On July 4, the Canadian federal government released updated proposed regulations under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA). The amendment includes significant changes to the anti-money laundering (AML) and combating the financing of terrorism (CFT) rules that aims to provide more flexibility for businesses offering financial services online by issuing more principle-based regulation and less prescriptive requirements, especially in the context of identity verification and electronic signatures.
What are the key changes in the amended regulations?
Identity Verification
Under the current regulations, one of the most challenging compliance obligations is verifying a person’s identity in a non-face-to-face identity verification context, e.g. online or over the phone. This is especially frustrating for online and mobile commerce.
The proposed amendments replace all of the existing identity verification methods with new ones, most notably that government-issued photo identification is now required. Previously, any government-issued identification, even without a photograph, was acceptable.
Going forward, any two of the following three requirements must be met for successful identity verification:
- Successful verification of a person’s name and address by referring to a reliable source
- Successful verification of a person’s name and date of birth by referring to a reliable source
- Successful verification of a person’s name and deposit, loan, or credit card account information with a Canadian financial institution
The exact definition of a “reliable source” is still not yet fully clear, but FINTRAC, Canada’s financial intelligence unit, is expected to provide guidance in the near future. However, it would be reasonable to expect that the currently accepted method of using credit header data will continue to be accepted going forward.
Electronic Signatures
Currently, when someone opens a new account at a Canadian financial institution, they are required to create a “signature card,” which is a record signed by the person who is authorized to give instructions regarding the account. While the current regulations allow for an “electronic signature,” this has been narrowly defined by FINTRAC as a photocopy or faxed copy of the original signature created using pen and paper.
The proposed regulations modernize the definition a signature card to include electronic data that is either created or adopted by a client and is accepted by the financial institution. By allowing for greater latitude in defining both the signature card and electronic signature, this welcome change by Canadian regulators will facilitate the growth of the financial services industry in an increasingly digital world.
Politically Exposed Persons
Canada’s existing rules already require that regulated financial service businesses monitor foreign PEPs. Once the proposed regulations come into effect, those same requirements will also apply to domestic PEPs as well as the heads of international organizations and family members and close associates of such persons.
In order to ease the expected regulatory burden that will be created by the additional requirements, PEP determinations and the accompanying reviews and approvals will need to be completed within 30 days instead of 14 days, as it is now. Also, the new PEP requirements will not come into force until one year after the new regulations have been officially registered, allowing businesses to update their systems in preparation for the change.
With the upcoming changes to IDV and PEPs, regulated Canadian financial service businesses can further streamline their customer due diligence process by using online identity verification products such as GlobalGateway, which offers access to over reliable 140 data sources including credit header data, telecommunications, government-issued ID, utility, electoral roll, and many more.
“The days when all the information a bank needed to know about a customer was in a filing cabinet are long gone,” said Stephen Ufford, Founder and CEO of Trulioo. “Technologies exist today to allow banks, governments and financial institutions to quickly harness data to verify identities in real-time regardless of location, race, creed, situation, circumstance or environment.”
Will the proposed regulations impact your business? If so, how will you prepare for the new rules?
