Reliance and Agents in Identity Verification

"Our partner already verified this customer" can mean two legally different things, and the regulations treat them separately. Under PCMLTFR s. 106, a business that is required to verify a person's identity under s. 105(1) "may rely on an agent or mandatary to take the measures to do so": someone else performs the verification on the business's behalf, in the present, using the ordinary methods. Under s. 107 — what FINTRAC calls the reliance method — a business accepts identity verification that was previously done by another person or entity referred to in s. 5 of the PCMLTFA (that is, another Canadian reporting entity), or by an affiliated foreign entity subject to similar identity-verification and record-keeping requirements.

Neither mechanism moves the legal duty. PCMLTFA s. 6.1 puts it plainly: "Every person or entity referred to in section 5 shall verify the identity of a person or entity in accordance with the regulations." An agent can hold the passport; a partner can share its file; the obligation stays with the reporting entity.

FINTRAC's methods guidance currently profiles five named methods: government-issued photo identification, credit file, dual-process, affiliate or member, and reliance. The regulation's own list in s. 105(1) also has five entries — the commonly quoted "three methods" (photo ID, credit file, dual-process) correspond only to paragraphs 105(1)(a), (c) and (d). Reliance is different in kind: it lives in s. 107, outside the s. 105(1) list, because the business is not running a verification at all — it is accepting one that another reporting entity already completed.

The practical controls follow from that structure. Confirm that the party being relied on actually falls within s. 5 of the Act (or is a qualifying foreign affiliate) — the method is only available against that population. Obtain enough about the original verification to build a record of your own: PCMLTFR s. 108 requires a record of how identity was verified, keyed to the method used. And treat reliance as a starting point, not an endpoint — ongoing monitoring under s. 123.1 still requires keeping client identification information up to date across the business relationship. The precise conditions FINTRAC expects for reliance arrangements go beyond what these sections spell out, so check the current FINTRAC methods guidance before adopting the method.

An agent or mandatary under s. 106 does not get a menu of their own — they carry out one of the s. 105(1) methods on the business's behalf, and the result must meet the same regulatory standard. PCMLTFR s. 105(5) requires that a document used to verify identity "must be authentic, valid and current" and that other information used for that purpose "must be valid and current" — a standard that sits in the regulation itself, not only in guidance. Parallel rules apply when the client is an entity: corporate records under s. 109(2) and other-entity records under s. 112(2) must likewise be authentic, valid and current.

Operationally, businesses using agents typically document three things: the arrangement with the agent, the method the agent applied, and the resulting s. 108 record fields for that method. For what the agent agreement itself must contain, check the current FINTRAC guidance. One trap in the drafting: s. 105(1)(b) also mentions an "agent or mandatary" — but that is the agent of a federal or provincial government body in the government-information method, not a business's own verification agent under s. 106.

Sections 106 and 107 themselves did not change in 2025 — the population around them did. On April 1, 2025, obligations came into force for cheque-cashing businesses, factors, and financing or leasing entities; on October 1, 2025, for acquirers of private automated banking machines and title insurers. Classification matters when checking a counterparty's status: cheque-cashing services are a prescribed MSB service under PCMLTFR s. 29.1, so a cheque-cashing business is an MSB; but factors (s. 24.1, under PCMLTFA s. 5(i)) and financing or leasing entities (s. 24.15, under s. 5(j)) are separate reporting-entity classes, not MSBs; and PABM acquirer services are written directly into the Act's MSB definition at s. 5(h)(iv.1).

Two consequences follow for this topic. First, the newly covered businesses now carry identity-verification duties of their own — and the agent and reliance mechanisms are part of how a business that onboards through storefronts or partner networks can structure that work. Second, the universe of "person or entity referred to in section 5" that anyone may rely on under s. 107 grew accordingly. Entity verification also picked up a related 2025 change: since October 1, 2025, material discrepancies with the Corporations Canada individuals-with-significant-control database, for CBCA corporations assessed as high risk, must be reported to the CBCA Director within 30 days (s. 138.1) — worth flagging for anyone outsourcing entity-onboarding workflows.

Confusion between neighbouring concepts causes most trouble here. An agent or mandatary (s. 106) works for the business, performing its verification. Reliance (s. 107) accepts a verification another reporting entity performed earlier. Third-party determination (PCMLTFR ss. 134–137) is neither: it asks whether the client is acting on behalf of someone else — a fact about the client, not about who ran the identity check. A clean client file shows which method was used, who performed it, and the s. 108 record details for that method, so a reviewer can reconstruct the verification without asking anyone.