Record-Keeping for Financing and Leasing Firms: 6 Steps to Achieve Audit Readiness

Disclaimer: This article summarizes FINTRAC record-keeping requirements applicable to financing and leasing entities as of April 1, 2025. The content provided is for general information only and does not constitute legal advice.

Record-keeping is where many financing and leasing firms run into trouble during FINTRAC reviews—not because policies are wrong, but because records cannot be produced quickly and completely.[1] This guide explains what FINTRAC requires firms to keep, where processes break down in practice, and six practical steps to build an audit-ready setup without adding unnecessary work.

Six Steps to Audit-Ready Record-Keeping:

Establish one place to look for each financing or leasing arrangement
Make required fields unavoidable
Design a clear trigger for large cash transactions
Keep report copies organized and retrievable
Maintain version history for risk assessment
Perform periodic internal reviews

Common Pitfalls:

Records are split across too many systems
The payer and customer details don’t match
Authorized signatory documentation is missing
Occupation or business type is too vague
Records are lost due to staff turnover or outsourcing
Retention timing is misunderstood

Why Record-Keeping Breaks Down

For newly in-scope financing and leasing firms (effective April 1, 2025), record-keeping is often where a risk-based compliance program either stands up—or falls apart. This is especially true in financing and leasing, where records are commonly spread across multiple systems and counterparties.

In a FINTRAC exam, firms are not just explaining what they do. They are expected to prove it with complete records that can be produced quickly. [1] FINTRAC guidance emphasizes record availability and completeness, not just written policies.

This guide covers three practical areas:

What records must be captured
Where record-keeping typically breaks down in real operations
How to make records “audit-ready” in practice

What to Capture (The “Must-Have” Records)

FINTRAC’s record-keeping guidance for financing and leasing firms is very specific, detailing what records must be kept and for how long. [1]

A. Copies of Reports You Submit to FINTRAC

You must keep a copy of every report you submit, including:

Suspicious Transaction Report (STR)
Listed Person or Entity Property Report
Large Cash Transaction Report (LCTR)
Large Virtual Currency Transaction Report (LVCTR) [1]

Retention (how long to keep them):

STR and Listed Person or Entity Property Report: at least 5 years after the day it was submitted [1]
LCTR and LVCTR: at least 5 years from the date the report was created [1]

B. Large Cash Transaction Record ($10,000 CAD or More in Cash)

You must keep a large cash transaction record (LCTR) when you receive a single transaction of $10,000 CAD or more in cash (subject to the 24-hour rule). [1][2]

This record must include details such as:

Date cash was received
Who was involved (name, address, DOB, occupation/business)
Currency type and amount
Purpose of the transaction
How the cash was received (in person, by mail, etc.)
Any account affected
Reference numbers tied to the transaction
What the cash was used for (the “disposition”) [1]

Retention: at least 5 years from the date the record was created. [1]

C. Large Virtual Currency Transaction Record ($10,000 CAD Equivalent or More)

If you receive virtual currency equivalent to $10,000 CAD or more (subject to the 24-hour rule), you must keep a large virtual currency transaction record (LVCTR) with specific details (including addresses and transaction identifiers). [1]

Retention: at least 5 years from the date the record was created. [1]

D. “Deal File” Records for Every Financing or Leasing Arrangement

A deal file is the complete set of records associated with a financing or leasing arrangement.
For every arrangement, FINTRAC expects you to keep:[1]

Information record for the person/entity you enter the arrangement with.

For entities: details for each person who enters into the arrangement on the entity’s behalf (name, address, DOB, and principal business or occupation).
For corporations: a copy of corporate records showing who has the power to bind the corporation (for example, articles or bylaws listing signing officers). [1]

2. Record of financial capacity (how they can afford the arrangement). [1]

3. Record of terms of the arrangement (key deal terms). [1]

4. Payment record for each payment you receive, including:

Date of payment
Name of payer
Amount and the cash portion
The type and value of payment (if not funds)
Method used to pay [1]

Retention:

Information records: at least 5 years from the day the last business transaction was conducted
Other records: at least 5 years from the date the record was created [1]

Where Record-Keeping Breaks in Practice

Even teams with good intentions tend to see record-keeping break down in predictable places.

