Autowrite's OrganizationVisit Website →
← Back to blog

Canadian Brokers: FINTRAC 5 year vs FSRA 6 year on Mortgage Files

September 16, 2026
Canadian Brokers: FINTRAC 5 year vs FSRA 6 year on Mortgage Files

FINTRAC requires mortgage brokers, lenders, and administrators to keep reports and related records for at least 5 years, reducible within 30 days of a request. Provincial regulators often set a longer bar. FSRA expects Ontario brokerages to hold records for six years after a mortgage expires or renews, and other provinces layer on their own prescribed periods. When federal and provincial rules disagree, the longer period wins. Skip straight to the checklist below to see how that plays out on an actual file.

TL;DR:

  • Federal rules require mortgage-related records to be retained for at least five years, with provincial regulators like FSRA often extending this period to six years after expiry or renewal.
  • Accurate recordkeeping must include client identification, transaction documentation, and informal communication like emails and call summaries, as regulators expect a complete narrative of each file.
  • Files must be stored in a legible, searchable electronic format with proper indexing, backups, and access controls to meet legal standards and facilitate a 30-day regulator request window.
  • When multiple regulations apply, the longest retention period governs, and clear documentation of the chosen rule helps during audits to demonstrate compliance.
  • Automation tools like Autowrite can automate classification, tagging, and storage of files, significantly reducing the risk of retention gaps and enabling faster, more reliable regulator response.
Autowrite
Reduce Mortgage Filework
Autowrite streamlines document intake, classification, extraction, underwriting, and compliance for mortgage brokers managing retention requirements.
Explore Autowrite

Table of Contents

Document Retention Mortgage Canada: Quick Compliance Checklist

Before touching policy documents or vendor contracts, run this checklist against your current file room, whether that is a physical cabinet or a cloud folder. It surfaces the gaps that actually get flagged during a regulator review.

Minimum retention periods by record type:

  • FINTRAC reports and related records: 5 years from submission or from the date the record was created
  • FSRA-regulated files (Ontario): 6 years after mortgage expiry, renewal, or transaction completion
  • Nova Scotia prescribed records under the Mortgage Regulation Act: varies by record category, so check the schedule for each file type
  • Tax-relevant mortgage records that touch investor reporting: 6 years from the end of the relevant tax year, per Canada Revenue Agency guidance
  • Closing documents lenders require lawyers to hold as originals: retained per lender instruction, often indefinitely post-closing

Two moves fix most retention gaps fast:

  1. Centralize and tag. Pull scattered PDFs, emails, and scanned originals into one system and tag each file by regulator, province, and expiry date. A file with no jurisdiction tag is a file nobody can defend on short notice.
  2. Automate the calendar. Set reminders tied to mortgage expiry dates, not calendar years, since that is the trigger most provincial rules actually use.

Before you close this checklist, confirm two things: every file can be exported in a legible, readable format on demand, and someone specific, not "the team", owns each file's retention clock. Regulators ask "who has this" during audits far more often than brokers expect.

What Does FINTRAC Require You to Keep, and for How Long?

FINTRAC's rules are the federal floor, and they apply regardless of which province you operate in. Mortgage administrators, brokers, and lenders fall under FINTRAC's reporting entity obligations, which means specific document categories carry specific clocks.

Statistic Callout: FINTRAC mandates a minimum 5-year retention period for submitted reports and associated records, with a 30-day window to produce them once requested.

Four record categories matter most for mortgage transactions:

  • Reports submitted to FINTRAC. Copies of any report you filed, suspicious transaction reports included, must be kept for 5 years starting from the submission date.
  • Information records. Client identification, verification documents, and beneficial ownership records fall under the same 5-year window, counted from the date the record was created or the last business transaction, whichever comes later.
  • Mortgage loan records. Application details, loan terms, and funding documentation need 5 years of retention from the date the file was created or last touched.
  • Receipt-of-funds records. Documentation showing where down payment funds or loan proceeds originated needs the same 5-year floor.

The starting point for that 5-year clock depends on the record type, and this is where brokers most often miscalculate. A report you filed on a live file starts counting from submission, not from when the mortgage eventually closes or renews. A client identification record, by contrast, resets its clock every time there is a new business transaction with that client, so a repeat borrower's file might never actually hit its expiry date if they keep coming back.

