Beneficial Ownership: the 25% Question

Beneficial ownership is an obligation attached to entity verification. PCMLTFA s. 6.1 requires reporting entities to verify identity in accordance with the regulations, and PCMLTFR s. 138(1) adds the ownership layer: whenever you verify an entity's identity, you must obtain, for a corporation, the names of all directors and the names and addresses of every person who owns or controls, directly or indirectly, 25% or more of its shares. For entities other than corporations, it is the names and addresses of everyone who owns or controls 25% or more of the entity. For trusts, it is the names and addresses of the trustees and of all known beneficiaries and settlors. In every case you must also obtain information establishing the entity's ownership, control and structure.

Two words in that provision do most of the work. "Or more" means a person sitting at exactly 25% is in scope — the threshold is not "more than 25%." "Indirectly" means you cannot stop at the shareholder register: if a client corporation is wholly owned by a holding company, you trace through that holding company, and through each further layer, to the individuals behind it.

The provision captures people who own 25% or more and people who control 25% or more — and control can exist without ownership. Consider a logistics business whose shares are split 20/20/20/20/20 among five family members: no one crosses the threshold on ownership alone, but if one sibling holds an arrangement giving them direction over another's stake, they may control 25% or more of the shares without owning them. Even where the analysis ends with no one meeting the test, the ownership, control and structure information is still required, and you should document how you reached that conclusion — for exactly what FINTRAC expects you to keep in a no-beneficial-owner case, check the current beneficial ownership guidance.

Keep this distinct from third-party determination. PCMLTFR ss. 134–137 ask whether someone is acting on behalf of a third party — a separate obligation with its own records. Section 138 asks who ultimately owns or controls the client entity itself. A client can act entirely on its own behalf and still have beneficial owners you must identify.

Obtaining the information is only half of s. 138. Under s. 138(2) you must take reasonable measures to confirm its accuracy at two moments: when the information is first obtained, and in the course of ongoing monitoring — s. 123.1(b) expressly requires monitoring to keep the s. 138 information up to date. A beneficial ownership record collected at onboarding and never revisited does not satisfy the provision.

Do not confuse this with verifying the entity's existence. A corporation's identity is verified under s. 109(1) by referring to its certificate of incorporation, an annual securities filing, or another record confirming its existence with its name, address and directors' names; other entities are verified under s. 112(1) by a partnership agreement, articles of association or a similar record — and those records must be authentic, valid and current (ss. 109(2), 112(2)). A certificate of incorporation proves the corporation exists; it says nothing about who ultimately owns it. Confirming beneficial ownership accuracy is a distinct step, and the measures FINTRAC accepts for it are set out in its beneficial ownership guidance — work from the current version rather than a remembered list. Whatever you use, record what you obtained, what you checked it against, the date, and who did it.

If the beneficial ownership information cannot be obtained, or its accuracy cannot be confirmed, s. 138(4) prescribes the consequence: take reasonable measures to verify the identity of the entity's chief executive officer — or the person who performs that function — and apply the special measures required under s. 157, which include enhanced ongoing monitoring. FINTRAC's guidance describes this as treating the client as high risk. Note the wording: older policies still say "most senior managing officer," but the current regulation says chief executive officer.

Treat the fallback as an exception with a cost, not an alternative onboarding path. Every relationship routed through s. 138(4) carries high-risk treatment and enhanced monitoring for its duration, so a business landing there routinely has an operational problem, not a shortcut. Document why the information could not be obtained or confirmed before relying on it.

Federally incorporated clients add a second data source. Corporations Canada maintains a database of individuals with significant control for corporations incorporated under the CBCA, and since October 1, 2025, PCMLTFR s. 138.1 requires that material discrepancies between your beneficial ownership information and that database — for CBCA corporations you have assessed as high risk — be reported to the CBCA Director within 30 days.

Teams typically fold this into the confirmation step: for a federal corporation, pull the individuals-with-significant-control record at onboarding and at monitoring reviews, compare it against the s. 138 information the client provided, and record the comparison either way. Where the client is high risk and the mismatch is material, the 30-day clock runs. Two boundaries are worth noting: the database covers CBCA corporations, so provincially incorporated clients have no equivalent record to check under this provision; and the database extract is an input to confirming accuracy, not a substitute for obtaining the s. 138(1) ownership, control and structure information from the client. For what counts as a material discrepancy, check the current FINTRAC guidance.