Fake Articles of Association: Detecting KYB Fraud in Canada

Fake articles of association are a corporation's constitutional document — the rules governing share structure, director powers, and shareholder rights, filed with Corporations Canada or a provincial registry on incorporation — that has been fabricated, partially altered, or obtained through a fraudulent filing to pass a KYB (Know Your Business) check. Unlike a certificate of incorporation, which only proves a company was formed, articles of association carry evidentiary weight about who controls the entity today, which is exactly why bank onboarding teams, equipment lessors, and vendor risk desks rely on them and why fraudsters target them.

This article is provided for informational purposes only and does not constitute legal, financial, or regulatory advice. Regulatory references are accurate as of the publication date. Consult a qualified professional for guidance specific to your situation.

Why Articles of Association Are a High-Value Fraud Target in Canada

Canada's dual incorporation structure is what makes this document harder to verify than in a single-registry jurisdiction. A company can incorporate federally under the Canada Business Corporations Act through Corporations Canada, or provincially — Ontario, British Columbia, Alberta, Quebec, and every other province and territory maintain their own registry — and the articles filed on incorporation set out share allotment, director appointment and removal, voting thresholds, and distribution of assets for that entity. Because they establish who is legally entitled to act on the company's behalf, a counterparty that accepts a forged or hijacked set of articles is misled about who has authority to sign contracts, open accounts, or receive funds — not just about paperwork.

That evidentiary weight is precisely what makes articles of association more dangerous to forge successfully than a bank statement: a convincing fake does not just misrepresent a balance, it misrepresents legal control of the entity itself — and since January 22, 2024, federal corporations under the CBCA must also file individuals with significant control (ISC) information with Corporations Canada, adding a second document a fraudster now has to falsify convincingly (Corporations Canada, individuals with significant control filing requirement). A reviewer checking only the articles and missing the ISC register — or checking the wrong registry for the company's jurisdiction of incorporation — leaves exactly the gap a forger is counting on.

Four Ways Fraudsters Fake Articles of Association

Fabrication from Scratch

A fraudster with no genuine document to start from recreates a registry's certificate wording and articles format in a word processor or design tool, then invents a corporation number, director names, and share structure that either do not exist on the register or belong to an unrelated entity. This method is the crudest and the easiest to catch, because it fails the moment anyone searches the fabricated corporation number on the live register — but it still passes reviewers who confirm a document "looks official" without checking it against Corporations Canada's free federal corporation search or the relevant provincial registry.

Registry-Level Identity Hijack

This is the most dangerous variant because the resulting document is entirely genuine. A fraudster files a bogus director change, a fraudulent annual return, or a false change of registered office against a real, existing corporation, waits for the registry to process it, then downloads the now-updated — but illegitimately altered — articles or corporate profile as if it were legitimate. Neither Corporations Canada nor most provincial registries verify the truth of what is filed at submission; that gap is exactly why Canada added a discrepancy-reporting layer on top of the ISC regime. As of October 1, 2025, reporting entities that identify a mismatch between a federal corporation's filed beneficial ownership information and what they observe during onboarding must report the discrepancy to Corporations Canada within 30 days, an explicit acknowledgment that filings alone cannot be trusted without an external check (Corporations Canada, beneficial ownership discrepancy reporting).

Partial Field Tampering on a Real Document

A genuine set of articles or a genuine certificate is downloaded and edited in a PDF editor to change one or two specific fields — a director's name, the stated share structure, or the registered office address — while everything else, including the corporation number, is left untouched. This survives a reviewer who confirms the corporation number exists but does not compare every field on the document against the corresponding entry on the live registry, whether federal or provincial.

Full Generative-AI Synthesis

Image and document-generation models can now produce a complete, plausible-looking articles of association or certificate of incorporation from a short prompt, matching a federal or provincial registry's typography, seal placement, and boilerplate governance language without ever touching a real filing. The output typically carries a fabricated corporation number, invented director names, and share structure figures with no counterpart on any register at all — but because the visual formatting is convincing, it defeats a purely visual check just as effectively as a partially tampered real document, and increasingly more efficiently for the fraudster, since no genuine source document is needed to start from.

What This Fraud Enables

A forged or hijacked set of articles of association is rarely the fraud itself — it is the credential that gets a fraudster through a door that would otherwise stay shut. Four schemes recur across onboarding channels:

• Shell companies for money laundering. A registered entity with plausible-looking constitutional documents and a clean-seeming filing history clears an initial KYB threshold, after which it is used to move funds through business accounts that appear legitimate on paper — the pattern the Proceeds of Crime (Money Laundering) and Terrorist Financing Act and FINTRAC oversight exist to interrupt.
• Supplier and vendor impersonation (CEO fraud, invoice redirect). A forged or partially tampered document lets a fraudster present as a trusted supplier's authorized representative, redirecting payment to an account they control while the underlying corporation details look correct on a cursory check.
• Equipment financing and leasing fraud. Lessors that rely on articles of association to confirm signing authority and share structure before releasing high-value equipment are exposed when the director named as having authority to sign is fabricated or substituted — a pattern that shows up repeatedly in equipment financing and leasing onboarding.
• Hostile business bank account takeover. A registry-level identity hijack that changes the registered director or ISC on file can be used to convince a bank that new signatories have legitimate authority over an existing business account, particularly where bank KYC onboarding relies on the filing history rather than an independent identity check of the individuals named.

