FINTRAC Insights: An Overview of Canada’s Identity Verification Guidelines and Reporting Obligations

Reporting entities operating in Canada must comply with Canadian Know Your Customer (KYC) and Anti-Money Laundering (AML) regulations under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA).

Canada’s AML and KYC requirements include client identification and reporting. They’re designed to prevent money laundering, assist law enforcement and combat financial crime.

The Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) developed the KYC and AML obligations. It offers guidance to help compliance teams understand the requirements and timelines for identity verification reporting and recordkeeping.

Organizations that use best practices such as a robust compliance program, a compliance officer and up-to-date records that align with regulations can ensure their compliance with the requirements.

FINTRAC-Approved Identity Verification Methods for KYC in Canada

FINTRAC has approved five identity verification methods.

1. Government-Issued Photo Identification

This method requires a valid, current identity document, or an equivalent foreign document, issued by a federal, provincial or territorial government. The document must have a full name, unique identification number and photo.

FINTRAC allows for remote document verification. The information on the document must be corroborated through, for example, a selfie or a live video stream.

An organization’s compliance policies and procedures must describe the process and record the person’s full name, verification date, document type, identification number, issuing country and document expiration date.

2. Credit File

This involves verifying valid, current credit file information from a Canadian credit bureau. The credit file must be at least three years old, provide information from more than one source and hold data that matches the person’s name, address and birth date.

The file check must occur at the time of identity check. Automatic methods such as digital identity verification can accelerate the process by providing valid information from the credit file.

If the person’s information doesn’t match the credit file, the organization must access data from another credit bureau or use a different verification method. But if there’s only a minor variation, the organization may determine the data matches because a manual verification might indicate it’s a typo, a slightly out-of-date address or a similar nonessential difference.

The credit data verification must record:

• Full name
• Date of the credit file search
• Name of the Canadian credit bureau or third-party vendor holding the file
• The person’s credit file number

The organization’s compliance policies must describe how the process ensures the information is valid and what remediation steps to take if it isn’t.

3. Dual Process

This verification method requires validating information from two reliable sources. A successful verification must include two of the following conditions.

• Name and address
• Name and birth date
• Name and a deposit account, a prepaid payment product account or a credit card or loan account with a financial entity

If an organization uses a credit file to meet the third condition, the file needs to be only six months old. That makes the dual-process method helpful in verifying thin-file customers who don’t have a long-term credit file.

Reliable, reputable sources include governments, financial institutions and utilities. The address verification process can rely on sources such as insurance documents, employment records and student transcripts. 

A verification partner with access to multiple data sources can provide information that meets two conditions as long as the sources are different.

Organizations that use the dual process must record:

• Full name
• Verification date
• The two reliable sources
• Information type
• The number associated with source information

4. Affiliate

In this method, registered entities can rely on verifications performed by an affiliate, foreign affiliate or member of the same financial services or credit union group. The full name, address and birth date data points must match.

The affiliate’s verification must have used the government-issued photo identification, credit file or dual-process methods. It’s the organization’s responsibility to either ensure the identity was correctly verified or reverify it.

The registered entity must record:

• Full name
• The date when it verified the identity
• Name of the affiliate
• The method used by the affiliate
• Information the affiliate recorded

5. Reliance

The reliance method lets organizations rely on verification performed by another registered entity or its affiliated foreign entity. The affiliated foreign entity must operate outside Canada in a way consistent with a registered entity, such as a foreign bank subsidiary.

The identity information used in reliance must be valid and verified in a manner consistent with the PCMLTFA at the time of verification. The reliance method requires an emphasis on money laundering or terrorist financing risks.

The registered entity must record:

• Full name
• The written agreement with the registered or affiliated foreign entity to verify the identity
• Information the registered or affiliated foreign entity used to verify the identity

Business Entity Verification Methods

FINTRAC also requires organizations to verify business entities such as corporations, trusts, partnerships, funds or unincorporated organizations. There are three acceptable verification methods.

1. Confirmation of Existence

This method involves verifying a valid record that shows the organization is real and still operating. If the entity is a corporation, the registered entity needs one of the following.

