Why Effectiveness Reviews Matter: Preparing for a FINTRAC Audit with Rodney MacInnes

Hello and welcome to another episode of the Know Your Compliance podcast. I am excited to have my good friend and fellow compliance nerd, Rodney McInnis from Outlier Compliance Group, joining us today. Hello,

Rodney, Hi Greg. Thank you very much for having me.

I am always excited to chat with you, but today, we are going to be nerding out on effectiveness reviews, and it's something that I spend a lot of time talking with people about, and I suspect you spend even more time talking about that with people.

Yeah, I spent the core of my morning this morning talking to four or five different people on this exact topic. So it's something

I do fairly something you do every now and then, cool, cool, which I think

kind of led us here, because the core, the crux of those conversations is usually fairly similar. So maybe we put this together and answer some of those questions, so I can just point people to go, like, go watch that podcast. It will answer all your questions.

Hey. So this is actually a time saving effort for you. If we can record a good enough thing, you could just use this and save yourself a whole 20 minute conversation with people. I love it. This. This is, this is efficient. Cool, cool. So let's start at the very beginning, because most of our listeners will know what an effectiveness review is. But let's but just to make sure we're all on the same page, why don't you start by giving us a bit of a definition of what it is we're talking about. What is it effective? What's that look like?

So an effectiveness review has a few different terms that it's called. It's sometimes called an audit, which we can thank our friends south of the border for. That is what they like to call it. In Canada, it is referred to as an AML Compliance effectiveness review that has been shortened to a compliance effectiveness review that has been shortened to a cer. So if you see the acronym cer, what that is is a compliance effectiveness review. And more commonly, people call it the two year review, because legislatively, as a reporting entity, you are obligated to conduct a cer or compliance effectiveness review at least once every two years, and that two years is a ruling period that is from the commencement of your previous review, not when you finished it. So if you start and it takes six months, you don't then start your two year clock. You now only have a year and a half left until your next one starts. This is a common one that folks miss, and something to make sure that you are on top of as that is a silly way to have a finding during a fin track exam, especially when you're actually doing your reviews.

Yeah, yeah. That's a that's a good point and worth calling out for sure. Like, the timing of it is, like, it's funny, because very few things in fin track are very specific. Every now and then you there's, there's a few guide, pieces of guidance. They're, like, super specific. This is one of them. Like, there is just, it's super black and white. You have to start one every 24 months, and you can't start one until you finish the previous one. So, you gotta, you got a window, you got to do it okay, and you covered. One of the other things, is it different than an audit? And effectively, no, it's somewhat just different terminologies. Is kind of what, what would be a fair, a fair way of phrasing that, I think,

yeah, how we explain it to folks usually is, think of it as an audit, because most people know what an audit is, and it's not a pretty picture to paint for people, but think of it as an audit before compliance. So it is. It is meant to encompass the entirety of your compliance program, so not only the documented portion, your policies, your procedures, your risk assessment, but also the operational piece. So what I'm doing is I'm looking at the documentation to make sure that you have everything that you need and that it covers what you're supposed to be covering. Then I'm going to test the operational side of it so you can have really pretty documentation if you don't follow it, not super useful. So that's the other, the other part of that audit. So I'm going to look at the operations and all of that portion of the program to make sure that a, they're troying up together, but B, that they're they're covering all of the requirements that you're obligated.

Yeah. Okay, so it's, and that's how I've often described it's kind of like a two part test. There's kind of a gap analysis between the regulations and what you've written in your documentation, and then a gap analysis between your documentation and what you've actually are doing in your day is, is how I've kind of phrased that to people occasionally,

and that's that's very important to understand, is like you could write something that isn't legislatively obligated in your policies and procedures not follow it, and that'll still be a finding that goes that also leads into a fin track exam. So if you, if you document a process and don't do it, even if it's not required, Fin track is going to call you out to say you have this particular process, but I don't see, I see points one through four, but point five is never in any of the operational data. So important things to understand, you know, not only from what you're doing. And from a legislative standpoint of what you're doing, from a documentation standpoint, so

Okay, that's all seems fair and reasonable. I guess where I want to go next is who, who is qualified. And I'm purposely leading you into a really big topic there. I know qualify.

