PEPs and HIOs: What MSBs Must Do

PCMLTFA s. 9.3(1) requires prescribed businesses to determine, in prescribed circumstances, whether they are dealing with a politically exposed foreign person, a politically exposed domestic person, a head of an international organization (HIO), or a family member or close associate of one of these. The definitions sit in s. 9.3(3). The category matters because the consequences differ: a foreign PEP connection drives mandatory extra measures whenever a trigger fires, while domestic PEPs and HIOs drive those measures only when the risk is assessed as high.

The precise office lists — which positions make someone a domestic PEP, which roles make someone an HIO, which relatives count as family members — are more specific than a generic "politician" filter. Before building screening rules, check the current FINTRAC guidance for non-account-based sectors, which sets out the categories as they apply to MSBs.

For MSBs (and foreign MSBs, via s. 120(2)), the determination triggers are in PCMLTFR s. 120(1). The MSB must take reasonable measures to determine whether a person is a PEP, HIO, family member or close associate when that person: requests initiation of an international electronic funds transfer of $100,000 or more; is a beneficiary of an international EFT of $100,000 or more; requests a transfer of $100,000 or more in virtual currency; or is a beneficiary of a receipt of $100,000 or more in virtual currency. Under FINTRAC's guidance for non-account-based sectors, the MSB has 30 days after the transaction to make the determination and complete any required measures.

Two boundaries keep this obligation clean. First, these are transaction triggers, not account triggers — MSBs are a non-account sector, and the account-based PEP regime in s. 116 covers financial entities, not MSBs. Second, don't confuse these thresholds with the identity-verification triggers in s. 95(1) ($1,000 for EFT requests and virtual currency transfers, $3,000 for foreign exchange, for example). Verifying identity at $1,000 does not require a PEP determination; the compulsory PEP check sits at $100,000. In practice, "reasonable measures" typically means asking the client and screening the name against a PEP list or open sources — and recording what was done either way.

Where the person is a politically exposed foreign person (or a family member or close associate of one), or a politically exposed domestic person or HIO (or family member or close associate) whom the MSB assesses as high risk, PCMLTFR s. 122 requires the MSB to take reasonable measures to establish the source of the funds or virtual currency used for the transaction and the source of the person's wealth, and to ensure a member of senior management reviews the transaction. Practitioners usually separate the two sources this way: source of funds is where the money in this transaction came from; source of wealth is how the person accumulated their overall assets.

The timing rule is 30 days after the day the transaction is conducted (s. 122(9)). A persistent misconception holds that there is a 14-day deadline — there is no 14-day rule anywhere in the PEP provisions. Another common mix-up: the 30-days-after-account-opening clock in s. 121(3) belongs to account-based sectors and has no application to MSB transaction determinations.

The statute extends the determination to family members and close associates because influence — and its proceeds — rarely moves through the office-holder's own name. A remittance business handling a $100,000 transfer for a relative of a senior foreign official faces the same s. 122 measures as if the official were standing at the counter. The associate's own profile may look unremarkable; the risk lives in the connected person's ability to use them as a conduit.

Who counts as a family member or close associate is defined territory, not a judgment call — check the current FINTRAC guidance for the lists and examples. Where the call is genuinely judgment-based (is this business partner a "close associate"?), write down the reasoning. A documented "considered and ruled out" is defensible; an empty file is not.

PCMLTFR s. 123 requires records of PEP determinations and the measures taken. A workable record shows the trigger transaction, the screening performed, the result, the source-of-funds and source-of-wealth information gathered, the senior management review, and dates demonstrating the 30-day window was met.

A positive determination should also feed the client's risk rating. Where the client is in a business relationship — for an MSB, per FINTRAC guidance, that forms the second time identity must be verified within a 5-year period (PCMLTFR s. 4.1(b)) or on entering a service agreement with an entity client — ongoing monitoring under s. 123.1 applies: detecting reportable transactions, keeping client information up to date, reassessing the risk level, and checking that activity stays consistent with what is known. Clients rated high risk take the special measures in s. 157, including enhanced ongoing monitoring.