كندا KYC, KYB & AML compliance checklist
قائمة عملية وموثقة بالمصادر لتنفيذ متطلبات KYC وKYB وAML في كندا.
- تاريخ آخر مراجعة
- تاريخ آخر مراجعة:
- الإصدار
- الإصدار 1.1
إجابة مباشرة
ما الذي تغطيه قائمة الامتثال الخاصة بـ كندا؟
تحوّل قائمة كندا قواعد KYC وKYB وAML الأساسية إلى 11 مجالات رقابية و44 فحوص تنفيذ، وتشمل الجهات المختصة وواجبات الإبلاغ والأدلة الواجب الاحتفاظ بها.
حقائق تنظيمية أساسية
- Primary AML framework
- PCMLTFA and its regulations, with sector-specific reporting-entity duties
- Financial intelligence unit
- Financial Transactions and Reports Analysis Centre of Canada (FINTRAC)
- Suspicious transaction report
- No monetary threshold; submit as soon as practicable after reasonable grounds to suspect are established
- Large cash report
- CAD 10,000 or more, including qualifying 24-hour aggregation; file within 15 calendar days
- Large virtual-currency report
- CAD 10,000 equivalent or more, including qualifying 24-hour aggregation; file within 5 working days
- International EFT report
- CAD 10,000 or more for prescribed initiation or final-receipt roles; file within 5 business days
- AML beneficial ownership
- Individuals directly or indirectly owning or controlling at least 25%, plus ownership and control structure
- CBCA significant control
- 25% voting rights or fair-market-value shares, or control in fact; federal corporations have register and filing duties
- Core AML retention
- Generally at least 5 years, but the event starting the clock varies by record
- MSB registration
- Canadian and qualifying foreign MSBs must register with FINTRAC before operating
- Retail payment providers
- In-scope PSPs must register with the Bank of Canada and meet operational-risk and safeguarding rules
- FATF public lists
- Canada was not named on the FATF public-list page reviewed 31 July 2026
تفاصيل التنفيذ
متطلبات وإجراءات الامتثال في كندا
افتح كل مجال لمراجعة المتطلب وإجراء التنفيذ المقترح والأدلة الواجب الاحتفاظ بها والمصدر الأساسي.
01Scope, authorities and licensing perimeterResolve the legal entity, activities, customers, delivery model and provincial nexus first. Federal AML registration or reporting status does not replace another federal or provincial authorization.4 عناصر+
PCMLTFA obligations apply to the persons and entities in section 5, with detailed duties that vary by reporting-entity category and activity.
- إجراء التنفيذ
- Map each entity, product and flow to the applicable section 5 category and regulations before assigning controls.
- الأدلة الواجب الاحتفاظ بها
- Signed perimeter memorandum, activity map, reporting-entity classification, regulator mapping and legal conclusions.
- المصدر الأساسي
- PCMLTFA, ss. 5-6; FINTRAC, Who must report
Canadian MSBs and foreign MSBs that direct and provide prescribed services to persons or entities in Canada must register with FINTRAC before beginning covered operations.
- إجراء التنفيذ
- Classify foreign exchange, remittance, money-order, crowdfunding and virtual-currency services; complete registration before launch and keep registration information current.
- الأدلة الواجب الاحتفاظ بها
- Service analysis, registration application, FINTRAC number, registry extract, renewal calendar and change filings.
- المصدر الأساسي
- PCMLTFA, ss. 11.1-11.2; FINTRAC, Money services businesses
An in-scope payment service provider must be registered with the Bank of Canada before performing retail payment activities, subject to the RPAA geographic test and exclusions.
- إجراء التنفيذ
- Apply the five payment-function test, geographic scope and exclusions; obtain registration before launch and separately assess FINTRAC MSB status.
- الأدلة الواجب الاحتفاظ بها
- RPAA scope memo, registration decision, public-registry extract and AML registration reconciliation.
- المصدر الأساسي
- RPAA, ss. 2, 4-6 and 23; Bank of Canada, Criteria for registering PSPs
Provincial laws can separately regulate money services, securities, consumer contracts, privacy and corporate records.
- إجراء التنفيذ
- Build a province-by-province matrix for every customer and operating nexus; document licences, registrations and exemptions before service begins.
