Fake Certificates of Incorporation in Canadian KYB Onboarding

A fake certificate of incorporation is a Corporations Canada or provincial registry certificate, corporate profile report, or annual return that has been edited, fabricated, or presented with a genuine corporation number but substituted details, to pass a KYB onboarding check. Because Canada's corporate registries are free or low-cost to search, fraudsters can steal, edit, or misrepresent a real filing far more easily than they can forge a bank statement or a passport. This is the fraud-detection companion to our guide on how to verify a company registration online: that article covers the legitimate lookup process, this one covers how the document gets faked and caught.

This article is for informational purposes only and does not constitute legal, tax, or regulatory advice. Consult a lawyer or compliance professional for guidance specific to your organization. Legislation and guidance referenced are current as of 25 July 2026.

What a Certificate of Incorporation Proves — and What It Does Not

A certificate of incorporation confirms that a corporation was legally formed on a specific date, under a specific name and number, within a specific jurisdiction — but it says nothing about who currently runs the business. It is issued once, at formation, and never updated: a genuine 2019 certificate remains genuine even if the corporation has since changed directors, moved its registered office, or been dissolved. KYB onboarding should treat it as only a starting point — proof the entity was validly created, not proof it is still active or controlled by the people a counterparty believes it is dealing with.

Canada's dual system adds a layer most European verifiers never have to think about. A business can be incorporated federally under the Canada Business Corporations Act (CBCA) through Corporations Canada, or provincially under the equivalent act in whichever province or territory it chose — Ontario, British Columbia, and Quebec each run their own registry: the Ontario Business Registry, BC Registry Services, and the Registraire des entreprises du Québec (REQ). A certificate that cannot be located in the registry it claims to belong to is not automatically fraudulent — the reviewer may simply be searching the wrong system — but resolving that ambiguity is part of the verification step, and fraudsters occasionally lean on it, presenting a provincial certificate to a counterparty who only knows how to search the federal registry. A company claiming national operations but incorporated in only one province should also carry extra-provincial registrations wherever it does business; a missing one is a checkable gap.

The filing history — annual returns, profile updates, director changes, and ISC declarations for CBCA corporations — is what matters for ongoing risk. A counterparty presenting only the original certificate is showing a snapshot from formation day, not the current legal state, and that gap is where forged documents tend to hide.

Canada's Beneficial Ownership Registry Changes the Fraud Calculus

Corporations Canada has operated a federal beneficial ownership registry for CBCA corporations since 22 January 2024, requiring them to file information on individuals with significant control — generally anyone holding 25% or more of shares — with public search limited to corporate name rather than individual name, for privacy reasons (Corporations Canada, Beneficial ownership transparency). The regime tightened on 1 October 2025: FINTRAC-regulated reporting entities must now obtain beneficial ownership information during due diligence and report discrepancies against the registry (Fasken, Further Expansion of Canada's AML Regime). British Columbia is expected to add its own public transparency register for BC-incorporated companies in 2026, after pressure from the province's money-laundering inquiry (Fasken, New Public Transparency Register for B.C. Companies).

These changes target a specific fraud pattern: hiding who actually controls a Canadian shell company, a practice labelled "snow-washing" — using Canada's clean international reputation to launder illicit funds through anonymously-owned corporate structures, with flows estimated in the tens of billions of dollars a year (Canadians for Tax Fairness, Report: Snow-washing, Inc.; CBC News, Canada must expose hidden company owners to end 'snow washing'). What the registry does not solve is forgery of certificates belonging to companies that already exist and already have ownership on file. A fraudster who cannot hide a new shell's ownership can still take a real corporation's genuine certificate and misrepresent who is presenting it — which is why document-level verification against the live registry remains necessary.

How Fraudsters Actually Forge These Documents

Editing a genuine downloaded PDF is the most common method, because certificates, annual returns, and corporate profile reports from Corporations Canada and most provincial registries are inexpensive or free to obtain. A fraudster orders a real filing, opens it in a PDF editor, and changes the registered office, director names, or filing date before presenting it as current, relying on the reviewer not cross-checking the live registry.

