KYC for Online Marketplace Sellers in Canada: CRA, FINTRAC and PCMLTFA Compliance 2026

Canadian online marketplaces are now subject to a mandatory seller identity and income reporting regime. The Canada Revenue Agency's (CRA) Reporting Rules for Digital Platform Operators, which came into force on 1 January 2024, require platforms to collect, verify, and report seller data that crosses specified thresholds — with the first CRA reports covering 2024 calendar-year data due by 31 January 2025. Beyond the CRA rules, marketplace operators that provide payment processing, foreign exchange, or virtual currency services may qualify as Money Services Businesses (MSBs) under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA), triggering additional registration and AML obligations with FINTRAC. Privacy obligations under PIPEDA, Quebec's Loi 25, and British Columbia and Alberta's PIPA regimes add a further compliance layer for how seller data is collected, stored, and disclosed.

This article is provided for informational purposes only and does not constitute legal or tax advice. Regulatory requirements may vary depending on your platform's business model, province of operation, and seller base. Consult a qualified Canadian tax or compliance professional for advice specific to your circumstances.

CRA Digital Platform Reporting Rules: Canada's DAC7 Equivalent

Canada's Reporting Rules for Digital Platform Operators implement the OECD Model Rules for Reporting by Platform Operators (MRDPO) into Canadian law through Budget 2021 amendments to the Income Tax Act — the rules came into force on 1 January 2024 and are administered by the Canada Revenue Agency.

The Canadian rules closely follow the OECD model, which also forms the basis of the EU's DAC7 directive (2021/514/EU) and the UK's Platform Information Regulations (SI 2023/1143). Because all three regimes share the same OECD architecture, data fields and thresholds are largely consistent across jurisdictions — allowing platforms that operate internationally to build a single compliance workflow.

The CRA rules apply to Reporting Platform Operators — entities that provide, or arrange for, the provision of a Covered Platform: a digital interface through which sellers can be connected with buyers for the sale of goods, rental of immovable property, provision of personal services, or rental of transportation. Coverage is not limited to Canadian-resident platforms. A foreign-resident platform with a nexus to Canada — for example, where it has Canadian-resident sellers or derives revenue from Canadian transactions — may fall within scope.

Platforms must carry out due diligence procedures on all active sellers, collect prescribed data fields, and submit an annual information return to the CRA. The due diligence rules require platforms to verify sellers' identity information against reliable, independent sources — self-declaration alone is insufficient.

For a broader overview of KYC documentation obligations applicable to Canadian businesses, see our document compliance guide.

Who Must Report: Thresholds and Definitions

Under the CRA's Reporting Rules for Digital Platform Operators, a seller becomes a Reportable Seller — and must be included in the platform's annual CRA return — when they complete 30 or more transactions in a calendar year or earn C$2,800 or more in gross consideration during that year; data collection obligations apply to all active sellers regardless of volume.

The C$2,800 threshold represents Canada's adoption of the OECD Model Rules' €2,000 equivalent, adjusted for Canadian dollars. Platforms must track transaction counts and cumulative proceeds across the calendar year and identify sellers who cross either trigger before the 31 January reporting deadline.

Platforms that have sellers resident in multiple OECD jurisdictions may be able to satisfy their obligations through a single consolidated return exchanged under the OECD multilateral competent authority agreement — reducing the burden of filing separate reports to each country's tax authority. Canadian platforms operating in the EU, for example, may file with the CRA and have relevant EU-resident seller data exchanged automatically.

The thresholds determine when a report must be filed — not when data collection begins. Platforms must collect and verify identity and tax information from all sellers at onboarding, regardless of anticipated volume. A seller who does not cross either threshold in a given year does not require reporting for that year, but their verified data must be retained for six years under the CRA's general record-keeping requirement.

Seller Documentation: What to Collect from Canadian Sellers

Platforms must collect and verify a prescribed set of identity and tax documents from every seller before permitting them to conduct transactions — the specific requirements differ between individual and business sellers, with the CRA aligning to the OECD's prescribed due diligence fields.

