FINTRAC Policy Interpretations

Verifying identity

Credit File Method – one source must be 3 years old

Question:

On June 1st, 2021, regulated entities are required to comply with new changes related to identification and verification namely that for the single source credit file method the information must have come from more than one source (105(1)(c)). FinTRAC's interpretation is that a source is a trade line.

So, there are potentially two interpretations of this new requirement:

  1. That the credit file, which has existed for at least three years, is supported by at least two other sources (age not relevant); or
  2. The credit file, which has existed for at least three years, must be supported by at least two other sources that each also need to be at least three years old or more.

If possible, it would be very helpful to get clarification regarding which interpretation aligns to the new requirement.

Answer:

As of June 1st, 2021, paragraph 105(1)(c) of the amended Proceeds of Crime (Money Laundering) and Terrorist Financing Regulations (PCMLTFR) will state, a person or entity that is required to verify a person’s identity shall do so by referring to information that is in the person’s credit file — if that file is located in Canada and has been in existence for at least three years and the information is derived from more than one source — and by confirming that the name, address and date of birth in the credit file are those of the person.

In addition, subsection 105(5) of the amended PCMLTFR will state that a document that is used by a person or entity to verify identity under subsection (1) must be authentic, valid and current. Other information that is used for that purpose must be valid and current.

An information source for a credit file is an underlying tradeline that is used to make up the credit file (e.g., credit account, loan account, utility account, etc.). As such, one credit file could be made up of any number of sources of information (tradelines).

Therefore, as of June 1st, 2021, a reporting entity (RE) using the credit file method to verify a person’s identity must ensure that:

  1. The credit file is located in Canada;
  2. The credit file itself has been in existence for three (3) or more years – meaning that there is at least one tradeline that is 3 or more years old, whether currently active or not; and
  3. The information within the credit file is derived from two (2) or more valid and current sources (tradelines).

The RE will then need to confirm that the name, address, and date of birth are those of the person.

Given the requirement that information used for verifying identity must be valid and current, the 2 sources (tradelines) relied upon need to be active. However, there is no requirement that the tradeline that makes the credit file itself 3 or more years old be currently active. That said, if it is active, it may be relied upon as one of the two sources, assuming it is valid and current.

Date answered: 2021-05-07

PI Number: PI-11487

Activity Sector(s): Accountants, British Columbia notaries, Casinos, Dealers in precious metals and stones, Financial entities, Life insurance, Money services businesses, Real estate, Securities dealers

Obligation(s): Verifying identity

Guidance: Methods to verify the identity of persons and entities

Regulations: 105(1)(c)

Dual Process Method – 2 Government IDs

Question:

Under the dual process method - if a copy of a particular government-issued photo identification document (such as a provincial driver's licence) is used to verify, for example, a client's name and address, would it be acceptable or unacceptable to then verify the client's name and date of birth with a copy of a different government-issued photo identification document (such as a Canadian passport)?

In other words, does the second document have to be something other than government-issued photo identification?

If it is possible to rely on two copies of two different government-issued photo identification documents (one to verify name and address, and one to verify name and birthdate), my follow-up question is whether the two documents need to come from two different levels of government (e.g., Canadian passport (federal) and Ontario driver's licence (provincial)), or two different ministries of the same level of government, to satisfy the requirement that the information come from two different sources. So, for example, would it be acceptable or unacceptable to rely on a copy of an Ontario government-issued photo ID to verify a client's name and birthdate, and a copy of a different Ontario government-issued photo ID to verify the client's name and address? In such a case, the information in each document would arguably be coming from the same source (the Ontario government).

 

Answer:

One of the methods that may be used to verify the identity of a person under the PCMLTFR is commonly referred to as the dual process method, where, pursuant to paragraph 105(1)(d) of the PCMLTFR, the dual process method involves doing any two (2) of the following:

  • referring to information from a reliable source that includes the person’s name and address, and verifying that the name and address are those of the person,
  • referring to information from a reliable source that includes the person’s name and date of birth, and verifying that the name and date of birth are those of the person, or
  • referring to information that includes the person’s name and confirms that they have a deposit account or a credit card or other loan account with a financial entity, and verifying that information.
     

Subsection 105(4) of the PCMLTFR goes on to state that for the purposes of the dual process method, the information that is referred to must not be from, or derived from, the same source and neither the person whose identity is being verified nor the person or entity that is verifying their identity can be a source.

