FINTRAC: Preparing your identity verification strategy for more than just compliance

FINTRAC, the Financial Transactions and Reports Analysis Centre of Canada, is Canada’s financial intelligence unit that detects, prevents, and deters financial crimes through data and analysis. It also ensures that businesses subject to the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) and associated regulations are in compliance.

Recent amendments to PCMLTFA outline new regulated sectors and additional obligations for existing reporting entities. Among these changes are enhanced requirements to verify the identity of individuals and entities  under certain circumstances, including:

• Before a large financial transaction
• When suspicious financial activities are detected
• For specific record-keeping purposes

These obligations also apply to transactions conducted online. When a person isn’t physically present, institutions can rely on government-issued photo identification if they have a process to confirm the document’s authenticity.

If your organization falls under FINTRAC regulations, you face an important choice: will compliance be treated as a checkbox exercise, or will your organization turn these requirements into a competitive advantage, using them as an opportunity to optimize your operations and customer experience.

As you determine your organization’s path forward, this blog can help you decide — is your organization going to strive to become FINTRAC-ready or FINTRAC-optimized?

Who needs to be FINTRAC compliant?

Compliance with FINTRAC and its associated PCMLTFA regulations is non-negotiable for organizations within the following sectors:

• Already regulated sectors: Banks, credit unions, trusts, MSBs, mortgage brokers, insurance, securities dealers, real estate brokers, notaries (BC), and more
• Newly regulated sectors as of 2025: Title insurers, financing/leasing companies, factoring firms, cheque cashing businesses, and private ABM acquirers

For newly regulated sectors, comprehensive AML programs must be implemented. These programs include robust identity verification, recordkeeping, suspicious transaction reporting, and ongoing monitoring to keep client information current based on risk.

For already regulated sectors, these changes provide an opportunity to reassess internal processes and strengthen risk assessment, recordkeeping, and reporting, while delivering the best balance of user experience, security, and compliance.

FINTRAC-ready vs FINTRAC-optimized

As teams across these sectors evaluate their approach to identity verification, two paths are emerging: FINTRAC-ready and FINTRAC-optimized.

FINTRAC-ready

On the FINTRAC-ready path, an organization meets baseline regulatory requirements through traditional methods, including manual document reviews, uploaded statements and certificates, in-person verification, and form-based processes.

While this approach checks the compliance box, it’s often at the cost of operational efficiency, resulting in slow onboarding, high customer abandonment, and resource-intensive compliance reviews.

Typical challenges with the FINTRAC-ready scenario include:

• Customer friction: Multi-day onboarding with document uploads, email exchanges, and manual reviews
• High abandonment rates: Customers drop off during lengthy verification processes
• Operational burdens: Compliance teams spend hours manually reviewing documents and chasing missing information
• Scalability issues: Each new customer creates linear increases in workload

FINTRAC-optimized

With the FINTRAC-optimized path, an organization uses compliance as a foundation to build a competitive advantage through technology, automation, and enhanced user experience, turning the company into a growth engine. This includes leveraging advanced methods such as facial recognition technology to compare a user’s selfie against their identification document photo.

Typical gains with the FINTRAC-optimized approach include:

• Improved customer experience: Fully automated, mobile-friendly verification so onboarding can happen in minutes, not days
• High completion rates: Intuitive processes resulting in higher completion rates
• Operational efficiency: Automated checks, saving compliance resources
• Scalability: Technology handles volume spikes without proportional staffing increases

Blog

Canadian platform integrates ID verification

“We chose to partner with OneSpan to integrate identity verification into our platform. That not only helps users verify clients’ identities but protects their personal information as well,” says Anderson Brice, CEO of BACC Solutions.

Read success story

How leading organizations optimize their FINTRAC compliance approaches

To keep up with leading organizations, here are three recommendations to consider to help determine which FINTRAC compliance approach best suits your needs. Be sure to discuss your plans with your legal and compliance teams before getting started.

1. Assess your current solution: Review where your organization’s solutions and processes currently stand.

• Map out the journey your customers take and determine where there are points of friction
• Track benchmarks for your current onboarding speed and completion rates, then make a note of improvement opportunities
• Determine which countries you receive documentation from, then evaluate how easily you’re able to assess each foreign document
• Conduct an audit for gaps in recordkeeping, monitoring, reporting, and scalability

2. Explore advanced technology options: Consider what technological advancements your organization can implement to improve compliance, efficiency, and the overall user experience. This may include:

• AI-powered document verification: Use document authenticity algorithms to read and extract data from identification (ID) documents and validate authenticity. For example:
  • Compare the features of the government-issued photo ID against known characteristics such as size, texture, character spacing, raised lettering, format, design; security features such as holograms, barcodes, magnetic strips, watermarks, embedded electronic chips; or markers such as logos and symbols
  • Use detailed security checks to confirm whether a document is genuine or has been falsified, forged, photocopied (print attack), or displayed on a screen (replay attack)
• Biometrics:
  • Use facial biometrics with low false match rate (FMR)
  • Include passive and active liveness detection to protect against deep fakes
• User experience tools:
  • Implement a fully automated identity verification process
  • Capture user consent with a consent management platform (CMP)
  • Provide users with a multi-channel experience, including modern methods such as a QR code for mobile handover
  • Look for solutions that offer white-labeling to keep your organization’s branding consistent and aligned with customer expectations

3. Consider additional compliance needs: In addition to assessing your current solutions and exploring advanced technology options, it’s important to remember that PCMLTFA compliance also requires record keeping and security protections.

• Determine the best way to enforce records of evidence summary and audit trails within your organization
• Ensure every solution your organization uses can adhere to global regulations for both security and data protection

Blog

Digital transformation in auto finance: The MotoNovo story

MotoNovo transformed their customer loans with digital ID verification and eSignature. While this UK lender is not subject to FINTRAC, see how their implementation has fueled growth.

Read success story

OneSpan Sign offers global identity verification

OneSpan Sign has a proven track record with Canadian financial institutions and banks worldwide, and provides global coverage for over 10,000 identity documents across 194 countries.

We enable FINTRAC and global standards, providing users with the white-glove treatment, including:

• World-class facial recognition technology
• AI authenticity algorithms
• Certified active and passive liveness detection
• A complete white-labeled solution
• Evidence summary and audit trail

Achieve FINTRAC compliance and beyond

FINTRAC compliance isn't optional, but how you achieve it is a strategic choice. Organizations that view 2025's PCMLTFA regulatory expansion as merely a compliance hurdle will meet requirements but may struggle with efficiency and experience.

Organizations that see it as an opportunity to modernize their identity verification approach will achieve compliance and gain competitive advantages in customer experience, operational efficiency, and fraud prevention.

If you’re ready to move from FINTRAC-ready to FINTRAC-optimized, sign up for a free trial of OneSpan Sign or meet with us to discuss how you can future-proof your onboarding and compliance strategies.

Speak to an expert

Speak to a OneSpan expert about Canada’s PCMLTFA requirements for digital identity verification.

Contact us

The information contained on this page is for information purposes only, provided as is as of the date of publication, and should not be relied upon as legal advice or to determine how the law applies to your business or organization. It is recommended that you seek guidance from your legal counsel with regard to law applying specifically to your business or organization and how to ensure compliance. OneSpan does not accept liability for the contents of these materials or for third parties.

For official guidance, visit fintrac-canafe.gc.ca.