Client Identity Verification in Canada: FINTRAC
Key takeaways
- FINTRAC accepts photo ID, credit file, dual-process, affiliate, reliance and agent methods.
- Remote photo ID needs document authentication plus face matching, not just a video call.
- Casinos verify at $10,000 cash or virtual currency in 24 hours, $3,000 credit/exchange, and before account payouts.
- Record the method, sources and reference numbers for every verification.
- Re-verify when doubts arise; otherwise keep client information current through monitoring.
Client identity verification in Canada means confirming that a person is who they claim to be using one of the methods FINTRAC accepts: government-issued photo ID (in person or authenticated remotely), a credit file, the dual-process method, or reliance on an affiliate, another reporting entity or an agent. Casinos must verify identity at set thresholds, such as $10,000 in cash within 24 hours.
For casinos and online gambling operators that are reporting entities under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA), these rules decide which onboarding flows are acceptable, what has to be stored, and when a player must be verified again. This guide summarises FINTRAC's published guidance as of October 2026, maps each method to how it works in a digital onboarding flow, and lists the casino-specific triggers. It is a practical summary, not legal advice; confirm details against FINTRAC's current pages.
Who must verify client identity under FINTRAC rules
The Financial Transactions and Reports Analysis Centre of Canada (FINTRAC), Canada's financial intelligence unit based in Ottawa, supervises reporting entities under the PCMLTFA. Casinos are one of the reporting-entity sectors. FINTRAC's casino guidance defines a casino by reference to a government, organization, board or operator under paragraphs 5(k) to (k.3) of the Act; in practice that covers provincial lottery and gaming corporations and the operators they authorise. Whether a particular online operator is itself a reporting entity depends on that structure, so check with counsel.
Operators choosing technology for these obligations should start from the method rules below, then compare vendors. Our guide to KYC providers for iGaming operators covers document verification, liveness and database checks, and how per-check pricing works.
FINTRAC's accepted methods for client identity verification
FINTRAC's methods to verify the identity of persons and entities guidance sets out the options. Each has precise conditions; the table summarises them for a person (an individual).
| Method | What it requires | Remote / digital use | Common failure point |
|---|---|---|---|
| Government-issued photo ID | Authentic, valid and current ID from a federal, provincial or territorial government (or foreign equivalent) with name, photo and unique number; must match the person | Allowed if technology authenticates the document and the person is matched to it, e.g. by live video or a selfie compared by facial recognition | Only viewing the ID over video is not enough; municipal IDs are not accepted |
| Credit file | Canadian credit file at least three years old, from more than one source, matching name, address and date of birth | Fully remote via a credit bureau or authorised vendor | Client-supplied copies or old searches cannot be used; date-of-birth mismatches usually fail |
| Dual-process | Two different reliable sources confirming two of: name and address; name and date of birth; name and a financial account | Remote, using databases and documents from distinct sources | The client and your own organisation cannot be a source; social media is not acceptable; truncated account numbers fail |
| Affiliate or member | Rely on verification already done by an affiliate (or co-op member) using one of the methods above | Remote, by data sharing | Name, address and date of birth must match the affiliate's records |
| Reliance on another reporting entity | Written agreement; obtain the information as soon as feasible; confirm it is valid and current | Remote | No written agreement, or information not actually obtained |
| Agent or mandatary | Written agreement in place before use; you obtain the information and remain responsible (FINTRAC lists this as effective 1 October 2025) | Agent may verify in person on your behalf | Agreement signed after the verification took place |
Remote photo-ID verification in practice
Most online casinos use the photo-ID method remotely: the player photographs the ID, the system checks security features and data consistency, and a selfie or short video is compared with the ID photo using facial recognition with liveness detection. FINTRAC's guidance is explicit that simply looking at someone holding an ID on a video call does not meet the standard; the document itself must be authenticated with technology. Our breakdown of KYC ID verification documents lists which Canadian documents typically work and why some fail.
When dual-process is the better fallback
Players with thin credit files (newcomers, young adults) often fail the credit-file method. Dual-process lets you combine, for example, a utility bill confirming name and address with a bank statement confirming name and account, as long as the two come from different reliable sources. A credit file can serve as one of the two sources if it has existed for at least six months.
When casinos must verify identity: FINTRAC thresholds
FINTRAC's casino guidance (published March 2021, in force since 1 June 2021) lists the situations that trigger identity verification. Amounts are in Canadian dollars.
| Situation | Threshold | Timing |
|---|---|---|
| Large cash transaction (e.g. chip purchases, front money, bets in cash) | $10,000 or more | At the time of the transaction; 24-hour rule applies |
| Large virtual currency transaction | $10,000 or more equivalent | At the time of the transaction; 24-hour rule applies |
| Casino disbursement (reportable) | $10,000 or more | At the time of the transaction; 24-hour rule applies |
| Extension of credit | $3,000 or more | At the time of the transaction |
| Receipt of funds | $3,000 or more | At the time of the transaction |
| Foreign currency exchange | $3,000 or more | At the time of the transaction |
| Initiating an electronic funds transfer | $1,000 or more | When requested; international EFTs subject to the 24-hour rule |
| Account holder and persons authorised to give instructions | Any amount | Before any funds are disbursed |
| Suspicious transaction (including attempted) | Any amount | Before submitting the suspicious transaction report, unless already verified or verifying would tip off the person |
The 24-hour rule means several smaller transactions by or on behalf of the same person within 24 consecutive hours are added together; once the total reaches the threshold, verification and reporting obligations apply. For online casinos, where every player has an account, the account-holder rule usually means verification happens before the first withdrawal at the latest, and most operators verify at or shortly after registration.
