Client Identification and Verification Obligations for FINTRAC-Regulated Ontario Businesses

If your Ontario business is regulated under federal anti-money laundering law, one of your most concrete day-to-day obligations is verifying who your clients actually are before certain transactions or relationships proceed. This is more involved than glancing at a driver's licence — regulated businesses need a defined, documented process, applied consistently.

This article explains, at a general level, what client identification and verification typically requires and why cutting corners on it creates real risk.

Why Identification and Verification Exist as a Separate Step

Anti-money laundering law distinguishes between simply asking who a client is and actually verifying it through an acceptable method. The point is to prevent a business from accepting a client's say-so about their identity without confirming it against some independent, reliable source, because that unverified gap is exactly where illicit funds can be laundered through legitimate-looking transactions.

When Verification Is Typically Required

Regulated businesses generally need to identify and verify a client's identity in defined circumstances, which commonly include:

• Before conducting certain transactions above a threshold set out in the applicable regulations.
• Before establishing an ongoing business relationship with a client.
• When a transaction appears connected to activity your business is required to monitor for.

The specific triggering thresholds and transaction types are set out in FINTRAC's regulations and guidance for each sector and are adjusted from time to time. This article deliberately doesn't quote a dollar figure, because using an outdated one is worse than not stating one — confirm the current trigger for your sector directly.

Common Methods of Verifying Identity

Regulated businesses generally rely on one or more recognized methods, which can include:

1. Government-issued photo identification — examining an original, valid piece of identification issued by a government authority.
2. Credit file methods — verifying identity information against an established credit history.
3. Dual-process methods — verifying identity using two independent, reliable sources of information about the client, rather than a single document.
4. Reliance on a third party, in specified circumstances where permitted, subject to your own business remaining responsible for the outcome.

Not every method is available for every type of client or transaction, and the acceptable methods and documentation requirements are set out in detail in the applicable regulations. Treat the list above as an orientation to the categories that exist, not a checklist to apply without confirming which methods your business can actually use.

Verifying Corporate and Other Non-Individual Clients

Where the client is a corporation, partnership, or other entity rather than an individual, regulated businesses generally also need to confirm the entity's existence, for example through corporate records, and identify the individuals who own or control it — connecting back to the beneficial ownership concepts that apply more broadly in Canadian corporate law. A corporate client cannot simply substitute its own paperwork for identifying the real people behind it.

Verification Isn't Always a One-Time Event

For some client relationships, identification and verification obligations don't end once the file is opened. Regulated businesses are often expected to keep client information current and to reassess it as circumstances change — for example, when a client's transaction pattern shifts, or when other information comes to light that raises a question about who you're really dealing with. Treat your initial verification as the start of the relationship's compliance record, not the end of it.

Recordkeeping That Goes With Verification

Verifying identity isn't a one-time glance. Regulated businesses are generally expected to keep records of how identity was verified, what documents or methods were used, and when, for a set retention period. If your verification process doesn't produce a record a regulator could later review, it likely isn't meeting the standard the rules expect.

Frequently asked questions