White-Label, Embedded Finance and Group Structures: Who Has the Obligation?

Canadian AML obligations are assigned by legal entity, not by brand. The money-services-business paragraphs of the PCMLTFA — s. 5(h) for domestic businesses and s. 5(h.1) for foreign ones — catch a person or entity "engaged in the business of providing" the listed services; the newest listing, acquirer services in relation to a private automated banking machine at s. 5(h)(iv.1), uses exactly that wording. In a white-label or embedded-finance program the end user sees one name on the interface, but the scoping question is which entity actually provides the service under subparagraphs 5(h)(i)–(v): who contracts to move or exchange the funds, who holds them in flight, who gives the settlement instruction on the rail. Whichever entity that is carries the full package — registration with FINTRAC, the identification triggers in PCMLTFR s. 95(1) (for example, a request to initiate an electronic funds transfer of $1,000 or more), record-keeping and reporting. A trademark licence, by itself, moves none of that.

What a program can delegate is execution. Under PCMLTFR s. 106, a reporting entity "may rely on an agent or mandatary to take the measures" to verify identity under s. 105(1) — which is how a front-end partner typically collects and checks ID for the provider behind it. Under s. 107, an entity may instead rely on verification already performed by another person or entity referred to in s. 5 of the Act, or by an affiliated foreign entity with similar identification and record-keeping requirements; within corporate groups, s. 105(1)(e) also offers an affiliate-or-member method. None of these move the obligation. The reporting entity remains the one required to verify, and it must hold the s. 108 records — paragraphs (a) to (i), keyed to the method used — even when a partner performed the steps. Set out the mandate in the program agreement, and check the current FINTRAC guidance on methods to verify identity for what the arrangement itself must cover.

The brand partner is not only the MSB's distributor — it is typically the MSB's client. Under PCMLTFR s. 4.1(d), an MSB whose client is an entity enters a business relationship when it enters into a service agreement for services under subparagraphs 5(h)(i)–(v) of the Act (s. 4.1(e) is the foreign-MSB equivalent). Signature day therefore starts real work: verify the partner entity against its certificate of incorporation or equivalent records (ss. 109 and 112); obtain the names of its directors and the names and addresses of everyone owning or controlling 25% or more, plus information on ownership, control and structure (s. 138(1)), and take reasonable measures to confirm accuracy (s. 138(2)); where an information record must be kept, make the third-party determination under s. 137.

If beneficial ownership cannot be obtained or confirmed, s. 138(4) requires reasonable measures to verify the identity of the entity's chief executive officer and application of the special measures under s. 157. The relationship then sits under ongoing monitoring per s. 123.1 — detecting reportable transactions, keeping client information current, reassessing risk, and checking that activity matches what is known. Since October 1, 2025, material discrepancies with the Corporations Canada individuals-with-significant-control database, for CBCA corporations assessed as high risk, must be reported to the CBCA Director within 30 days (s. 138.1).

Corporate groups get scoped one entity at a time, and the last two years show why. Cheque-cashing services became an MSB-prescribed service under PCMLTFR s. 29.1 — alongside crowdfunding platform services — with obligations in force April 1, 2025. Factoring did not: a factor is a separate reporting-entity class under PCMLTFA s. 5(i) and PCMLTFR s. 24.1, also from April 1, 2025. Financing or leasing entities are another class again under s. 5(j) and s. 24.15, covering among other things business-purpose financing or leasing of property other than real property, and passenger vehicles in Canada. Private-ABM acquirer services sit inside the MSB definition itself at s. 5(h)(iv.1), in force October 1, 2025 — the same date title insurers came in as their own class; the mortgage sector arrived earlier, on October 11, 2024.

A group with a payments subsidiary, a factoring arm and a leasing arm can therefore hold three different obligation sets, and an analysis done for one entity does not answer for its siblings. A non-Canadian group entity serving the same program raises the separate foreign-MSB question under s. 5(h.1) — check the current FINTRAC guidance before assuming it falls outside.

A defensible scoping file typically turns on about a dozen facts, established with evidence rather than intentions: which entity contracts with the end user; which entity holds funds, even briefly; who instructs settlement; whose name appears on the rail (Interac e-Transfer or SWIFT records are useful evidence); the full flow of funds, including refund and failure paths; which entity earns the fee; whether any activity matches the subparagraph 5(h)(i)–(v) categories or a prescribed service under s. 29.1; whether the activity is better characterized as factoring or financing/leasing, which points to a different class entirely; where each entity is incorporated; what the partner agreement assigns to each party; and when each product launched relative to the in-force dates above.

Write the conclusion narrowly: a dated memo stating the facts relied on, the provisions considered, and the answer for each named entity on those facts as of that date — with listed re-review triggers such as new products, new rails, new group entities and new in-force dates. Avoid a standing "we are not regulated" declaration. The October 2024, April 2025 and October 2025 waves each moved the perimeter, and a conclusion that was sound when the program agreement was signed can be stale by launch. A memo that says exactly what was decided, on what facts, and when it must be revisited is worth more in a FINTRAC examination — and to a bank or partner doing diligence — than a broad assurance no one can trace.