Business Verification in Canada: Complete Guide [2026]

Business verification in Canada has a clear regulatory framework. FINTRAC sets the rules, the PCMLTFA defines the obligations, and reporting entities across banking, real estate, payments, and other sectors are expected to follow them.

But knowing that verification is required and knowing how to do it properly are two different things. The process involves more than collecting a registration document. It means identifying who owns and controls a business, verifying the individuals behind it, applying the right method for the entity type and risk level, and keeping records in a way that holds up to scrutiny.

This guide covers all of it: what KYB means in the Canadian context, which regulations apply, what documents to collect, who needs to be verified, and how the process works in practice.

What is Know Your Business verification in the context of Canada?

Know Your Business (KYB) verification in Canada is the process of confirming that a business is legally registered and not involved in financial crime. It is a regulatory requirement under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) and enforced by the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC).

In practice, this means verifying a business's registration details, identifying who ultimately owns or controls it, and confirming that the people behind it are who they say they are before any financial relationship begins.

KYB in Canada vs the US: how do they compare?

Canada Business Verification regulations

Canada’s business verification regulations, as outlined by FINTRAC, mandate that reporting entities adhere to specific protocols to prevent financial crimes.

Here are eight key points

1. Mandatory identity verification

Reporting entities must verify client identity for transactions involving cash ($10K+), virtual currency ($10K+), electronic funds transfers ($1K+), and any suspicious transaction regardless of the amount. This applies across all regulated sectors and must be completed before or at the time of the transaction.

2. Approved verification methods

Entities can verify identity using government-issued photo ID, a Canadian credit file active for three or more years, or the dual-process method, which requires confirming a person's name and address from one reliable source and their name and date of birth from a separate source. No single document can serve both purposes under the dual-process approach.

3. Beneficial ownership disclosure

Entities must identify and verify all individuals who directly or indirectly own or control 25% or more of a business. This includes collecting names, dates of birth, addresses, and ownership percentages.

As of October 2025, reporting entities assessing a business as high risk must also cross-reference their records against the Corporations Canada beneficial ownership registry and must file a discrepancy report if the information does not match.

4. Record-keeping obligations

Businesses must retain all identity verification records, transaction details, ownership documentation, and agent agreements for a minimum of five years. Records must be organized in a way that allows them to be produced to FINTRAC within 30 days upon request.

5. Use of agents for verification

Third-party agents can carry out verification on behalf of reporting entities under a written agreement. As of October 2025, money services businesses are now required to conduct criminal record checks on agents before engaging them. Even with an agent in place, the original reporting entity remains fully accountable for compliance.

6. Sanctions and property reporting

As of 2025, reporting entities must submit a Listed Person or Entity Property Report to FINTRAC when they are required to disclose property under the Special Economic Measures Act, the Justice for Victims of Corrupt Foreign Officials Act, the United Nations Act, or the Criminal Code.

This links sanctions compliance directly to AML obligations, and both compliance teams are expected to coordinate on identifying and reporting listed property.

7. Expanded scope of regulated entities

Canada has progressively brought new business types under FINTRAC's oversight. As of April 2025, cheque cashing businesses, factoring companies, and financing or leasing entities became reporting entities.

As of October 2025, title insurers and acquirers of private automated banking machines were added. All newly regulated entities are required to register with FINTRAC, build a compliance program, verify client identities, and submit required reports.

8. Private-to-private information sharing

Reporting entities can now voluntarily share client information with each other to help detect money laundering and sanctions evasion. To do so, a code of practice must be submitted to FINTRAC and approved by the Office of the Privacy Commissioner of Canada. This is intended to improve intelligence across the financial system without compromising individual privacy protections.

Now, let’s see the document requirements.

Methods to verify businesses in Canada

Verifying a business in Canada ensures legitimacy, regulatory compliance, and fraud prevention. FINTRAC mandates verification based on the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA).

Depending on the business type and risk level, different methods apply. Let’s go through each.

