Question 1

What identity verification standard applies to Canadian financial institutions under PCMLTFA?

Accepted Answer

FINTRAC's Methods to Verify the Identity of an Individual guidance (updated March 2025) allows document verification, credit file method, dual-process method, and affiliate method. For remote onboarding, the electronic identification method requires two independent data sources confirming name and address. Biometric verification is accepted as a supplementary factor for stronger assurance.

Question 2

What is the Pan-Canadian Trust Framework (PCTF) and why does it matter?

Accepted Answer

The PCTF, developed by DIACC, defines four identity assurance levels (IAL 1-4) and a common vocabulary for digital identity across the public and private sectors. It is aligned with NIST SP 800-63-4 and eIDAS 2.0. OSFI and FINTRAC are increasingly referencing PCTF standards in their guidance, making it the de facto national identity assurance framework.

Question 3

Does Quebec's Loi 25 create additional requirements for biometric data?

Accepted Answer

Yes. Loi 25 (Act respecting the protection of personal information in the private sector, as amended) creates stricter requirements than PIPEDA for AI-based profiling, automated decision-making, and data transfers. Businesses collecting biometric data in Quebec must conduct privacy impact assessments (PIAs) before deployment, publish technology watch policies, and provide opt-out rights for automated profiling.

Question 4

When must businesses file Suspicious Transaction Reports (STRs) with FINTRAC?

Accepted Answer

STRs must be filed within 30 days of the transaction being deemed suspicious, regardless of the amount. Large cash transactions of CAD 10,000 or more must be reported by the next business day as LCTRs. Electronic funds transfers of CAD 10,000 or more have separate EFTR reporting requirements.

Question 5

How does Canada's digital identity framework compare to the EU's eIDAS 2.0?

Accepted Answer

Canada does not have a single federal digital ID mandate equivalent to eIDAS 2.0. The PCTF serves a similar technical role, defining assurance levels and interoperability standards. The primary difference: eIDAS 2.0 mandates EUDIW issuance by government; Canada relies on a multi-stakeholder model where banks (Verified.Me), telcos, and provincial governments each contribute identity infrastructure.

Question 6

Is biometric verification required for KYC compliance under PCMLTFA?

Accepted Answer

Biometric verification is not universally mandated for KYC under the PCMLTFA. FINTRAC permits multiple identity verification methods including documentary, credit file, and dual-process methods. Biometric facial verification supports the photo identification method when a live selfie is matched against a government-issued photo ID such as a Canadian passport or provincial driver's licence. It becomes the practical standard for remote digital onboarding where in-person verification is not feasible, and where the risk profile of the customer segment warrants a higher assurance level.

Question 7

Does PIPEDA require express consent for biometric data collection?

Accepted Answer

Yes. The OPC has consistently confirmed that biometric data requires express consent rather than implied consent, given its heightened sensitivity under PIPEDA Schedule 1, Principle 4.3.4. This means the individual must be clearly informed of the purpose of collection, the retention period, and any third-party disclosures, and must actively agree before collection begins. In Quebec, Loi 25 imposes additional technology-specific disclosure requirements under Article 8 and prohibits biometric collection where a less privacy-invasive alternative is available to achieve the same purpose.

Question 8

What is liveness detection and why is it necessary?

Accepted Answer

Liveness detection verifies that the biometric sample comes from a physically present person, rather than a photograph, mask or deepfake. Without this layer, a facial verification system can be defeated by a printed photo or a recorded video. ISO/IEC 30107-3 Levels 1 and 2 are the market reference standards for presentation attack detection. For FINTRAC-regulated entities, the absence of liveness detection in a remote digital onboarding flow creates a documented gap in the identity verification methodology. The OPC has noted that biometric systems deployed without adequate technical safeguards against spoofing may fail the PIPEDA Principle 4.7 safeguards requirement.

Question 9

How should biometric templates be handled under PIPEDA and Loi 25?

Accepted Answer

Under PIPEDA Principle 4.7, biometric templates must be protected by security safeguards appropriate to their sensitivity — including encryption at rest and in transit, access controls, and audit logging. Under Principle 4.5, templates must be destroyed or anonymised as soon as the purpose for collection is fulfilled. Quebec Loi 25, Article 25 imposes the same destruction requirement with a deadline tied to the purpose of collection. Because a compromised biometric template cannot be replaced, the standard of care for template storage must be higher than that applied to other personal information. Incidents involving biometric template breaches must be reported to the OPC under PIPEDA Section 10.1 where there is a real risk of significant harm.

Question 10

What is the Quebec CAI notification requirement for biometric databases?

Accepted Answer

Under Loi 25, Article 44, any person who operates a technology — including a biometric verification system — that allows for the identification, location or profiling of natural persons must notify the Commission d'accès à l'information (CAI) before putting it into operation. This obligation applies to organisations that maintain enrolled biometric templates for the purpose of verifying individuals over time. The notification must include the purpose of the database, the categories of personal information collected, the security measures in place, and the retention period. Failure to notify the CAI is an offence under Loi 25 and can result in administrative monetary penalties of up to $25 million CAD or 4% of worldwide turnover.

Data

Digital Identity Trends 2026: The Future of Online Verification and e-ID in Canada

Biometric Verification: Fingerprint, Facial and Voice

Document Fraud Statistics and Trends 2026: Canadian

Compliance Automation ROI: Benchmarks by Industry

Document Fraud 2026: Statistics and Detection

AI vs Manual Document Verification: ROI Comparison

Document verification ROI calculator: TCO analysis and payback period

Document Fraud and Validation Costs: The Data

Document Fraud in Canada 2026: Data & Trends

Manual Document Validation: True Cost (TCO)

Cost of Compliance: True Cost of Manual Checks

RegTech 2026: Regulatory Technology Guide in Canada

Compliance Fines and Penalties: What Canadian