In addition, subsection 105(5) of the PCMLTFR stipulates that a document used to verify identity must be authentic, valid, and current and that other information used for that purpose must be valid and current. Information for this purpose may be found in statements, letters, certificates, forms or other sources and can be provided through an original version or you may obtain another version of the information’s original format, such as a fax, photocopy, scan, or electronic image. For further clarity, it is acceptable to rely on a fax, photocopy, scan or electronic image of a government-issued photo identification document as one of the two sources of information required to verify the identity of an individual under the dual process method.

Therefore, to answer your question, it would be acceptable to refer to two different pieces of government-issued photo identification as information under the dual process method, assuming the information is valid and current. For instance, an RE could refer to a photocopy of a valid and current provincial driver’s licence that includes the person’s name and address, and a photocopy of a valid and current Canadian passport that includes the person’s name and date of birth and verify that the applicable information is that of the person.

Please note that, given the requirement that the information must be from two different sources, should an RE wish to refer to two pieces of government issued-photo identification issued by the same level of government, the RE must ensure that each piece is issued by a different department, ministry or office, as applicable.

Date answered: 2021-04-08

PI Number: PI-11505

Activity Sector(s): Accountants, British Columbia notaries, Casinos, Dealers in precious metals and stones, Financial entities, Life insurance, Money services businesses, Real estate, Securities dealers

Obligation(s): Verifying identity

Guidance: Methods to verify the identity of persons and entities

Regulations: 105

Credit file method – derived from more than one source

Question:

For the single process credit file method that can be used to identify a client, a line has been added which requires that the information must now be derived from more than one source. Does this mean that two (2) credit file searches must now be referred to for this method?

Or does the information in the (single) credit file simply needs to refer to more than one source? You do not need two credit files. Just one credit file search that refers to more than one source?

Answer:

Paragraph 105(1)(c) of the amended Proceeds of Crime (Money Laundering) and Terrorist Financing Regulations (PCMLTFR) states, a person or entity that is required to verify a person’s identity shall do so by referring to information that is in the person’s credit file — if that file is located in Canada and has been in existence for at least three years and the information is derived from more than one source — and by confirming that the name, address and date of birth in the credit file are those of the person.

An information source for a credit file is an underlying tradeline that is used to make up the credit file (e.g., credit account, loan account, utility account, etc.) As such, one credit file could be made up of any number of sources of information (tradelines).

The requirement for the information to be derived from more than one source (i.e. more than one tradeline) will apply to this method and will come into force on June 1st, 2021. FINTRAC does not expect, nor does the amended PCMLTFR require, reporting entities to refer to more than one credit file when using the credit file method to verify the identity of a person.

 

Date answered: 2021-04-06

PI Number: PI-11485

Activity Sector(s): Accountants, British Columbia notaries, Casinos, Dealers in precious metals and stones, Financial entities, Life insurance, Money services businesses, Real estate, Securities dealers

Obligation(s): Verifying identity

Regulations: 105(1)(c)

Life insurance group plans – verifying identity

Question:

Is a life insurance company, broker or agent required to identify the beneficiaries named by group plan members?

Answer:

Pursuant to the PCMLTFR:

Section 22 - a life insurance company or life insurance broker or agent:

  • (1) shall, regardless of the means of payment, keep an information record in connection with the sale of an immediate or deferred annuity or a life insurance policy
    •     (a) for which they are to receive an amount of $10,000 or more over the duration of the annuity or policy; or
    •     (b) under which they are to remit an amount of $10,000 or more to a beneficiary over the duration of the annuity or policy.
  • (2)(b) The information record in connection with the sale referred to in paragraph 1(b) shall be created before the life insurance company or life insurance broker or agent first remits funds or virtual currency to the beneficiary under the annuity or policy and shall be kept in respect of the beneficiary.
  • (3) In the case of a life insurance policy that is a group life insurance policy or in the case of a group annuity, the information record shall be kept in respect of the applicant for the policy or annuity.