1. Confirmation of Existence method

The confirmation of existence method is the most straightforward way to verify a business. It requires obtaining official documents that prove the business is legally registered and recognized by a government authority. These documents can include:

• Certificate of incorporation for corporations
• Partnership agreement for partnerships
• A business license issued by a provincial or federal registry.

In many cases, verification is done by cross-referencing the provided documents with publicly available business registries or databases, ensuring the business is active and operating as claimed.

This method is mandatory for most financial and high-risk transactions.

2. Reliance method

In some cases, a business does not need to be verified from scratch if another trusted reporting entity has already conducted a FINTRAC-compliant verification. This is known as the Reliance Method, which allows one entity to depend on the due diligence work of another.

For this method to be valid, there must be a written agreement in place that outlines the reliance arrangement and confirms that the initial verification was conducted using approved methods. The entity relying on this verification must still assess the credibility of the original verifier and maintain oversight to ensure compliance with FINTRAC’s regulatory requirements.

3. Simplified identification method

Certain businesses are classified as low-risk under FINTRAC’s framework and may be eligible for simplified verification. These typically include government agencies, publicly traded companies listed on recognized stock exchanges, and regulated financial institutions such as banks and securities dealers.

Instead of collecting extensive documentation, verification can be conducted using publicly available information, such as stock exchange listings, government records, or regulatory filings. This method significantly reduces the administrative burden but is only applicable to entities explicitly listed under FINTRAC’s simplified verification rules.

4. Agent or Mandatary verification method

Businesses can also be verified through an agent or mandatary who conducts the verification process on behalf of a reporting entity. The agent must follow FINTRAC’s prescribed verification methods, maintain detailed records, and ensure compliance with all regulatory requirements.

This is often used in cases where businesses operate in different jurisdictions or when third-party professionals, such as lawyers or financial institutions, are better positioned to collect and authenticate the necessary information.

But note that, even when using an agent, the original reporting entity remains fully responsible for ensuring that the verification meets the required standards, conducting enhanced due diligence when required, and that records are retained for at least five years.

Documents required: What information to collect and verify?

• Proof of business registration: Depending on the business type, this includes a certificate of incorporation, partnership agreement, provincial or federal business registration document, or trade name registration.
• Beneficial ownership information: Names, dates of birth, addresses, and ownership percentages of all individuals holding 25% or more of the business. Supporting proof can include a shareholder register, articles of incorporation, or partnership deeds.
• Identity verification of owners and authorized signatories: Government-issued photo ID, Canadian credit file check (active for 3+ years), or dual-process verification using two separate source documents such as a utility bill, bank statement, or CRA tax document.
• Business financial information: Required in high-risk cases or flagged reviews. This can include bank account details, GST/HST registration number, financial statements, invoices, contracts, or proof of an active web presence.

Who needs to be individually verified during business onboarding?

Not every person connected to a business needs to go through individual verification, but the people who own it, control it, or represent it during onboarding do. Who exactly falls into that list depends on the type of business entity.

A few terms are worth clarifying here.

• The applicant is the individual preparing or submitting the onboarding application on behalf of the business.
• The controlling person is whoever exercises ultimate management control over the company, regardless of their ownership stake.
• A UBO is any individual who holds or exercises 25% or more of the shares or voting rights, directly or indirectly. If no single individual crosses that 25% threshold, a Controlling Person Declaration is requested instead.

If the person submitting the application is not a director, UBO, or controlling person, a Letter of Authorization signed by one of those individuals is also required.

Can you collect personal data during business verification in Canada?

Yes, but only what the law requires. Collecting personal data during business verification is both permitted and mandatory under the PCMLTFA, but it does not override privacy obligations. Reporting entities must also comply with PIPEDA, which limits collection to only what is necessary to fulfill legal requirements under the PCMLTFA. Collecting more than that, even with compliance intent, is a violation.

In certain situations, such as filing a suspicious transaction report, personal data can be disclosed to FINTRAC without the individual's knowledge or consent. Outside of those specific exceptions, organizations are expected to have a clear privacy policy explaining how personal information is collected, used, and disclosed as part of their AML obligations.

