Canada’s financial intelligence unit has sent a pointed warning to the credit union sector. On 24 September 2026, the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) imposed administrative monetary penalties on four Canadian credit unions, totalling $816,750.
According to Alessa, the fines followed compliance examinations that uncovered failings in risk assessments, ongoing monitoring, compliance policies and suspicious transaction reporting.
The message is that written policies are no longer enough. Institutions must now show that their anti-money laundering (AML) controls are applied consistently and deliver results in practice.
Although the four cases differed, several shared weaknesses emerged. The first concerned risk assessments. FINTRAC found assessments that were incomplete, poorly documented or disconnected from daily compliance work, and some failed to capture an institution’s true exposure or shape how monitoring was carried out.
Compliance teams are being urged to treat the risk assessment as a living document, revisiting it whenever products, membership or risk exposure shift, and ensuring identified risks feed directly into monitoring rules, review cycles and investigative priorities.
The second theme was a gap between procedure and practice. Regulators pointed to missed ongoing customer reviews, incomplete customer information and uneven application of monitoring requirements. Even well-designed procedures offer little protection when operational pressures cause steps to be skipped. Tracking overdue reviews, assigning clear ownership and building escalation routes are among the recommended fixes.
Alert management formed the third concern. Unresolved alerts, incomplete transaction assessments and thinly documented conclusions make it harder to spot suspicious activity or recognise when reporting obligations apply. For smaller teams under rising alert volumes, the temptation to clear queues quickly can mean genuine risks slip through. Standardised investigation workflows, risk-based prioritisation and regular review of false positive rates can help balance speed with quality.
Finally, documentation and effectiveness reviews came under scrutiny. In one case, an AML effectiveness review missed weaknesses that FINTRAC later found during its examination. Reviews must test whether controls work, not merely confirm that policies exist, and records should clearly explain what risks were identified, what action was taken and why.
The penalties land in a period of unprecedented enforcement. FINTRAC issued 35 notices of violation in the 2025-26 fiscal year, its highest annual total, with penalties exceeding $247m across reporting entities. Exam readiness is therefore becoming a continuous discipline rather than a last-minute exercise.
The path forward rests on four priorities: revisiting the risk assessment, testing whether procedures work on the ground, reviewing investigation effectiveness and making oversight measurable through clear indicators and tracked corrective actions.
Ultimately, regulators will judge AML programmes on whether they surface meaningful risks and support sound decisions, not on the volume of policies or the sophistication of the technology behind them.
Read the full Alessa post here.
Copyright © 2026 RegTech Analyst
Copyright © 2026 RegTech Analyst