That's a very strategic phrase that you've used, and sounds familiar, isn't it, when it comes to compliance effectiveness reviews, because if you have read any of the guidance from FINTRAC, which kind of tell you who and what you have to do for a lot of the AML requirements on pretty much all of them, it's one of the factors that is considered when looking at who is the reviewer you're looking to have complete this process. And a lot of the focus is on the expertise. What gives this person the expertise or the knowledge to go in and properly assess the effectiveness, and that's that's one of the big underscores in the the knowledge within producing a report of the final result of an effectiveness review is the knowledge to make a determination and document that determination on Whether your program is effective, you can have a nice review, and it can have a really long, complex report at the end of it, but one of the key components that I like, frankly, I see missing a lot, is a determination of whether your program is effective or not. And that is, I mean, it's in the name, it's inherent that that needs to be part of it. And it is kind of mind blowing to me that it is not common practice to have a determination of the effectiveness. A lot of what you see is this meets regulatory requirements. You kind of get into a process at that point of like I went through this big list of check boxes and checked all of the boxes. I mean, that's better than nothing. But fin track looks at that and they're going to be questioning, you know, who is this person, company, whatever that completed this review, why are they qualified enough or have the expertise to do this thing? And where is the determination of what you're doing is effective or not? And that is, is one of the common shortfalls I see within the industry.

Yeah, the way you phrased it in how made it feel like the you might meet the regulatory requirements, but have you've not even considered whether it's being operationalized properly or not, is, is what I'm hearing you say in the way you phrase that anyway. And so I guess to your point, it's it really is somebody who's gotta, gotta know what they're talking about. So, I mean, can I go get a certificate for this stuff? Listeners, I'm smiling broadly because I know the answer to the question. Well,

like a certificate to prove your expertise? Yeah, absolutely. Is that going to be enough? Again, you're you're in that boat, if it's better than nothing. So one of the kind of the industry standards is the cam certification, or the certified anti money laundering specialist. I, I wrote that exam, and I want to say 2011 and it it requires the a the time. So you can't just, on day one go in and write your your cam certification. You have to have a little bit of time in the background. You have to have done a certain amount of work, a certain amount of testing. There's like a point scoring in order to qualify to write the exam. So it's a better bar than nothing, but that the exam, in my opinion, isn't what necessarily would qualify you as a specialist. It's something. But there is other factors that get considered an equation of, you know, have you worked in the industry that you're currently testing the effectiveness on, which is a big one. Do you Do you understand, you know, the different pieces of that particular model and stuff like that. The other, the other piece is with the cam certification, there's a lot of international stuff that's included in the in the cert that I operate solely my optically in Canada. And yeah, sure, I know what Basil is. I know what the wolf group is. I understand those things, but they have very, very little to do with my day to day work, especially when it relates to, you know, the real estate sector, or jewelry or something along those lines. So having, having worked in the the real estate space is is a benefit when it comes to finding and selecting your reviewer, because you know, someone like myself who has worked in the space you. Has a better understanding of, not only what it's like on the on the sales side, on the real estate side, on the jargon side and things like that, also understand the struggles that you know you get into on the real estate side of things and the data collection and stuff like that. So it's it's not, it's not missed and

well, and, you know, it's also true for the mortgage sector, which has its own unique set of things to consider as you go through that review. And again, those similar kind of needing to understand the sector. Because well, and I, you know, if I were to kind of double click on that for a second, like the what transaction management, or enhanced transaction management, means in the real estate sector and in a financial institution are worlds apart from each other. They're just like, a completely different set of activities, really. I mean,

even in between the real estate agent brokerage side and the mortgage broker inside, that looks very different. Those

are, yeah, you're right. Actually, like, those are, yeah, yeah, the ex, the expected and the unexpected are very different. So, yeah, no, fair enough. So I guess one of the, one of the questions I get a lot on this is, well, can't I just do this myself?