Individual Sellers

For individual sellers, platforms must collect and verify:

Note on SIN handling: The Social Insurance Number is highly sensitive personal information. Platforms collecting SINs for CRA reporting must comply with CRA guidance on SIN collection and storage, as well as applicable privacy legislation (see Section 5 below). SINs must not be used for any purpose beyond the CRA reporting obligation without separate legal authority.

Business Sellers

For business sellers (corporations, partnerships, sole proprietors), the required documents expand:

Verification must go beyond mere collection. Platforms are expected to confirm that information provided is consistent, plausible, and not contradicted by other data in the seller's file. CheckFile's multi-layer analysis — structural, metadata, and cross-document consistency checks — addresses precisely this requirement, supporting verification of 3,200+ document types across 32 jurisdictions, including Canadian provincial driver's licences, Social Insurance Number letters, CRA Business Number confirmation letters, and Corporations Canada certificates.

Bilingual note: Federally regulated Canadian businesses are subject to the Official Languages Act. Marketplaces operating as federally regulated entities must offer their seller onboarding interface in both English and French. In Quebec, the Charte de la langue française (Charter of the French Language) imposes additional French-language requirements for businesses operating in the province.

For a practical walkthrough of KYC document checklists by business type relevant to Canadian operators, see our KYC solutions for banking and regulated finance.

FINTRAC and PCMLTFA: When Marketplaces Become MSBs

A marketplace operator that processes payments on behalf of sellers, facilitates foreign exchange transactions, or deals in virtual currencies is likely a Money Services Business (MSB) under the PCMLTFA and must register with FINTRAC, implement a written AML/ATF compliance programme, and meet ongoing reporting obligations.

The distinction matters because most marketplace operators assume their primary compliance burden is the CRA's platform reporting rules. In practice, many modern marketplaces also act as payment intermediaries — collecting buyer funds, holding them in float, and disbursing proceeds to sellers — and this activity can trigger MSB status independently of the CRA regime.

When Does Marketplace Activity Trigger MSB Status?

Under the PCMLTFA and its associated regulations, a business is an MSB if it provides one or more of the following services:

• Foreign exchange dealing: Converting currency, including converting payment proceeds from a non-Canadian currency
• Money transfer services: Transmitting funds on behalf of individuals or entities (including seller disbursements that cross international borders)
• Virtual currency dealing: Exchanging or transferring virtual currencies (e.g., accepting crypto payments on behalf of sellers)
• Issuing or redeeming payment instruments: Gift cards, stored value cards, or similar instruments where the marketplace is the issuer

If your marketplace disburses payments in multiple currencies, converts foreign proceeds for Canadian sellers, or operates a digital wallet feature, you should obtain a legal opinion on whether you qualify as an MSB before assuming you do not.

FINTRAC Registration Requirements

MSBs must register with FINTRAC before commencing operations. Registration is completed online through the FINTRAC portal and must be renewed every two years. A business that fails to register when required faces administrative monetary penalties of up to C$100,000 per violation.

PCMLTFA Compliance Programme Requirements

Registered MSBs and other reporting entities under the PCMLTFA must implement a compliance programme that includes:

1. A designated compliance officer with sufficient authority and resources
2. Written compliance policies and procedures tailored to the nature and volume of transactions
3. A risk assessment of the entity's clients, products, services, and delivery channels
4. Ongoing employee training with documented competency assessments
5. An effectiveness review of the compliance programme at least every two years

For MSB-status marketplaces, the KYC obligations under the PCMLTFA add to — and do not replace — the CRA platform reporting obligations. Both sets of obligations require identity verification of sellers, but they have different trigger thresholds, different data fields, and different retention periods.

For an overview of KYC requirements across regulated sectors in Canada in 2026, see our KYC 2026 requirements guide.

Provincial Privacy Laws: PIPEDA, Loi 25, and PIPA

Canadian marketplace operators that collect seller identity documents and tax information are subject to federal and provincial privacy legislation — the specific obligations depend on the nature of the commercial activity, the provinces where sellers and buyers are located, and whether the platform is federally regulated.

