FINTRAC Identification: Canada’s Official Laws and Methods [2025]

So, FINTRAC ID stuff. Yeah, it’s a thing if you work anywhere that touches money in Canada. They updated it this year, and honestly, some of the changes are pretty  straightforward once you get them.

Basically, FINTRAC makes sure people aren’t using businesses to clean dirty money. Makes sense. They tell you how to check who your customers actually are – what ID works, what doesn’t, that kind of thing.

Most of it is common sense, but there are specific rules. Like you can’t just eyeball someone’s license and call it good. There’s a process. And some document combinations work better than others.

Figured I’d put together what I know since I’ve been doing this for a while. So, yeah, that was for the topic’s introduction. Let’s now get to the meat of the topic.

FINTRAC’s Identification Requirements Under the PCMLTFA

OK so Canada’s anti-money laundering framework starts with the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA). Sections 6 and 7 say you have to ID your clients and keep records. Pretty straightforward, but FINTRAC gets specific about how.

You cannot open an account for a person, corporation, or other entity if you cannot verify their identity in accordance with the Regulations. ~ PCMLTFA, S.C 2000, c. 17, s. 9.2.

Let’s break down what this means in practice.

1.   You Need Three Things from Every Client

Before you work with any client, you’re expected to confirm three key pieces of information:

• For individuals: full legal name, date of birth, and residential address
• For businesses: legal name, business address, and names of all directors and beneficial owners

After collecting, you need to verify it using one of FINTRAC’s approved methods (more on this in a minute).

2.   Get Everything Before You Start Working Together

Don’t open accounts first and collect info later. Get their details and understand why they want to do business.

For example, if you’re onboarding a company, start with proof of incorporation, but don’t stop there. You’ll also need something that shows who can act on the company’s behalf, like the bylaws or a director’s resolution.

And if someone owns 25% or more, fill out a Beneficial Ownership form like Form 636. That’s how you know who’s really behind the business.

3.   Keep Info Fresh

People move. Companies change hands. Risk levels shift. Build reminders into your system so you check back on clients regularly, especially the risky ones, or when something seems off.

4.   Watch for Third Parties

You always need to ask: Is this person acting on behalf of someone else? If the answer is yes, collect that third party’s full name, address, and relationship with your client.

FINTRAC expects you to record this clearly. And if you can’t confirm their identity? Do your best to verify, document everything you tried, explain why it didn’t work, and notify your compliance officer. That situation might require a suspicious transaction report.

5.   Check for PEPs

Every time you onboard a new client, make sure you check if they’re a Politically Exposed Person (PEP) or linked to an international organization. Most teams do this at the start, and it’s good practice to recheck periodically.

If someone is flagged as a PEP, you’ll need to conduct enhanced due diligence (EDD). It usually means getting more documentation and watching their account more closely to approve the relationship before proceeding.

6.   Keep Records for Five Years

Whatever you did to verify someone, FINTRAC wants proof. Save everything: what method you used, copies of docs, notes from reviews, and any follow-ups.

The five years start when the relationship ends or from the last transaction, whichever comes later.

Five FINTRAC-Approved Identity Verification Methods

You’re not stuck with just one way to verify identity. FINTRAC gives you five options. The best one depends on your setup and the client’s situation. Here’s how each method works and when it makes sense to use it.

1.   Government-Issued Photo ID

This is the simplest method, especially when you’re face-to-face with the client. Just check an original, valid government-issued photo ID like a passport or driver’s license issued by a federal, provincial, or territorial authority.

If you’re verifying remotely, confirm the ID is legit and that the photo matches the person. You can do that with biometrics, liveness checks, or hologram validation tools. Don’t forget to record the ID type, how, and when it was verified.

2.   Credit File Verification

You can use this if the person has a Canadian credit history. To qualify, the credit file must:

• Be at least three years old
• Match the client’s full name, address, and date of birth
• Come straight from a credit bureau at the time of verification.

It’s a solid option for people who already have a credit footprint in Canada.

3.   Dual-Process Method

This one’s a two-source check. You use two different documents to confirm separate details. For example, a utility bill can confirm the address and a bank or investment account statement can verify the name and date of birth.

Each document needs to come from a different provider. Both should be recent and from reliable sources. It’s a handy option when the client doesn’t have a valid photo ID as long as it meets FINTRAC’s rules.

4.   Attestation by a Guarantor

If you can’t verify the client directly, a guarantor can do it. This is often used in legal, real estate, or cross-border cases. A qualified professional (like a lawyer or accountant) checks the ID and confirms it in writing.

The attestation must include:

• The client’s verified information
• Type of ID reviewed
• The date it was verified
• The guarantor’s full name and contact details

The guarantor must be independent, properly qualified, and not linked to the client. Just make sure you keep a signed copy in your records.

5.   Previously Verified Records

If your organization or another reporting entity has already verified the client, you can use those records. This can save time, especially for returning clients. Just make sure the records are still accurate, complete, and up to date.

If anything’s unclear or seems outdated, do a fresh check. When in doubt, re-verify. It’s safer and keeps your process compliant.

When You Must Verify Client Identity: Triggers and Events

There are three main trigger categories: transaction triggers, relationship triggers, and profile-based triggers.

Category	Event	When Identity Must Be Verified
Transaction-Based	Large cash transaction	When a client deposits or receives $10,000 or more in cash (24 hrs)
	Large virtual currency transaction	$10,000+ in crypto sent or received in a single day
	Suspicious transaction	Any transaction that doesn’t match the client’s usual activity
	International funds transfer	Cross-border transfer of $1,000 or more
	Prepaid card or money order use	When issuing or redeeming $3,000+ in prepaid products
Relationship-Based	Opening a new account	At the start of any formal business relationship
	Adding a joint account holder	When another person is added to an existing account
	Applying for a credit or payment product	Before issuing a credit card or prepaid payment product
Profile-Based	Politically exposed person (PEP) flagged	If the client is linked to a PEP or senior official
	Risk profile changes	If the client’s behavior or risk level increases
	Client from a high-risk country	If the client is based in or linked to a high-risk jurisdiction

Conducting Identity Verification at Scale

This sounds easy until you’re onboarding hundreds or thousands of users a week. That’s when manual reviews, disconnected tools, and messy records start to break things. But FINTRAC doesn’t ease up just because you’re growing.

You still need to verify identities, keep proper records, and stay audit-ready.

The good news is there are tools that actually help with this. The right setup can handle checks automatically when people sign up, flag the sketchy ones for your team to look at, and keep everything organized for when auditors show up.

That’s basically why we built Signzy. Our APIs handle document verification, face matching, and ID checks – all the tedious parts that eat up your day. Everything runs through APIs, so it scales with however many people you’re onboarding.

If you want to see how it would work for your setup, we can walk through it. Takes like 30-60 minutes to show you the main features.