- الأدلة الواجب الاحتفاظ بها
- Provincial matrix, regulator correspondence, licences, exemptions, counsel advice and renewal controls.
- المصدر الأساسي
- FINTRAC, MSB guidance; Bank of Canada, RPAA registration criteria
02Compliance program, governance and risk assessmentA reporting entity's program must be reasonably designed, risk-based and effective, not a generic policy pack detached from its Canadian activities.4 عناصر+
Every reporting entity must establish and implement the prescribed compliance program and ensure it is reasonably designed, risk-based and effective.
- إجراء التنفيذ
- Obtain senior approval for a program mapped to the entity's category, products, customers, channels, geography and sanctions-evasion exposure.
- الأدلة الواجب الاحتفاظ بها
- Approved program, legal mapping, board record, risk appetite, control inventory and accountable owners.
- المصدر الأساسي
- PCMLTFA, s. 9.6(1)-(2); PCMLTFR, s. 156
The program includes a compliance officer, written policies and procedures, documented risk assessment, ongoing training and an effectiveness review at least every two years.
- إجراء التنفيذ
- Appoint an empowered officer, calendar training and independent testing, and track findings to verified closure.
- الأدلة الواجب الاحتفاظ بها
- Appointment, role charter, policy set, risk assessment, training logs, two-year review and remediation register.
- المصدر الأساسي
- PCMLTFR, s. 156; FINTRAC, Compliance program requirements
High-risk situations require prescribed special measures, including enhanced identification, relationship information and ongoing monitoring measures appropriate to the risk.
- إجراء التنفيذ
- Define high-risk triggers and enhanced controls, approvals, review frequency and transaction monitoring; record the rationale for residual risk.
- الأدلة الواجب الاحتفاظ بها
- Risk methodology, high-risk file, enhanced checks, approvals, monitoring results and exception log.
- المصدر الأساسي
- PCMLTFA, s. 9.6(3); PCMLTFR, s. 157
Use of an agent, mandatary or service provider does not remove the reporting entity's responsibility; MSBs also have current duties to review agent eligibility and criminal records.
- إجراء التنفيذ
- Perform pre-appointment and prescribed periodic agent checks, contract for compliance evidence, monitor performance and retain exit capability.
- الأدلة الواجب الاحتفاظ بها
- Eligibility review, criminal-record material, contract, agent list, oversight reports, issues and termination plan.
- المصدر الأساسي
- PCMLTFA, ss. 9.92-9.93; PCMLTFR, ss. 37.1 and 133; FINTRAC, MSB guidance
03Natural-person identification and verificationIdentity triggers and permitted methods depend on the reporting-entity sector and transaction. Configure the precise rule, not a single universal onboarding threshold.4 عناصر+
FINTRAC permits prescribed verification methods including government-issued photo identification, Canadian credit file, dual process, qualifying affiliate or member confirmation, and reliance arrangements.
- إجراء التنفيذ
- Configure methods by sector and use case; retain required details showing the source was authentic or reliable, valid and current.
- الأدلة الواجب الاحتفاظ بها
- Method matrix, vendor configuration, source details, verification result, timestamps and quality tests.
- المصدر الأساسي
- PCMLTFR, ss. 105-109; FINTRAC, Methods to verify identity
Remote use of government-issued photo identification requires a process that authenticates the document and matches it to the person; collecting an image alone is insufficient.
- إجراء التنفيذ
- Test document security, liveness or person match as appropriate, fraud signals, accessibility and manual escalation before accepting remote identity.
- الأدلة الواجب الاحتفاظ بها
- Authentication specification, vendor tests, decision logs, fraud review, exceptions and sampled files.
- المصدر الأساسي
- FINTRAC, Methods to verify identity, government-issued photo ID method
Identity must be verified at the prescribed sector and transaction triggers, including suspicious completed or attempted transactions regardless of amount where the rule applies.
- إجراء التنفيذ
- Map every account, service and transaction trigger to timing, method and exceptions; route failed or incomplete verification to a controlled decision before proceeding.
- الأدلة الواجب الاحتفاظ بها
- Trigger matrix, workflow rules, attempted-transaction records, restrictions, closure decisions and STR assessment.
- المصدر الأساسي
- PCMLTFR, ss. 83-104 and 154; FINTRAC, When to verify identity
An agent or mandatary used for verification must operate under the prescribed written arrangement and provide the information needed for the reporting entity's records.
