FINTRAC identity verification methods: the accepted ways to verify identity in Canada

Under the PCMLTFA, FINTRAC sets out the methods a reporting entity may use to verify a person's identity, and you have to use one of them; they are not interchangeable with whatever a vendor happens to offer. The most common are the government-issued photo identification method, the credit file method, and the dual-process method, which together cover the large majority of remote onboarding. FINTRAC also recognises reliance on the verification already done by an affiliate or another reporting entity in defined circumstances, and the use of an agent or mandatary to carry out verification on the entity's behalf. Whichever method is chosen, the reporting entity has to apply it correctly and record which one it used. The method is only step one; the evidence that it was applied correctly, retained for the required period, is what actually survives an examination, so the record matters as much as the choice.

The government-issued photo identification method verifies identity by confirming that an authentic, valid, and current government-issued photo identity document belongs to the person, and that the person is who they claim to be. The document has to be issued by a federal, provincial, or territorial government, and the entity has to be satisfied both that the document is genuine and that the person presenting it is the document holder. It is the most common method for remote onboarding. AI-powered verification lives inside this method: facial recognition matches a live selfie to the photo on the document, passive liveness confirms the person is real and present, document checks confirm the ID is authentic, and deepfake detection screens out a generated face before it becomes an account. None of that changes the legal method; it is a stronger, self-recording way of applying it, which matters because Bill C-12 now expects the method to confirm a real, present human.

FINTRAC does not mandate a specific technology by name, so there is no rule that says you must use liveness or biometrics as such. What it requires is that verification be carried out by an accepted method and, under Bill C-12, that the program as a whole be reasonably designed, risk-based, and effective. That standard is where the technology comes back in. For remote onboarding, liveness detection and facial recognition are how a firm demonstrates that the accepted method it chose, typically the government-issued photo identification method, actually confirms a real, present person rather than simply matching a static document. A method that technically exists on paper but does not confirm a live human will not meet the effectiveness test. So while biometrics are not named as a requirement, in practice they are how many digital-first firms evidence that their chosen method works, which is exactly what an examiner now probes.

The credit file method is an accepted method on its own, but only when its conditions are met. The reporting entity refers to information in a credit file held by a Canadian credit bureau that has existed for at least three years, consults it at the time of verification, and confirms that the name, address, and date of birth match what the customer provided. Where those conditions hold, a credit check can be enough. The limitation is what it proves. A credit file confirms that a consistent record exists; it does not, on its own, confirm that the live human applying is the person the record describes. That is why higher-risk flows often pair it with a document or biometric check. It is also a known weak point against synthetic identity fraud, because a credit file is exactly what a synthetic identity is engineered to build, so relying on it alone leaves that gap open.

The dual-process method verifies identity using information from two different reliable and independent sources, and it is the fallback used where a photo document or a usable credit file is not available. Each of the two sources has to confirm at least two of the person's name, address, and date of birth, drawn from sources such as a government record, a utility statement, or a financial account, in the specific combinations FINTRAC requires. It is more administrative than the photo ID method and is common where biometric capture is not practical. The important constraint is that the two sources must be genuinely reliable, independent of each other, and recorded; the combination has to meet FINTRAC's requirements rather than simply being any two documents. Because it does not involve a live biometric check, higher-risk flows may still layer additional corroboration on top, but applied correctly and documented, the dual-process method is a fully accepted route to verification.

Reporting entities have to keep records of how identity was verified, including which accepted method was used and the information relied on, for the retention period FINTRAC sets, and be able to produce them on request. The exact length is the retention period FINTRAC prescribes rather than a single fixed number, and the obligation runs for that full period, not just through onboarding. What the record has to capture is the substance of the verification: which method was applied, what was checked, what the result was, who decided, and the underlying evidence. That is the difference between a program that looks compliant and one that is. Keeping the evidence is as important as choosing the method, because an examination tests the record, not the intention. Modern verification software helps by recording this automatically for every customer, producing the examiner-ready file as a by-product of onboarding rather than a later scramble.