• Certificate of incorporation
• Annual filing record under provincial securities legislation
• Most recent version of any other record that confirms the corporation’s existence and includes its name, address and directors

If it’s not a corporation, the organization needs one of the following.

• Partnership agreement
• Articles of association
• Most recent version of any other record confirming its existence and showing its name and address

In either case, organizations can use digital business verification and must record the:

• Registration number
• Type of record
• Source for the record

2. Reliance

The reliance method rules for business entity verification are similar to those for individuals. The organization must collect and record the data used to verify the business entity.

3. Simplified Identification

An organization can use this method if an assessment determines a business entity is low risk. FINTRAC notes the business entities, including public companies and government agencies, eligible for the method. 

The registered entity must record:

• Grounds for determining a low risk of a money laundering or terrorist financing
• Entity information, people who assure the entity exists and those who are authorized to act on the entity’s behalf

Recordkeeping, Transaction Reporting and Beneficial Ownership

Registered entities must provide records to FINTRAC within 30 days of a request. Those include:

• Records of transactions of $3,000 or more
• Records of electronic funds transfers of $1,000 or more
• Account records
• Intended use of an account
• Applications
• Account operating agreements

Registered entities must report suspicious transactions that could reasonably have a connection to money laundering or terrorist financing. Large cash transaction reports are required when they exceed CAD $10,000. 

Registered entities also must report beneficial ownership information. 

“You must take reasonable measures to confirm the accuracy of the beneficial ownership information when you first obtain it and in the course of conducting ongoing monitoring of your business relationships,” according to FINTRAC.

Those measures include confirming the entity’s CEO and screening for politically exposed persons (PEPs) or heads of international organizations. There are different requirements for different entity structures, but organizations generally need to verify the names and addresses of everyone who directly or indirectly owns or controls 25% or more of the entity.

Verifying Vulnerable Populations

FINTRAC provides a path for organizations to remain compliant while onboarding retail deposit accounts for people who don’t have identity verification documentation or information.

Organizations can apply a flexible, risk-based approach to onboarding those people for basic retail deposit accounts until they can get an ID. Some requirements include:

• Documenting procedures
• Monitoring the progress of customer identification
• Identifying people within a reasonable timeframe

2024 FINTRAC Changes

The PCMLTFA was updated in July 2024. New FINTRAC requirements cover systems to report sanctioned property and prevent evasion. Money service businesses must submit agents’ criminal record checks to FINTRAC, ensure compliance among top officials and significant shareholders, and renew checks every two years.

Sanctions Evasion

All registered entities must report incidents of suspected sanctions evasion that violate the United Nations Act, the Special Economic Measures Act or the Justice for Victims of Corrupt Foreign Officials Act.

Business Relationship

Money service businesses must now verify a person within five years of entering a business relationship for the second time. They must now verify a business entity when entering a service agreement.

Ongoing monitoring requirements for business relationships include keeping client identification information up to date based on risk assessment.

PEPs

When organizations become aware a customer is a politically exposed person, they must establish the person’s financial source and apply enhanced due diligence such as additional identity verification and ongoing monitoring. Transactions exceeding $100,000 also trigger those requirements.

The changes mark a shift in how Canada enforces sanctions. Registered entities now face the challenge of strengthening their compliance programs to meet new reporting requirements and spot signs of sanctions evasion. 

Identity Verification Services in Canada

Trulioo helps organizations navigate the complexities of the Canadian regulatory landscape while streamlining identity and business verification.

When organizations blend Trulioo data coverage with services such as fraud intelligence, document verification, watchlist screening and adverse media checks, they create a holistic onboarding strategy that can lead to ironclad compliance and industry-leading verification rates in Canada.

Trulioo provides real-time access to all business registries in Canada, including federal and provincial. That vast data source network, combined with Trulioo local expertise and cutting-edge technology, delivers up-to-date official information, such as firmographics or details about directors and officers, to registered entities. Trulioo also provides corporate profile PDFs for simplified recordkeeping.

That full suite of in-house verification capabilities through a single, global platform gives organizations the insight and flexibility to overcome any onboarding challenge in Canada.