Do you get that question too. Oh, thank goodness so there is a yes and technically it is allowed. The expectation is, if you are a one person or two person shop that is possible, and the expectation wouldn't be that that person sits outside of the compliance function, because when you get into a space that's small, like, it's hard to kind of separate those

two things, yeah, and there's a level of reasonableness here, exactly when you get into

a larger brokerage, and That's what I mean, larger, like three or more people, it it's possible, but you really have to have that person that a sits outside of compliance. That should be fairly easy to find at any brokerage, because 95 ish more percent of people sit outside the compliance function. They're more on the sales side of things. Two is, you need someone that sits outside of that compliance function that has the expertise. And if you have someone in your brokerage who isn't in the compliance department that has enough expertise, I like that would be amazing. I would be very confused, and especially, you know, and maybe you have some really good training. It's, it's the struggle. Is back to the earlier conversation about fin track, questioning the expertise and why that person has the the, you know, the understanding to conduct that review right in a different sector that we serve, there is a kit that you can download, and it provides you with the tools to do your own review, because in the other sector, there's a lot of small, one and two person businesses, and you know, there's not enough revenue generated to also start paying consultants to two reviews every two years. I would say the completion ratio on the folks that download that to the folks that call us and ask is less than 10% so

it's actually a lead generator for you. They start to try to do it, and then they call you and say, Wait, no, we don't have it.

That's and I mean, that's been one of the primary kind of Outlier promotional tools is just giving the information out, because the more everyone knows, the better it's going to be. But at the same time, I've got a business to run, I've got revenue to generate, and compliance can sometimes be, you know, a bit of a burden when it comes to to revenue generation, where I think it's done correctly, it will really, really help you. But if you're looking at doing a review, I mean a review, for me, is not a started on Monday and finish it by Friday. Temple of a project, it is a it's a lot of work. And so when you start to do the work yourself, you really understand why there's, you know, like, what's typically considered a significant cost to it. It is not, it's not something that I can polish off in five hours. It is typically looking somewhere in the 20 to 30 hour range of my work, and dad doesn't even consider the work going in on the brokerage, to put the files together, to answer the questions, to have the conversations, and all of that stuff. So it's, it's a lot well,

and just to add to that, it's 20 to 30 hours of your work. But that's because you already have a plan and a and you've done this before, and you know what. You know where you're going. It. Exactly which, if you think about an effectiveness review, you got to have a plan like that's actually part of the regs to, if we're kind of being honest, you gotta, you gotta know what you're going to be doing, go and do it and then, and then document what you've done. So there's actually kind of three parts of this thing that if I was going to go do it myself, I'd have to first plan it, then do it, then write it all about it after, oh, and then incorporate the findings, I suppose, as well. If I'm like, Yeah, remediate

your findings and everything else, yeah, yeah. But that's actually a really excellent point. Is the drafting of the report is, I mean, are the hor the reports we hand over are usually like, if we struck out the CVS to to evidence why we are experts in our field, and show you how long we've been in the space. I mean, it's 2020, to 30 pages of writing. Yeah, that's, that's five days of work, right there, for most people, not more,

and you can't chat. GPT that work, despite

what a bunch of people are gonna try and tell you, I have friends with more expertise than me that have tried and are like, it's just not possible. Nah, it's not there

yet. So now even so okay, I can get over the I need to hire somebody. Why don't I just go hire the absolute cheapest I can find because, because I've done some work on this, and there is a range of pricing available, and if I'm, if I'm looking at this, making a decision as to who to hire, can't I just hire the cheapest person? Shouldn't I just hire the cheapest person? Isn't that my business imperative?

The second question you asked is a much better question. You You can hire whoever you want to. No one can stop you. Should you? My opinion might be slightly biased, but I'm not saying you have to hire Outlier or anything like that. What I'm saying is back to the previous points that we've been talking about. You need to hire someone who knows what they're doing. Now, we're seeing a lot of, you know, one person shops pop up and bring the cost down because they don't have an office. You know, the advertising budget is small. You know, you're not dealing with like a Deloitte whose name is on their building and stuff like that. So it brings the cost down, but at the same time you you're still expected to have done the due diligence on whoever that person is to make sure that they have the expertise to do that thing. So where someone comes in and is like, and what we get a lot folks come to us, and I found this person that will do this for $8,000 and your quote is over 10. Why would I sign with you? And I get to have that conversation a lot, which is the extra cheese piece is our reviews always have two people from our team on them, so you're looking at like I myself have been in the industry 16 or 17 years. The person on our team the least is still in like well into double digits. So you're going to have two people with a deep well of experience looking at your program and telling you what needs to be corrected and where your attention needs to be paid versus a one person shop, there's no one reviewing that person's work. So interesting point there. There's a lot of heavy lifting that people don't really think about is where you're having one person doing the work. There's actually a lot of like oversight from a review on your side of errors were made within the report by spelling errors and stuff like that. That isn't super important, but you put that in front of fin track, and fin track sees, you know, a bunch of grammatical errors within a reporter really start to question the quality of the work that was done on the other end. So it's a, it is, is definitely a, a tricky balance on that side. But effectively, what you're effectively, that's a perfect what you're looking for, and especially when it comes to a review, is we tend to try and help people understand that a review is a practice round for a fin track exam. What you're doing is your effective mess up using that. You're basically going through a fin track exam without fin track being present. So you have someone that you're able to ask questions with. So when we do reviews with people, we let them. We do it on a fixed fee, so that you can ask me all the questions you want and bug me all you want because you've paid for my time already. And so as we go through the process, I want you asking every little, tiny, little question all the time, because you don't get to do that with fin track, and that will put you in a much more comfortable place when it comes exam time, because I've been through this and I understand why they're doing this part. I understand why this question. Is the way it is and things like that. So it's, it's good to have the expertise, because it will really help pay dividends when it comes time to sitting in front of and been tracking examiner.

