On September 24th, 2026, the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) announced administrative monetary penalties against four Canadian credit unions, totaling $816,750. The penalties followed compliance examinations that identified weaknesses in areas including risk assessments, ongoing monitoring, compliance policies and suspicious transaction reporting.
For credit unions, these FINTRAC penalties are more than a reminder of regulatory obligations. They highlight a fundamental challenge facing anti-money laundering (AML) compliance teams: having the right policies and controls is only part of the equation. Institutions must also demonstrate that those controls are consistently applied and effective in practice.
As FINTRAC increases its enforcement activity, teams should take this opportunity to evaluate whether their AML programs are delivering the outcomes they were designed to achieve.
Key Highlights
- FINTRAC penalized four Canadian credit unions a combined $816,750 on September 24th, 2026, following compliance examinations.
- Examiners found weaknesses in risk assessments, ongoing monitoring, compliance policies and suspicious transaction reporting.
- Several findings reflected gaps between written procedures and day-to-day practice, including missed customer reviews and incomplete client information.
- In one case, an effectiveness review failed to catch weaknesses that FINTRAC later identified during its examination.
- FINTRAC issued 35 notices of violation in 2025–26, the most in its history, with penalties totalling more than $247 million.
- Credit unions can strengthen AML effectiveness by revisiting risk assessments, testing procedures in practice, reviewing investigations and making oversight measurable.
What FINTRAC’s Credit Union Penalties Reveal About AML Program Gaps
The four penalties involved different institutions and circumstances, but the findings point to several common themes.
An AML risk assessment must drive real decisions
Risk assessments are intended to help institutions understand their exposure to money laundering and terrorist financing and determine where controls and resources are most needed.
However, FINTRAC identified shortcomings in risk assessments that were incomplete, insufficiently documented or not adequately reflected in day-to-day compliance activities. In some cases, the assessments did not fully capture the institution’s risks or inform how monitoring was conducted.
What teams should do:
- Review whether your risk assessment reflects your current customer base, products, services, transaction activity and geographic exposure.
- Confirm that identified risks translate into appropriate monitoring rules, customer review frequencies and investigative priorities.
A risk assessment works best as a living tool, updated whenever the institution’s products, members or risk exposure change.
AML policies and procedures must be followed consistently
Several of the penalties highlighted gaps between written procedures and actual practices. These included missed ongoing customer reviews, incomplete customer information and inconsistent application of established monitoring requirements.
Even well-designed procedures offer limited protection if staff cannot apply them consistently or operational pressures cause important steps to be missed.
What teams should do:
- Compare documented policies with actual workflows.
- Review whether customer due diligence and ongoing monitoring are completed within established timeframes, particularly for higher-risk relationships.
- Track overdue reviews, assign clear ownership and establish escalation procedures for outstanding work.
- Revisit procedures when products, systems, business models or regulatory obligations change.
Alert backlogs and investigation quality create compliance risk
The findings also underscore the importance of effective alert management and investigation practices.
Unresolved alerts, incomplete transaction assessments and insufficiently documented conclusions make it more difficult to identify suspicious activity and determine when suspicious transaction reporting obligations have been triggered.
For smaller teams, rising alert volumes and limited investigative capacity can create a difficult balancing act. Processing alerts faster offers little benefit if important risks are overlooked along the way.
What teams should do:
- Evaluate both the volume and quality of alerts, including how many are AML false positives.
- Regularly assess monitoring rules, prioritize activity based on risk, and track backlogs to identify where additional attention is needed.
- Use standardized investigation workflows and documentation templates to help investigators work consistently without sacrificing analytical quality.
The real objective of alert management is to ensure that potentially suspicious activity is appropriately assessed, escalated and reported when required.
Effectiveness reviews and documentation must hold up to examination
The penalties reinforce another important point: institutions need to be able to explain how they manage risk and why they make particular compliance decisions.
In one case, FINTRAC found that an AML effectiveness review had failed to identify weaknesses later uncovered during an examination. This illustrates why reviews must go beyond confirming that policies exist or that processes have been completed.
What teams should do:
- Strengthen quality assurance and effectiveness testing. Review a sample of customer files, investigations and reporting decisions to determine whether procedures are being followed and controls are achieving their intended results.
- Maintain clear records of findings, corrective actions, decision rationales and follow-up testing. When weaknesses are identified, document how they will be addressed and verify that remediation has been effective.
Documentation should tell a coherent story: what the institution identified, what it did about the risk and how it reached its decisions.
Record FINTRAC Enforcement Raises the Stakes for Exam Readiness
The September 2026 announcements also need to be considered in the broader regulatory environment.
FINTRAC reported that it issued 35 notices of violation in the 2025–26 fiscal year, the largest number in a single year in the Centre’s history. Those notices resulted in penalties totalling more than $247 million across the businesses subject to Canada’s anti-money laundering laws.
The four credit union announcements therefore arrive amid a period of significant enforcement activity. FINTRAC’s public notices provide institutions with concrete examples of the types of deficiencies that can emerge during compliance examinations.
For credit unions, the takeaway is readiness. Risks and findings will vary from one institution to the next, but every team should be prepared to demonstrate how its credit union AML compliance program operates, how weaknesses are identified and how risks are addressed.
Exam readiness should be an ongoing discipline that is in place well before an examination is announced.
Four Steps to Strengthen Credit Union AML Effectiveness
Improving an AML program rarely requires more complexity, more tools or significantly larger teams. Credit unions get further by understanding where current processes fall short and prioritizing improvements accordingly.
Consider these four steps:
- Revisit your risk assessment. Confirm that it reflects your institution’s current exposure and informs customer risk ratings, monitoring and investigative priorities.
- Test whether procedures work in practice. Verify that customer reviews, enhanced monitoring and other required activities are completed consistently and on time.
- Review investigation effectiveness. Examine alert backlogs, escalation practices, reporting decisions and documentation quality to identify opportunities for improvement.
- Make oversight measurable. Establish clear performance indicators, conduct regular quality assurance reviews and track corrective actions through to completion.
These steps help teams focus limited resources on the areas that matter most while building a stronger foundation for regulatory examinations.
Ultimately, AML effectiveness is measured by whether the program identifies meaningful risks, supports sound decisions and produces demonstrable results. The number of policies an institution maintains, or the sophistication of its technology, matters far less.
Building an Exam-Ready AML Program for Your Credit Union
FINTRAC’s September 2026 penalties offer a timely reminder: an effective AML program has to work in practice as well as on paper.
For compliance teams facing resource constraints and increasing demands, the path forward starts with understanding current program performance, identifying gaps and making targeted improvements that strengthen both operational efficiency and regulatory readiness.
To help your team get started, Alessa’s AML Effectiveness Playbook for Community Banks & Credit Unions provides a practical framework for evaluating your AML program across five key pillars, identifying opportunities for improvement and prioritizing actions without unnecessary complexity.
Download the Playbook and take the next step toward a more effective, risk-based and exam-ready compliance program.
Source: FINTRAC, Public Notice of Administrative Monetary Penalties, September 24, 2026.
