When MSBs Must Verify Identity: Triggers and Thresholds

The duty itself sits in the statute: PCMLTFA s. 6.1 requires every business covered by the Act to verify identity "in accordance with the regulations." For money services businesses and foreign MSBs, the regulation doing the work is PCMLTFR s. 95(1). It enumerates every transaction type that forces verification of a person, each with an exact dollar figure — there is no single "MSB threshold," there are two bands.

The $1,000 band: a request to initiate an electronic funds transfer of $1,000 or more (s. 95(1)(b)); transmitting $1,000 or more in funds other than by EFT (s. 95(1)(a.1)); a transfer of $1,000 or more in virtual currency (s. 95(1)(d)); a virtual currency exchange transaction of $1,000 or more (s. 95(1)(e)); and being the beneficiary of an international EFT of $1,000 or more or a virtual currency transfer of $1,000 or more (s. 95(1)(f)). The $3,000 band: issuing or redeeming money orders, traveller's cheques or similar negotiable instruments of $3,000 or more (s. 95(1)(a)); cashing one or more cheques totalling $3,000 or more (s. 95(1)(a.2)); and foreign currency exchange transactions of $3,000 or more (s. 95(1)(c)).

A client who asks a remittance business to wire $1,200 to family abroad has made a request to initiate an EFT of $1,000 or more — the trigger attaches to the request, so businesses typically build the identity check into intake, before funds move. The non-EFT limb closes the rail gap: a remittance model that moves value without sending an EFT — paying recipients from local float and settling between offices later, for example — meets the same $1,000 line under s. 95(1)(a.1). The threshold does not depend on how the value travels.

The trigger also works in both directions. Paying out an incoming international EFT of $1,000 or more means verifying the person collecting it, and the same paragraph (s. 95(1)(f)) covers beneficiaries of virtual currency transfers of $1,000 or more. On the virtual currency side the band mirrors the fiat rules: a $1,000-plus virtual currency transfer triggers under s. 95(1)(d), and a virtual currency exchange transaction of $1,000 or more — say a platform exchanging $1,500 of funds for virtual currency — triggers under s. 95(1)(e).

A client converting $3,200 into a foreign currency at an exchange counter crosses the s. 95(1)(c) line; at $2,900 the foreign-exchange trigger itself does not fire, though the no-minimum triggers below still can. Issuing or redeeming $3,000 or more in money orders, traveller's cheques or similar negotiable instruments triggers under s. 95(1)(a).

The cheque-cashing trigger is written as "one or more cheques totalling $3,000 or more" (s. 95(1)(a.2)) — three $1,100 cheques presented together reach it even though no single cheque does. Cheque-cashing services are a prescribed MSB service under PCMLTFR s. 29.1, with obligations in force since April 1, 2025, so a business whose model is cashing cheques for a fee runs these same triggers as a registered MSB.

Two cross-sector rules sit outside the s. 95 list. Section 84 requires verifying the identity of any person or entity from which the business receives a large cash or large virtual currency amount. Section 85 requires reasonable measures to verify identity for any transaction reportable as suspicious under s. 7 of the Act — at any amount — subject to the tipping-off exception in s. 85(2). A $600 transfer that raises reasonable grounds to suspect still carries an identity obligation.

At $100,000, international EFTs and virtual currency transfers — whether the client is initiating or receiving — add a determination duty under s. 120(1): reasonable measures to determine whether the person is a politically exposed foreign or domestic person, a head of an international organization, or a family member or close associate of one. Where the person is a politically exposed foreign person, or a high-risk domestic PEP or HIO (or family member or close associate of either), s. 122 requires reasonable measures to establish source of funds and source of wealth plus senior-management review, completed within 30 days after the transaction (s. 122(9)) — a 30-day window, not the 14 days sometimes quoted.

Third-party determination travels with related events: receiving $10,000 or more in cash or in virtual currency (ss. 134–135), and wherever an information record must be kept — which for MSBs includes entity service agreements (s. 137).

For persons, s. 105(1) lists five methods: government-issued photo identification; information from a government body authorized to verify identity; a Canadian credit file in existence at least three years; the dual-process method; and the affiliate-or-member method. The commonly cited trio — photo ID, credit file, dual-process — is only three of the five. Any document used must be authentic, valid and current (s. 105(5)). An agent or mandatary may perform the verification (s. 106), which matters for MSB agent networks, and s. 107 permits reliance on verification previously done by another reporting entity. Whichever route is used, s. 108 prescribes records keyed to the method.

Entity clients are covered by ss. 95(3)–(4): corporations are verified under s. 109(1) — certificate of incorporation, an annual securities filing, or the most recent version of another record confirming existence with name, address and directors — and other entities under s. 112(1). Section 95(5) exempts public bodies, corporations or trusts with net assets of $75 million or more listed on a Canadian or designated FATF-member-state stock exchange, and their subsidiaries.

Under PCMLTFR s. 4.1(b), a business relationship forms — among other triggers — the second time the business is required to verify a client's identity; FINTRAC's guidance frames this for MSBs as the second required verification within a five-year period (the five-year qualifier is guidance framing, not regulation text). For an entity client, signing a service agreement forms the relationship at once (s. 4.1(d)). From that point s. 123.1 requires ongoing monitoring: detecting reportable transactions, keeping identification information up to date, reassessing the client's risk level, and checking that activity stays consistent with what is known about the client.

The practical build is mechanical: encode each s. 95(1) paragraph as a rule in intake and transaction flow, log which trigger fired, which s. 105 method was used and on what date, and count required verifications per client so the business-relationship flip is caught when it happens rather than reconstructed later.