FINTRAC Insights: An Overview of Canada’s Identity Verification Guidelines and Reporting Obligations

Reporting entities operating in Canada must comply with Canadian Know Your Customer (KYC) and Anti-Money Laundering (AML) regulations under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) enforced by the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC).

The obligations include verifying individuals and business entities throughout the customer life cycle. For businesses, FINTRAC requires confirmation of legal existence and verification of beneficial owners with 25% or more control, directors, shareholders and authorized representatives. 

The measures help prevent financial crime, support law enforcement and improve corporate ownership transparency.

To remain compliant, organizations must adopt verification methods that align with FINTRAC’s guidelines, ensure accurate recordkeeping and maintain up-to-date customer information through ongoing monitoring and remediation.

Evolving FINTRAC Requirements

Canada updated the PCMLTFA in 2024. The amendments include an expanded definition of reporting entities, bringing more industries under FINTRAC oversight. 

Business sectors under FINTRAC requirements to establish and maintain full compliance programs include payment service providers, crowdfunding platforms, mortgage administrators, and brokers and lenders. The changes have significant implications for fintech companies, gig economy platforms, online marketplaces and other industries that may not have operated with formal Know Your Business processes.

Many newly regulated organizations may have not collected comprehensive business identity or beneficial ownership data during onboarding, particularly in cases involving small or sole proprietorships. As a result, those entities now face the challenge of conducting potentially large-scale reverification to meet FINTRAC’s requirements.

For organizations with a large number of historical records, the process can involve verifying tens of thousands of businesses at once. FINTRAC expects entities to take reasonable measures to confirm the accuracy of beneficial ownership information and to ensure onboarding records reflect current legal and operational statuses.

With discrepancy reporting requirements – under which regulated entities report material mismatches between internal records and government registries – taking effect in October 2025, organizations must review and update their client base to avoid regulatory scrutiny and operational exposure.

Sanctions Evasion

All registered entities must report incidents of suspected sanctions evasion that violate the United Nations Act, the Special Economic Measures Act or the Justice for Victims of Corrupt Foreign Officials Act.

Business Relationship

Money service businesses must now verify a person within five years of entering a business relationship for the second time. They must now verify a business entity when entering a service agreement.

Ongoing monitoring requirements for business relationships include keeping client identification information up to date based on risk assessment.

Politically Exposed Persons

When organizations become aware a customer is a politically exposed person, they must establish the person’s financial source and apply enhanced due diligence such as additional identity verification and ongoing monitoring. Transactions exceeding $100,000 also trigger those requirements.

The changes mark a shift in how Canada enforces sanctions. Registered entities now face the challenge of strengthening their compliance programs to meet new reporting requirements and spot signs of sanctions evasion. 

Business Entity Verification Methods

FINTRAC requires organizations to verify business entities such as corporations, trusts, partnerships, funds or unincorporated organizations. There are three acceptable verification methods.

1. Confirmation of Existence

This method involves verifying a valid record that shows the organization is real and still operating. Enterprises can use digital business verification and must record the:

• Registration number
• Type of record
• Source for the record

2. Reliance

The reliance method lets organizations rely on verification performed by another registered entity or its affiliated foreign entity. The affiliated foreign entity must operate outside Canada in a way consistent with a registered entity, such as a foreign bank subsidiary.

The information used in reliance must be valid and verified in a manner consistent with the PCMLTFA at the time of verification. The reliance method requires an emphasis on money laundering or terrorist financing risks.

3. Simplified Identification

An organization can use this method if an assessment determines a business entity is low risk. FINTRAC notes the business entities, including public companies and government agencies, eligible for the method. 

Recordkeeping, Transaction Reporting and Beneficial Ownership

Registered entities must provide records to FINTRAC within 30 days of a request. Those include:

• Transactions of $3,000 or more
• Electronic funds transfers of $1,000 or more
• Account operating agreements

Registered entities must report suspicious transactions that could reasonably have a connection to money laundering or terrorist financing. Large cash transaction reports are required when they exceed CAD $10,000. 

Registered entities also must  take reasonable measures to confirm the accuracy of beneficial ownership information. There are different requirements for different entity structures, but organizations generally need to verify the names and addresses of everyone who directly or indirectly owns or controls 25% or more of the entity.

FINTRAC-Approved Identity Verification Methods

FINTRAC has approved five identity verification methods.

1. Government-Issued Photo Identification

This method requires a valid, current identity document, or an equivalent foreign document, issued by a federal, provincial or territorial government. The document must have a full name, unique identification number and photo.

FINTRAC allows for remote document verification. The information on the document must be corroborated through, for example, a selfie or a live video stream.

2. Credit File

This involves verifying valid, current credit file information from a Canadian credit bureau. The credit file must be at least three years old, provide information from more than one source and hold data that matches the person’s name, address and birth date.

The file check must occur at the time of identity check. Automatic methods such as digital identity verification can accelerate the process by providing valid information from the credit file.

If the person’s information doesn’t match the credit file, the organization must access data from another credit bureau or use a different verification method. The credit data verification must record:

• Full name
• Date of the credit file search
• Name of the Canadian credit bureau or third-party vendor holding the file
• The person’s credit file number

3. Dual Process

This verification method requires validating information from two reliable sources. A successful verification must include two of the following conditions.

• Name and address
• Name and birth date
• Name and a deposit account, a prepaid payment product account or a credit card or loan account

If an organization uses a credit file to meet the third condition, the file needs to be only six months old. That makes the dual-process method helpful in verifying thin-file customers who don’t have a long-term credit file.

A verification partner with access to multiple data sources can provide information that meets two conditions as long as the sources are different.

Organizations that use the dual process must record:

• Full name
• Verification date
• The two reliable sources
• Information type
• The number associated with source information

4. Affiliate

In this method, registered entities can rely on verifications performed by an affiliate, foreign affiliate or member of the same financial services or credit union group. The full name, address and birth date data points must match.

The affiliate’s verification must have used the government-issued photo identification, credit file or dual-process methods. It’s the organization’s responsibility to either ensure the identity was correctly verified or reverify it.

The registered entity must record:

• Full name
• The date when it verified the identity
• Name of the affiliate
• The method used by the affiliate
• Information the affiliate recorded

5. Reliance

The reliance method rules for identity verification are similar to those for businesses. The organization must collect and record the data used to verify the identity.

Identity Verification Services in Canada

Trulioo helps organizations navigate the complexities of the Canadian regulatory landscape while streamlining identity and business verification.

When organizations blend Trulioo nondocumentary coverage with services such as fraud intelligence, document verification, business verification, watchlist screening and adverse media checks, they create a holistic onboarding strategy that can lead to ironclad compliance and industry-leading match rates in Canada.

Trulioo provides real-time access to all business registries in Canada, including federal and provincial. That vast data source network, combined with Trulioo local expertise and cutting-edge technology, delivers up-to-date official information, such as firmographics or details about directors and officers, to registered entities. Trulioo also provides corporate profile PDFs for simplified recordkeeping.

That full suite of in-house verification capabilities through a single, global platform gives organizations the insight and flexibility to overcome any onboarding challenge in Canada.

This post was updated in June 2025 to reflect the latest regulatory updates.