KYC for Lawyers: AML & Verification

Lawyers in Canada occupy a unique position in the anti-money laundering framework. The Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) and provincial Law Society rules impose client identification and verification duties on legal professionals when they engage in certain financial activities. Yet these obligations sit alongside solicitor-client privilege — a constitutionally protected right affirmed by the Supreme Court of Canada in Canada (Attorney General) v. Federation of Law Societies of Canada, 2015 SCC 7 — creating a tension that no other regulated profession faces to the same degree. This guide sets out the current framework for lawyers, the client verification process, and the consequences of non-compliance.

KYC obligations for lawyers -- what the law requires

Canadian lawyers are subject to client identification and verification requirements through two parallel regimes: provincial Law Society rules (which incorporate the spirit of the PCMLTFA) and the inherent professional duty to avoid facilitating financial crime. While the Supreme Court of Canada struck down FINTRAC's direct reporting authority over lawyers in Federation of Law Societies, 2015 SCC 7, the Law Societies of each province have adopted robust client identification and verification rules that achieve substantially the same protective objectives.

The Federation of Law Societies of Canada publishes the Model Rules on Client Identification and Verification, which provincial Law Societies have adopted with minor variations. These rules apply to all lawyers and Quebec notaires engaged in certain activities.

Which activities trigger identification and verification duties

Client identification and verification obligations apply when a lawyer engages in or gives instructions in respect of the receiving, paying, or transferring of funds:

In scope:

• Buying, selling, or transferring real property or interests in land.
• Managing client money, securities, or other assets.
• Creating, operating, or managing companies, trusts, or other legal entities.
• Acting as a nominee shareholder or director.
• Financial transactions on behalf of a client.

Out of scope:

• Litigation and dispute resolution (when not handling funds).
• Criminal defence.
• General legal advice that does not involve the activities listed above.

The three pillars of client due diligence

When regulated activities are undertaken, the lawyer must apply identification and verification measures at three levels:

Standard identification and verification. Identify the client (and any beneficial owner), verify identity using reliable and independent sources, and understand the purpose and intended nature of the business relationship.

Enhanced measures. Required for higher-risk situations — for example, politically exposed persons (PEPs), heads of international organizations (HIOs), or transactions involving high-risk jurisdictions.

Ongoing vigilance. Lawyers must remain alert to circumstances that indicate their services may be used for money laundering or terrorist financing, even after initial identification is complete.

Solicitor-client privilege vs AML obligations -- the tension

Solicitor-client privilege is a constitutionally protected right in Canada, affirmed as a principle of fundamental justice under section 7 of the Canadian Charter of Rights and Freedoms. The Supreme Court of Canada's landmark decision in Federation of Law Societies held that FINTRAC's power to search law offices violated this protection, resulting in lawyers being exempt from direct FINTRAC reporting obligations.

Table: which activities trigger obligations and which are protected

How privilege operates in practice

Unlike other reporting entities, Canadian lawyers do not file suspicious transaction reports (STRs) with FINTRAC. Instead, when a lawyer knows or suspects that their services are being used for money laundering purposes, they must:

1. Withdraw from the retainer — the lawyer must not continue to facilitate the transaction.
2. Report to their Law Society if required by provincial rules — some provinces have implemented reporting mechanisms.
3. Maintain records of the identification and verification steps taken.

The critical distinction is that privilege protects communications made for the purpose of seeking or giving legal advice. It does not protect communications made for the purpose of furthering a criminal purpose — this is the "crime/fraud exception" recognised in Canadian law.

Client verification process -- step-by-step workflow

A structured identification and verification process reduces both compliance risk and the time spent on manual checks.

Step 1: determine whether the engagement triggers obligations

Before any verification, the lawyer must assess whether the proposed work falls within the scope of the Law Society rules. If the work is purely contentious and does not involve handling funds, identification obligations may not apply.

Step 2: identify the client and beneficial owner

For individuals, collect full name, date of birth, residential address, and occupation. For corporate clients, obtain the registered name, corporation number, registered office, and the identity of all beneficial owners who own or control 25% or more of the entity.

Step 3: verify identity

Verification must use reliable and independent sources. The Federation of Law Societies Model Rules specify:

• Individuals. Current Canadian passport, provincial driver's licence, or other government-issued photo ID, supplemented by verification of address.
• Corporations. Certificate of incorporation, annual return, or corporate registry search from Corporations Canada or the applicable provincial registry.
• Trusts. Trust deed, identification of all trustees and beneficiaries, and a structure chart where relevant.

Automated document validation reduces verification time from 30-45 minutes per client to under 5 minutes, while flagging inconsistencies that manual review might miss.

Step 4: assess risk and apply proportionate measures

Apply the firm's risk assessment framework, considering:

Step 5: ongoing vigilance and record retention

Identification and verification is not a one-off exercise. Lawyers must remain vigilant throughout the retainer and update verification records when circumstances change. All records must be retained for at least 6 years from the completion of the matter.