Fabricating a document from scratch is less common but still occurs, usually where the target is a one-off visual check rather than a determined verifier. This means recreating a Corporations Canada certificate's layout, or a provincial registry's format — Ontario's, BC's, and Quebec's templates each differ — in a design tool or, increasingly, using generative AI to produce a convincing image-based certificate with a plausible corporation number that does not exist or belongs to an unrelated entity.

Corporate identity theft is the more dangerous variant: using a real corporation's genuine number and name, but substituting the director names, ISC details, or registered office. Because the number checks out on a cursory glance, this survives a reviewer who confirms "yes, this corporation exists" without comparing every field against the live registry.

A fourth pattern is a stale filing history that quietly omits a recent dissolution, amalgamation, or discontinuance. The certificate and early filings are entirely genuine; missing is the most recent entry showing the corporation was dissolved for failing to file annual returns, amalgamated into a different entity, or continued into another jurisdiction — any of which makes the certificate obsolete as proof of who the counterparty is dealing with.

Real Fraud Schemes This Enables

Invoice fraud and CEO fraud often start with a forged registration document impersonating a real, trusted supplier, redirecting payment to an account the fraudster controls. Construction sees fraudulent subcontractor onboarding, where a forged or borrowed certificate lets a non-compliant contractor pass a general contractor's paperwork check before work begins — a pattern echoing the fraud covered in our vendor compliance certificate piece.

Shell companies built for money laundering are the pattern Canadian authorities have spent the most political capital on. Snow-washing schemes typically pair a legitimately-incorporated shell — sometimes with a genuine, unaltered certificate — with fabricated or omitted ownership details, moving illicit funds through real estate or corporate accounts while looking like an ordinary Canadian business. Synthetic loan-fraud setups follow a related logic, pairing a genuine or lightly-altered registration document with fabricated financial statements, echoing the tactics in our analysis of fake financial statements in business lending. The certificate is rarely the fraud itself — it is the credential that gets the fraudster past the door.

Detection Techniques That Actually Work

The single most effective control is cross-checking the corporation number directly on the registry matching the claimed jurisdiction, rather than trusting the PDF a counterparty has sent. For federal corporations, searching Corporations Canada's online registry takes under a minute and shows current status, registered office, and directors as actually held. For provincially incorporated companies, the equivalent check runs through the relevant provincial registry — Ontario Business Registry, BC Registry Services, or the REQ, among others — and confirming which jurisdiction applies is itself the first verification step.

For CBCA corporations, checking the federal beneficial ownership registry adds a second layer, surfacing the individuals with significant control on file and flagging mismatched names. Requesting a recently dated corporate profile report or annual return, rather than the original certificate alone, catches what a static document cannot — a dissolution or amalgamation it conveniently omits. PDF metadata analysis is a further layer: creation software and modification timestamps can reveal a "2019 certificate" was actually last saved in an image editor weeks ago. Font and layout inconsistencies against the genuine template are a weaker but useful signal for wholesale fabrications.

What Compliance Teams Are Actually Asking

Compliance and fintech practitioners on Canadian KYB forums often ask how to tell a slightly outdated but genuine certificate from a deliberately manipulated one, since a company that has not filed an annual return in a while can look similar to one hiding something. The distinguishing factor is not the age of the certificate — static by design — but whether the current registry entry matches what the counterparty claims today; an old certificate paired with an up-to-date profile is normal, one paired with a contradicting profile is not.

A second recurring question is whether confirming a corporation number exists is enough, without checking the specific province named on the document. Confirming existence is not the same as confirming standing: a number can be real while the office, directors, or jurisdiction claimed are wrong, so most teams treat "existence confirmed" as the first step, not the last, escalating to a direct comparison whenever identity or jurisdiction cannot be matched cleanly.

