Identification is not a photocopy of a driver’s licence stapled to a file. FINTRAC names five specific methods for an individual and three for an entity — use the wrong one, or use one incorrectly, and the file does not actually satisfy the obligation.
Key takeaways
STEP 01 OF 10
This is the core know-your-client obligation. Every licensed agent or salesperson is, by the nature of the job, a reporting entity under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act — the definition covers anyone “authorized under provincial legislation to act as an agent for purchasers or vendors in respect of a purchase or sale of real property.” There is no small-deal exemption in the identification duty itself — build the workflow to run on every purchase-or-sale transaction, not selectively on ones that feel higher-risk.
STEP 02 OF 10
FINTRAC’s Guideline 11 sets out five methods for identifying an individual: government-issued photo ID; the credit file method; the dual-process method; the affiliate method; and the reliance method. Each has its own specific requirements, and defaulting to “photo ID every time” without knowing the alternatives means missing situations where a repeat client is better served by the reliance method (Step 6) instead of re-verifying from scratch.
STEP 03 OF 10
This is the most familiar method and also the easiest to get subtly wrong: the ID must be authentic, valid, and current, and it has to be federal, provincial, or territorial — a foreign passport on its own does not satisfy this specific method, even though it is a legitimate photo ID in the ordinary sense. A non-resident buyer identified this way needs a different method, or a Canadian-issued document, not a foreign passport treated as equivalent.
STEP 04 OF 10
The credit file method requires a file that is valid, current, from a Canadian bureau, and at least three years old, drawing on multiple sources. This age test is the part agents most often skip — see the worked example below for what happens when a client’s file does not actually meet it, and why the method simply is not available in that case, regardless of how complete the file otherwise looks.
STEP 05 OF 10
The dual-process method calls for two different, reliable, independent sources, used in combination, confirming the person’s name plus one of: address, date of birth, or a financial account. This is frequently the right method for a newcomer buyer with a thin or absent Canadian credit file — where the credit-file method in Step 4 is unavailable, dual-process is often the practical alternative rather than defaulting straight to photo ID re-verification.
STEP 06 OF 10
Where an affiliated reporting entity, or another reporting entity under a written reliance agreement, has already verified the same person’s identity, you do not need to repeat the full process. The affiliate method relies on a prior verification within your own corporate family; the reliance method relies on another reporting entity’s prior verification, including an affiliated foreign entity, under a written agreement. Confirm the underlying agreement or affiliation actually exists and covers this specific client before relying on either method — the shortcut is only valid where the prior verification is real and documented. A newer, third avenue sits alongside both: since October 1, 2025, FINTRAC's guidance permits using an agent or mandatary under a written agreement to actually carry out the verification on your behalf — unlike the reliance method, that agent does not need to be a reporting entity itself, which can matter for a client identified through a third-party service rather than another brokerage.
STEP 07 OF 10
Entities have their own three methods: confirmation of existence (certificate of incorporation or an equivalent government record), the reliance method, or the simplified method for specified low-risk entities only. Separately, and regardless of which entity method you use, you must identify anyone who is a beneficial owner, defined as directly or indirectly owning or controlling at least 25% (FINTRAC guidance) of the entity — for a corporation, that means the names of all directors plus the names and addresses of every 25%-plus shareholder; for a trust, the trustees, known beneficiaries, and settlors.
STEP 08 OF 10
This is a distinct, separate step, and the method used to confirm cannot be the same method used to collect. Acceptable confirmation approaches: reviewing official documentation, consulting a corporate or beneficial-ownership registry, or a signed client attestation. A file that only ever asked the client to name their own owners, with no independent confirmation step at all, has completed collection but not confirmation — and both are required, both at onboarding and during ongoing monitoring.
STEP 09 OF 10
Remote, online identification is explicitly permitted, but it has to actually authenticate the document, not just capture an image of it. FINTRAC’s guidance names facial-recognition comparison of a “selfie” against the ID photo, or a live video call comparing the person’s face and the ID’s name to the document, as acceptable approaches — and confirms these steps do not need to happen simultaneously. A workflow that captures the document at one point and completes a liveness check later is compliant; a workflow that only ever captures a static photo with no authentication step at all is not.
STEP 10 OF 10
An identification record only satisfies the obligation for as long as it is actually retained and retrievable — see the record retention schedule guide for the specific clocks that apply, and the FINTRAC compliance starter kit for how identification fits into the wider compliance file. Build the identification step to write directly into the same system that tracks retention, rather than leaving completed ID checks in a folder disconnected from the record-keeping workflow.
A client’s credit file was opened on January 15, 2024. The transaction requiring identification takes place on February 10, 2026.
This is not a paperwork technicality — a file that fails the three-year age test simply is not a valid basis for this specific method, no matter how complete or accurate the credit report otherwise is. The correct response is to fall back to the dual-process method (Step 5) or government-issued photo ID (Step 3), not to note the shortfall and proceed anyway. A workflow that only checks “do we have a credit file” without checking its age will pass files that do not actually satisfy the method being relied on.
FINTRAC’s five methods and the beneficial-ownership test apply identically in every province — there is no provincial variation in the identification obligation itself. What differs by province is which privacy law governs the completed ID record once it is sitting in your file.
| Jurisdiction | Which law governs the stored ID record | Practical effect |
|---|---|---|
| Most of Canada (incl. Ontario) | PIPEDA governs directly. | The general “meaningful consent” and safeguards principles apply to how the ID copy is stored and who can access it. |
| Alberta, British Columbia, Quebec | Each province’s own substantially similar private-sector statute governs a purely intra-provincial file — PIPEDA still applies the moment the record crosses a provincial or national border. | Most cloud-based CRM or ID-verification platforms host or route data outside the province, which pulls PIPEDA back in even for an agent working entirely within BC, Alberta, or Quebec. |
The identification workflow itself does not change by province. What should change is where you check whether the storage and transmission of the resulting record actually complies — a Quebec-based brokerage using a US-hosted verification platform is very likely triggering PIPEDA on the storage side even though the identification methods it used were the same five FINTRAC names everywhere.
Not on its own — that specific method requires a federal, provincial, or territorial document. A foreign passport can still support identification through the dual-process method instead, in combination with a second independent source.
Only where a written reliance agreement actually exists between the two reporting entities, or the verification was done by an affiliate within the same corporate family. An informal understanding that “the other agent already checked ID” is not, on its own, a valid reliance-method basis.
Yes — FINTRAC’s guidance explicitly confirms the authenticity/currency check and the identity-matching step do not need to happen at the same time, provided both steps are actually completed and documented.
Not under the 25% ownership test on its own — none individually crosses the threshold. Confirm separately whether any of them exercises control by another route, since the test covers those who own or control 25% or more, not ownership percentage alone.
A short review of your actual intake process against FINTRAC's five individual and three entity methods.
