Compliance-as-a-Service: what CaaS is and why it works for Canadian regulated firms
Compliance-as-a-Service (CaaS) bundles AML software with a Canadian compliance practitioner bench under one predictable annual cost. This is the plain-English explainer: what CaaS is, who it is built for, and why it is increasingly the only sensible model for lean Canadian MSBs, PSPs, and crypto firms.
Compliance-as-a-Service (CaaS) is the model where a specialist provider owns the day-to-day operation of a firm's AML compliance program, including the software, the practitioner work, and accountability for delivery, in exchange for one predictable subscription cost. It is not a tool. It is not a consultancy. It is the whole program, run for you, by people whose job is compliance.
For Canadian money services businesses (MSBs), payment service providers (PSPs), and virtual asset service providers (VASPs) under FINTRAC, CaaS has gone from "interesting alternative" to "the only sensible model" for the lean firm. Here is what CaaS actually is, who it fits, and why the math now favours it almost universally.
What is Compliance-as-a-Service?
Three things together make a service genuinely CaaS, as opposed to a relabelled tool or relabelled consultancy:
- A purpose-built AML platform as the system of record. Onboarding, KYC, screening, risk rating, transaction monitoring, case management, reporting, and audit trail all sit in one place, owned by the provider.
- A named practitioner bench that operates the program. A fractional Chief Anti-Money Laundering Officer (CAMLO), supported by analysts and reviewers, who own the five PCMLTFA pillars day to day. Not advice "on call", but actual operations.
- One predictable cost, sized to the firm. No per-alert metering, no hourly billing for the practitioner work, no surprise bills when an examination lands. The number you agree to is the number.
If any one of those is missing (software-only, advisory-only, or unpredictable pricing), it is not CaaS. It is one component of the program, dressed up as the whole.
Who is CaaS built for?
The Canadian firms where CaaS works are the firms where the in-house model has stopped working.
- Money services businesses (MSBs) with founder-led operations, lean ops teams, and FINTRAC examinations on the horizon.
- Payment service providers (PSPs) early in the Retail Payment Activities Act compliance lifecycle, building toward registration and ongoing oversight.
- Crypto firms and VASPs facing FINTRAC, Travel Rule, and LVCTR obligations on top of provincial securities exposure.
- Small regulated entities outside the bank tier, where a full in-house compliance team is neither affordable nor warranted by transaction volume.
- Foreign MSBs operating into Canada, where the local compliance presence has to be credible to FINTRAC without standing up a full Canadian operation.
The common thread is the gap between regulatory expectation and in-house capacity. CaaS exists to close it.
Why is CaaS the future of compliance for lean Canadian firms?
Three forces have aligned in 2026 to make CaaS the default, not the alternative.
1. The legal bar moved.
Under Bill C-12, the new statutory standard for a Canadian compliance program is "reasonably designed, risk-based and effective". The third word is the change: regulators now ask whether the program actually works, evidenced by outcomes, not just by the existence of policies. Meeting that bar with a spreadsheet, a part-time compliance officer, and a screening tool is hard. Meeting it with an integrated platform plus a practitioner bench is what the bar is calibrated for. We covered the legal mechanics in the Bill C-12 compliance guide.
2. The cost of non-compliance went up.
The March 2026 AMP increase lifted the per-violation ceilings under the PCMLTFA across all three severity tiers. The per-occurrence model has not changed, which means a foundational deficiency aggregates fast. For most lean firms, the worst-case aggregate exposure now exceeds the lifetime cost of a strong CaaS subscription, often by a wide margin. The AMP explainer and the enforcement-surge analysis have the numbers.
3. The cost of in-house compliance is unrecoverable.
A Compliance Manager to Director in Toronto runs roughly CAD $130K to $210K per year. A Chief Compliance Officer runs CAD $230K to $340K, before benefits, tooling, and overhead. That number reflects the practitioner only. It does not include the software stack, the screening data feeds, the case management system, or the periodic independent review. For a lean MSB or fintech, those numbers are not a tradeoff against CaaS; they are a category mismatch.
What does a CaaS program look like in practice?
The deliverables are concrete. They are also the same deliverables FINTRAC examines on for the five PCMLTFA pillars, which is the point.
- Compliance officer. A named, qualified fractional CAMLO accountable to the board, with a defined scope and reporting line.
- Risk assessment. Built for the firm, refreshed on a defined cadence, and used to drive control calibration. The document is real, not template-shaped.
- Policies and procedures. Written for the actual operation, version-controlled, with staff attestation tracked in the platform.
- Training program. Role-based, evidenced by completion records, with detectable behavioural change in alerts and escalations.
- Independent effectiveness review. Conducted on cadence, by someone genuinely independent, with findings tracked to closure.
- Day-to-day operations. Onboarding decisions, screening hits, transaction monitoring alerts, case investigations, regulatory reports (STRs, LCTRs, EFTRs, LVCTRs), board reporting, examination response.
What does not count as CaaS?
Three things often labelled "managed compliance" that are not actually CaaS:
- A screening tool with a chat channel. If the practitioner work is "on call" rather than owned, the firm still operates the program. The control is software, not service.
- A retainer with a consultant. If there is no integrated platform of record, the audit trail lives across email and the consultant's notes. That is the opposite of "reasonably designed, risk-based and effective".