That right there, to me, is exactly the point that I wish people really, that I really want people to hear, which is, okay, yes, you have to do this. So you're gonna you're gonna go figure out a way to do this. But the quality of work you get done here is important, because it's either going to make your fin track examination seem easier or harder than your effectiveness review. And if your fin track examination is harder than your effectiveness. Review, you might have done the wrong effectiveness. Review, I

think you can actually dial that back to be like, this is going to make your fin track exam easier or harder. Period, forget about your effectiveness. Review, you're either going to go in to be like, I'm prepared. I know what I'm looking for. I know what I'm walking into, versus getting into it. And fin track being like, I have questions about this previous effectiveness review that you had done, and now you're making that way more difficult than it needs to be.

Yeah, that's actually a good point. FINTRAC themselves will rely somewhat on their on the effectiveness review findings to to point them towards where they should and shouldn't be looking fair point. Fair point. So what have you seen go wrong? Like, what's, what's the what are the things that go in an effective or that happen during an effective issue that cause them to not go as well as they should, or to that that? Yeah, and we talked about timing already, so let's maybe we double click on timing for a second, because that's, I know that's one of the common challenges. But what else is there? I suppose,

to deep dive into this topic would be a podcast series in and of itself. Yeah, I've seen, I've seen a lot of fun stories when it comes to effectiveness, reviews, mainly, mainly the biggest shortfall that we see is the lack of preparation and understanding of what is actually required, or the the why we're doing what we are doing, and why we're asking the questions we're asking. And so this is, you know, back to when we started the this podcast we talked about, you know, maybe this will make my life easier of of having these conversations, but it's it's going to streamline that for sure, but I still have to spend every single opening conversation with an effectiveness review, walking through the information requests. Why we're requesting what we're requesting, how that should be provided. You know, the timelines around those, those submissions and things like that, oh, when it comes to bad reviews and bad results and things like that, usually what it is is, it is a person who is simply trying to check the effectiveness review box and move on with their life and forget it and put it behind them, instead of using it as a tool that you're paying for to get your program where it should be and feel comfortable about what's happening within your brokerage from a fin track perspective, so that if you get that call from FINTRAC, you are not about to lose sleep for what could be months. You'll, you'll be like, Oh, we finished the review six months ago. The results were, you know, there were some findings. There's always going to be some findings. Compliance is never perfect, no matter how hard you try. And I, you know, I've been working on those. I've I've done four of the five. The fifth one is people 90% finished. And these are all information pieces that you're going to feed the fin track during the the pre exam call let them know we're almost finished with the last part of the implementation. Based on the results of our previous effectiveness review, Fin track may actually say, why don't you call us back when you're done? Right? Because you don't want to test something that's going to change in three weeks. That's pointless. It's not helpful.

Well, and I, you know, I've, I've, this is a different conversation that I have an awful lot, but it's a conversation still worth, worth pointing out as part of this conversation, Fin track isn't out to get people, despite what it might feel like, and they just like it that it's just not what they're interested in doing. They actually just want people to have a good compliance program. I mean, they also want to get some STRS, but the STRS are the result of a good compliance program. So I mean, if I were to summarize it, if they really truly, and I've felt this every time I deal with somebody from FINTRAC, and I'm sure you generally have the same opinion. I hope you do, if not, tell me so now, but the that FINTRAC is really as regulators go, they are pretty open to working with the. Regulated entities that they supervise, I think, is how I would phrase that, for sure. And

like, that's Canada in general. Canada wants to encourage compliance. Our penalty system is not punitive in nature. So it's not meant to, you know, put a business up against the wall and a penalty that they can't pay, which America is very different in that way you're seeing, like, fines up in the millions and billions,

billions. The TD was a, what started with a B there? So, yeah, yeah.