- إجراء التنفيذ
- Execute a compliant agreement, validate the agent's method, retrieve evidence promptly and test the arrangement periodically.
- الأدلة الواجب الاحتفاظ بها
- Agreement, agent due diligence, method records, retrieval tests, sample reviews and corrective actions.
- المصدر الأساسي
- PCMLTFR, ss. 109 and 109.1; FINTRAC identity-method guidance
04KYB, registries and beneficial ownershipKeep AML beneficial ownership under the PCMLTFR separate from a corporation's own ISC duties. Provincial entities also require their own registry analysis.4 عناصر+
Entity verification uses prescribed sources to confirm existence and requires the reporting entity to record the relevant incorporation, registration or governing details.
- إجراء التنفيذ
- Obtain current registry and constitutional material, verify status and authority, and identify persons authorized to bind or instruct for the entity.
- الأدلة الواجب الاحتفاظ بها
- Registry extract, constituting documents, business number, addresses, directors, signatory authority and verification log.
- المصدر الأساسي
- PCMLTFR, ss. 106-109; FINTRAC, Methods to verify identity
For a corporation, AML records include directors, individuals directly or indirectly owning or controlling at least 25% of shares, and information establishing ownership, control and structure; trusts and other entities have tailored tests.
- إجراء التنفيذ
- Trace every ownership layer to natural persons, calculate direct and indirect interests, record control and trust parties, and document when nobody reaches 25%.
- الأدلة الواجب الاحتفاظ بها
- Ownership chart, calculations, director list, trust records, source documents, confirmation steps and approvals.
- المصدر الأساسي
- PCMLTFR, s. 138; FINTRAC, Beneficial ownership requirements
Beneficial-ownership accuracy must be reasonably confirmed initially and during ongoing monitoring; prescribed high-risk CBCA cases require consultation of public ISC information. A material discrepancy must be reported within 30 days unless resolved within that period.
- إجراء التنفيذ
- Compare customer data with reliable records and the federal ISC registry when required; resolve the discrepancy within 30 days or submit the prescribed report and retain the acknowledgement.
- الأدلة الواجب الاحتفاظ بها
- Registry search, comparison record, discrepancy case, customer clarification, Schedule 7 report and receipt.
- المصدر الأساسي
- PCMLTFR, ss. 138(2)-(5), 138.1 and Schedule 7
Most CBCA corporations maintain an ISC register and file ISC information with Corporations Canada; significant control includes at least 25% of voting rights or fair-market-value shares and control in fact.
- إجراء التنفيذ
- For a federal corporation, identify ISCs, update the register at least annually and within 15 days of known changes, and make the required event and annual filings.
- الأدلة الواجب الاحتفاظ بها
- ISC register, annual enquiry, shareholder responses, change log, filings, receipts and exemption record.
- المصدر الأساسي
- CBCA, ss. 2.1, 21.1 and 21.21; Corporations Canada, ISC filing guidance
05PEPs, HIOs and enhanced due diligenceCanadian PEP and head-of-international-organization duties vary by sector, account, relationship and transaction. Family-member and close-associate scope must follow the precise rule.4 عناصر+
Financial entities, securities dealers and casinos have prescribed account-related duties to determine PEP, HIO, family-member and specified close-associate status at opening, through periodic monitoring and when relevant facts are detected.
- إجراء التنفيذ
- Screen at each legal trigger, capture relationship and office details, and route possible matches to trained adjudication.
- الأدلة الواجب الاحتفاظ بها
- Screening configuration, match evidence, periodic-monitoring log, relationship analysis and disposition.
- المصدر الأساسي
- PCMLTFR, ss. 121-123; FINTRAC, Account-based PEP and HIO guidance
Specified sectors have transaction-related PEP and HIO determinations for prescribed transactions of CAD 100,000 or more, including certain international EFT and virtual-currency events.
- إجراء التنفيذ
- Configure the exact sector and transaction triggers, aggregation where required, determination steps and escalation.
- الأدلة الواجب الاحتفاظ بها
- Trigger rules, transaction sample, determination record, relationship data, approval and monitoring case.
