Third-Party Determination — and KYB for Merchants and Agents

A third party, for AML purposes, is a person or entity that gives instructions for a transaction or is the one the transaction is really being conducted for — even though someone else is standing in front of you (or filling in your onboarding form). Third-party determination is governed by PCMLTFR ss. 134–137. A common citation error puts the range at 134–138; s. 138 is actually beneficial ownership, a different test entirely. Beneficial ownership asks who owns or controls your client. Third-party determination asks who is behind a specific transaction or arrangement.

The triggers that matter to payment companies and MSBs: when you receive $10,000 or more in cash (s. 134) or the equivalent in virtual currency (s. 135), you must take reasonable measures to determine whether the person is acting on behalf of a third party. Section 137 applies whenever an information record must be kept — which for MSBs includes entity service agreements — and requires the same determination. Section 136, the account-opening trigger, applies to financial entities, securities dealers and casinos, not MSBs.

"Reasonable measures" in practice usually means asking a direct question at onboarding or at the transaction — "Are you conducting this on behalf of anyone else?" — and paying attention to what you can see. Build the question into your flow and record the answer either way.

Where there is a third party, subsections 134(2)–137(2) require you to record: for a person, their name, address, date of birth and occupation or nature of principal business; for an entity, its name, address, nature of principal business, registration or incorporation number and the jurisdiction and country of issue — plus, in every case, the relationship between the third party and your client. Keep these records at least five years (s. 148(1)(c)).

The rule people miss: even when you cannot determine that a third party is involved, if you have reasonable grounds to suspect one, subsections 134(3)–137(3) require a record of whether the client states they are acting on their own behalf only, and your reasons for the suspicion. "They said no" is not the end of the obligation — the suspicion itself gets documented.

Typical signals: a bookkeeper depositing cash collected from someone else's business, a customer reading transfer instructions off a phone mid-transaction, or an account funded by one person while a different person directs where the money goes. None of these prove a third party exists; each is a reason to ask and to write down what you learned.

When a payment company signs up a business, entity verification comes first. A corporation is verified under PCMLTFR s. 109(1) by referring to its certificate of incorporation, an annual filing required under provincial securities legislation, or the most recent version of another record that confirms its existence and contains its name, address and directors' names. FINTRAC guidance also accepts a certificate of active corporate status, a signed published annual report, or a government letter or notice of assessment. Entities other than corporations are verified under s. 112(1) — partnership agreement, articles of association, or another record confirming existence, name and address. In each case the record must be authentic, valid and current (ss. 109(2), 112(2)) — that standard sits in the regulation itself, not just guidance.

Beneficial ownership comes next (s. 138): obtain the names of all directors and the names and addresses of everyone who owns or controls, directly or indirectly, 25% or more of the corporation's shares (25% or more of a non-corporate entity), plus information on its ownership, control and structure — and take reasonable measures to confirm accuracy when first obtained and during ongoing monitoring (s. 138(2)). If you cannot get or confirm the information, s. 138(4) requires reasonable measures to verify the identity of the entity's chief executive officer (the older phrase "most senior managing officer" is outdated) and application of the s. 157 special measures — FINTRAC describes this as treating the client as high risk. Since October 1, 2025, material discrepancies with the Corporations Canada individuals-with-significant-control database for high-risk CBCA corporations must be reported to the CBCA Director within 30 days (s. 138.1).

Two more pieces complete merchant onboarding. Entering a service agreement with an entity puts an MSB into a business relationship at that moment (s. 4.1(d)), which switches on ongoing monitoring under s. 123.1 — detecting reportable transactions, keeping client information current, and reassessing risk. And because the service agreement generates an information record, the s. 137 third-party determination applies at signing.

Verification can be operationally delegated without transferring the obligation. Under PCMLTFR s. 106, a reporting entity may rely on an agent or mandatary to take the identity-verification measures in s. 105(1); under s. 107, it may rely on verification previously done by another entity referred to in s. 5 of the Act, or an affiliated foreign entity with similar identification and record-keeping requirements. Either way, the records of how identity was verified — keyed to the method used — must exist under s. 108, and the responsibility remains with the reporting entity whose client it is. Onboarding an agent as a business partner follows the same entity steps as a merchant: verify existence under s. 109 or 112, collect beneficial ownership under s. 138, and monitor the relationship. For the operational detail of agent oversight programs, check the current FINTRAC guidance.

One trigger worth flagging in agent and merchant flows that move large sums: an MSB must take reasonable measures to make a PEP/HIO determination when a person initiates or benefits from an international electronic funds transfer, or a virtual currency transfer or receipt, of $100,000 or more (s. 120(1)), with the source-of-funds, source-of-wealth and senior-management-review measures completed within 30 days of the transaction (s. 122(9)) — there is no 14-day rule.

A low-risk rating changes how intensively you monitor a client; it does not turn off the identification triggers. The MSB thresholds in s. 95(1) are fixed dollar amounts — $1,000 for EFTs, non-EFT fund transmission and virtual currency transfers or exchanges; $3,000 for foreign exchange, money orders and cheque cashing — and they apply regardless of the client's risk score. The genuine exemptions in s. 95(5) are narrow: public bodies, corporations or trusts with net assets of $75 million or more listed on a Canadian or designated FATF-member-state exchange, and their subsidiaries. What risk rating legitimately governs is the cadence and depth of ongoing monitoring under s. 123.1, with the s. 157 special measures reserved for high-risk relationships.

The same record-keeping rules that force collection also bound it. The regulations specify exactly what an on-behalf-of record, a verification record or a beneficial ownership record must contain — collecting more than that adds privacy exposure without adding compliance value. A workable discipline: map each data field you collect to the provision that requires it, retain for the mandated period (at least five years for third-party records under s. 148(1)(c)), restrict access to staff who need it, and resist keeping identity documents or ownership charts you have no regulatory reason to hold.