Client identification is a legal obligation with prescribed methods and prescribed records. AI can prepare the record. It cannot be the verifier.
Key takeaways
Not every professional firm is a reporting entity. Section 5 of the Proceeds of Crime (Money Laundering) and Terrorist Financing Act lists who Part 1 applies to — banks, credit unions, life insurance companies, trust and loan companies, securities dealers, money services businesses and others, plus persons and entities engaged in prescribed businesses or activities.
For accountants and accounting firms, FINTRAC’s guidance is activity-based: the requirements bite when you engage in, or give instructions on behalf of a client in respect of, receiving or paying funds, purchasing or selling securities, real estate, business assets or entities, or transferring funds or securities. FINTRAC states that audit, review and compilation engagements are not subject to the Act or its regulations, and that providing advice is not the same as giving instructions.
Get this determination in writing before you buy anything. A firm that is not a reporting entity does not need a FINTRAC-shaped identification process; a firm that is cannot substitute a lighter one.
FINTRAC’s guidance on when accountants must verify identity names four situations: a large cash transaction, a large virtual currency transaction, a suspicious transaction, and the receipt of funds of $3,000 or more.
For large cash, you must verify the identity of every person or entity from which you received $10,000 or more in cash, when the transaction takes place, and the same threshold applies to virtual currency received in an equivalent amount. Both are subject to FINTRAC’s 24-hour rule.
For suspicious transactions you must take reasonable measures to verify identity regardless of amount, before submitting a Suspicious Transaction Report. For receipt of funds of $3,000 or more, a person is verified when the transaction takes place; a corporation or other entity, or one on whose behalf the transaction is conducted, is verified within 30 days after the day the transaction is conducted.
Exceptions exist — for cash or funds received from a financial entity or a public body, for very large corporations and trusts, and where you have already verified the person and have no doubts. Read the exceptions on the source page rather than from memory; they are narrower than they sound.
FINTRAC’s guidance on methods to verify identity sets out five methods for a person: government-issued photo identification, credit file, dual-process, affiliate or member, and reliance. For an entity there are three: confirmation of existence, reliance, and simplified identification.
Each method carries its own mandatory record. For the photo identification method you must record the person’s name, the date you verified identity, the type of document, its unique identifying number, the jurisdiction and country of issue, and the expiry date if it appears. For the credit file method you record the name, the date you consulted the file, the credit bureau or third-party vendor, and the credit file number.
The constraints are specific too. Photo identification issued by a municipal government is not acceptable. A Canadian credit file must have existed for at least three years and draw on more than one source, and the search has to happen at the time you are verifying — a client cannot hand you a copy. Under the dual-process method the two pieces of information must come from two different reliable sources, and neither you nor the client can be a source.
FINTRAC’s guidance requires you to have a process to authenticate a government-issued photo identification document, and is explicit that it is not enough to only view a person and their document through a video conference or another virtual application. Automated document authentication may form part of that process; it does not replace the requirement to have one and to describe it.
That description belongs in your compliance program. FINTRAC states that your policies and procedures must describe the processes you follow to determine whether a document is authentic, whether the client is present or not, and how you confirm it is valid and current.
And the whole regime remains the reporting entity’s. A tool does not verify identity; your firm does, using a method the regulations name, recorded in a form the regulations specify. Nothing about deploying software transfers that.
Identification collects a lot of personal information. FINTRAC itself points out that the use of personal information in Canadian commercial activities is protected by PIPEDA or similar provincial legislation, that you have to inform clients about the collection, and that you do not have to inform them when their information is included in a report you are required to submit to FINTRAC.
The ten fair information principles apply to the identification file like any other. Safeguards and retention limits matter most here, because identity documents are the highest-value data a small firm holds.
If you have not appointed anyone to own this, appointing a privacy officer and whether you need a written privacy policy are the two starting questions.
Can AI verify a client’s identity for us?
No. It can extract, pre-fill, check completeness and flag mismatches. Verification is performed by the reporting entity using a prescribed method, and the record has to show that.
Does a video call satisfy the photo identification method?
Not on its own. FINTRAC states it is not enough to only view a person and their document over video conference; you need a process to authenticate the document itself — see the methods guidance.
We only do compilations. Do we need any of this?
FINTRAC states that audit, review and compilation engagements are not subject to the Act or its regulations. Confirm your own activity mix against the guidance rather than assuming.
A 30-minute call is enough to tell you whether AI pays for itself here.