Paragraph 92(a) - a life insurance company or life insurance broker or agent shall, in accordance with section 105, verify the identity of a person in respect of whom they are required to keep an information record under section 22;

Subsection 154(3) - a …. life insurance company or life insurance broker or agent is not required to verify the identity of, or to keep a signature card for, a person who is a member of a group plan account […] if:

  • (a) the member’s contributions are made by the sponsor of the plan or by means of payroll deductions; and
  • (b) the identity of the plan sponsor has been verified in accordance with subsection 109(1) or 112(1).

A life insurance company, broker or agent is required to keep an information record in connection with the sale of an immediate or deferred annuity or a life insurance policy where they are to receive an amount of $10,000 or more over the duration of the annuity or policy, or under which they are to remit an amount of $10,000 or more to a beneficiary over the duration of the annuity or policy. Where they are required to keep an information record, they are required to verify identity.

However, in the case of a group life insurance policy or a group annuity, the information record shall be kept in respect of the applicant for the policy or annuity. As such, it is only the applicant, at that time, whose identity must be verified in connection with the information record.

Subparagraph 22(3) of the amended PCMTLFR speaks to who the company, broker, or agent should keep the information record on under paragraphs 22(1)(a) and 22(2)(a) of same. In addition, the exception noted at subsection 154(3) of the amended PCMLTFR speaks to the members of a group plan account and not to the beneficiaries.

As such, unless a general exception applies, a life insurance company, broker or agent will be required to verify the identity of the beneficiary of an annuity or a life insurance policy where an amount of $10,000 or more will be remitted over the duration of the policy. In the case of a group policy, each beneficiary’s identity must be verified, as the specific exception outlined at subsection 154(3) of the amended PCMLTFR does not apply.

The information record must be created on the beneficiary and this is to be created before the company, broker or agent first remits the funds or virtual currency. Although, please note subsection 22(4) of the PCMLTFR, which provides an exception to the timing of creating the information record. The beneficiary’s identity must be verified in accordance with the methods to ID, and must be done within 30 days of creating the record.

Date answered: 2020-11-16

Answer updated on: 2021-08-20

PI Number: PI-11065

Activity Sector(s): Life insurance

Obligation(s): Verifying identity

Guidance: When to verify the identity of persons and entities — Life insurance companies, brokers and agents

Regulations: 22, 92, 154(3)

Government-issued photo ID – valid and current according to its issuer

Question:

Is an ID still considered authentic, valid and current if a client has moved out of the address indicated on a driver’s license or other form of photo issued ID but before the expiry of the provincial deadline to change the address (e.g. within the first 30 days in New Brunswick)?

Answer:

The PCMLTFR stipulates that the government issued photo ID document must be authentic, valid, and current, and FINTRAC’s guidance further elaborates that:

  • Current, in respect of a document or source of information that is used to verify identity is one that is up to date, and, in the case of a government-issued photo identification document, must not have been expired when the ID was verified.
  • Valid, in respect of a document or information that is used to verify identity, is one that appears legitimate or authentic and does not appear to have been altered or had any information redacted. The information must also be valid according to the issuer, for example if a passport is invalid because of a name change, it is not valid for FINTRAC purposes.

Based on the above, it is not solely for FINTRAC to determine whether a document is valid and current. Rather, the issuer must be consulted to determine whether a document that contains “old” information continues to be valid during the time in which a person has to carry out the necessary update, as well as current based on this same window for updating.

In this instance, it would be for the applicable provincial ministry to address the question of a driver’s license’s status as “current and valid” during the time in which a person can update their address details.

Date answered: 2020-11-03

Answer updated on: 2021-08-20

PI Number: PI-11063

Activity Sector(s): Accountants, British Columbia notaries, Casinos, Dealers in precious metals and stones, Financial entities, Life insurance, Money services businesses, Real estate, Securities dealers

Obligation(s): Verifying identity

Guidance: Methods to verify the identity of persons and entities

Regulations: 105(1)(a), 105(5)

Act: 6.1

Government-issued photo identification document for verifying ID – Authentic, valid and current

Question:

How do I determine that a document is authentic?

Answer:

Reporting entities must verify the identity of a person pursuant to one of the methods prescribed in the PCMLTFR, which can all be used when a client is physically present or when a client is not physically present. The most common methods are referred to as i) the government-issued photo identification method, ii) the credit file method, and iii) the dual process method. These methods are at subsection 105(1) of the PCMLTFR.