Production obligations matter as much as the retention length itself. FINTRAC expects records to be producible within 30 days, and it accepts electronic copies as long as they are legible and complete. That means a scanned PDF buried in an unsearchable email archive technically satisfies the letter of the rule but fails the spirit of it, and likely fails the 30-day window in practice if nobody can find it fast. A broker whose files aren't already indexed by client name, transaction date, and record type is gambling on never getting a real request. Given how AML enforcement has tightened across financial services, that's not a bet worth making. The anti-money laundering compliance obligations that trigger many of these reports carry their own documentation trail, and that trail needs to live inside the same retention system, not off to the side.

FSRA, Nova Scotia, Alberta: Which Retention Rule Actually Applies to You?

Federal rules set the floor. Provincial regulators frequently build a higher ceiling, and the rule that governs your file is whichever one runs longer, not whichever one you happen to remember first.

Ontario (FSRA). FSRA expects mortgage brokerages and administrators to retain relevant records for six years after the mortgage term or renewal expires, or after the transaction completes. That six-year window covers financial records, applications, and correspondence, including informal communications like emails and call summaries. A funded file that closes in March 2026 on a 5-year term needs its records held until roughly 2037, not just five or six years from the closing date. An unfunded application, one that never closed, still falls under the same expectation once you count from whatever "completion" means for that file, so don't assume dead deals are exempt.

Mortgage file retention timeline illustration

Nova Scotia. The Mortgage Regulation Act's record-keeping regulations go further than most provinces by prescribing exactly which records must exist and how they must be filed and indexed, not just how long to keep them. Certain categories carry specific retention windows tied to when the application was made or when the mortgage transaction closed, and the regulation spells out indexing requirements that most other provinces leave to broker discretion. A Nova Scotia brokerage that treats its record-keeping the way an Ontario brokerage does risk missing the indexing piece entirely, since FSRA's guidance doesn't mandate a specific filing structure the way Nova Scotia's regulation does.

Alberta and other provinces. Retention expectations vary more by regulator interpretation than by dramatically different statutory language, but storage location, permitted formats, and prescribed periods still shift province to province. The practical move is to confirm which regulator has jurisdiction over each file, sometimes based on the mortgage property's location rather than the broker's home office, and check that regulator's current guidance directly rather than relying on a rule of thumb carried over from a different province.

How to pick the right rule when more than one applies:

  • Identify every regulator with jurisdiction: federal (FINTRAC always applies), provincial licensing body, and any lender-specific contractual retention clause.
  • Compare the retention windows each one sets for that specific record type.
  • Apply the longest period among them, not the average and not the one that's easiest to schedule.
  • Document which rule you applied and why, so an auditor can see your reasoning rather than guessing at it.

That last point matters more than it sounds. A file retained for six years under FSRA guidance but missing a note explaining why looks identical, from an auditor's chair, to a file retained for six years by accident.

Which Records and Communications Actually Belong in the File?

Regulators don't just want the closing package. They want enough material to reconstruct why decisions were made, which means the file has to include more than the polished, formal documents most brokers default to keeping.

Core transaction documents:

  • Signed mortgage application and any amendments
  • Government-issued identification and verification records
  • Income documentation: pay stubs, T4s, notices of assessment, or business financials for self-employed borrowers
  • Appraisal reports and property valuation records
  • Title search results and title insurance documentation
  • Closing statements and lender funding instructions
  • Correspondence containing lender conditions or condition waivers

Informal records regulators expect to see:

  • Emails discussing rate changes, condition extensions, or client concerns
  • Summaries of phone calls where a material decision was discussed
  • Text message logs, or written summaries of them, when they contain substantive transaction details

An FSRA finding makes clear that regulators evaluate a file as a narrative. When the formal documents are all present but the informal trail is missing, the file often reads as incomplete during an audit, even if nothing was actually done wrong. A missing call note about why a rate hold was extended looks, on paper, like a gap the broker can't explain.

Pro Tip: Treat every client text thread as a document with a retention clock. If a conversation touches loan terms, conditions, or funding, screenshot it into the file the same day, before it disappears into a phone upgrade or a deleted app.

Originals versus copies is its own question, and the Canadian Bar Association's guidance is direct about it: lenders increasingly require the closing lawyer to retain original signed documents after the transaction closes, shifting that storage burden onto the legal side rather than the brokerage. Brokers should still keep their own scanned copies for reference and production purposes, but shouldn't assume they are the party responsible for the original wet-ink signature page. Confirming who holds originals up front, and getting that in writing as part of lender instructions, avoids a scramble later when a title dispute surfaces years after closing.