- المصدر الأساسي
- PCMLTFR, ss. 121-123; FINTRAC, Account-based PEP and HIO guidance
A foreign PEP determination triggers prescribed source-of-funds and source-of-wealth measures, senior-management review and enhanced ongoing monitoring for account-based sectors.
- إجراء التنفيذ
- Establish and corroborate wealth and funds, obtain the required senior decision, define enhanced scenarios and review the relationship at the prescribed cadence.
- الأدلة الواجب الاحتفاظ بها
- Wealth narrative, source documents, senior approval, enhanced-monitoring plan, alerts and periodic review.
- المصدر الأساسي
- PCMLTFR, ss. 121-123; FINTRAC, PEP and HIO guidance
Domestic PEP and HIO status requires a risk determination rather than an automatic prohibition; prescribed measures follow when the relationship is high risk.
- إجراء التنفيذ
- Document the risk assessment and apply enhanced measures proportionately, without treating status alone as proof of criminality.
- الأدلة الواجب الاحتفاظ بها
- Risk decision, supporting factors, enhanced checks, approvals, monitoring and review record.
- المصدر الأساسي
- PCMLTFR, ss. 121-123; FINTRAC, PEP and HIO guidance
06Monitoring, suspicious reporting and confidentialitySuspicion reporting has no monetary threshold. Case records must show when reasonable grounds to suspect were established and why submission was timely.4 عناصر+
A reporting entity submits an STR for a completed or attempted transaction when there are reasonable grounds to suspect a connection to money laundering, terrorist activity financing or sanctions evasion.
- إجراء التنفيذ
- Monitor relevant activity, connect indicators to facts and context, and document the legal threshold for both filing and non-filing outcomes.
- الأدلة الواجب الاحتفاظ بها
- Scenario inventory, alerts, linked activity, investigation notes, decision rationale and STR receipt.
- المصدر الأساسي
- PCMLTFA, s. 7; Suspicious Transaction Reporting Regulations, s. 9; FINTRAC STR guidance
The STR is due as soon as practicable after completing the measures that enable the entity to establish reasonable grounds to suspect; there is no fixed monetary threshold or ordinary day count.
- إجراء التنفيذ
- Timestamp detection, investigation and threshold decisions; prioritize submission and record a suitable explanation for any delay.
- الأدلة الواجب الاحتفاظ بها
- Case chronology, threshold approval, queue metrics, delay rationale, filing time and acknowledgement.
- المصدر الأساسي
- Suspicious Transaction Reporting Regulations, s. 9(2); FINTRAC, Reporting suspicious transactions
Subsequent suspicious transactions remain reportable while suspicion persists, and a threshold report does not replace an STR.
- إجراء التنفيذ
- Link related cases and reports, reassess the customer periodically, and file every separately applicable cash, virtual-currency or EFT report.
- الأدلة الواجب الاحتفاظ بها
- Related-report references, customer reassessment, filing reconciliation and monitoring history.
- المصدر الأساسي
- FINTRAC, Reporting suspicious transactions, sections 7-8
A person must not disclose an STR or its contents with the intent to prejudice a criminal investigation.
- إجراء التنفيذ
- Restrict STR access, prevent customer-facing tipping off, control legal and law-enforcement requests, and train staff on permitted handling.
- الأدلة الواجب الاحتفاظ بها
- Access list, audit logs, training, disclosure procedure, tested response and incident records.
- المصدر الأساسي
- PCMLTFA, s. 8; FINTRAC STR guidance
07Cash, virtual currency, EFTs and the travel ruleBuild separate reporting decisions for cash, virtual currency and international electronic funds transfers. Apply the current 24-hour aggregation mechanics and exceptions for each report type.4 عناصر+
A reporting entity generally files an LCTR after receiving CAD 10,000 or more in cash in one transaction or qualifying aggregated transactions within a consecutive 24-hour window, subject to exceptions.
- إجراء التنفيذ
- Aggregate by the prescribed conductor, third-party or beneficiary relationship, identify required parties and file within 15 calendar days after receipt.
- الأدلة الواجب الاحتفاظ بها
- Aggregation logic, LCTR, acknowledgement, identity and third-party records, exception and reconciliation.
- المصدر الأساسي
- PCMLTFR, ss. 126 and 132(3); FINTRAC LCTR and 24-hour-rule guidance
A reporting entity in scope generally files an LVCTR after receiving virtual currency worth CAD 10,000 or more in one transaction or qualifying 24-hour aggregation.
