Is a photocopy of a driver's licence enough?

A copy alone isn't sufficient: the government-issued photo ID method requires that the document be examined (in person or via an equivalent verified process), that it be current and unexpired, and that specific details (name, document number, type, issuer, expiry) be recorded, not just kept as an image. A copy with no recorded verification details is a weak file even if it looks complete.

Can I verify identity remotely, without meeting the client?

Yes. FINTRAC permits methods designed for non-face-to-face verification, including credit file checks and dual-process verification using two independent sources. These have their own specific requirements (for example, a credit file method requires the file to have existed for at least three years). They are not simply 'ask for ID over email.'

Do beneficial owners need to be identified too, not just the client?

Yes. For corporate and other entity clients, you generally need to confirm the entity's existence and identify individuals with significant control (beneficial owners), in addition to identifying the individual who is actually transacting on the entity's behalf.

How long do identification records need to be kept?

Client identification records generally need to be retained for at least five years from the date the business relationship ends or the record is created, depending on the record type. Retention is part of why the method and details recorded at verification time matter: you may need to produce them years later.

FINTRAC client identification methods: what counts as valid KYC

FINTRAC accepts a specific set of methods for verifying who your client is, and each one has rules about acceptable documents, timing and record content. Here's what a dealership or leasing company needs to capture on every in-scope deal.

Identifying who you're dealing with is the operational core of FINTRAC compliance, and the requirement isn't just "get some ID," it's using one of a defined set of acceptable methods, correctly, with the right details recorded. Getting this piece right on every deal is what makes the five-element compliance program real rather than theoretical.

The acceptable methods

FINTRAC's guidance sets out several ways to verify an individual's identity. The ones most relevant to financing and leasing transactions:

Government-issued photo identification: examining a valid, current, government-issued ID (driver's licence, passport, etc.) and recording its type, number, issuing jurisdiction and expiry date.
Credit file method: verifying identity against information in the individual's credit file, provided the file has existed for at least three years.
Dual-process method: confirming identity using information from two independent, reliable sources (for example, a utility bill plus a financial account reference), where no single source is sufficient alone.
Affiliate or member verification and other specified methods for particular business structures.

Each method has its own rules about what has to be examined, what has to be recorded, and how recently the underlying information must date. Using "a method that sounds reasonable" isn't the same as using one FINTRAC recognizes, and a mismatch here is one of the most common examination findings.

What the record actually needs to contain

Whichever method is used, the file needs to show:

Which method was used, not left implicit.
The specific details the method requires (document type, number, issuer and expiry for photo ID; the sources and what was confirmed for dual-process).
When verification happened, and it should generally happen at or before the point required for the transaction type, not retroactively.
Who performed it.

A client file with a document image but no recorded method, date or details is exactly the gap an examiner is trained to find: see how an examination reviews files.

Beneficial ownership for entity clients

When your client is a corporation, partnership or trust rather than an individual, identifying the entity itself isn't enough. You generally need to also confirm the entity's existence (e.g., through a corporate registry search) and identify the individuals who own or control it (beneficial owners) along with the individual actually signing on the entity's behalf.

For a dealership or leasing company financing a fleet purchase through a numbered company, this means the file needs both the company's confirmation and the beneficial owner's identification, not just a signature on the contract.

Migrated / historical clients

If you're bringing years of paper or spreadsheet records into a proper system, you don't need to re-verify every existing client from scratch, but the record should honestly reflect when verification actually happened, not the date it was entered into your system. Backdating in good faith, transparently flagged, is very different from silently claiming everything happened today.

Building this without it becoming a bottleneck

Sales staff won't reliably remember method-specific rules deal after deal. Provasure's verification workflow walks the correct method, captures the required fields, and timestamps the record automatically, so the file that would satisfy an examiner is just the file you already have. Or start by checking your current process against the free 12-item readiness checklist.

Sources: FINTRAC's client identification and beneficial ownership requirements are set out in its official guidance at fintrac-canafe.canada.ca. Requirements vary by entity type and business sector. Verify against current guidance or counsel before relying on this summary.

This article is general regulatory information, not legal advice. Requirements depend on your business: verify against FINTRAC's official guidance or counsel.