of record, per RECO’s staff-training guidance and Bulletin 1.2’s duty-to-comply language.
Document that conclusion anyway — FINTRAC's requirement is to “institute and document a plan for a review… for the purpose of testing its effectiveness,” and a dated record stating the review was conducted and no changes were required satisfies that obligation more defensibly than no record of a review having happened at all.
A 30-minute call is enough to tell you whether your two review clocks are actually being tracked.