Legal Framework and Liability

Presenting a forged certificate to induce a business decision falls within the fraud offence at Section 380(1) of the Criminal Code, carrying up to fourteen years' imprisonment where the value exceeds $5,000. Separately, altering or fabricating the document is captured by the forgery provisions in Part IX: Section 366 defines forgery as making a false document with intent that it be acted on as genuine, Section 367 sets the penalty at up to ten years, and Section 368 covers using a document known to be forged. Where a forged certificate disguises the proceeds of an underlying crime, the laundering offence under Part XII.2, including Section 462.31, can apply on top.

For FINTRAC-regulated reporting entities — banks, money services businesses, real estate brokerages, and others — the obligation to scrutinize business documentation sits within the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA), requiring due diligence proportionate to risk, including verification of a corporate customer's existence, directors, and beneficial owners (FINTRAC, Guidance). A reporting entity that onboards on an unchecked, forged certificate risks its own compliance position, including the discrepancy reporting obligation effective October 2025.

A Layered Approach to Detection

Manual detection methods, including routine visual review of documents, catch only around 37% of occupational fraud cases, with a median delay of 87 days before detection (ACFE, 2024 Report to the Nations). That gap exists because a well-edited PDF can pass a five-second glance every time; it only fails when checked against an independent source — a discipline that matters even more where the "independent source" is one of fourteen possible registries depending on jurisdiction.

CheckFile's approach layers structural analysis, metadata checks, and cross-document validation, built to cover 3,200+ document types and 32 jurisdictions. CheckFile also deploys an AI-generation detection layer as a complementary signal, not a replacement for cross-checking the official register. A forged certificate still has to be checked against Corporations Canada or the applicable provincial registry, and its filing history, to confirm actual status, directors, and beneficial ownership — no document-level analysis alone substitutes for that step.

For teams refining a full KYB workflow, our complete guide to business entity verification covers the wider process, and our industry verification guide sets out sector checks across financing, construction, and regulated services. CheckFile's platform is also used in equipment financing and leasing, where a forged registration document paired with fabricated financials recurs — see our security page, pricing, and homepage.

If your onboarding process still relies on a visual read of a PDF a counterparty has sent, CheckFile's AI-generated document detection adds AI-generation signals as a complement to your existing controls — not a guarantee of catching every forgery, but a meaningful layer alongside registry cross-checks.

Frequently Asked Questions

Can a fake certificate of incorporation use a real corporation number?

Yes — this is corporate identity theft, the most dangerous variant of the fraud. The corporation number and name are genuine and pass a superficial check, but the director names, ISC details, or registered office have been substituted. The only way to catch it is comparing every field against the live registry, not just confirming the number exists.

Does Canada's beneficial ownership registry stop certificate forgery?

It substantially reduces one specific risk — hiding who ultimately controls a CBCA corporation, the pattern behind snow-washing — but it does not stop forgery of certificates belonging to companies that already exist. Reporting entities gained a discrepancy-reporting obligation in October 2025, but forged certificates for long-established, genuine companies remain a live risk requiring independent checks.

What is the fastest way to check if a certificate of incorporation is genuine?

Search the corporation number on Corporations Canada's registry if the certificate claims federal incorporation, or on the relevant provincial registry — Ontario, BC, or Quebec's REQ, among others — if it claims provincial incorporation, and compare the name, status, office, and directors against the document. This takes minutes and is more reliable than any visual inspection.

What happens if a stale filing history hides a recent dissolution or amalgamation?

The certificate and early filings may be entirely genuine, but the registry's current status field will show the dissolution or amalgamation that the presented document omits. Checking the corporate profile or annual return history, not just the original certificate, is essential to catch this pattern.

Is presenting a forged certificate of incorporation a criminal offence in Canada?

Yes. Using a forged certificate to induce a business decision falls under the fraud offence in Section 380(1) of the Criminal Code, carrying up to fourteen years' imprisonment where the amount exceeds $5,000. The underlying forgery is a separate offence under Sections 366 to 368, carrying up to ten years on indictment.