KYC and Beneficial Ownership Records

PCMLTFA s. 6 puts it plainly: every person or entity referred to in section 5 shall keep records in accordance with the regulations. That is a freestanding obligation. It is not satisfied by having done the verification — it is satisfied by keeping the prescribed record of it. When FINTRAC examines a business, it works from documents. Identity verification that left no dated trace is, from the examiner's side of the table, indistinguishable from verification that never happened.

The practical consequence: record creation belongs inside the verification step, not in an after-the-fact write-up. A record made at the moment of onboarding — with the method, the source, and the date — costs a minute. Reconstructing the same record eighteen months later, under an examination deadline, is often impossible.

A verification record that holds up answers four questions: who was verified, by what method, against which document or source (with its reference number and issuing details where applicable), and when and by whom. The exact prescribed fields differ by verification method and by sector, and they change — check the current FINTRAC record-keeping guidance for the field lists rather than reconstructing them from memory. What does not vary is the failure mode: an undated screenshot, or a checkbox with no method noted, proves very little.

Transaction records carry identity content too, and examiners read them alongside the KYC file. For a money services business the core set sits in PCMLTFR ss. 31, 32 and 36: a large cash transaction record for $10,000 or more in cash (s. 31) and a large virtual currency transaction record at the same threshold (s. 32), both with an exception for funds received from a financial entity or public body; EFT records at $1,000 or more for initiation, intermediary sending and final receipt (s. 36(d)–(f)); non-EFT remittance and transmission records at $1,000 or more (s. 36(c.1), (c.2)); virtual currency transfer records at $1,000 or more (s. 36(g), (h)); money-order issuance and redemption records at $3,000 or more (s. 36(b), (c)); and, since April 1, 2025, a cheque-cashing record at $3,000 or more (s. 36(b.1)).

One threshold trips people up: foreign exchange. PCMLTFR s. 36(i) requires an exchange transaction ticket for every foreign currency exchange transaction, regardless of amount. The $3,000 figure only appears in the s. 1(2) definition of the ticket — at $3,000 or more the ticket must additionally record the requester's name, address, principal business or occupation and, for a person, date of birth. Treating $3,000 as the trigger for the record itself leaves a gap in every smaller exchange.

For entity clients, the record needs to show the ownership and control picture — who ultimately owns, who directs, and through what chain — plus the source relied on, the date the information was obtained, and the measures taken to confirm its accuracy. The regulations prescribe the exact content and a specific fallback path for cases where beneficial ownership cannot be established; those details are not reproduced here, so check the current FINTRAC guidance for the prescribed steps before designing the file.

Accuracy is a moving target, and this is where PCMLTFR s. 146 matters: it is the ongoing-monitoring record requirement. When a periodic review re-confirms — or changes — the beneficial ownership picture, that review should leave a dated record in the file. Document gaps honestly. A note that says what could not be confirmed, when it was escalated, and what measures were applied instead survives review far better than silence, and far better than a stale certainty copied forward from onboarding.

Retention is PCMLTFR s. 148 — a point worth stating because it is commonly miscited as s. 146, which is actually the ongoing-monitoring record rule. Under s. 148(1), records must be kept for at least five years, on three different clocks: from the day the account they relate to is closed, for account records such as signature cards and account applications; from the day the last business transaction is conducted, for information records and corporate or partnership documents; or from the day the record was created, in any other case — the default clock for MSB transaction records. Section 148(2) relieves individuals of retention once their employment or contract ends, where the records belong to the employer — meaning the business, not the departed analyst, must still be able to produce them.

Keeping is only half the test. PCMLTFR s. 149 requires every record to be kept in such a way that it can be provided to an authorized person within 30 days of an examination request under PCMLTFA s. 62. Electronic storage is fine if a paper copy can readily be produced (s. 147). The operational check is simple: run a test export of a full client file — verification record, beneficial ownership record, monitoring notes — and time it. If it depends on a vendor ticket queue or a former employee's local drive, the 30-day clock is already a problem.

Notes that survive share four traits: they are contemporaneous, dated, attributed to a named person, and they state the decision and the reason — not just the outcome. "Reviewed — OK" tells an examiner nothing. "Confirmed director list against corporate registry extract dated [date]; ownership unchanged; no escalation required — [initials]" shows the work. Reference the evidence actually consulted; a note that points at a document that is in the file is worth ten adjectives.

Program documentation frames how individual files are judged. PCMLTFR s. 156(1) requires written compliance policies kept up to date, a documented risk assessment, a documented training plan for employees and agents with delivery recorded, and a documented plan for the effectiveness review — which s. 156(3) requires to be carried out, and its results documented, every two years by an internal or external auditor. That review is the rehearsal: the auditor pulls files exactly the way an examiner will. Treat its findings and the fixes that followed as part of the record set, because they demonstrate the thing this whole topic is about — that the work was actually done, and can be shown.