- A fractional CCO with hourly billing. If the bill scales with workload, it scales with exactly the moments (examinations, enforcement actions) when the firm is least able to absorb a spike. Predictable cost is part of the model, not a nice-to-have.
FAQ
What is Compliance-as-a-Service (CaaS)?
Compliance-as-a-Service (CaaS) is the model where a specialist provider owns the day-to-day operation of a firm's AML compliance program, including the software, the practitioner work, and accountability for delivery, in exchange for one predictable subscription cost. It is not a tool, and it is not a consultancy; it is the whole program, run for you, by people whose job is compliance. Three things together make a service genuinely CaaS. First, a purpose-built AML platform serves as the system of record, holding onboarding, KYC, screening, risk rating, transaction monitoring, case management, reporting, and audit trail in one place. Second, a named practitioner bench operates the program, typically a fractional Chief Anti-Money Laundering Officer supported by analysts and reviewers who own the five PCMLTFA pillars day to day. Third, one predictable cost is sized to the firm, with no per-alert metering or hourly billing. Remove any one of those and it is not CaaS.
Who is CaaS built for?
CaaS is built for the Canadian firms where the in-house model has stopped working. That includes money services businesses with founder-led operations, lean ops teams, and FINTRAC examinations on the horizon; payment service providers early in the Retail Payment Activities Act compliance lifecycle, building toward registration and ongoing oversight; and crypto firms and VASPs facing FINTRAC, Travel Rule, and LVCTR obligations on top of provincial securities exposure. It also fits small regulated entities outside the bank tier, where a full in-house compliance team is neither affordable nor warranted by transaction volume, and foreign MSBs operating into Canada that need a credible local compliance presence without standing up a full Canadian operation. The common thread across all of them is the gap between regulatory expectation and in-house capacity. CaaS exists to close that gap, which is why it suits lean firms under the Bill C-12 standard rather than large banks with deep compliance benches.
How is CaaS different from a fractional CAMLO?
A fractional CAMLO is a person, typically billed hourly or on retainer. CaaS is a whole program. The fractional CAMLO sits inside an integrated AML platform, backed by a practitioner bench, and is accountable for the five PCMLTFA pillars on a fixed annual cost. So CaaS includes a fractional CAMLO, but it is not just a fractional CAMLO. The distinction is what surrounds the person. A standalone fractional CAMLO still leaves the firm to supply the software, the screening data, the case management system, and the operational capacity to run alerts and reports. Under CaaS, those pieces come as one accountable package, which matters under the Bill C-12 standard because a program has to be reasonably designed, risk-based and effective, not just staffed. A named officer without an integrated platform of record produces an audit trail scattered across email and personal notes, which is the opposite of what the effectiveness standard is calibrated for.
Is CaaS cheaper than hiring a compliance officer in-house?
For lean Canadian firms, almost always yes. A Compliance Manager to Director in Toronto runs roughly CAD $130K to $210K per year, and a Chief Compliance Officer runs CAD $230K to $340K, before benefits, tooling, and overhead. Critically, those figures reflect the practitioner only. They do not include the software stack, the screening data feeds, the case management system, or the periodic independent review, all of which a firm still has to buy on top of the salary. CaaS bundles the platform, the practitioner work, and accountability for a fraction of that total cost of ownership. For a lean MSB or fintech, the in-house numbers are not really a tradeoff against CaaS; they are a category mismatch, because a single senior salary rarely buys a complete, integrated program. The comparison that matters is not salary versus subscription, but the full loaded cost of building the program in-house versus the predictable annual CaaS cost.
Does CaaS replace the firm's compliance officer?
It can, but it does not have to. CaaS can replace the firm's compliance officer through a named fractional CAMLO under FINTRAC-recognized arrangements, giving a small firm a qualified, accountable officer without a full-time hire. Alternatively, CaaS can support an existing in-house compliance officer by supplying the platform, the practitioner bench, and the operational capacity that a single person cannot generate alone. In that configuration the in-house officer keeps ownership and the CaaS provider extends their reach. The right answer depends on firm size, stage, and risk profile. A founder-led MSB with no compliance staff is a different case from a scaling fintech that already has a compliance lead but lacks depth underneath them. What CaaS always provides is the integrated system of record and the day-to-day operational work, whether that sits under a fractional CAMLO the provider names or an in-house officer the firm already employs. The model flexes to the firm.
Why is CaaS increasingly the default model for lean Canadian firms?
Three forces aligned in 2026 to make CaaS the default rather than the alternative. First, the legal bar moved: under Bill C-12, the statutory standard for a Canadian compliance program is now reasonably designed, risk-based and effective, and regulators ask whether the program actually works, evidenced by outcomes. Meeting that with a spreadsheet, a part-time officer, and a screening tool is hard; meeting it with an integrated platform plus a practitioner bench is what the bar is calibrated for. Second, the cost of non-compliance went up: the March 2026 AMP increase lifted per-violation ceilings under the PCMLTFA across all three severity tiers, and because the per-occurrence model is unchanged, a foundational deficiency aggregates fast. Third, the cost of in-house compliance is unrecoverable, since senior practitioner salaries have not fallen. For most lean firms, the worst-case aggregate exposure now exceeds the lifetime cost of a strong CaaS subscription, often by a wide margin.
Sources
Whichever model you choose, the screening layer matters.
Book a platform demo and see real-time sanctions, PEP, and adverse-media screening with audit-ready case history.
Book a platform demo