- إجراء التنفيذ
- Apply the prescribed valuation, receipt and aggregation rules; capture wallet and transaction details and file within 5 working days.
- الأدلة الواجب الاحتفاظ بها
- Valuation source, wallet data, aggregation output, LVCTR, receipt, exceptions and quality review.
- المصدر الأساسي
- PCMLTFR, ss. 125, 126 and 132(4); FINTRAC LVCTR guidance
Prescribed financial entities, MSBs, foreign MSBs and casinos report initiation or final receipt of qualifying international EFTs of CAD 10,000 or more, including applicable 24-hour aggregation.
- إجراء التنفيذ
- Determine the entity's role, cross-border character and aggregation; file within 5 business days after initiation or final receipt.
- الأدلة الواجب الاحتفاظ بها
- Funds-flow map, transaction data, aggregation test, EFTR, acknowledgement and filing reconciliation.
- المصدر الأساسي
- PCMLTFR, ss. 127-129 and 132(1); FINTRAC EFT guidance
The travel rule requires specified originator and beneficiary information to accompany prescribed EFT and virtual-currency transfers; recipients take reasonable measures when information is missing.
- إجراء التنفيذ
- Configure mandatory message fields, preserve received information, hold or reject according to a documented risk-based policy, and test intermediaries and vendors.
- الأدلة الواجب الاحتفاظ بها
- Message specification, transfer samples, missing-data cases, disposition rationale, vendor tests and monitoring.
- المصدر الأساسي
- PCMLTFA, s. 9.5; PCMLTFR, ss. 124-124.1; FINTRAC travel-rule guidance
08Targeted financial sanctions and listed propertyCanada's sanctions programs are regulation-specific. The consolidated autonomous list is a useful screening aid but has no force of law and does not replace the operative schedules and prohibitions.4 عناصر+
Canadian persons and persons in Canada must comply with applicable prohibitions and dealing restrictions under the Criminal Code, United Nations Act, SEMA, JVCFOA and program-specific regulations.
- إجراء التنفيذ
- Map products, persons, ownership, control, geography and activity to every applicable regulation and screen against current operative schedules.
- الأدلة الواجب الاحتفاظ بها
- Sanctions perimeter, regulation inventory, list versions, screening logs, ownership analysis and legal decisions.
- المصدر الأساسي
- United Nations Act; SEMA; JVCFOA; Global Affairs Canada, Current sanctions
The consolidated Canadian autonomous sanctions list is administrative and may lag amendments; the relevant regulation determines who is listed and what prohibition applies.
- إجراء التنفيذ
- Use the consolidated list for detection but verify every potential match against the current regulation and schedule before disposition.
- الأدلة الواجب الاحتفاظ بها
- Screening hit, regulatory verification, identity evidence, disposition, approval and list-update testing.
- المصدر الأساسي
- Global Affairs Canada, Consolidated Canadian Autonomous Sanctions List
Where the statutory trigger is met, listed person or entity property must be reported to FINTRAC without delay, in addition to disclosures, freezes or other action required by the underlying law.
- إجراء التنفيذ
- Freeze or restrict as the operative rule requires, escalate immediately, submit the FINTRAC property report and make every other required disclosure without tipping off.
- الأدلة الواجب الاحتفاظ بها
- Property record, freeze or restriction, legal analysis, FINTRAC report, authority disclosure and timestamps.
- المصدر الأساسي
- PCMLTFA, s. 7.1; FINTRAC, Reporting listed person or entity property
A completed or attempted transaction suspected to relate to sanctions evasion also requires an STR; a property report does not replace that assessment.
- إجراء التنفيذ
- Run a separate reasonable-grounds-to-suspect assessment, file promptly when met and link related property and transaction reports.
- الأدلة الواجب الاحتفاظ بها
- Sanctions-evasion case, facts and indicators, STR decision, filings, cross-references and acknowledgement.
- المصدر الأساسي
- PCMLTFA, ss. 2 and 7; FINTRAC, Report suspected sanctions evasion
09Records, retrieval and regulator accessFive years is common in the AML regulations, but the event that starts the clock depends on the record. Keep a record-level schedule rather than applying one deletion date to every file.4 عناصر+
Records required by the PCMLTFR are generally retained for at least five years after the record-specific event, such as the transaction, account closure or last business transaction.