Record-keeping: what you must store
Verification is only half of compliance; FINTRAC examiners also review the records. For each person, record their name and the date of verification, plus method-specific details:
- Photo ID: type of document, its number, the issuing jurisdiction and country, and the expiry date if available.
- Credit file: the bureau or vendor, the date of the search and the file reference number.
- Dual-process: the names of the two sources, the type of information each confirmed, and the account or reference number.
- Affiliate or member: the name of the affiliate or member, the method they used and the information they recorded.
- Reliance or agent: the written agreement and the information you obtained.
PCMLTFA records are generally kept for at least five years; confirm the exact retention period for each record type in FINTRAC's record-keeping guidance, and make sure your KYC vendor contract lets you retrieve them for that whole period, even after the contract ends.
Verifying entities, not just individuals
Most casino customers are individuals, but corporate accounts, junket-style arrangements, B2B partners and some high-value customers act through companies. FINTRAC requires a confirmation of existence for entities. For a corporation, that means a certificate of incorporation, an annual filing under provincial securities legislation, or another current record showing the corporation's name, address and directors. For other entities, such as partnerships or trusts, use a partnership agreement, articles of association or another current record showing the name and address. Keep a copy of the record, or, where you used a public database, record the registration number, the type of record and its source.
For account holders that are corporations or other entities, FINTRAC's casino guidance sets the timing as before the first transaction other than the initial deposit. Simplified identification exists for some low-risk entities, but only for the categories the Act lists and only where your documented risk assessment supports it, so most casinos will not rely on it.
Ongoing monitoring and re-verification
You do not need to re-verify a person for later transactions if you verified them with an accepted method and have no doubts about the information. You do need to keep client identification information up to date as part of ongoing monitoring, at a frequency driven by your risk assessment. Re-verify when something changes your confidence: a mismatched payment method, a name change, an expired document used for a high-value withdrawal, or behaviour that leads to a suspicious transaction report.
For minors, FINTRAC sets special rules, but they are largely irrelevant to gambling: online casino play in Canada is restricted to adults (19+ in most provinces, 18+ in Quebec, Alberta and Manitoba), and age checks should run at onboarding alongside identity checks.
Choosing an identity verification setup for a Canadian casino
- Support more than one method. Pair remote photo-ID with credit-file or dual-process fallbacks so players who fail one route are not lost.
- Check the vendor's FINTRAC mapping. Ask which FINTRAC method each check satisfies and what the audit record contains.
- Insist on authentication, not just capture. Document capture without security-feature checks and face matching does not meet the remote photo-ID standard.
- Plan for virtual currency. If you accept crypto, the $10,000 large virtual currency transaction rule and its 24-hour aggregation apply.
- Get the reliance paperwork right. Reliance and agent methods are only valid with written agreements in place before use.
Strong identity verification also supports responsible gambling: self-exclusion and limits only work if a player cannot simply open a second account under a different identity.
Frequently asked questions
What are the FINTRAC methods to verify client identity?
Government-issued photo ID (in person, or remotely with document authentication and face matching), credit file, dual-process, affiliate or member method, reliance on another reporting entity, and verification by an agent or mandatary under a written agreement.
Can identity be verified remotely in Canada?
Yes. FINTRAC accepts remote photo-ID verification if technology authenticates the document and confirms the person matches it, for example via live video or a selfie compared with facial recognition. Credit-file and dual-process methods are also remote.
When does a casino have to verify a client's identity?
For example: cash, virtual currency or reportable disbursements of $10,000 or more (24-hour rule applies), credit, funds received or currency exchange of $3,000 or more, EFTs of $1,000 or more, account holders before funds are disbursed, and suspicious transactions.
What is the dual-process method?
Confirming two of name and address, name and date of birth, or name and a financial account, using two different reliable sources. The client and your organisation cannot be a source, and social media is not acceptable.
How long must FINTRAC client records be kept?
PCMLTFA records are generally kept for at least five years. Confirm the period for each record type in FINTRAC's record-keeping guidance.
Compare independently vetted sites.
See reviews18+ only. Gambling can be addictive — please play responsibly and only bet what you can afford to lose. If gambling is affecting you or someone you know, contact a local support service. This content is informational and never a guarantee of winnings.
Written and reviewed by the iGaming Expert Hub editorial team. Facts checked against primary sources; see the reference above.