Records are split across too many systems	Loan origination system, customer relationship management (CRM), accounting, payment processor, dealer portals, shared drives—each has part of the story. No one place has a complete deal file.
The “payer” and the “customer” don’t match cleanly	Payments come from: A related company An employee of the borrower A spouse or partner The asset dealer or vendor involved in the transaction A broker trust account If your payment record doesn’t consistently capture who paid, how, and what portion was cash, you end up recreating it under pressure.
Corporate authority-to-bind document is missing	For corporate customers, it’s common to have incorporation documents but not the records that show who is allowed to sign for the company. FINTRAC explicitly calls this out for corporations. [1]
Occupation” and “business type” are too vague	If you record an occupation as “manager” or “sales” without further detail, it becomes difficult to assess whether a transaction is consistent with expected activity. It does not provide the context that FINTRAC expects you to record. [1]
Staff turnover or outsourcing causes record loss	If a contractor, dealer, or employee holds key documents and then leaves, you can lose the only copy. FINTRAC requires you to obtain and keep records kept for you by employees or contractors before the relationship ends. [1]
Retention timing is misunderstood	Different records have different retention “start clocks.” For example, information records are tied to the last business transaction, while other records are tied to the date they were created. Misunderstanding these timelines can lead to gaps or deleting records too early. [1]

How to Make Record-Keeping Audit-Ready (A Practical Operating Setup)

“Audit ready” means:

Files are complete
Rules are followed the same way every time
You can produce what is needed quickly

FINTRAC expects records to be kept such that they can be provided within 30 days of a request. [1] So long as a paper copy can be easily produced, records may be electronic. [1]

Step 1: Establish a single deal file structure (one place to look)

Use one ID (arrangement number) as the anchor and keep these sections consistent:

Customer and signer info (including authority-to-bind for corporations)
Financial capacity + deal terms
Payments (each payment as its own entry)
Reports filed (copies + submission proof)
Notes and decisions (why something was escalated, or why it was cleared)

If you can’t point a new hire to a single place and say, “everything is here,” it’s not audit-ready.

Step 2: Make required fields unavoidable (reduce “memory-based” work)

Record-keeping breaks down when critical data fields are optional. Use forms and workflows that enforce mandatory fields before users can finalize a record.

Ensure the system captures:

Payer name
Payment method
Cash portion
Corporate signer details (for corporations)
Clear occupation/business descriptions [1]

Step 3: Design a clear trigger for large cash transactions

When cash reaches the reportable threshold, your process should reliably:

Identify when the reporting threshold has been met (including the 24-hour rule). [2]
Ensure all FINTRAC-required details are captured. [1]
Link the resulting record or report copy back to the arrangement file.

Step 4: Store report copies beside the file, not in a separate mailbox

FINTRAC requires you to keep copies of reports and sets retention rules. Do not rely on email-only confirmation. Store:

The report PDF or export
The confirmation number or submission receipt
The submission date (retention depends on it) [1]

Step 5: Maintain version history for deal terms and risk level

In exams, “what did you know at the time?” matters. Keep a clear record when:

Terms change
Ownership or control changes
Risk level changes
Monitoring interval changes

You don’t need fancy tools, just a consistent change log.

Step 6: Perform periodic internal record-keeping reviews

FINTRAC expects firms to be able to produce required records within 30 days of a request. [1] A practical way to meet this expectation is to regularly test record retrieval.

As part of an internal review:

Periodically select a sample of financing or leasing arrangements (or agreements)
Retrieve the complete record set for each
Confirm that required documents are present, consistent and linked correctly

As best practice, aim to retrieve a complete file within 48 hours, well inside FINTRAC’s 30-day standard. This type of internal review helps to identify gaps early, so they can be addressed before a FINTRAC exam.