How Should You Store Records to Satisfy Canadian Regulators?

Storage is where good retention policies quietly fail. A brokerage can have the right retention periods written down and still lose a file simply because nobody can locate or read it years later.

Electronic storage baseline:

  • Files must remain legible for the entire retention period, not just at the point of scanning
  • Every record needs indexing by client, transaction date, and record type, or production within 30 days becomes a manual search project
  • Backups should run on a schedule that survives a single point of failure, meaning one server crash shouldn't threaten the only copy of a file
  • Systems need an audit trail showing who accessed or modified a record and when

The Canadian Bar Association notes that provincial electronic commerce laws give scanned records the same legal weight as paper originals, provided they're stored and managed under prescribed rules. That's good news for anyone tired of physical filing cabinets, but it comes with a condition: "stored and managed properly" is doing a lot of work in that sentence, and a folder of unlabeled PDFs on a shared drive doesn't meet it.

Data residency deserves a direct answer, not an assumption. Some brokerages assume Canadian client records must physically sit on Canadian servers. That's not universally mandated, but many provincial privacy expectations and client comfort levels push firmly in that direction, and several vendors market Canadian residency specifically because clients ask for it. If a vendor stores data outside Canada, that needs to be disclosed, and the contract should spell out what happens to the data if the vendor's business changes hands or shuts down. The data residency question is worth resolving before signing, not after a client asks where their SIN and income documents actually live.

Pro Tip: Ask any storage vendor for a sample breach notification timeline before you sign, not after something goes wrong. A vendor that can't answer quickly is telling you something about how prepared they actually are.

Access controls round out the picture: role-based permissions so junior staff can't pull every client file in the office, encryption at rest and in transit, and a documented secure disposal process once a retention period actually expires. Files that outlive their legal retention requirement without a documented reason become a liability under PIPEDA rather than a compliance asset, since organizations are expected to dispose of personal information once it's no longer needed for the purpose it was collected.

What Happens When a Regulator Requests Your Files?

A production request is where a retention policy either proves itself or falls apart in front of an auditor. FINTRAC's 30-day window is tight, and it assumes your files are already organized, not that you'll organize them once the letter arrives.

  1. Confirm the scope of the request immediately. Identify exactly which files, date ranges, and record types the regulator wants before pulling anything.
  2. Assign a single file owner. One person coordinates the response, verifies completeness, and tracks what's been sent, rather than three people assembling overlapping pieces.
  3. Build an index before sending documents. A table of contents with page references saves the reviewer time and makes gaps in your own file obvious before the regulator finds them.
  4. Redact only what the law permits. Unrelated third-party personal information sometimes needs redaction, but check with legal counsel before withholding anything tied to the actual request.
  5. Log chain of custody. Note who pulled each document, when, and from which system, in case the regulator asks how the file was assembled.
  6. Loop in legal counsel early if the request touches a disputed transaction or a client complaint, not after a response is already drafted.

Brokerages that pass audits smoothly tend to share one trait: nothing about the request surprises them, because their files were already indexed and complete before the letter arrived.

Building a Retention Policy That Actually Holds Up

A written policy that nobody follows isn't a policy, it's a document that will be used against you in an audit. Building one that operates day to day means covering specific ground.

What a working policy needs to define:

  • Scope: which entities, agents, and file types the policy covers
  • Record categories mapped to their specific retention period and starting trigger
  • Storage locations and who has access to each category
  • Destruction rules: how, when, and who authorizes disposal
  • Review frequency, since regulator guidance changes and a policy written in 2022 may already be outdated

Steps to put it into practice:

  1. Inventory every record type your brokerage currently generates or receives.
  2. Map each record type against federal, provincial, and lender-specific retention rules, and select the longest one for each category.
  3. Assign retention triggers to actual dates, mortgage expiry, transaction completion, or record creation, rather than a flat calendar year.
  4. Set up automated reminders tied to those trigger dates, not a generic annual review.
  5. Require secure destruction certificates when files are disposed of, so there's proof the disposal happened correctly and on schedule.
  6. Audit a sample of files twice a year against the policy to catch drift before a regulator does.

The hardest part isn't writing the policy. It's the ongoing discipline of applying it consistently across every agent and every file type, especially when agents use personal email accounts that the brokerage itself remains legally responsible for. FSRA guidance is explicit that the brokerage carries that responsibility regardless of which device or account an agent used, so written agreements with agents about record access need to be part of the policy, not an afterthought.

