FINTRAC compliance is not one obligation — it is nine or ten separate, connected pieces that have to work together as a file. Build them in this order, and each later piece has something real to plug into.
Key takeaways
STEP 01 OF 10
Start the kit by confirming what you actually are under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act: a real estate broker or sales representative is anyone “authorized under provincial legislation to act as an agent for purchasers or vendors in respect of a purchase or sale of real property.” This is a separate category from a real estate developer, which is defined by a sales-volume threshold and is, once triggered, permanently a reporting entity going forward. Build your compliance file around the agent obligations specifically — a buyer or seller counterparty who happens to also be a developer is a fact to notice, not a role you take on yourself.
STEP 02 OF 10
See the client identification workflow guide for the full five-method breakdown for individuals and three for entities. Nothing else in this kit works without a properly identified client on file — the STR trigger, the business-relationship record, and the beneficial-ownership check all assume identification has already happened correctly.
STEP 03 OF 10
For any corporate or trust buyer, identify anyone who owns or controls at least 25%, and separately screen for politically exposed persons. A domestic PEP designation lasts five years after leaving office; a foreign PEP designation never expires. All foreign PEPs, and their family members and close associates, are automatically treated as high-risk with no separate risk assessment needed to reach that conclusion — domestic PEPs require an individual risk assessment first.
STEP 04 OF 10
An STR is required once you have “reasonable grounds to suspect” — a possibility standard, not a certainty standard, tested against whether “another person with similar knowledge and training would likely reach the same conclusion.” There is no fixed deadline, only “as soon as practicable,” with delay requiring a documented reason. The same guidance is direct about tipping off: you may not inform anyone, including the client, that a report has been or will be made, if doing so would prejudice an investigation — and you should not let your own diligence questions become the tell.
STEP 05 OF 10
A Large Cash Transaction Report is required at $10,000 or more in a single transaction, filed within 15 calendar days. The rule most cash processes miss: the 24-hour aggregation rule requires a report where two or more cash payments together reach $10,000 within a consecutive 24-hour window, from or on behalf of the same person. See the worked example below for exactly how that plays out — a process that only flags single payments at or above $10,000 will miss a structured pair of smaller ones.
STEP 06 OF 10
Real estate is unusual here: the business-relationship record is triggered at the first time you are required to verify a client’s identity — not after a second transaction inside a window, the way it works for casinos and financial entities. Record the purpose and intended nature of the relationship as soon as identification happens, and use it going forward for ongoing monitoring — the point of the record is to help you recognize what is unusual for this specific client.
STEP 07 OF 10
FINTRAC retention runs five years, but the clock starts on different days by record type — see the record retention schedule guide for the full breakdown, including how the FINTRAC clock interacts with the Income Tax Act’s separate six-year rule on the same underlying file.
STEP 08 OF 10
FINTRAC publishes 33 specific indicators for real estate. A few worth building directly into an intake script: a client who “negotiates a purchase for the market value or above the asked price, but requests that a lower value be recorded on documents, offering to pay the difference ‘under the table’”; one who purchases without ever viewing the property; one who insists on signing only by fax; or one whose contact number is disconnected. Train the team on the actual published language, not a paraphrased version — the specific wording is what a reviewer will expect to see reflected in your own notes.
STEP 09 OF 10
FINTRAC’s administrative monetary penalties run in three tiers: minor ($1–$1,000 per violation), serious ($1–$100,000 per violation), and very serious, where the entity maximum reaches $500,000 per violation. Publication of every imposed penalty is mandatory, not discretionary. The AMP regime is also not the only exposure: the Act itself creates a separate criminal offence for knowingly failing to file a required report, and it runs far higher than any AMP — under section 75, a conviction on indictment carries a fine of up to $20,000,000, imprisonment for up to five years, or both. AMPs and criminal charges are not alternatives to each other — FINTRAC can refer the same non-compliance for prosecution regardless of any administrative penalty already assessed. See the worked example for what a handful of minor violations can add up to even before reaching the serious tiers — and note this is a completely separate regime, with separate numbers, from RECO’s own discipline fines covered in the complaint response guide.
STEP 10 OF 10
No fetched FINTRAC source states a required review frequency for a small real estate brokerage’s compliance programme specifically — treat this as an open item rather than assuming a specific mandated cycle. In the absence of a stated requirement, an annual review of the identification, retention, and red-flag training pieces against this kit is a reasonable operating discipline, not a stated legal minimum — label it as a practice choice if you document it, not as a cited FINTRAC deadline.
A buyer pays $6,000 in cash toward a deposit in the morning, then returns the same day with a further $5,500 in cash.
$6,000 + $5,500 = $11,500 within the same 24-hour window — over the $10,000 threshold, so an LCTR is required even though neither individual payment reached $10,000 on its own.
Now the AMP arithmetic. Suppose a compliance review finds four separate minor violations — incomplete fields on four identification records, for instance — each drawing a penalty near the top of the minor tier.
4 violations × up to $1,000 each = up to $4,000 in combined exposure — still well inside the minor tier, and a useful illustration of why the tiers exist: a handful of paperwork gaps costs low four figures, not the $500,000 top-tier figure most agents associate with a “FINTRAC violation” in the abstract.
Both scenarios use declared, illustrative numbers — the point is the mechanism, not a claim about any specific file. The aggregation rule and the AMP tiers themselves are the real, sourced facts; the dollar amounts in this example are scenario parameters chosen to make the arithmetic concrete.
Every piece of this starter kit is federal law and identical in every province. What genuinely differs is the separate, provincial regulatory layer that sits alongside it — and that layer changes how confidential client information gathered during FINTRAC identification can be shared internally.
| Province | The additional layer | What it adds on top of FINTRAC |
|---|---|---|
| Ontario | RECO Bulletin 2.5 requires that brokerage administrative and support staff who might access confidential client information — which includes identification and beneficial-ownership data — be governed by internal policies on password and email access. | A specific, named regulatory expectation about internal access controls for the same data FINTRAC requires you to collect. |
| Alberta | RECA’s Real Estate Act Rules govern the brokerage’s conduct separately, without an equivalent confidentiality bulletin fetched for this guide. | Confirm Alberta’s own internal-access expectations directly with RECA rather than assuming Ontario’s Bulletin 2.5 language applies there. |
The identification methods, the AMP tiers, the STR and LCTR triggers — none of that changes by province. What should change is which provincial regulator’s own confidentiality and access-control expectations you layer on top of the federal file once it is built.
No — there is no small-practice or part-time exemption in the identification, reporting, or record-keeping obligations. The obligation attaches to the role, not the transaction volume.
Yes — the threshold is $10,000 or more, not strictly above it. Combined with the 24-hour aggregation rule, this means a process built around “is any single payment over $10,000” will miss both an exact-threshold single payment framed as “not over” and a structured pair of smaller ones.
No — the tipping-off prohibition bars informing anyone, including the client, of the report or your intent to file it, where doing so would prejudice an investigation.
No — they are separate regulators with separate maximums. FINTRAC’s top tier reaches $500,000 per violation for an entity; RECO’s Discipline Committee fines top out at $50,000 for an individual and $100,000 for a brokerage. Never merge the two into one number.
A structured build-out of all nine pieces, sequenced so each later step has something real to plug into.
