Verifying Corporations, Partnerships and Trusts

The duty comes from PCMLTFA s. 6.1: every business covered by the Act must verify identity in accordance with the regulations. For individuals, PCMLTFR s. 105(1) offers five methods — government-issued photo identification, government-source information, credit file, dual-process, and the affiliate or member method. Entities work on a different logic entirely: a corporation is verified under s. 109, and every other entity — partnership, trust, unincorporated association — under s. 112, in both cases by referring to a record that proves the entity exists.

When the duty is triggered depends on your sector. For money services businesses, the entity triggers are consolidated in PCMLTFR ss. 95(3)–(4), with exemptions in s. 95(5) for public bodies, corporations or trusts with net assets of $75 million or more listed on a Canadian or designated stock exchange in an FATF member state, and their subsidiaries. Two triggers cut across sectors: s. 84 requires verifying whoever you receive a large cash or large virtual currency amount from, and s. 85 requires reasonable measures to verify identity for transactions reportable as suspicious.

Under s. 109(1) you verify a corporation "by referring to its certificate of incorporation, to a record that it is required to file annually under applicable provincial securities legislation or to the most recent version of any other record that confirms its existence as a corporation and contains its name and address and the names of its directors." FINTRAC's methods guidance lists acceptable examples: a certificate of incorporation, a certificate of active corporate status, an annual securities filing, the corporation's published annual report signed by an audit firm, or a government letter or notice of assessment.

Two refinements matter in practice. Directors' names do not have to be confirmed if the corporation is a securities dealer (s. 109(3)). And the record must be authentic, valid and current — that standard sits in the regulation itself at s. 109(2), not only in guidance. An expired certificate or a superseded filing does not meet it; the "most recent version" wording does real work here.

Everything that is not a corporation is verified under s. 112(1) by referring to a partnership agreement, articles of association, or the most recent version of any other record that confirms the entity's existence and contains its name and address. The same authentic, valid and current standard applies through s. 112(2). For a trust, the record that typically does this job is the trust document itself; for less common structures, check the current FINTRAC methods guidance for what records it accepts.

Note the asymmetry with corporations: for non-corporate entities the record must confirm existence, name and address, but there is no directors-names element. The people behind a partnership or trust are instead captured through the beneficial-ownership requirements that attach to the same verification event.

When you verify any entity's identity, PCMLTFR s. 138(1) requires you to obtain: for a corporation, the names of all directors and the names and addresses of everyone who owns or controls, directly or indirectly, 25% or more of its shares; for other entities, those holding 25% or more of the entity; and for trusts, the trustees and all known beneficiaries and settlors — plus, in every case, information on the entity's ownership, control and structure. You must take reasonable measures to confirm that information's accuracy when first obtained and again in the course of ongoing monitoring (s. 138(2)).

If the information cannot be obtained or its accuracy confirmed, s. 138(4) requires reasonable measures to verify the identity of the entity's chief executive officer, or whoever performs that function — the older "most senior managing officer" phrasing is outdated — and to apply the high-risk special measures under s. 157. And since October 1, 2025, a material discrepancy between what you collected and the Corporations Canada individuals-with-significant-control database, for a CBCA corporation you have assessed as high risk, must be reported to the CBCA Director within 30 days (s. 138.1).

You may use an agent or mandatary to take the verification measures (s. 106), or rely on verification previously done by another reporting entity — or an affiliated foreign entity with similar identification and record-keeping requirements (s. 107). Either way, s. 108 requires a record of how identity was verified, keyed to the method used: for entities, keep the record you referred to (or a note of where to find it), its source, and the date you consulted it.

Entity verification pulls two neighbouring obligations into the same workflow. Where an information record must be kept — for a money services business, that includes a service agreement with an entity client such as a partnership — s. 137 requires determining whether the client is acting on behalf of a third party, recording the third party's details and its relationship to the client; those records are kept at least five years (s. 148(1)(c)). Verification events also mark business-relationship formation under s. 4.1 — the second time you are required to verify a client, or for an MSB the moment it enters a service agreement with an entity (FINTRAC's guidance frames the second-verification test within a five-year window). Once the relationship exists, ongoing monitoring under s. 123.1 includes keeping identification and beneficial-ownership information up to date.