FINTRAC client identification, in the day-to-day language of a mortgage file.

Effective October 11, 2024, mortgage administrators, mortgage brokers, and mortgage lenders became reporting entities under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act and its regulations, per FINTRAC's mortgage sector guidance. The obligations sit with whichever role you play on a given file — a brokerage, a lender, and an administrator involved in the same deal can each carry separate obligations.

In practice, that means a compliance program with five required elements: a designated compliance officer with real authority, written policies and procedures, a documented risk assessment, an employee training program, and a review of the program's effectiveness at least every two years. Client identification is the piece that touches every single file, which is why it's worth getting right at the transaction level, not just in a policy manual nobody reopens.

FINTRAC's framework requires verifying the identity of persons and entities for prescribed activities and transactions, and then maintaining that verification through ongoing monitoring for as long as the business relationship continues — not as a one-time box checked at intake and forgotten.

For a typical Canadian mortgage file, that means identifying the borrower — and any unrepresented party to the transaction, such as a guarantor who isn't independently represented — at the point the business relationship is established, then keeping that information current for the life of the relationship rather than treating it as a closing-day formality.

FINTRAC accepts five methods for verifying an individual's identity, per its methods guidance, and the requirements differ enough between them that mixing them up is where most day-to-day errors happen:

• →Government-issued photo ID. A federal, provincial, or territorial photo ID (or an equivalent foreign document) that's authentic, valid, and current, viewed in person or authenticated virtually — it must show the person's name, photo, and a unique identifying number.
• →Credit file method. A Canadian credit bureau file that's at least three years old, contains information from multiple sources, and matches the client's name, address, and date of birth — and it has to be searched at the time of verification. A file pulled for a pre-approval weeks earlier doesn't satisfy this on its own.
• →Dual-process method. Two independent, reliable sources (utility bills, government statements, bank statements, property tax assessments) confirming any two of: name and address, name and date of birth, or name and a financial account. Neither source can be the client themselves, your own brokerage, or a social media profile.
• →Affiliate or member method. Relying on identification already completed by an affiliated reporting entity, provided they used one of the approved methods and the name, address, and date of birth match.
• →Reliance method. Relying on another reporting entity's prior verification under a written agreement, confirming the information used remains valid and current.

For a straightforward salaried borrower meeting in person or over video, government photo ID or dual-process tends to be the practical default. Credit file verification is convenient when you already have bureau access as part of the application — just remember it has to be pulled fresh, not reused from an earlier stage of the same deal.

The mistakes that show up in a records review are rarely dramatic — they're small gaps that add up:

• →Treating a credit file pulled for a pre-approval months earlier as still valid for identification purposes, instead of confirming it fresh at the time of verification.
• →Using only one dual-process source instead of two independent ones, or leaning on a source — like a social media profile — that isn't accepted.
• →Verifying the primary borrower but skipping a guarantor or co-signer who isn't independently represented on the file.
• →Treating identification as a closing-week task instead of an intake-stage one, which leaves no time to fix a gap before funding.

Entity borrowers — a numbered company, a holding corporation, a trust — add a step individual borrowers don't: confirming beneficial ownership. You need to obtain, and take reasonable measures to confirm the accuracy of, information about who actually owns or controls the entity, alongside the entity's own identifying information (name, address, and nature of its principal business). A politically exposed person determination may also apply to certain activities involving that borrower.

This is the part of a file that's easiest to underweight because it feels like paperwork rather than risk assessment. In practice, it's the piece most likely to surface a genuine red flag — an ownership structure that doesn't match the story you've been told is exactly what the identification step exists to catch.

Brokerages that handle this well treat identification the same way they treat income documentation — a checklist item confirmed and dated at intake, not something reconstructed later if a file gets flagged. That means naming who on the file is responsible for confirming the method used, storing the record somewhere retrievable, and dating it, since FINTRAC requires records to be producible within 30 days of a request.

If you're building or auditing that workflow, our brokerage file audit checklist walks through the identification and documentation gaps a real review tends to surface, and pairs well with the broader discipline covered in our companion piece on what to keep and for how long.