Canada: FINTRAC's Updated Guidance On Methods To Verify Identity: A New Spin On "Authentic"

The Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) has updated its guidance on Methods to verify the identity of an individual and confirm the existence of a corporation or an entity other than a corporation (Guidance). The Guidance follows recent amendments to the regulations (Regulations) to the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) in respect of identity verification.

On the surface, the amendments to the Regulations appeared to modernize the previous identity verification regime by allowing for remote identity verification using only a single identity document (ID) as a source. However, FINTRAC's Guidance hinders that progress by prohibiting the use of Skype and similar telephony technology as a standalone method for identity verification where the parties are not physically together.

AUTHENTICATION

Prior to the recent amendments to the Regulations, in order to verify the identity of an individual using an ID only, a regulated entity could only do so in person, as the Regulations required a regulated entity to view an "original" document. The amendments to the Regulations replaced the "original, valid and current" requirement with a requirement that the ID be "authentic, valid and current".

The hope was that this change would allow reporting entities (REs) to use telephony methods to view IDs for the purposes of verifying identity in accordance with the Regulations. However, the Guidance shuts that door by interpreting the "authentic" requirement as a mandate for REs to use enhanced technology.

Specifically, the Guidance provides that a RE can determine the authenticity of a government-issued photo identification document in the following ways:

• In person by looking at the characteristics of the original physical document and its security features and being satisfied that it is authentic as issued by the competent authority and is valid (unaltered, not counterfeit) and current.
• Where the person is not physically present, FINTRAC provides that the authenticity of the identification document must be determined using technology. Specifically, FINTRAC provides that the authenticity of a government-issued ID must be determined by using a technology capable of assessing the document's authenticity.

As an example of this approach FINTRAC provides the following:

After discussing this, FINTRAC notes that when an individual is not physically present, a RE is still required to determine if the person presenting the photo identification matches the name and photo of the person in the authenticated document provided.

In order to do this, FINTRAC provides that a RE can participate in a live video chat session allowing a RE to compare the name and features of the live video image to the name on the photo and photo on the government-issued ID.

FINTRAC also provides that an individual can be asked to take a selfie using the camera on their phone or electronic device, and a RE could then use facial recognition software to compare the features of the "selfie" to the photo on the government-issued ID. Presumably, this could be utilized in a more automated process.

After providing this information, FINTRAC notes the following:

It is unclear why a RE cannot, through a video conference feature, look at the characteristics of an ID, look at its security features and be satisfied that it is authentic, in the same manner as if the person was meeting face-to-face with the RE.

By requiring a technology application, FINTRAC, through its guidance, is adding a requirement that is not provided for in the Regulations. The Regulations require that a RE be satisfied that a document is "authentic"; there is no requirement for a RE to use technology in order to do so. Arguably, if using technology as a means of confirming authenticity is the standard, it should be the standard for all identity verification regardless of whether the document is viewed in person or remotely. The Guidance serves as further evidence of FINTRAC's view that the "gold star" standard of identity verification is an in-person review of an ID.

Hopefully technology solutions will not be terribly difficult to implement or require expensive builds or integration by REs, but it will be something that REs need to address.

REs should be cognizant of the fact that when they are interacting with clients through their mobile devices and using these technology solutions, that if they retain IP addresses and device numbers or other data used in these interactions, this information will be required to be populated in any reports that they are making to FINTRAC in respect of these clients.

DUAL PROCESS METHOD

In respect of the dual process method, previously, other information used to ascertain identity had to be valid and current and could not include an electronic image of a document. This prohibition on using an electronic image has been removed. As a result, the Guidance also provides some interesting insights into acceptable methods of verifying identity for the purposes of the dual method. Specifically, the Guidance clarifies that statements, letters, certificates, and forms may be used under the dual process method and that this information can now be provided by way of fax, photocopy, scan or electronic image of the original document. Surprisingly, the Guidance also allows a RE to rely on a fax, photocopy, scan, or electronic image of a government-issued photo ID as one of the two sources under the dual method.

Some helpful information from FINTRAC in the Guidance deals with circumstances where the information obtained from a person whose identity is being verified is not an exact match with the information obtained by a RE. In this regard, FINTRAC notes that there may be circumstances where there is a "slight typo" in a name or address or that there may be multiple addresses in a credit file. In these circumstances, FINTRAC notes that a RE may still determine that the information "matches" what the individual provided. This should give comfort to REs where they wish to rely on information that is clearly correct but for a slight misspelling. In respect of a discrepancy in the date of birth however, FINTRAC notes that "it is more likely that you will determine that the information does not match". It is important to note that the Guidance still leaves the matching logic to the RE to determine.

Other helpful guidance is provided in respect of portfolio acquisitions. In that regard, FINTRAC notes that a RE is not required to re-identify acquired clients if their identity was verified in accordance with the Regulations at the time that the verification took place. As a best practice, FINTRAC encourages REs to review and update client information as determined by the RE's risk assessment process.

There is also a helpful discussion in how credit file information can be used as both parts of the dual method process.

POLICIES AND PROCEDURES

It is noted in the Guidance that a RE's policies and procedures must describe the processes that are followed to determine that an identification document is authentic, valid and current as well as how the RE verifies the photo and name of the individual. FINTRAC notes that the process for authentication and the process for name/photo match do not have to happen concurrently.

In addition, the Guidance provides that a RE's policies and procedures must describe the process a RE follows to use the credit file method to verify an individuals' identity, including the steps a RE will take if the information is not found to be valid or current.

REs are advised to update their policies and procedures to comply with FINTRAC's expectations.

For permission to reprint articles, please contact the Blakes Marketing Department.

© 2019 Blake, Cassels & Graydon LLP.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.