Sanctions and penalties for non-compliance

Non-compliance with client identification and verification obligations carries significant consequences for Canadian lawyers.

Law Society enforcement

Each provincial Law Society has disciplinary powers over lawyers who fail to comply with client identification and verification rules. Consequences range from:

• Practice review: mandatory remediation and compliance plan.
• Fines: provincial Law Societies can impose monetary penalties.
• Suspension: temporary removal of the right to practise.
• Disbarment: permanent removal in serious cases.

The Law Society of Ontario, the Barreau du Québec, and other provincial regulators publish disciplinary decisions, creating reputational consequences beyond the formal penalty.

Criminal penalties

While lawyers are exempt from FINTRAC reporting, they remain subject to criminal liability under the Criminal Code for knowingly facilitating money laundering (section 462.31) or terrorist financing (section 83.02). Maximum penalties include imprisonment for up to 10 years. The PCMLTFA also provides for criminal penalties for certain offences, and the RCMP investigates serious financial crime cases.

Reputational consequences

Law Society disciplinary decisions are published and searchable. A lawyer found to have failed in their identification and verification duties faces not only formal sanctions but lasting damage to their market position, client relationships, and ability to attract talent.

Automating KYC while preserving solicitor-client privilege

Automation addresses both the efficiency challenge and the compliance challenge, provided the chosen tool respects the boundaries of solicitor-client privilege.

What a law firm needs from a verification tool

• Data compartmentalisation. Identification and verification data must be segregated from the legal file. No information from privileged communications should be accessible to the verification system.
• Canadian/EU data residency. Client data must be hosted within a jurisdiction that meets PIPEDA and provincial privacy law standards.
• Full audit trail. Every verification step must be timestamped and logged, producing an evidence file that satisfies Law Society inspection requirements.
• Sanctions and PEP/HIO screening. Real-time checks against the Canadian consolidated autonomous sanctions list, international sanctions lists, and PEP/HIO databases.

CheckFile.ai provides automated document validation with European hosting, native file compartmentalisation, and a complete audit trail. View our pricing for a solution scaled to your firm's volume.

For a detailed look at automating KYC in law firms while protecting privilege, read our companion guide on law firm KYC automation and client privilege.

The business case

A mid-sized firm onboarding 150 new matters per month spends an estimated 75 to 110 hours on manual identification and verification. Automated verification reduces this by 70-80%, freeing lawyers for billable work.

For a comprehensive overview, see our industry document verification guide. Our data from over 180,000 documents processed monthly across regulated sectors shows a 94.8% fraud detection rate and an average verification time of 4.2 seconds.

Frequently asked questions

How does solicitor-client privilege interact with AML obligations in Canada?

Solicitor-client privilege is constitutionally protected in Canada. The Supreme Court held in Federation of Law Societies (2015 SCC 7) that FINTRAC cannot exercise search powers over law offices or require lawyers to file STRs. However, lawyers must comply with Law Society client identification and verification rules, and must withdraw from retainers where they suspect their services are being used for money laundering. The "crime/fraud exception" removes privilege protection when communications are made for the purpose of furthering a criminal purpose.

What is the difference between FINTRAC reporting and Law Society obligations?

FINTRAC reporting (STRs, large cash transaction reports) applies to most reporting entities but does not apply to lawyers due to the constitutional protection of privilege. Instead, lawyers must comply with their provincial Law Society's client identification and verification rules, which achieve similar protective objectives through different mechanisms — primarily the duty to withdraw from suspicious retainers.

How long must identification and verification records be kept?

Law Society rules generally require retention for at least 6 years from the completion of the matter. The specific period may vary by province. Records should include copies of identity documents, verification results, and the risk assessment.

Do Law Society rules apply to in-house counsel?

The application varies by province. Generally, in-house counsel who engage in activities that would trigger identification and verification obligations for external lawyers are subject to the same rules. Consult your provincial Law Society for specific guidance.

What happens if a lawyer has no identification and verification policy in place?

Provincial Law Societies treat the absence of a compliance programme as a serious failure. Law Society rules require lawyers to maintain documented procedures proportionate to their practice. Failure to do so can result in disciplinary action even if no actual money laundering has occurred.

Strengthen your firm's AML compliance

AML compliance is a professional obligation and a mark of credibility. Automating client verification with a tool designed for the legal profession saves time, reduces error rates, and produces the audit trail that Law Societies expect. Contact us for a demonstration tailored to your firm's requirements.

This article is for informational purposes only and does not constitute legal, financial, or regulatory advice. Consult a qualified professional for questions relating to your specific compliance obligations.

---

Take action

CheckFile verifies 180,000 documents per month with 98.7% OCR accuracy. Test the platform with your own documents — results within 48h.

Request a free pilot