Exceptions and Efficiencies (To Avoid Duplication)

FINTRAC includes exceptions that can reduce duplication. For example:

If information is readily available in other records, you do not have to record it again.
A copy of an LCTR can serve as the large cash transaction record if it contains all required information. [1]
Some record requirements do not apply in specific cases (for example, receiving cash from certain counterparties or arrangements with certain entity types). [1]
Use exceptions carefully: reduced work is only helpful if the remaining record is still complete.

How AMLForms Supports Record-Keeping

AMLForms is designed as automated AML record management tools to keep records together in a consistent format.It enables financing and leasing firms to:

Capture the required deal-file data once, including corporate signers, payment details, and cash portions
Standardize how staff collect required information across teams and locations
Link payments, risk decisions, and filed reports to the same financing or leasing arrangement
Produce audit-ready records without searching across systems

Quick Checklist: The Minimum Audit-Ready Record (Per Arrangement)

Plus signer details for entities
Authority-to-bind for corporations

Date
Payer
Amount
Cash Portion
Type/Value
If not funds
Method

STR
LCTR
LVCTR etc.

Target 48 hours internally

Bottom Line

In practice, the outcome of a FINTRAC examination is not determined solely by whether policies exist. What matters is whether required records can be produced quickly, consistently and completely. Financing and leasing firms that centralize records, standardize data capture, and periodically test retrieval are far better positioned to meet regulatory expectations with confidence.

This guidance reflects FINTRAC requirements applicable to financing and leasing firms as of April 1, 2025. This article is general information, not legal advice.

Sources

[1] FINTRAC – Record keeping requirements for financing or leasing entities

[2] FINTRAC – The 24-hour rule (guidance)

See AMLForms in Action

Book a personalized demo to see how AMLForms helps you onboard, verify, screen, and monitor customers with confidence.

Book A Demo

FAQs

When did FINTRAC record-keeping rules start applying to financing and leasing firms?

FINTRAC's AML record-keeping and reporting obligations have applied to financing and leasing entities since April 1, 2025. From that date forward, firms must maintain complete deal files, capture payment details, and retain copies of every report submitted to FINTRAC. The rules apply across the sector regardless of company size, so even smaller leasing operations are now expected to demonstrate audit-ready record-keeping during examinations.

What is the 24-hour rule for cash transactions in financing and leasing?

The 24-hour rule means two or more cash transactions of less than $10,000 CAD, received from the same person or entity within a 24-hour window, are treated as a single reportable transaction once they total $10,000 CAD or more. Firms must capture and report the combined amount, not each payment individually. The same logic applies to virtual currency transactions equivalent to $10,000 CAD or more.

How quickly must a financing firm produce records during a FINTRAC examination?

FINTRAC expects firms to produce required records within 30 days of a request. Most well-run firms set an internal target of 48 hours for retrieving a complete deal file — significantly faster than the regulator's window. Hitting that internal benchmark consistently is a strong signal that records are centralized, linked correctly, and ready for an examination at short notice.

Can financing and leasing firms keep AML records electronically?

Yes. FINTRAC permits records to be kept in electronic form, provided a paper copy can be easily produced when requested. In practice, scanned documents, exported reports, and digital workflows are all acceptable — as long as the system can generate readable, complete copies on demand. Keeping records electronically usually makes retrieval faster and reduces the risk of misfiled or missing documents during an audit.

What documents are required when a corporate customer enters a financing arrangement?

For corporate customers, FINTRAC expects firms to record details for each person entering the arrangement on the corporation's behalf — including name, address, date of birth, and principal occupation. Firms must also keep a copy of corporate records showing who has the power to bind the corporation, such as articles of incorporation or bylaws listing signing officers. The missing authority-to-bind document is one of the most common gaps flagged in reviews.