Subsection 105(5) of the PCMLTFR further requires that a document used to ascertain identity under subsection (1) be authentic, valid, and current and that other information used for that purpose be valid and current.

While the restriction on using an electronic image of a document has been removed from the PCMLTFR, other stipulations do exist to ensure the continued effectiveness of the obligation to verify identity. Specifically, if a reporting entity chooses to verify identity by referring to:

1.         A government-issued photo identification document - it must be authentic, valid and current.

  • a. You can determine the authenticity of a government-issued photo identification document in person by looking at the characteristics of the original physical document and its security features (or markers, as applicable) in the presence of the individual to be satisfied that it is authentic as issued by the competent authority (federal, provincial, territorial government), that it is valid (unaltered, not counterfeit), and current (not expired). 
  • b.  If an individual is not physically present, the authenticity of a government-issued photo identification document must be determined by using a technology capable of assessing the document’s authenticity. For example, a technology that would compare the features of the government-issued photo identification document against known characteristics (size, texture, character spacing, raised lettering, format, design, etc.), security features (holograms, barcodes, magnetic strips, watermarks, embedded electronic chips, etc.), or markers (logos, symbols, etc.) to be satisfied that it is an authentic document as issued by the competent authority (federal, provincial, territorial government).

2.         Information under the credit file or dual process method, it must be valid and current, as well as, under the dual process method, from different sources. 

  • As such, an electronic image of a document can be used for either option above, but must also meet the requirements of subsection 105(5) of the PCMLTFR. 

Date answered: 2019-09-24

PI Number: PI-9976

Activity Sector(s): Accountants, British Columbia notaries, Casinos, Dealers in precious metals and stones, Financial entities, Life insurance, Money services businesses, Real estate, Securities dealers

Obligation(s): Verifying identity

Regulations: 105(1), 105(5)

Act: 6.1

Redacted account numbers

Question:

Would a redacted credit card account number be sufficient to meet the record keeping requirements when ascertaining the identity of a person using the method specified at paragraph 105(1)(d) of the Proceeds of Crime (Money Laundering) and Terrorist Financing Regulations (PCMLTFR), commonly referred to as the dual process method?

Answer:

Paragraph 105(1)(d) of the PCMLTFR states that a person’s identity may be ascertained “by doing any two of the following:

 

  • (i) referring to information from a reliable source that includes their name and address, and verifying that the name and address are those of the person,
  • (ii) referring to information from a reliable source that includes their name and date of birth, and verifying that the name and date of birth are those of the person, or
  • (iii) referring to information that includes their name and confirms that they have a deposit account or a credit card or other loan account with a financial entity, and verifying that information.”

In accordance with paragraph 108(d) of the PCMLTFR, when the dual process method is used, a record must be kept that includes the person’s name, the date on which the person’s identity was ascertained, the source of the information, the type of information referred to and “the account number included in it — or if there is no account number included in it, a number associated with the information”.

The record keeping requirement for the dual process method therefore clearly contains the obligation to retain an account number. The term “account number” is generally understood to be the unique number given to an individual account, and it is usually complex enough to eliminate the possibility that more than one person has the same number. If the account number is redacted it is no longer the true account number unique to the individual account. Additionally, this information is required to be included in reports submitted to FINTRAC, as applicable, and is critical for any analysis conducted to ensure that one or more transactions are related. Therefore, this information is essential in aiding FINTRAC to contribute to the public safety of Canadians by helping to protect the integrity of Canada’s financial system through detecting, preventing, and deterring money laundering and the financing of terrorist activity.

As a result, a redacted credit card account number would not be sufficient for meeting the record keeping requirement at paragraph 108(d) of the PCMLTFR. Instead, it is FINTRAC’s expectation that reporting entities will record a complete account number, as applicable, when ascertaining the identity of a person using the dual process method at paragraph 105(1)(d) of the PCMLTFR.

Alternatively, persons and entities subject to the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) and its associated Regulations may choose to use the government-issued photo identification method, the credit file method, or to verify the required information of the dual process method by other means.

Date answered: 2017-10-18

PI Number: PI-8138

Activity Sector(s): Accountants, British Columbia notaries, Casinos, Dealers in precious metals and stones, Financial entities, Life insurance, Money services businesses, Real estate, Securities dealers

Obligation(s): Verifying identity

Regulations: 105(1)(d), 108(d)

Date Modified: