FINTRAC identity verification in 2026: methods, rules, C-12

Last reviewed: 31 October 2026 · Not legal advice

FINTRAC identity verification is the part of Canada's anti-money laundering regime that most onboarding teams touch every day. The Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) and its Regulations (PCMLTFR) say who must verify, which methods count and what to record, and FINTRAC (the Financial Transactions and Reports Analysis Centre of Canada, CANAFE in French) explains them in its guidance.^[1][3][4]

FINTRAC identity verification in 2026 at a glance

1. 11 October 2024Mortgage sectorMortgage administrators, brokers and lenders covered.
2. 1 April 2025New sectorsFactors, cheque cashers, financing and leasing entities.
3. 1 October 2025Agents for entitiesAgents for entities, title insurers, ownership discrepancy reports.
4. 26 March 2026Bill C-12Royal assent; new penalty framework applies.
5. Not yet setUniversal enrolmentWaits for regulations in the Canada Gazette.

Dates from FINTRAC's sector pages, its changes page and LEGISinfo.^{[5][7][10][11][12]}

Who must verify identity under the PCMLTFA

Section 5 of the PCMLTFA lists the reporting entities: banks, credit unions and caisses populaires, life insurers, trust and loan companies, securities dealers, money services businesses (MSBs) in Canada and foreign MSBs serving people in Canada, prescribed businesses and professions, and provincial casinos.^[4]

Universal enrolment with FINTRAC waits for "Regulations to be developed and published in the Canada Gazette, Part II", like stablecoin issuer registration.^[5]

For virtual currency thresholds and the Travel Rule, read our guide on KYC for MSBs, crypto and payment providers in Canada.

FINTRAC identity verification: the five methods for a person

FINTRAC's guide is direct: "You can use any of the 5 methods described below to identify a person".^[1]

Simplified. Your written policies set the order and fallbacks.^[1]

The affiliate or member method and the reliance method both need the earlier verification to have used photo ID, credit file or dual-process, or before 1 June 2021 the methods then in force; reliance also needs "a written agreement or arrangement" that gets you all the underlying information on request.^[1][3] A person verified with a valid method, with the record kept, needs no new check later unless you have doubts.^[1]

The government-issued photo ID method, in person and remote

In person, you inspect the original document in the client's presence.^[1] Remote verification is allowed in two distinct steps: authenticate the document, then confirm that the name and photo belong to the person.^[1]

Guide 11, s. 2.1FINTRAC, Methods to verify the identity of persons and entities

"You may use the government-issued photo identification method if a person is not physically present, but you must have a process in place to authenticate the government-issued photo identification document. For instance, you could assess a document by using a technology capable of determining the document's authenticity."

Source: FINTRAC Guide 11^[1]

FINTRAC's examples include holograms, barcodes, watermarks and embedded electronic chips.^[1]

The two steps "do not need to happen at the same time", but you must complete both, and your written policies must describe how you do each.^[1]

Credit file and dual-process: the three-year and six-month rules

A scan of a government photo ID can be one dual-process source.^[1]

Using an agent or mandatary, including for entities since 1 October 2025

An agent or mandatary verifies identity on your behalf. For a person, the agent must use the photo ID, credit file or dual-process method; for a corporation or other entity, the confirmation of existence method.^[1] The entity part applies since 1 October 2025.^[5]

FINTRAC's three conditions: agreement first, all information as soon as feasible, and satisfaction that the method was followed.^[1]

FINTRAC's examples: an agent's 2019 photo ID check stays usable after the licence expires if name and appearance are unchanged, but not after a name change, nor if the licence had expired when checked.^[1]

When to verify: timing rules

PCMLTFR s. 105(7) sets the timing.^[3]

Under 12, verify a parent, guardian or tutor; ages 12 to 15 may use any method or, if information is lacking, a dual-process variant.^[1][3]

Verifying corporations and beneficial owners

For a corporation, confirmation of existence uses a certificate of incorporation, an annual securities filing or the latest record with name, address and directors, for example from the Corporations Canada database; other entities use a partnership agreement, articles of association or a similar record.^[1] At the same time, for a corporation, obtain the names of all directors and the names and addresses of everyone who owns or controls, directly or indirectly, 25% or more of the shares, plus ownership, control and structure; trusts and other entities have their own lists (PCMLTFR s. 138).^[3]