So this is, you know, this is the difference in candidate. It is truly meant to encourage compliance. And since Sarah Paquet took over as the director of fin track, like, frankly, I think she's done a fantastic job. She's an extremely intelligent woman, and she's changed the mentality within fin track to be more of a partnership with reporting entities than a regulator. And reporting entity like, like, kind of relationship, like, they're very, they're they're just humans. Yes, they are your regulator. Don't call them and ask questions about whether you should submit an SDR or not. But that's not to say that you can't call them and ask them a question about, you know, like a very complex situation that you're looking at when it comes to so the legislation says this, the guidance says this, but we're looking at this solution, you know, are, would that be okay? And they're not going to ever say, like, you know, this service provider, totally acceptable, or anything like that. But there are, there are conversations that you can have where you have a more complex question. You can also submit policy interpretation requests, which is another way to go about it. But as far as the relationship that it that exists. It is a much I want to use friendlier, because that can be dangerous, but is a much more comfortable interaction than it was previously, where I've sat in exams, you know, tennis years ago, where fin track wouldn't even accept a bottle of water. That may look like a bribery, right? Like, and that creates a very like, weird and awkward interaction where now they're still cautious, obviously, about that, but they're a little more human in their interaction, absolutely,

for sure. Okay, so back onto the effectiveness reviews you're gonna go so important to get it done, I think we've kind of touched on the importance of having I know we've touched on the importance of having a qualified person. We've talked on about the complexity of doing the work. We've talked about the costs, general costs, and why there is a range of costs. Was there anything on any of those that we need to double click on a little bit more before we before wrap?

Not that I can think of

from my point of view and what I'm hoping people and I'll let you kind of catch some thoughts while I, while I, while I talk here, but from my point of view, what I'm hoping people really hear out of this is two things, first of all, maybe even three things. First of all, these things aren't optional. Secondly, doing them properly benefits you. And thirdly, doing them properly normally means hiring somebody qualified and competent and and those three pieces together, I think, are what I would really hope our listeners get out of out of this conversation, if nothing else,

I think that that does cover. Those three points are very important. The cost is always a factor. I wish, I wish I made enough money that it wasn't and it didn't matter. But that's never going to be the world that we live in, and that's okay. The you know the cost is understanding the value that you are deriving from that situation. And it's really hard to put a cost on confidence, comfort, you know, falling asleep at night and things like that, because I've, I've been in situations, even in reviews, where folks are confessing to me that, you know this, this review has kept me up. I'm so stressed out, you know, I'm really scared of what's what you're gonna say and things like that. And it's like, you don't be you need to, you need to relax. Because the best part is, is, at the end of this, I'm gonna give you a document that tells you exactly what you need to do, yeah, and then you just get to start go like you get to go away to start doing that. Versus, I've been in the exact same scenario in a fin track exam, and I can't help them at that point. Once you're in an exam, it's beyond my control, and the only thing you can do is invent a time machine and travel back in time and fix what was broken before. So

the value for mercy, basically, the value

the insight, the you know, the path to compliance that you receive in a quality review is what's going to pay dividends when it comes time that is an examiner sitting across the chair. Table doing the exact same thing your reviewer should have just finished with you. So the you know, the investment in the expertise, in having someone that understands your industry, your business, those are those are crucial and and that goes back to the initial conversation. Of part of that conversation is me training you on what I'm about to do as part of the review. And then the other part of that is you training me on your business and how you operate and how your processes look and things like that. What makes you special? Because every brokerage has just got a little bit something different than everyone else, and I need to hear about those up front, because that's going to that's going to help me make your program better, which is the whole point of me being there.

That makes sense to me, and that is probably the right tone to wrap things up on. So Rodney, I want to thank you once again. It is always a pleasure to chat on you are a you have the lifetime pass to to come back on anytime. Always happy to chat, for sure. And thank you. On behalf of all of our audience, thank you for taking the time.

Thank you very much for having me. I concur This is always a good time chatting. You always have excellent insights and good suggestions on topics. I'm happy to be here and share whatever I can

awesome, sure.