- إجراء التنفيذ
- Map each record class to its exact trigger and legal hold; prevent early deletion and dispose securely when retention and other-law needs end.
- الأدلة الواجب الاحتفاظ بها
- Retention schedule, trigger mapping, system rules, legal holds, deletion certificates and sampled records.
- المصدر الأساسي
- PCMLTFR, s. 148; FINTRAC record-keeping guidance
Required records may be electronic if a paper copy can readily be produced and must be retrievable in the form and time required by FINTRAC.
- إجراء التنفيذ
- Preserve authenticity, readability and linkages; test regulator retrieval across customers, accounts, transactions, reports and source evidence.
- الأدلة الواجب الاحتفاظ بها
- Data map, retrieval test, access logs, export sample, backup restore and issue remediation.
- المصدر الأساسي
- PCMLTFR, ss. 147-149
Beneficial-ownership records are kept for at least five years after the last business transaction, and STR-related records have their own prescribed retention requirements.
- إجراء التنفيذ
- Create separate clocks for business relationships, beneficial ownership, transaction records and report copies; record the closure or last-transaction event.
- الأدلة الواجب الاحتفاظ بها
- Customer timeline, beneficial-owner record, STR copy, clock calculation and retention test.
- المصدر الأساسي
- PCMLTFR, ss. 138(5) and 148; Suspicious Transaction Reporting Regulations
Outsourcing storage or case management does not transfer accountability for complete, secure and prompt production.
- إجراء التنفيذ
- Contract for Canadian legal requirements, access, export, preservation, incident notice and exit; exercise retrieval and migration periodically.
- الأدلة الواجب الاحتفاظ بها
- Vendor contract, data locations, access controls, retrieval exercise, incident test and exit package.
- المصدر الأساسي
- PCMLTFA, ss. 6 and 62; PCMLTFR, ss. 147-149
10Privacy, biometrics and transfersResolve whether PIPEDA, a substantially similar provincial law, sector law or several regimes apply. AML retention authority does not authorize unrelated collection or indefinite reuse.4 عناصر+
PIPEDA requires accountability, identified purposes, appropriate consent where required, collection limitation, safeguards, access and retention controls for personal information in scope.
- إجراء التنفيذ
- Map every KYC data element and purpose, identify legal authority and consent, minimize collection, control access and set defensible retention and deletion.
- الأدلة الواجب الاحتفاظ بها
- Data inventory, purpose and authority register, notices, consent record, access matrix, retention and privacy assessment.
- المصدر الأساسي
- PIPEDA, ss. 5-7 and Schedule 1; OPC, Privacy Guide for Businesses
Biometric templates and identity signals can be sensitive personal information; necessity, effectiveness, proportionality, consent and security must be assessed in the applicable jurisdiction.
- إجراء التنفيذ
- Complete a privacy impact assessment before biometric use, document alternatives and bias testing, separate templates, limit reuse and provide deletion controls.
- الأدلة الواجب الاحتفاظ بها
- Privacy impact assessment, necessity test, consent flow, model tests, security design, vendor terms and deletion proof.
- المصدر الأساسي
- PIPEDA, ss. 5-7 and Schedule 1; OPC guidance on biometrics and sensitive information
Under PIPEDA, a breach posing a real risk of significant harm must be reported to the OPC and notified to affected individuals as soon as feasible; records of every safeguards breach are kept for 24 months.
- إجراء التنفيذ
- Assess harm promptly, document the decision, report and notify when required, inform relevant third parties, and retain the complete breach record.
- الأدلة الواجب الاحتفاظ بها
- Incident chronology, harm assessment, OPC report, notices, third-party communications and 24-month record control.
- المصدر الأساسي
- PIPEDA, ss. 10.1-10.3; Breach of Security Safeguards Regulations, s. 6
An organization remains accountable for personal information transferred to a processor, including processing outside Canada, and must use contractual or other means to provide comparable protection.
- إجراء التنفيذ
- Map locations and sub-processors, assess legal-access and security risk, contract for comparable safeguards, disclose cross-border practices and test deletion and return.
