Every other FINTRAC obligation — record-keeping, reporting, ongoing monitoring — assumes you actually know who your client is in the first place. Identity verification isn't a formality that happens once at intake and gets filed away; it's the foundation the rest of the compliance program depends on, which is exactly why FINTRAC is specific about what counts as adequate verification and what doesn't.
This module covers the three methods FINTRAC most commonly recognizes for verifying an individual. Each has its own specific requirements, and using a method incorrectly — a credit file that's too recent, a dual-process pairing that isn't actually independent — creates a compliance gap even if the broker genuinely believes the client's identity was confirmed.
This is the most intuitive method: a current, valid, government-issued document — a driver's licence, passport, or provincial ID card — that displays the person's name, photograph, and a unique identifying number, examined against the person themselves to confirm the photograph matches. In person, this means physically viewing the document and its security features, not just accepting a description of it. Remotely, it means using technology that can authenticate the document itself and confirm, through video or facial-recognition comparison, that the person presenting it matches the photograph.
The document has to be authentic, valid, and current — an expired licence, or one you have reason to doubt is genuine, doesn't satisfy the method even if the client insists it's fine. This is the method most brokers default to because it's familiar, but it isn't the only option, and it isn't always the most practical one for a fully remote client relationship.
This method verifies identity by matching a client's name, address, and date of birth against an established Canadian credit file — from a bureau like Equifax or TransUnion — rather than examining a physical document. Three specific conditions have to be met for this to count: the credit file has to exist for at least three years, it has to draw on information from more than one source (multiple tradelines, not a single thin file), and it has to be searched at the actual time of verification — a credit file pulled weeks or months earlier for a different purpose doesn't satisfy the requirement when reused later.
This method can be convenient precisely because a credit check is often happening anyway as part of building the mortgage file — but the timing condition is easy to get wrong. If the credit pull used for identity verification wasn't conducted at the point of verifying identity specifically, or if it doesn't meet the three-year and multiple-source conditions, it doesn't count, even though a credit report was genuinely obtained.
The dual-process method combines two pieces of information from two different, independent, reliable sources — for example, matching a client's name and address from one source with their name and date of birth from a second, or confirming their name alongside an existing financial account (a deposit account, credit card, or loan) from a separate source. The key requirement, and the one most likely to be gotten wrong, is independence: both pieces of information have to come from genuinely separate, reputable sources — a government body, a utility provider, a financial institution — and neither can come from the client themselves or from your own brokerage's own records.
A common mistake is treating two documents the client hands over as satisfying dual-process, when both actually originated from the same underlying source, or when one of them is something the brokerage itself generated rather than an independent third party. The method exists specifically to guard against a client fabricating their own supporting documentation, so the independence requirement isn't a technicality — it's the entire point of the method.
None of the three methods is universally preferred — the right one depends on the client relationship. A client meeting in person can usually be verified quickly with government-issued photo ID. A fully remote client, especially one whose mortgage process never involves an in-person meeting, may be more efficiently verified through the credit file method if a qualifying file exists, or dual-process if it doesn't.
When a first attempt doesn't work cleanly — an ID document that's hard to authenticate remotely, a credit file that's too thin or too recent — the answer is to move to a different method entirely, not to lower the bar on the method you started with. Documenting which method was used and why, for every client, is what turns identification from something you did into something you can demonstrate you did if it's ever reviewed.
A broker pulls a client's credit report as part of the mortgage application and later wants to use that same report, from three weeks earlier, to satisfy FINTRAC's credit file identification method. Does this work?
The credit file method has three specific conditions — at least three years old, multiple sources, and searched at the time of verification — and the timing condition is exactly what a reused, three-week-old report fails to meet, even if the file otherwise qualifies on age and sources. A credit report pulled for general mortgage-file purposes doesn't automatically double as FINTRAC identification unless it's specifically searched for that purpose at that time. And there's no rule against using more than one method, or switching methods, for the same client.
The intro and first module are free to read. Add your name and email once and the rest of this course opens — along with every other course on the site. No card, no trial.
Already unlocked on another device?
