Outsourced Compliance Officer for MSBs: Cost and When to Hire

On September 24, FINTRAC published penalties against four credit unions in a single day, from $16,500 for Your Neighbourhood Credit Union in Kitchener to $676,500 for Caisse populaire acadienne (UNI) in New Brunswick. All four were cited for the same thing: written compliance policies that weren't kept current and approved by a senior officer. Three of the four were also cited for their risk assessment.

Credit unions have compliance staff, board oversight and examiners who know them well. If they let the paperwork core of the program go stale, a five-person MSB where the founder signed on as compliance officer at registration is in a worse position. FINTRAC issued 35 notices of violation in 2025–26, the most in a year in its history, and the same gaps keep showing up.

Rockwell's view: the compliance officer seat exists to keep the program current. Policies, the risk assessment and the two-year review all drift the moment nobody owns them, and that drift is what FINTRAC fines most often.

what the four notices have in common

Read the four notices side by side and the pattern is plain. Every one cites policies that were out of date or unapproved. UNI, Pathwise and Caisse Alliance were also cited for a risk assessment that missed the prescribed factors. Caisse Alliance also skipped the two-year effectiveness review and the special measures for high-risk clients. UNI, the largest penalty, adds four suspicious transactions that were never reported.

Fixing all of it takes someone whose job is to update the documents, test them and sign off. Across every public penalty since September 2025, written policies and the risk assessment show up in about 8 in 10. Our FINTRAC penalties tracker lists all of them.

what your compliance officer actually owns

FINTRAC requires every MSB to appoint a compliance officer responsible for implementing the program. That person needs the authority and resources to do it, working knowledge of your business, and fluency with the PCMLTFA. In practice the role covers:

• The written program. Policies and procedures, kept current, approved by a senior officer.
• The risk assessment. Documented, built on the prescribed factors, and updated when your products, clients or geography change.
• Reporting.STRs, large cash, large virtual currency and EFT reports filed on time, with a record of why an alert did or didn't become a report.
• Training and the two-year review. An ongoing training program and an effectiveness review at least every two years.
• FINTRAC and the bank. The named contact for examinations, and the person your bank calls when it wants evidence before renewing your account.

signs the seat is empty at your MSB

You can run this check yourself in an afternoon. If two or more of these are true, the program is drifting.

• Your policies carry the registration date. Nobody has approved a new version since you registered with FINTRAC.
• Your risk assessment predates your current products. You added a corridor, a crypto service or a new client type and the assessment still describes the old business.
• You can't find the last effectiveness review. Or it was done by the same person who runs the program.
• Alerts get cleared without notes.You could not show an examiner why a flagged transaction didn't become an STR.
• The compliance officer is the founder. And compliance gets whatever hours are left after sales, banking and operations.

outsourced compliance officer, consultant or full-time hire

These three get confused, and they solve different problems.

• A one-off consultant writes your manual and risk assessment, then leaves. Useful at registration. Twelve months later you are back to stale documents with nobody named against them.
• An outsourced compliance officer is named as your CAMLO of record and runs the program month to month: updates, reviews, reporting oversight and the FINTRAC and bank relationship.
• A full-time compliance officer does the same work in house, which makes sense once the volume fills the week.

what an outsourced compliance officer costs in Canada

A full-time compliance officer costs $120,000 or more before benefits and training, and a small MSB rarely has a full week of compliance work to give them. That is why most small MSBs end up with the founder in the seat.

An outsourced compliance officer runs on a fixed monthly retainer scoped to your transaction volume, products and reporting load, so a credible quote follows a short look at your program. Weigh the retainer against the cheapest penalty on September 24: $16,500, for policies alone, at a credit union that had staff to fix them.

when you should not hire us

Hire full-time when compliance volume genuinely fills a week: a large agent network, high daily alert volume, or a bank or regulator that expects a dedicated in-house team. Hire a lawyer first if you are already under examination with findings that may lead to a penalty or an appeal. And if you only need a manual to register, a one-off consultant will cost you less. Just put a date in the calendar for when it goes stale.

how Rockwell helps

Rockwell acts as the named, CAMS-certified compliance officer for Canadian MSBs. We write and maintain your policies and procedures, keep your risk assessment current with quarterly reviews alongside management, oversee FINTRAC reporting through Comply+, and handle the evidence your bank asks for. The team is led by a CPA, CFA and CAMS who was CFO and CCO of a publicly listed crypto company.

If your two-year review is due or overdue, we can run that first so you know where the program stands.

Explore outsourced compliance officer services, prepare for an effectiveness review, or talk to Rockwell if your policies still carry the date you registered.