AML and KYC glossary for Canada
The language of financial-crime compliance is dense with acronyms. This glossary defines the AML, KYC, and identity verification terms that matter most to Canadian regulated firms, in plain English, with links to the deeper guides where each one is unpacked.
This glossary covers the AML, KYC, and identity verification terms a Canadian regulated firm runs into most often. Definitions are written for operators, not lawyers, and each links to the fuller guide where the topic is unpacked. Use it as a quick reference or a starting point.
What are the key identity and verification terms?
KYC (Know Your Customer). The process of verifying the identity of an individual customer before and during a business relationship. In Canada it has to be done by a FINTRAC-accepted method.
KYB (Know Your Business). The equivalent process for a corporate customer: verifying the entity, identifying and verifying its beneficial owners, and screening the structure.
Liveness detection. A check that the face in front of the camera belongs to a real, present human rather than a photo, mask, or replay. Passive liveness does this from a single selfie without asking the user to act.
Presentation attack. An attempt to fool verification by presenting a fake to the camera, such as a printed photo, a screen replay, or a mask. Defended by presentation attack detection, benchmarked against ISO/IEC 30107.
Injection attack. An attempt to bypass the camera entirely by feeding a synthetic video stream into the capture pipeline. Defended alongside liveness.
Deepfake. AI-generated or face-swapped video or imagery used to impersonate a person at onboarding. Screened by deepfake detection.
Synthetic identity. A fabricated identity that blends invented and sometimes real data to pass checks. See synthetic identity fraud.
OCR (Optical Character Recognition). Technology that reads the text on an identity document so it can be parsed and cross-checked. See document verification.
MRZ (Machine-Readable Zone). The coded lines on a passport or card that encode the holder's details, parsed and checked against the visible fields.
What do sanctions, PEP, and adverse media mean?
PEP (Politically Exposed Person). A person entrusted with a prominent public function, who carries higher money-laundering risk and triggers enhanced measures. Identified through screening.
Sanctions screening. Checking customers against Canadian and international sanctions lists, including lists from ministerial directives. A strict obligation.
Adverse media. Negative-news screening that surfaces risk-relevant information about a customer from public reporting.
Which program and reporting terms should you know?
FINTRAC. The Financial Transactions and Reports Analysis Centre of Canada, the regulator that supervises reporting entities and receives their reports.
PCMLTFA. The Proceeds of Crime (Money Laundering) and Terrorist Financing Act, the law that sets out reporting-entity obligations in Canada.
Bill C-12. The 2026 amendments that introduced the reasonably designed, risk-based, and effective standard and raised penalty ceilings. See the Bill C-12 guide.
CAMLO (Chief Anti-Money Laundering Officer). The compliance officer of record accountable for a firm's AML program. Can be engaged on a fractional basis.
CDD and EDD. Customer Due Diligence, and Enhanced Due Diligence for higher-risk customers: the structured assessment of who a customer is and the risk they present.
Beneficial ownership. The real humans who ultimately own or control a corporate customer. A material conflict with the federal registry can trigger a material discrepancy report.
STR (Suspicious Transaction Report). A report filed with FINTRAC when there are reasonable grounds to suspect a transaction relates to money laundering or terrorist financing.
LCTR and LVCTR. Large Cash Transaction Reports and Large Virtual Currency Transaction Reports, filed at defined thresholds.
Travel Rule. The requirement that originator and beneficiary information travel with a transfer. See the Travel Rule guide.
AMP (Administrative Monetary Penalty). A financial penalty FINTRAC can impose for non-compliance. Ceilings rose sharply in 2026, as covered in the AMP increase explainer.
RPAA (Retail Payment Activities Act). The framework governing payment service providers, alongside the PCMLTFA. See the RPAA explainer.
FAQ
What does CAMLO stand for?
CAMLO stands for Chief Anti-Money Laundering Officer, the compliance officer of record accountable for a firm's AML program in Canada. It is the named role a reporting entity designates to own the program: overseeing policies, monitoring, screening, and reporting, and standing as the point of accountability when FINTRAC examines the firm. The role can be filled in-house or, particularly for smaller firms without a full compliance department, engaged on a fractional basis, where an external practitioner carries the CAMLO responsibility part-time rather than as a full-time employee. Either way, the accountability is real: the CAMLO is the person a regulator holds responsible for whether the AML program is reasonably designed and actually operating. Naming a CAMLO is a baseline expectation of a Canadian compliance program, not an optional refinement, which is why the term recurs so often across FINTRAC guidance and in the other reporting obligations covered in this glossary.
What is the difference between KYC and KYB?
KYC, Know Your Customer, is the process of verifying the identity of an individual customer before and during a business relationship, and in Canada it has to be done by a FINTRAC-accepted method. KYB, Know Your Business, is the equivalent process for a corporate customer: it means verifying the entity itself, identifying and verifying its beneficial owners, and screening the resulting structure. The core difference is layers. Verifying an individual is a single-subject check, but a company can be owned and controlled through several other companies, so KYB has to trace ownership up through that structure to reach the real humans who ultimately own or control the customer. That is why KYB carries more steps and more room for discrepancy than KYC. Both sit at the front of a compliance program, and both feed the screening and ongoing monitoring that follow, but KYB answers a harder question about who is really behind a business.
What is a PEP in AML?
A PEP, or politically exposed person, is someone entrusted with a prominent public function, who is treated as carrying higher money-laundering risk because of the position they hold. Identifying a PEP does not by itself bar the relationship; it triggers enhanced measures, the closer scrutiny a compliance program applies to higher-risk customers. In the language of this glossary, that maps to enhanced due diligence, the more rigorous assessment reserved for higher-risk customers rather than the standard customer due diligence applied to everyone. PEPs are identified through screening, and in a Canadian program that screening runs alongside sanctions screening and adverse-media screening as part of the same review. The practical takeaway is that a PEP finding is a signal to look more closely and apply enhanced due diligence, not an automatic reason to refuse the customer, which is what separates a PEP result from a sanctions match, where the obligation is a strict one.
What is liveness detection?
Liveness detection is a check that the face in front of the camera belongs to a real, present human rather than a photo, mask, or replay. Its job is to defeat presentation attacks, attempts to fool verification by presenting a fake to the camera such as a printed photo, a screen replay, or a mask, which is why it is benchmarked against standards for presentation attack detection. Passive liveness does this from a single selfie, without asking the user to perform any action, which keeps the check invisible to the person being verified. Liveness sits alongside defences against injection attacks, where the goal is to bypass the camera entirely by feeding a synthetic video stream into the capture pipeline, and against deepfakes, AI-generated or face-swapped imagery used to impersonate a person at onboarding. Together these checks answer whether the person on the other side of the camera is genuinely there.
Sources
Know the terms. Now see them working.
Book a platform demo and we will show you how real-time screening and audit-ready case history turn these terms into a defensible FINTRAC program.
Book a demo