Can Automation Actually Reduce Retention Risk?

Manual retention tracking works until a brokerage hits a certain file volume, and most hit that ceiling faster than they expect. Automated classification and metadata tagging solve the two problems that break manual systems: files getting mislabeled, and retention clocks getting forgotten.

A centralized system that automatically tags each document with its category, jurisdiction, and expiry date turns a 30-day FINTRAC production request from a scramble into an export. Autowrite, an AI-powered operating system built for Canadian mortgage brokers, automates document classification and data extraction as part of its underwriting workflow, which means files arrive already sorted by type rather than needing manual triage months or years later. That kind of automated document workflow doesn't replace a retention policy, but it makes the policy actually enforceable instead of aspirational.

Before adopting any automation platform for retention purposes, run it through a short governance check:

  • Confirm where data physically resides and whether that meets your brokerage's residency commitments to clients
  • Verify the platform maintains audit logs showing who accessed or modified a record
  • Test whether the system can actually produce a complete, indexed file within FINTRAC's 30-day window
  • Ask how the vendor handles data if your contract ends, since retention obligations don't disappear when a software subscription does

Automation earns its place in a compliance stack only when it can prove those four things, not because it sounds efficient on a sales call.

Retention Isn't Paperwork. It's Risk Management With a Deadline

Most brokers treat document retention as a filing chore, something to tolerate rather than something that protects them. That's backwards. A complete, well-indexed file is often the only thing standing between a broker and a bad outcome when a client disputes a transaction three years after closing, or when a regulator opens a routine audit and finds a firm that clearly knew what it was doing.

The brokerages that handle this well share a pattern: they centralize records the moment a file opens, rather than reconstructing history after the fact. That habit pays off far more in disputes and audits than in day-to-day operations, which is exactly why it gets neglected. Nobody feels the cost of a missing call note until the day they need it.

Automation changes the economics of this, not because software replaces judgment, but because it removes the excuse of "we didn't have time to file it properly." Tools built specifically for Canadian mortgage workflows can carry that operational weight so brokers spend their attention on clients instead of folder structures.

— Anant Bawa

Autowrite: Centralize Retention Without the Manual Filing Grind

Autowrite is the alternative to manual document filing for brokerages managing retention across federal FINTRAC rules and provincial regulators like FSRA: it classifies and tags every incoming file automatically, so the retention clock and jurisdiction tag are attached the moment a document lands, not months later during an audit scramble.

Autowrite

That matters most in the exact scenario this article walks through: a 30-day FINTRAC production request, or a six-year-old FSRA file review, where the difference between an organized brokerage and a disorganized one is whether someone can actually find the record. The system extracts data and classifies files as they come in, with Canadian data residency built into how client information is stored, which removes one of the biggest open questions brokers face when picking a storage vendor. Instead of building a retention system from scratch with spreadsheets and calendar reminders, brokers get a system already structured around how Canadian mortgage files actually move from intake to closing to long-term storage. If your current file room would make you nervous during a regulator call this week, start a trial with Autowrite and see how classification and retrieval work on your own files before your next audit cycle.

Sources

FAQ

There's no single national retention law covering all documents. Mortgage-specific federal rules set a 5-year floor for FINTRAC reports and related records, while provincial regulators like FSRA often require six years, and tax-related records generally follow a six-year CRA guideline.

What does retention mean on a mortgage?

In this context, retention refers to the legally required length of time a broker, lender, or administrator must keep a mortgage file's records, along with the format and access requirements that make those records producible if a regulator requests them.

What records need to be kept for 6 years in Canada?

Ontario's FSRA guidance requires mortgage brokerages to retain relevant records for six years after a mortgage's term or renewal expires, or after the transaction completes, covering applications, financial records, and correspondence. Tax-related records generally follow a similar six-year window under CRA guidance, counted from the end of the relevant tax year.

Does Autowrite help with mortgage document retention compliance?

Autowrite automates document classification and data extraction for Canadian mortgage brokers, which helps organize files by category and jurisdiction as they're created rather than after the fact, supporting faster production if a regulator requests records within FINTRAC's 30-day window.

How long should you keep records for an unfunded mortgage application?

An unfunded application still falls under retention obligations once you identify which rule applies, typically counted from the date the file was created or last actively worked, and the same federal and provincial minimums that apply to funded files generally apply here too.