FINTRAC identification requirements

Amendments to the Canadian Know Your Customer/Anti-Money Laundering (KYC AML) regulations — the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) — were registered on June 25, 2019.

As most of the requirements are in force as of June 1, 2021, the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) has published its obligations for Reporting Entities (REs) and offered guidance. Due to the pandemic, FINTRAC will have some flexible measures in assessing and enforcing compliance with the new requirements.

Compliance teams need to understand the exact nature and new timelines of their identification reporting, record-keeping and other KYC/AML obligations.

FINTRAC-approved identity verification methods

There are now five identity verification methods approved by FINTRAC, up from three methods in previous guidance. However, the actual processes aren’t substantially different; as stated by Canadian business law firm Osler, “With respect to individuals, the difference from the prior guidance is entirely cosmetic, and the methods are all familiar.”

1. Government-issued photo identification method

An authentic, valid and current identity document issued by a federal, provincial, or territorial government (or an equivalent foreign government document). The data requirements are:

  • Full name
  • Unique identifying number
  • Photo

Of course, the information needs to match the name and appearance of the person.

FINTRAC states remote processes are valid, “but you must have a process in place to authenticate the government-issued photo identification document.” The use of document verification is a legal process to help establish identity. However, the document’s information needs to be corroborated (for example, using a selfie or a live video stream).

You need to do both steps and your compliance program’s policies and procedures must describe the processes. You must record:

  • Full name
  • Date of verification
  • Document type
  • Unique identifying number
  • Jurisdiction (province or state) and country of issue
  • The document expiry date, if available

2. Credit file method

This involves credit file information from a Canadian credit bureau that is valid and current. The requirements are:

  • The file is at least three years old
  • Contains information from more than one source
  • Matches the name, address and date of birth of the person

The file check must occur at the time of the identity check. So, automatic methods like online identity verification can provide you with valid and current information from the person’s credit file.

If the person’s information doesn’t match the credit file record, information from another credit bureau, or another method, must be used. However, if there’s a minor variation or discrepancy, you may determine that the information still matches; a manual verification might indicate it’s just a typo, a slightly out-of-date address, or a similar non-essential difference.

You must record:

  • Full name
  • Date of the credit file search
  • Name of the Canadian credit bureau or third-party vendor as the source holding the credit file
  • The person’s credit file number

Your compliance program’s policies and procedures must describe the processes to ensure the information is valid and current and what remediation steps need to be taken if it isn’t.

3. Dual-process method

This verification method requires validating current information from two different reliable sources. For a successful verification, two of the following conditions require confirmation:

  • Name and address
  • Name and date of birth
  • Name and a deposit account, a prepaid payment product account, or a credit card or other loan account with a financial entity

If using a credit file to meet the third condition, the file only needs to be six months old. Thus, the dual-process method is often helpful to verify thin-file customers who don’t have a long-term credit file available.

A reliable source is well known and reputable — like a government, Crown corporation, financial institution, or utility. Address verification can use sources like insurance documents, employment records, or student transcripts. Also, an aggregator of sources can provide information that meets two conditions, as long as the sources are different (referred to as different tradelines).

You must record:

  • Full name
  • Date of verification
  • Name of the two different reliable sources
  • Information type
  • The number associated with source information

4. Affiliate or member method

You may rely on verifications performed by an affiliate, foreign affiliate or another member of your financial services or credit union group. These data points must match:

  • Full name
  • Address
  • Date of birth

The initial verification must have used the government-issued photo identification method, the credit file method, or the dual-process method. It’s your responsibility to ensure the identity is verified correctly; a re-verification may be necessary if any doubt exists.

You must record:

  • Full name
  • The date on which you verified the identity
  • Name of the affiliate or the member
  • The previous method used
  • Information that the affiliate or the member recorded

5. Reliance method

You may rely on a verification performed by another RE or an affiliated foreign entity. The affiliated foreign entity must be an affiliate of a RE and carry out activities outside of Canada that is consistent with being an RE (for example, a foreign bank subsidiary).

The identity information obtained must be valid and current and gathered in a consistent manner with the PCMLTFA at the time. Using this method requires careful consideration of the risk of money laundering or terrorist financing, especially if dealing with foreign entities.

You must record:

  • Full name
  • The written agreement or arrangement with the other RE or affiliated foreign entity to verify a person’s identity
  • Information that the other RE or affiliated foreign entity referred to verify the person’s identity

PIPEDA - key points for compliance

Identity verification methods for entities

Just as REs must verify a person’s identity, they must also identify entities like corporations, trusts, partnerships, funds, or unincorporated associations or organizations. There are three acceptable methods.

1. Confirmation of existence method
An authentic, valid and current record that demonstrates the organization is real and still exists. If the entity is a corporation, you need one of the following:

  • Certificate of incorporation
  • Annual filing record under provincial securities legislation
  • Most recent version of any other record that confirms the corporation’s existence and contains its name and address, as well as the names of its directors

If it’s not a corporation, you need one of the following:

  • Partnership agreement
  • Articles of association
  • Most recent version of any other record confirming its existence and containing its name and address

In either case, you may use electronic methods, such as available with Trulioo GlobalGateway Business Verification. You must record the:

  • Registration number
  • Type of record
  • Source of the electronic version of the record

2. Reliance method
The rules around the reliance method to identify an entity are similar to the reliance method rules mentioned above. You need to collect and record the information used to confirm the identity of the corporation or other entity.

3. Simplified identification method
If an entity is determined to be a low risk during the risk assessment process, you may use a simplified identification method. FINTRAC notes seven specific types of entities, including public companies and government agencies, eligible for this method. You must record:

  • Grounds for considering there is a low risk of a money laundering offense or terrorist financing
  • Entity information, persons that assure the entity exists and that the persons you deal with are authorized to act on behalf of the entity

Other FINTRAC June 2021 changes

Beneficial ownership

All REs must now report beneficial ownership information. FINTRAC states, “You must take reasonable measures to confirm the accuracy of the beneficial ownership information when you first obtain it and in the course of conducting ongoing monitoring of your business relationships.” These measures include the entity’s CEO and screenings for politically exposed persons (PEPs) or heads of international organizations (HIOs).

While there are different requirements for different entity structures, in general, you need to collect the names and addresses of all persons who directly or indirectly own or control 25% or more of the entity.

Virtual currency transactions
Any service that deals extensively with virtual currencies, like exchanges or transfer services, are now considered money service businesses (MSBs). All MSBs must report any virtual currency transactions or set of transactions over $10,000 in a 24-hour period.

Travel rule
Financial entities, MSBs, foreign MSBs and casinos need to obtain (and potentially report) certain information concerning electronic funds transfers or virtual currency transfers:

  • Name, address and account number or other reference numbers (if any) of the person or entity who requested the transfer
  • Name and address of the beneficiary
  • If applicable, the beneficiary’s account number or other reference numbers

Identity verification services in Canada

If you require further clarification or information regarding identity requirements in Canada, please contact Trulioo. We are a Canadian-based company that provides identity, document and business verification services in more than 195 countries, with coverage of over 5 billion people and 330 million companies.