Detecting Fake Articles of Association in Canada

The single most effective control is comparing every material field on the document received — corporation number, director names, registered office, share structure — against the same fields on the correct live registry for that entity's jurisdiction of incorporation: Corporations Canada's search tool for federal (CBCA) corporations, or the applicable provincial registry (ServiceOntario, BC Registry Services, Alberta's Corporate Registry, or the Registraire des entreprises du Québec) for provincially incorporated ones. Getting the registry wrong is itself a common failure mode: federal articles must show up on the federal register, not a provincial one, and vice versa.

Filing history review is the second layer, because a registry-level hijack leaves a trace: an unusual director change, an annual return filed outside the normal cycle, or a registered-office change shortly before the document was presented are all visible on the corporate profile. For federal corporations, the ISC register adds a further check — a recent, unexplained change to individuals with significant control alongside a change in the articles is a stronger signal than either alone. PDF metadata — creation software, author field, and last-modified timestamp — can reveal that a document dated years ago was edited or generated within the past few weeks. For AI-generated documents specifically, look for a corporation number with no register match, inconsistent typography or spacing against a genuine registry template, and the absence of authentication features that accompany documents genuinely issued through a registry's own systems.

A further wrinkle: consent and identity-verification workflows built around these checks must respect provincial privacy variation, particularly Quebec, where Law 25 imposes stricter consent and disclosure obligations than PIPEDA applies elsewhere in Canada.

What Compliance Teams Are Actually Asking

Compliance and fintech practitioners frequently ask how to distinguish a corporation that has simply not updated its articles in years from one where the document has been deliberately manipulated, since both can look equally static on the page. The distinguishing signal is not the age of the document but whether the current register entry — status, directors, share structure, ISC data — matches what the counterparty is presenting today; a stale-but-consistent filing is normal, one that contradicts the live register is not.

A second recurring question is what to do when a registry-level hijack means the document itself is technically genuine, since a standard visual or metadata check will not catch fraud a registry has already processed. The practical answer is to treat an unexplained, recent director or ISC change as a trigger for direct outreach to the corporation — through an independently sourced contact, not one on the document itself — before relying on the filing.

A third question concerns proportionality: whether a single mismatched field is enough to decline onboarding, or whether it should simply prompt a query. Most teams treat one inconsistency as grounds for a direct registry check and a request for explanation, reserving outright refusal for cases involving director identity or share structure, or where two or more fields disagree at once.

A Layered Approach, Not a Single Check

Manual document review catches only around 37% of occupational fraud cases, with a median detection delay of 87 days, which is why a single visual pass on articles of association is not a sufficient control on its own (ACFE, 2024 Report to the Nations). Canadian police-reported fraud reinforces the scale of the underlying problem: incidents rose 12% in 2023 alone, and the combined police-reported fraud rate nearly doubled over the preceding decade, from 260 to 501 incidents per 100,000 population (Statistics Canada, police-reported crime statistics 2023). CheckFile's approach combines structural checks, metadata analysis, and cross-validation against official registries as one layer among several, not a replacement for a live Corporations Canada or provincial registry lookup. That includes an AI-generation detection layer deployed as a complementary signal alongside structural checks, not a standalone verdict — a hijacked filing that is technically genuine will still need a filing-history and outreach check that no document-level analysis alone can replace.

For teams building out a full onboarding workflow, our complete guide to business entity verification covers the wider process end to end, and our industry verification guide breaks down sector-specific checks across financing, construction, and regulated services. This article is the companion piece to our analysis of forged certificates of incorporation, which focuses on the formation document rather than the governance rules a company adopts alongside it. See CheckFile's security page, pricing, and homepage for more on how the platform fits into a broader onboarding stack.

If your review process still relies on a visual read of a PDF a counterparty has sent, CheckFile's AI-generated document detection adds AI-generation signals as a complement to your existing controls — not a guarantee of catching every forgery, but a meaningful layer alongside registry cross-checks and filing history review.

Frequently Asked Questions

Can genuine articles of association still be fraudulent in Canada?

Yes, when they result from a registry-level identity hijack — a fraudulent director change or annual return filed against a real corporation. The document Corporations Canada or a provincial registry holds is technically authentic, so the only way to catch this is reviewing the filing history and ISC register for unexplained recent changes, not just checking that the document itself looks correct.

What is the fastest way to check if articles of association are genuine in Canada?

Search the corporation number on Corporations Canada's free federal search if the entity is CBCA-incorporated, or the applicable provincial registry otherwise, and compare every material field — directors, registered office, share structure — against the document received. This takes only a few minutes and catches fabricated, tampered, and most AI-generated documents, since none of them can match a genuine register entry unless the underlying filing was itself fraudulent.

How is a fake articles of association different from a fake certificate of incorporation?

A certificate of incorporation only proves a corporation was formed on a given date; articles of association set out who controls it — director powers, share structure, voting rights. A forged certificate misrepresents that a corporation exists validly, while forged or hijacked articles misrepresent who is legally entitled to act on the corporation's behalf today, which is why they carry more weight in onboarding decisions involving signing authority.

Does the federal ISC register stop this fraud?

It substantially improves transparency for CBCA corporations by making individuals with significant control publicly searchable, and the October 2025 discrepancy-reporting requirement adds a check on that data, but it does not stop registry-level hijacks of existing corporations, document-level tampering or fabrication, or fraud involving provincially incorporated companies outside the federal regime. Independent document and filing-history checks remain necessary regardless.

Is presenting forged articles of association a criminal offence in Canada?

Yes. Using a forged or manipulated document to induce a business decision falls under fraud provisions in Section 380 of the Criminal Code, which carries up to fourteen years' imprisonment where the value exceeds five thousand dollars, and creating a false document with intent that it be acted upon as genuine falls under forgery in Section 366. Filing false information with a corporate registry can also expose the filer to separate offences under the applicable federal or provincial corporations statute.