FINTRAC Identity Verification Methods in Canada

Reporting entities governed by the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) must confirm who their customers are before opening accounts or completing certain transactions. FINTRAC prescribes specific ways to do this in the associated regulations. Getting the method right matters: an examination finding of inadequate verification can lead to administrative monetary penalties.

Below is general information—not legal advice—on the three principal FINTRAC identity verification methods available for individual clients in Canada, plus what each means for remote onboarding.

The government-issued photo ID method

The government-issued photo ID method requires you to reference an authentic, valid, and current photo identification document issued by a federal, provincial, or territorial government—or a foreign equivalent. Documents issued by municipalities do not qualify. A Canadian passport, driver's licence, or provincial health card (where provincial law permits its use) are common examples.

• The document must not be expired.
• The name and photo must reasonably match the person presenting it.
• You record the document type, number, issuing jurisdiction, and the date you verified it.

For remote identity verification in Canada, you cannot simply eyeball a scan. FINTRAC expects you to use a process or technology to confirm the document is authentic—assessing security features and confirming the person matches the ID, for example through a liveness check paired with document capture.

The credit file method

Under the credit file method, you compare the client's name, date of birth, and address against information held in a Canadian credit file. Two conditions are strict: the credit file must have existed for at least three years, and you must consult it at the time you verify identity, drawing directly from a Canadian credit bureau such as Equifax or TransUnion.

• All three data points—name, address, and date of birth—must match.
• A single credit file is sufficient; you cannot combine a thin or recently created file with another source under this method.

Because it queries an independent third-party source without collecting a document image, the credit file method fits naturally into automated, chat-based flows where you want to minimize the personal data you store.

The dual-process method

The dual-process method lets you confirm identity using information from two different, reliable, and independent sources. You must draw on two of the following combinations:

• Name and address from one source, plus name and date of birth from a second source.
• Name and address from one source, plus name and a financial account confirmation from a second source.
• Name and date of birth from one source, plus name and a financial account confirmation from a second source.

The two sources must be independent of each other and of your organization—the client cannot be one of them. Acceptable sources include a Canada Revenue Agency notice of assessment, a provincial statement, a utility bill, or confirmation that the person holds a deposit or credit account. Using the same source twice does not satisfy the requirement.

Choosing a method for remote onboarding

All three methods can be used to verify identity in Canada without meeting the client face to face, provided your controls meet FINTRAC's expectations for authenticity and data matching. Selection often comes down to your customer base:

• Newcomers may lack a three-year credit file, making the photo ID or dual-process approach more practical.
• Established residents may prefer the friction-free credit file query.
• Thin-file clients can be covered by combining two independent records under the dual-process method.

Whichever route you take, record the method used, the information referenced, and the date. FINTRAC requires you to keep verification records and, for higher-risk relationships, to re-verify when doubts arise about previously obtained information.

Data handling after verification

Collecting identity data creates an obligation to protect it. A layered onboarding flow—running document capture, a credit file query, or dual-source checks through a conversational interface on Telegram or WhatsApp—can confirm identity while applying configurable retention so records are purged once the regulatory hold period ends. That keeps you aligned with both PCMLTFA recordkeeping duties and provincial privacy expectations.

For the authoritative requirements, consult FINTRAC's guidance on methods to verify the identity of persons and entities and confirm your obligations with qualified counsel.