What the PCMLTFA is
The Proceeds of Crime (Money Laundering) and Terrorist Financing Act, usually shortened to PCMLTFA, is the federal statute that sets Canada's anti-money laundering and anti-terrorist financing framework. Detailed rules sit in regulations made under it, and FINTRAC publishes guidance on how it expects those rules to be applied.
The Act places obligations on reporting entities. These include banks and credit unions, securities dealers, life insurers, casinos, accountants and real estate businesses in certain circumstances, dealers in precious metals and stones, and money services businesses. Clients are not reporting entities, and the Act does not impose compliance duties on them directly.
Clients are still affected, because a reporting entity can only meet its obligations with information that comes from the client. When a provider asks for documents, explanations or updates, it is usually doing so because the law requires it to know, verify or record something. It is not a matter of preference, and a provider cannot waive a legal requirement to make onboarding faster.
Identification at the start
An MSB must verify the identity of its clients. For a business client, that involves two layers.
The first layer is the entity. The provider confirms that the company, partnership or trust exists, usually from documents such as a certificate of incorporation, a recent extract from a corporate registry, or a trust deed. It records the entity's name, address and principal business, and the names of its directors.
The second layer is the people. The provider identifies the individuals who will act for the client, such as authorised signatories. It also obtains beneficial ownership information: who directly or indirectly owns or controls 25% or more, and for a trust, the trustees, known beneficiaries and settlors. It must take reasonable measures to confirm that information.
The methods for verifying individuals are set by the regulations and FINTRAC guidance. They include checking authentic government-issued photo identification, using information from a Canadian credit file, or combining reliable information from two independent sources. Providers working with international clients often use certified copies and video verification within those frameworks.
Other things the provider must determine
Identification is not the only thing the law asks a provider to find out at onboarding. Depending on the relationship, a provider must also:
- Understand the purpose and intended nature of the relationship. What will the account be used for, which currencies and countries are involved, and what volumes are expected.
- Make a third party determination. The provider must take reasonable measures to establish whether the client is acting on behalf of someone else, and if so, record information about that third party.
- Make a politically exposed person determination. In the circumstances the regulations set out, the provider must establish whether the client is a politically exposed person, a head of an international organisation, or a family member or close associate of one. Many providers extend this check to beneficial owners and signatories as a matter of policy.
- Screen against sanctions lists. Canadian sanctions laws apply to everyone in Canada. Providers screen clients, owners and counterparties as part of their own compliance.
- Assess risk. The provider must assess the money laundering and terrorist financing risk of the relationship and apply enhanced measures where the risk is high.
Why providers ask so many questions
Clients often say that they have already provided everything, and then receive another request. Usually the reason is one of the following.
The answer did not match the documents. If the ownership chart shows two shareholders but the register shows three, the provider has to resolve the difference before it can confirm accuracy.
The activity has changed. A client onboarded to pay European suppliers starts receiving funds from a new country, or volumes triple. Ongoing monitoring requires the provider to understand the change.
A transaction needs context. A large or unusual payment may need an invoice, a contract or an explanation of the commercial reason. This is about understanding the transaction, not an accusation.
Information has gone out of date. Providers must keep client information current. Passports expire, directors change and certificates of good standing become stale.
A good provider will explain what it needs and why. A good client will answer fully the first time, because partial answers usually create a second round of questions.
Ongoing monitoring during the relationship
Onboarding is the start of the provider's obligations, not the end. Throughout the relationship an MSB must conduct ongoing monitoring. That means periodically reviewing the information it holds, keeping it up to date, and watching transactions to check that they are consistent with what it knows about the client.
The intensity depends on risk. A lower-risk client might be reviewed on a longer cycle, with transaction monitoring running in the background. A higher-risk client will be reviewed more often and may be asked for regular updates on its business, its counterparties and its source of funds.
For clients, the practical points are straightforward:
- Tell the provider about significant changes, such as new owners, new directors or a change in business model, before they show up in transactions.
- Expect periodic refresh requests and plan for them, especially for documents that expire.
- When sending an unusual payment, include supporting information with the instruction rather than waiting to be asked.
Records and how long they are kept
The PCMLTFA requires reporting entities to keep records, and to keep them for at least five years. For an MSB that includes records of client identification, beneficial ownership information, the business relationship, the transactions it carries out and the reports it files.
From a client's perspective this has a few consequences. Documents you provide at onboarding will be kept for the required period after the relationship ends, even if you close your account. You cannot ask a provider to delete records it is legally required to keep. Privacy law in Canada continues to apply, so the provider must protect the information, use it for proper purposes and disclose it only as the law permits or requires.
Record keeping is also why a provider will want documents in a usable form. An unreadable scan, a document in a language the provider cannot read without a translation, or a copy without certification where certification is required, will usually be sent back. The record has to stand up to examination by FINTRAC years later, long after the original conversation is forgotten.
Reporting to FINTRAC
An MSB files several kinds of reports with FINTRAC. Some are routine and based purely on thresholds. Others depend on judgement.
- Large cash transaction reports for receipt of CAD 10,000 or more in cash.
- Large virtual currency transaction reports for receipt of virtual currency worth CAD 10,000 or more.
- Electronic funds transfer reports for international EFTs of CAD 10,000 or more sent or received.
- Suspicious transaction reports where there are reasonable grounds to suspect that a transaction, or attempted transaction, is related to money laundering or terrorist financing. There is no minimum amount.
- Listed person and terrorist property reports where the provider knows or believes that property is owned or controlled by or on behalf of a terrorist group or listed person. FINTRAC has used different names for this report over time.
Threshold reports are a normal part of business. A EUR 50,000 supplier payment sent abroad will produce an EFT report as a matter of course, and it says nothing negative about the client. Judgement-based reports are different, and they are protected by the tipping-off rule described next.
The tipping-off rule
The PCMLTFA prohibits disclosing that a suspicious transaction report has been made, or its contents, with the intent to prejudice a criminal investigation. In practice, providers adopt a firm policy of never confirming or denying whether a suspicious transaction report exists.
Clients occasionally interpret that silence as evasiveness. It is a legal constraint. If a payment is held, a provider may ask questions, request documents or decline to proceed, and it may not be able to explain every reason. Staff are trained not to speculate, and they will not answer questions such as whether a report has been filed about a particular transaction.
The rule protects investigations and it protects clients too. A report is not an accusation and does not mean anyone has done anything wrong. It is a piece of information passed to FINTRAC for analysis. Most clients will never know whether a report has been filed in connection with them, and in the large majority of cases nothing further happens.
How to make the process easier
Compliance goes faster when both sides prepare. A few habits make a noticeable difference:
- Prepare an onboarding pack before you apply: corporate documents, an ownership chart with percentages, identification for directors and beneficial owners, and a short description of your business and expected payment flows.
- Explain your structure in plain words. A two-paragraph note on why a holding company sits in a particular jurisdiction saves several emails.
- Keep a single point of contact who understands both the business and the documents.
- Answer every part of a request. If something is not available, say so and explain what you can provide instead.
- Give advance notice of unusual payments, such as a large one-off acquisition or a new counterparty country.
Before you act
This article is a general overview of how the PCMLTFA affects clients of a money services business. It is not legal advice, and it does not describe every obligation in the Act or regulations.
If you are preparing to open an account with CCYFX, our onboarding page lists the documents we usually ask for, and the compliance page sets out the CCYFX approach to compliance.