- الأدلة الواجب الاحتفاظ بها
- Transfer map, vendor assessment, contract, transparency notice, security review, audit and exit evidence.
- المصدر الأساسي
- PIPEDA Schedule 1, principles 4.1.3 and 4.8; OPC cross-border processing guidance
11Payments, agents and practical evidence packsTurn the legal perimeter into testable launch gates. Payment providers may simultaneously face RPAA, FINTRAC and provincial obligations.4 عناصر+
Since 8 September 2025, in-scope PSPs must maintain the prescribed operational-risk and incident-response framework and safeguard end-user funds when they hold them.
- إجراء التنفيذ
- Implement the written frameworks, map systems and third parties, test incidents, reconcile safeguarded funds and obtain legal support for the safeguarding arrangement.
- الأدلة الواجب الاحتفاظ بها
- Frameworks, risk register, incident exercise, safeguarding legal analysis, daily reconciliation, exceptions and remediation.
- المصدر الأساسي
- RPAA, ss. 17-20; RPAR, ss. 5-17; Bank of Canada supervisory framework
Registered PSPs submit an annual report by 31 March following the reporting year and make other prescribed change, incident and new-activity reports.
- إجراء التنفيذ
- Maintain a Bank of Canada obligations calendar, assign owners and reconcile every report to source data and registration information.
- الأدلة الواجب الاحتفاظ بها
- Calendar, annual report, source reconciliation, change notices, incident reports, acknowledgements and approvals.
- المصدر الأساسي
- RPAA, ss. 21 and 22; RPAR, ss. 18-20; Bank of Canada reporting guidance
A reporting entity remains responsible for activities performed through agents or service providers and must maintain evidence that delegated controls operate effectively.
- إجراء التنفيذ
- Define responsibility, data and escalation in contracts; test onboarding, monitoring, reporting, privacy and sanctions controls end to end.
- الأدلة الواجب الاحتفاظ بها
- Responsibility matrix, contracts, control tests, case samples, service metrics, findings and verified remediation.
- المصدر الأساسي
- PCMLTFR, s. 133; RPAA, s. 87; Bank of Canada registration guidance
Each checklist row requires an explicit applicability decision, owner, current source and reconstructable operating evidence before launch.
- إجراء التنفيذ
- Mark each row applicable, not applicable or pending legal confirmation; close blockers and obtain compliance, privacy, security and product approvals.
- الأدلة الواجب الاحتفاظ بها
- Completed checklist, applicability rationale, source snapshot, owner sign-off, test result, gap ticket and launch approval.
- المصدر الأساسي
- PCMLTFA, s. 9.6; PCMLTFR, s. 156; RPAA, ss. 17-20
سجل المصادر الأساسية
35 مصدرًا مستخدمًا في هذه القائمة
استخدم هذه الروابط للتحقق من التشريعات وإرشادات الجهات الرقابية وإجراءات الإبلاغ والبيانات الدولية.
- Proceeds of Crime (Money Laundering) and Terrorist Financing ActJustice Laws Website · Primary legislation
- Proceeds of Crime (Money Laundering) and Terrorist Financing RegulationsJustice Laws Website · Primary regulation
- Suspicious Transaction Reporting RegulationsJustice Laws Website · Primary regulation
- FINTRAC obligations and guidance directoryFINTRAC · Official regulator guidance
- Compliance program requirementsFINTRAC · Official regulator guidance
- Methods to verify the identity of persons and entitiesFINTRAC · Official regulator guidance
- When to verify identity - factorsFINTRAC · Official regulator guidance
- Beneficial ownership requirementsFINTRAC · Official regulator guidance
- PEP and HIO guidance for account-based sectorsFINTRAC · Official regulator guidance
- Reporting suspicious transactionsFINTRAC · Official regulator guidance
- Reporting large cash transactionsFINTRAC · Official regulator guidance
- Reporting large virtual currency transactionsFINTRAC · Official regulator guidance
- Reporting electronic funds transfersFINTRAC · Official regulator guidance
- Reporting transactions under the 24-hour ruleFINTRAC · Official regulator guidance
- Travel rule for EFT and virtual-currency transfersFINTRAC · Official regulator guidance
- Reporting listed person or entity propertyFINTRAC · Official regulator guidance
- FINTRAC money services business guidanceFINTRAC · Official regulator guidance
- Money Services Business RegistryFINTRAC · Official register
- Canada Business Corporations ActJustice Laws Website · Primary legislation
- Individuals with significant controlCorporations Canada · Official registry guidance
- ISC filing requirementsCorporations Canada · Official registry guidance
- United Nations ActJustice Laws Website · Primary legislation