Best practices for business verification in Canada

✔️ Verify before the relationship starts, not after. FINTRAC requires identity verification to be completed before or at the time of a transaction. Building it into the start of onboarding rather than treating it as a follow-up step keeps you on the right side of that requirement.

✔️ Do not stop at business registration. A certificate of incorporation confirms that a business exists. It does not tell you who controls it. Always trace ownership to the individual level and verify the people behind the entity, not just the entity itself.

✔️ Match your verification method to the risk level. Low-risk entities like publicly listed companies can go through simplified verification. Higher-risk entities require more thorough checks. Applying the same method to every business regardless of risk is a gap that audits tend to surface.

✔️ Cross-reference against the Corporations Canada beneficial ownership registry for high-risk entities. As of October 2025, this is a regulatory requirement for entities assessed as posing elevated money laundering or terrorist financing risk. If there is a discrepancy, a report must be filed.

✔️ Keep records in a retrievable format. FINTRAC can request records within 30 days. If your documentation is scattered across systems or stored in ways that are hard to pull together quickly, that is a compliance risk in itself.

✔️ Reassess at meaningful intervals. Verification is not a one-time event. Ownership structures change, businesses restructure, and individuals move in and out of control positions. Periodic review, especially for higher-risk clients, keeps your records accurate.

✔️ If you use agents, verify them too. As of October 2025, money services businesses must conduct criminal record checks on agents before engaging them. Even after that, the original reporting entity remains responsible for the quality of the verification.

✔️ Keep your privacy obligations in mind. Collecting more personal information than the PCMLTFA requires is a PIPEDA violation. Only gather what is necessary for the specific compliance purpose you are fulfilling.

✔️ Automate where the process is repeatable. Manual verification works at low volumes but introduces delays, inconsistencies, and human error as onboarding scales. Using APIs to pull directly from federal and provincial registries, validate GST/HST numbers, and map UBO structures means the same checks run the same way every time, without the turnaround time of document-by-document review.

Conducting business verifications in Canada at scale with Signzy

Verifying one business is straightforward. Verifying hundreds or thousands across provinces, entity types, and risk levels is where manual processes break down. Signzy is built for that scale, with APIs purpose-built for the Canadian regulatory environment and coverage across all 13 federal states and provinces.

"Coverage across all 13 provinces and territories matters. We have clients everywhere, including Yukon and Nunavut. Other providers only covered major provinces. Signzy actually reaches the whole country." — VP Compliance, Payments Platform (500+ employees)

Here are three ways Signzy can help you verify businesses in Canada faster and with fewer gaps.

1. Verify business registration and ownership in real time

Signzy's Canada Business Verification API pulls directly from federal and provincial registries to confirm business credentials and ownership. For entities with complex structures, the UBO verification layer maps out who ultimately owns or controls the business, even when that control runs through multiple intermediate entities. What you can verify includes:

• Business name, business number, and registry ID
• Registration status and date
• Beneficial owners with 25% or more ownership
• Directors and authorized signatories
• Multi-layer ownership structures

2. Validate GST/HST numbers before money moves

A registered business number does not automatically confirm tax compliance. Signzy's Canada GST/HST Verification API validates a business's GST registration status against CRA data for any specific transaction date, so you know whether the number on an invoice is active, expired, or fabricated before a payment is processed.

This is especially relevant for finance and procurement teams handling high volumes of B2B transactions or onboarding new suppliers.

3. Scale without rebuilding your compliance stack

Both APIs are designed to integrate quickly, with documentation built for developers and go-live timelines of two to four weeks. As regulations change, such as the expanded FINTRAC obligations that came into force through 2025, Signzy updates its coverage so your workflows stay compliant without requiring manual intervention on your end.

Whether you are onboarding ten businesses a month or ten thousand, the process runs the same way.

“Quebec business registrations used to require separate lookups from federal ones. Signzy handles both in one system. Saves us about 15 minutes per business verification, which adds up fast when you're onboarding 50+ merchants weekly." — KYB Analyst, Financial Services (200+ employees)

If you are working through how to bring your Canada business verification process up to standard, or just want to see how the APIs hold up against your current workflow, you can book a demo and walk through it with the team.