When Beneficial Ownership Gets Hard: Gaps, Discrepancies and Nonprofits

Under PCMLTFR s. 138(1), whenever you verify an entity's identity you must obtain, for a corporation, the names of all directors and the names and addresses of every person who directly or indirectly owns or controls 25% or more of the shares. For entities other than corporations, it is 25% or more of the entity; for trusts, it is the trustees and all known beneficiaries and settlors. In every case you must also obtain information about the entity's ownership, control and structure — not just a list of names, but enough to understand how control actually flows.

The obligation has two halves. Obtaining the information is the first. The second, under s. 138(2), is taking reasonable measures to confirm its accuracy — both when you first collect it and again in the course of ongoing monitoring, which s. 123.1(b) explicitly ties to keeping s. 138 information up to date. A client-signed attestation with no cross-check against a corporate record or registry may not survive scrutiny as a reasonable confirmation measure on a higher-risk file; what counts as reasonable scales with the risk you have assigned.

Sometimes the chain simply cannot be resolved: an offshore holding layer will not produce records, ownership is disputed, or the documents the client provides cannot be reconciled. The regulation anticipates this. PCMLTFR s. 138(4) says that if you cannot obtain the beneficial ownership information, or cannot confirm its accuracy, you must take reasonable measures to verify the identity of the entity's chief executive officer, or the person who performs that function. A common misconception is worth correcting here: older materials refer to verifying the "most senior managing officer" — that phrasing is outdated, and the current regulation says chief executive officer.

The CEO fallback is not a free pass. Section 138(4) also requires you to apply the special measures under s. 157 — the same enhanced measures required for high-risk clients, including enhanced ongoing monitoring. FINTRAC's guidance describes this as treating the client as high risk. Operationally, that means the file should show three things: the specific attempts you made to obtain and confirm ownership information and why they failed; the identity verification you performed on the CEO; and the concrete enhanced measures you applied afterward. A file that shows only the fallback, without the documented attempts that justified it, invites the question of whether the fallback was earned or merely convenient.

Since October 1, 2025, there is a further step for federally incorporated clients. Under PCMLTFR s. 138.1, if a client is a CBCA corporation that you have assessed as high risk, and the beneficial ownership information you hold materially disagrees with the Corporations Canada individuals-with-significant-control database, the material discrepancy must be reported to the CBCA Director within 30 days.

This changes the routine for anyone onboarding federal corporations: comparing your s. 138 information against the public ISC filing is now a step with a reporting consequence, not just a good-practice cross-check. Note the two gating conditions — the corporation is CBCA-incorporated and assessed as high risk — and note that the 30-day clock is short compared with most record-keeping timelines. For what counts as "material" in a given fact pattern, check the current FINTRAC beneficial ownership guidance, which addresses discrepancy reporting alongside the confirmation obligations.

A charity funded by public donations has no shareholders, so no one "owns 25% or more" — but s. 138(1) still applies when you verify its identity. For entities other than corporations, the test is ownership or control of 25% or more of the entity, and control is the operative word for nonprofits: the analysis shifts to who directs the organization. In practice that means obtaining the names of directors (for an incorporated nonprofit) and identifying anyone who exercises control — and, as always, documenting the ownership, control and structure information the section requires. Many nonprofits will genuinely have no person meeting the 25% control threshold; recording that conclusion, and the structure information that supports it, is itself the compliance outcome.

The entity's existence still has to be verified through the ordinary channels: a corporation by its certificate of incorporation or another qualifying record under s. 109(1), and an unincorporated association under s. 112(1) by its articles of association or the most recent record confirming its existence, name and address. Whatever record you use must be authentic, valid and current — that standard sits in the regulation itself, at ss. 109(2) and 112(2), not just in guidance. Where a nonprofit's structure is opaque enough that control genuinely cannot be established or confirmed, the s. 138(4) escalation applies the same as for any other entity: verify the CEO or the person performing that function, and apply the s. 157 special measures. For sector-specific risk considerations around donation-funded organizations, check the current FINTRAC guidance rather than relying on rules of thumb.

The common thread across all three scenarios is that the escalation is only defensible if the file shows the work. For a normal file: the beneficial ownership information obtained, the source used to confirm it, and the date. For an unresolvable file: the attempts made, the s. 138(4) CEO verification, the high-risk designation, and the specific s. 157 enhanced measures adopted. For a high-risk CBCA corporation: the ISC database comparison and, where a material discrepancy was found, evidence the report went to the CBCA Director within 30 days. Ongoing monitoring under s. 123.1 then keeps each of these current — beneficial ownership is not a one-time onboarding artifact but information the regulation expects you to reconfirm as the relationship runs.