Then take reasonable measures to confirm its accuracy, which "cannot be the same as the measures you used to obtain the information".^[8]

Since 1 October 2025, for corporations under the Canada Business Corporations Act (CBCA) that you assess as high risk, you must consult Corporations Canada's database and report a material discrepancy within 30 days, then keep the notice of acknowledgement.^[8] A discrepancy resolved within 30 days need not be reported.^[8] If you cannot obtain or confirm beneficial ownership, take reasonable measures to verify the chief executive officer's identity and apply the special measures for high-risk clients.^[8]

PEP and HIO determinations and follow-up deadlines

Account-based reporting entities (financial entities, securities dealers, casinos) must take reasonable measures to determine whether a client is a politically exposed person (PEP), a head of an international organization (HIO), or a family member or close associate.^[9]

Record keeping: five years, and 30 days to produce

PCMLTFR s. 148(1) sets the floor: at least five years after the account closes for account records, after the last business transaction for information records and entity existence records, and after creation for all other records.^[3] Section 149 adds that records must be producible to FINTRAC within 30 days after a request.^[3][20]

• Store the applicable photo ID fields for every person verified by that method.^[1]
• Keep the agent agreement next to each agent-made verification.^[1]
• Keep the beneficial ownership record and the confirmation measure used.^[3]
• Test that you can export any client file within 30 days.^[3]

What Bill C-12 changed on 26 March 2026

Bill C-12, the Strengthening Canada's Immigration System and Borders Act, was introduced on 8 October 2025 and received royal assent on 26 March 2026 (S.C. 2026, c. 4).^[7] Bill C-2, the Strong Borders Act, is separate: as of 31 October 2026 LEGISinfo shows it at second reading in the House of Commons, so it is not law.^[21]

New penalty frameworkFINTRAC, Administrative monetary penalties: changes

"Reporting entities that commit prescribed violations after March 26, 2026, will be required to enter into mandatory compliance agreements and may be subject to compliance orders."

Source: FINTRAC, pen/3-eng^[6]

Violations entirely before 26 March 2026 keep the old policy and amounts, and each examination is scoped to one framework.^[6] FINTRAC's page states the increase only as "up to 40 times current limits" while it updates its penalty policy and guidance.^[6]

Enforcement lessons from FINTRAC's published penalties

FINTRAC publishes its penalties.^[14] These were imposed under the previous framework; the findings are FINTRAC's, as published.

The pattern: written controls not applied, and evidence missing when examiners asked. After 26 March 2026 such findings face higher maximums.^[6]

A 30-day plan for your compliance team

Week 1: map methods and policies

• List every onboarding channel and the FINTRAC method each one uses.^[1]
• Rewrite the remote photo ID policy to name both steps: document authentication and the name and face match.^[1]
• Remove any flow that relies on a video call view alone.^[1]

Week 2: agents and fallbacks

• Sign or update a written agent or mandatary agreement before the next verification by a provider.^[1]
• Add a dual-process fallback for clients whose credit file is under three years old.^[1]

Week 3: entities, owners and PEPs

• Collect directors and 25% owners at onboarding, with the structure chart.^[3]
• Confirm ownership with reasonable measures at onboarding and during ongoing monitoring.^[3][8]
• Check high-risk CBCA clients against Corporations Canada and diarize the 30-day discrepancy window.^[8]
• Screen for domestic PEPs, HIOs, family members and close associates, not only foreign PEPs.^[9][17]

Week 4: evidence and C-12 readiness

• Sample 20 files against FINTRAC's record fields.^[1]
• Prove that enhanced measures written in policy appear in the files.^[19]
• Run a 30-day production drill on a random client file.^[3]

How Didit helps with FINTRAC identity verification

Didit's ID verification authenticates government-issued documents across 220+ countries and 14,000+ document types, checking for tampering and fraud.^[22] With liveness and a 1:1 selfie-to-portrait face match, the flow maps to FINTRAC's government-issued photo ID method for a person who is not present, as FINTRAC describes it.^[23][24][1] Near-field communication (NFC) chip reading is available for passports and ID cards with a chip.^[25]

