Income Document Verification for KYC: Paystubs, T4s & FINTRAC Compliance 2026

Income document verification is a core KYC requirement for Canadian financial institutions subject to the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA). Pay stubs, T4 slips, Notices of Assessment — these documents are essential for compliance and among the most frequently falsified. In 2026, with AI-generated document fraud accelerating, Canadian regulated entities face growing supervisory scrutiny from FINTRAC and OSFI regarding source-of-funds verification practices.

Why Income Documents Are Required Under PCMLTFA/FINTRAC

The obligation to verify income and source of funds derives from sections 6 to 9.1 of the PCMLTFA, the associated Regulations, and FINTRAC's Compliance Guidance on Know Your Client (KYC) requirements updated in 2024. In practice, income verification serves two distinct purposes:

1. Establishing source of funds: confirming that resources come from a lawful activity (wages, rental income, sale of assets) and not from the proceeds of crime under Part XII.2 of the Criminal Code of Canada.
2. Risk profile assessment: ensuring the declared income level is consistent with anticipated transaction activity, as required under FINTRAC's ongoing compliance monitoring framework.

FINTRAC's 2025 Compliance Assessment Report identified deficient source-of-funds verification as one of the top five shortcomings across examined reporting entities, resulting in Administrative Monetary Penalties (AMPs) of up to $100,000 per violation for individuals and $500,000 for entities. (Source: FINTRAC-CANAFE.gc.ca)

Reporting entities under the PCMLTFA include: banks and federally regulated financial institutions, credit unions, life insurance companies, real estate brokers, mortgage brokers, securities dealers, money services businesses (MSBs), and accountants.

Accepted Income Documents: Canadian Reference Table

Accepted documents vary by the client's employment situation. The table below covers the main categories relevant to Canadian financial institutions:

Consistency between the pay stub year-to-date (YTD) gross pay and the T4 box 14 Employment Income is the primary red flag check — significant unexplained divergence warrants additional inquiry before proceeding with onboarding or enhanced due diligence.

Most Common Income Document Frauds in Canada

Pay stub and income document fraud has increased sharply. According to the ACFE 2024 Report to the Nations, manual document fraud detection catches only 37% of cases on average, with a mean detection delay of 87 days.

Common income document frauds targeting Canadian financial institutions:

• Edited PDF pay stubs: altering employer name, wage amounts, or deduction figures using standard PDF editors. Metadata reveals original creation or modification date.
• Fictitious or dissolved employers: using a company name and Business Number (BN) of a business that never registered with CRA, is dissolved under provincial corporate registries, or belongs to an unrelated industry.
• Inconsistent CPP/EI deductions: CPP contributions for 2026 are 5.95% on pensionable earnings between the basic exemption ($3,500) and the Year's Maximum Pensionable Earnings (YMPE, $68,500). EI premiums are 1.66% of insurable earnings. Significant deviations indicate manipulation.
• AI-generated pay stubs: since late 2024, generative AI tools produce visually convincing pay stubs; only metadata analysis or direct CRA payroll account verification catches these.
• Altered Notices of Assessment: CRA's My Account portal allows clients to download official PDF Notices of Assessment with a unique reference number that can be verified directly with CRA.

Provincial variation matters: Quebec residents may present pay stubs with RQAP (parental insurance) deductions instead of or in addition to EI — failure to account for this creates false positives in deduction-arithmetic checks.

Verification Methods: Manual to Automated

Manual Verification — Limitations

Manual verification relies on analyst judgement: visual inspection, deduction arithmetic, employer contact. The ACFE 2024 Report to the Nations documents 37% detection and 87-day mean delay — incompatible with FINTRAC's expectations for a risk-based compliance program under the PCMLTFA.

Automated Verification — Multi-Layer Approach

Automated income document verification via CheckFile uses a multi-layer methodology:

• High-fidelity OCR: extraction of all key fields (employer Business Number, SIN fragment, gross/net pay, CPP/EI deductions, pay period, YTD figures).
• Cross-document validation: concordance between employer details on pay stub, CRA/provincial registry records, and bank statement credits in the same application.
• Metadata analysis: detection of PDF files created by digital generation tools or modified post-export.
• CPP/EI arithmetic check: automated verification that Canada Pension Plan and Employment Insurance deductions are arithmetically consistent with declared gross pay under the rates in force for the tax year.
• Business Number verification: real-time check of employer registration status with Corporations Canada and provincial registries.