- Special Economic Measures ActJustice Laws Website · Primary legislation
- Current sanctions imposed by CanadaGlobal Affairs Canada · Official government guidance
- Consolidated Canadian Autonomous Sanctions ListGlobal Affairs Canada · Official administrative screening list
- Personal Information Protection and Electronic Documents ActJustice Laws Website · Primary legislation
- Breach of Security Safeguards RegulationsJustice Laws Website · Primary regulation
- Privacy Guide for BusinessesOffice of the Privacy Commissioner of Canada · Official regulator guidance
- Privacy breaches at your businessOffice of the Privacy Commissioner of Canada · Official regulator guidance
- Retail Payment Activities ActJustice Laws Website · Primary legislation
- Retail Payment Activities RegulationsJustice Laws Website · Primary regulation
- Retail payments supervisory frameworkBank of Canada · Official regulator framework
- Criteria for registering payment service providersBank of Canada · Official regulator guidance
- FATF Canada country pageFinancial Action Task Force · Official international assessment
- FATF black and grey listsFinancial Action Task Force · Official current-status source
إجابات مباشرة
أسئلة KYC وKYB وAML في كندا
Is every Canadian business a FINTRAC reporting entity?+
No. PCMLTFA section 5 and the regulations define covered categories and activities. Classify the entity and each product before applying reporting, verification or record-keeping duties.
When is a suspicious transaction report due?+
As soon as practicable after the reporting entity completes the measures that establish reasonable grounds to suspect a completed or attempted transaction relates to money laundering, terrorist financing or sanctions evasion. There is no monetary threshold.
What are the major CAD 10,000 reports?+
Depending on reporting-entity type and transaction, CAD 10,000 can trigger large cash, large virtual-currency or international EFT reporting, including prescribed 24-hour aggregation. Their scope and deadlines differ.
What is Canada's AML beneficial-ownership threshold?+
For corporations and many other entities, FINTRAC rules focus on individuals who directly or indirectly own or control at least 25%. The reporting entity must also understand ownership, control and structure and apply tailored trust rules.
Is the CBCA ISC register the same as FINTRAC beneficial ownership?+
No. They overlap but have different legal actors and duties. Federal corporations maintain and file ISC information; reporting entities separately collect and confirm beneficial ownership under the PCMLTFR.
Must an MSB register before launch?+
Yes. A Canadian MSB, and a qualifying foreign MSB directing covered services at Canada, must register with FINTRAC before operating. Registration is not a licence or endorsement and does not replace provincial requirements.
Does a payment provider need both FINTRAC and Bank of Canada registration?+
Potentially. FINTRAC MSB status and RPAA payment-service-provider status use different activity and scope tests. A business can fall within both and may also face provincial requirements.
What is the core AML retention period?+
Many required records are kept for at least five years, but the event that starts the period differs by record. Use a record-level schedule rather than one universal deletion date.
What is the PIPEDA breach deadline?+
Where a breach creates a real risk of significant harm, report to the OPC and notify affected individuals as soon as feasible. Keep records of every safeguards breach for 24 months, while checking provincial and sector overlays.
Is Canada on a FATF public list?+
Canada was not named on FATF's current public-list page reviewed on 31 July 2026. It remains a FATF member with published assessment and follow-up history.
منهجية البحث والمراجعة
تحدد VOVE ID Compliance Research النطاق التنظيمي، وتحول الالتزامات إلى ضوابط تشغيلية، وتربط الادعاءات الجوهرية بالمصادر، وتسجل تاريخ وإصدار كل مراجعة.
This checklist is general regulatory information, not legal advice, a licence determination or a statement that every row applies to every Canadian business. It reflects primary and authoritative material reviewed on 31 July 2026. Confirm entity type, reporting-entity category, activity, customer, province or territory, incorporation jurisdiction, regulator, registration and licensing perimeter, live FINTRAC reporting instructions, sanctions regulations, privacy scope and later legal developments with qualified Canadian counsel and the competent authorities before launch.