For Canada, Didit's database validation includes a credit-bureau service that, in the docs' words, "Verifies input data against Credit Header data obtained from a Credit Bureau in Canada and responds with data sufficient to meet FINTRAC requirements"; an agency application is required.^[26] Anti-money laundering (AML) screening covers 1,300+ sanctions, PEP and watchlist sources, with daily rescreening of approved users and webhook alerts.^[27][28] Registry sources listed for Canada include Corporations Canada and provincial registries such as Ontario, British Columbia, Alberta and Quebec, with availability varying by company.^[29] Transaction monitoring adds real-time rules and cases.^[30]

Retention runs from one month to ten years, with deletion on demand; data is processed and stored in the EU by default, and Enterprise customers can request in-country processing subject to availability and contract.^[31][32] Didit holds SOC 2 Type 1 and Type 2, ISO/IEC 27001:2022 and iBeta Level 1, offers a hosted flow or API with SDKs and signed webhooks, and verifies in French among other languages.^{[33][34][36][35]}

Frequently asked questions

Sources

1. Methods to verify the identity of persons and entities, FINTRAC compliance guidance, modified 3 December 2024.
2. Méthodes pour vérifier l'identité de personnes et d'entités, CANAFE, modified 15 September 2025.
3. Proceeds of Crime (Money Laundering) and Terrorist Financing Regulations, SOR/2002-184, Justice Laws Website.
4. Proceeds of Crime (Money Laundering) and Terrorist Financing Act, S.C. 2000, c. 17, s. 5, Justice Laws Website.
5. Modernization and upcoming changes impacting reporting entities, FINTRAC, modified 13 April 2026.
6. Administrative monetary penalties: changes following legislative amendments, FINTRAC, modified 6 May 2026.
7. Bill C-12, Strengthening Canada's Immigration System and Borders Act, LEGISinfo, Parliament of Canada.
8. Beneficial ownership requirements, FINTRAC compliance guidance, modified 30 July 2026.
9. Politically exposed persons and heads of international organizations requirements for account-based reporting entities, FINTRAC.
10. Mortgage administrators, brokers and lenders: FINTRAC's requirements, FINTRAC.
11. Financing or leasing entities: FINTRAC's requirements, FINTRAC.
12. Title insurers: FINTRAC's requirements, FINTRAC.
13. Armoured cars: FINTRAC's requirements, FINTRAC.
14. Public notice of administrative monetary penalties, FINTRAC, modified 9 July 2026.
15. Administrative monetary penalty imposed on The Toronto-Dominion Bank, FINTRAC, 2 May 2024.
16. Administrative monetary penalty imposed on Synergy Credit Union, FINTRAC, 27 November 2025.
17. Administrative monetary penalty imposed on Primary Capital Inc., FINTRAC, 18 September 2025.
18. Administrative monetary penalty imposed on Canaccord Genuity Corp., FINTRAC, 3 July 2025.
19. Administrative monetary penalty imposed on 13010431 Canada Inc., FINTRAC, 14 May 2026.
20. Record keeping requirements for financial entities, FINTRAC.
21. Bill C-2, Strong Borders Act, LEGISinfo, Parliament of Canada.
22. ID verification overview, Didit documentation.
23. Liveness overview, Didit documentation.
24. Face match overview, Didit documentation.
25. NFC verification overview, Didit documentation.
26. Canada Credit Bureau (FINTRAC) verification, Didit documentation.
27. AML screening overview, Didit documentation.
28. Continuous AML monitoring, Didit documentation.
29. Company registry sources by country, Didit documentation.
30. Transaction monitoring overview, Didit documentation.
31. Data retention and deletion, Didit documentation.
32. Security and compliance, Didit documentation.
33. Certifications, Didit documentation.
34. SDKs and integrations, Didit documentation.
35. Supported languages, Didit documentation.
36. Webhooks, Didit documentation.

See the ID verification page, read about identity verification in Canada, or check pricing. If you handle biometrics in Quebec, read our guide to Quebec Law 25 and biometrics; for adult or gaming platforms, our guide to age verification in Canada.