CheckFile's multi-layer analysis (structural, metadata, cross-document consistency) identifies falsification signals that human review misses, consistent with FINTRAC's 2024 guidance on technology-based compliance controls. (Source: FINTRAC-CANAFE.gc.ca, Compliance Guidance)

Canadian Regulatory Framework

The PCMLTFA (S.C. 2000, c. 17) and the Proceeds of Crime (Money Laundering) and Terrorist Financing Regulations establish the legal framework for Know Your Client and source-of-funds verification in Canada. Key requirements:

• Ongoing monitoring: FINTRAC requires reporting entities to keep client information current, including income and source of funds, on an ongoing basis commensurate with the client's risk level.
• Record keeping (Section 12 PCMLTFA): CDD records, including income verification documents, must be retained for 5 years from the date the last transaction is conducted or the account is closed.
• Suspicious Transaction Reports (STRs): when income documents cannot establish a lawful source of funds, an STR must be submitted to FINTRAC as soon as practicable after the institution takes measures to complete it (Section 7 PCMLTFA).
• Quebec (Loi 25): the Act respecting the protection of personal information in the private sector (Loi 25, amended 2022, in force September 2023) imposes additional privacy obligations on income data collection and storage in Quebec that go beyond PIPEDA requirements — institutions collecting income data for Quebec residents must ensure Loi 25 alignment.
• OSFI guidance for federally regulated entities: Guideline E-13 (Regulatory Compliance Management) and the revised AML/ATF Guidance for DTIs (2024) provide additional income verification expectations for banks and life insurers.

For more on Canadian AML compliance requirements, see our guide to anti-money laundering compliance.

Integration into Canadian KYC and Lending Workflows

Integrating automated income document verification into Canadian digital KYC processes delivers regulatory and operational value:

• CDFI/credit union alignment: automated income document verification supports both federally and provincially regulated financial institutions with a single API implementation.
• Open Banking readiness: as Canada's open banking framework (Consumer-Driven Banking Act 2024) matures, automated document verification complements consented data-sharing for clients who lack sufficient digital banking history.
• Audit trail for FINTRAC reviews: each verification is timestamped and logged, providing the evidential record required during FINTRAC compliance examinations.

CheckFile supports over 3,200 document types from 32 jurisdictions, including Canadian pay stubs, T4s, Notices of Assessment, and provincial corporate registry extracts. The solution integrates via REST API into CRM, LOS, and KYC platform workflows.

For a technical integration guide, see our document verification API guide.

Frequently Asked Questions

What income documents does FINTRAC require for KYC onboarding?

FINTRAC does not prescribe a fixed document list, but its Compliance Guidance recommends 2-3 recent pay stubs plus a T4 for employed clients, and a T1 General return with Notice of Assessment for self-employed individuals. For Enhanced Due Diligence (EDD) clients (PEPs, high-risk countries), additional source-of-wealth documentation is expected.

How do I spot a fake pay stub without calling the employer?

Four key checks: (1) verify the employer's Business Number (BN) at Corporations Canada or the provincial registry; (2) confirm CPP contributions (5.95% of pensionable earnings above $3,500) and EI premiums (1.66% of insurable earnings) are arithmetically consistent; (3) compare stated net pay against direct deposit credits in provided bank statements; (4) examine PDF metadata for signs of recent creation or post-export modification.

Is a Notice of Assessment alone sufficient to verify income for KYC?

A Notice of Assessment confirms prior-year income as filed with CRA but does not verify current employment or current income level. It should be supplemented with recent pay stubs (within 60-90 days) to confirm that employment is ongoing and the income level is maintained. For self-employed clients, it is also advisable to request CRA My Business Account confirmation of filed returns.

How long must income verification documents be retained under the PCMLTFA?

Section 12 of the PCMLTFA requires that records used to verify identity and conduct customer due diligence — including income verification documents — be kept for 5 years from the date of the last transaction or account closure.

When must a Suspicious Transaction Report (STR) be filed over income document issues?

An STR must be submitted to FINTRAC as soon as practicable once the institution has taken measures to complete it (Section 7 PCMLTFA) and there are reasonable grounds to suspect that a transaction is related to money laundering or terrorist financing — which includes suspicion that income documents were falsified to misrepresent source of funds.