Canada's privacy landscape is fragmented: federal law governs in some circumstances, and four provinces have enacted their own private-sector privacy statutes, three of which have been deemed substantially similar to PIPEDA by the federal government.

Federal: PIPEDA

The Personal Information Protection and Electronic Documents Act (PIPEDA) applies to private-sector organisations that collect, use, or disclose personal information in the course of commercial activity in Canada, where provincial law has not displaced it. For most online marketplace operators engaged in inter-provincial or international commerce, PIPEDA is the default federal privacy framework.

Key PIPEDA obligations for marketplaces collecting seller KYC data:

• Consent: Obtain meaningful consent from sellers for the collection of personal information (including SINs, identity documents, and financial details)
• Purpose limitation: Collect only the personal information necessary for the stated purpose (CRA reporting, FINTRAC AML compliance)
• Accuracy: Take reasonable steps to ensure seller information is accurate and up to date
• Safeguards: Apply appropriate security measures proportionate to the sensitivity of the information (SINs and financial data require strong safeguards)
• Access and correction: Allow sellers to access their personal information and request corrections
• Retention: Retain personal information only as long as necessary for the identified purpose, then securely destroy it (subject to the CRA's six-year retention requirement)

The Office of the Privacy Commissioner of Canada (OPC) (www.priv.gc.ca) oversees PIPEDA compliance and can investigate complaints, issue findings, and refer matters to the Federal Court.

Quebec: Loi 25 (Law 25)

Quebec's Act Respecting the Protection of Personal Information in the Private Sector (commonly called Loi 25 or Law 25) was amended in three phases, with the most significant requirements taking effect in September 2023. Loi 25 applies to any enterprise that collects personal information about Quebec residents — regardless of where the enterprise is located.

Key Loi 25 requirements that affect marketplace seller KYC:

• Privacy impact assessments (PIAs): Required before any new project involving personal information, including new seller onboarding workflows or third-party verification tools
• Data minimisation: Stricter than PIPEDA — only information that is necessary for the specific purpose may be collected
• Consent: Consent must be manifest, free, informed, and given for a specific purpose; bundled consent is generally insufficient
• Biometric data: Specific rules apply if the marketplace uses biometric verification (e.g., liveness detection for seller identity)
• Data breach notification: Breaches involving personal information that present a real risk of serious harm must be reported to the Commission d'accès à l'information (CAI) and to affected individuals
• Privacy officer: Every enterprise subject to Loi 25 must designate a person responsible for the protection of personal information and publish their contact information

Marketplace operators onboarding sellers in Quebec should ensure their privacy notices, consent flows, and vendor contracts are Loi 25-compliant. French-language privacy notices are required for Quebec residents.

British Columbia and Alberta: PIPA

British Columbia and Alberta have each enacted a Personal Information Protection Act (PIPA) deemed substantially similar to PIPEDA. Organisations operating primarily within those provinces collect, use, and disclose personal information under provincial PIPA rather than federal PIPEDA for intra-provincial activities.

The substantive obligations under BC PIPA and AB PIPA are broadly similar to PIPEDA — consent, purpose limitation, accuracy, safeguards, and access — but there are differences in detail, particularly around consent for collection of sensitive information such as government-issued identification numbers.

Marketplace operators that have sellers concentrated in BC or Alberta should verify whether their onboarding processes meet provincial PIPA requirements in addition to, or instead of, PIPEDA.

Summary: Privacy Law Applicability by Province

For a connected discussion of data privacy compliance across multiple regimes, see our data privacy compliance guide.

Penalties for Non-Compliance

Non-compliance with Canada's digital platform reporting rules and PCMLTFA AML obligations carries significant financial and reputational consequences — and the CRA and FINTRAC have both intensified enforcement activity in recent years.

CRA Penalties: Platform Reporting Rules

Under the Income Tax Act, as amended to incorporate the platform reporting rules, penalties for non-compliance include:

The CRA can also issue Requirements for Information compelling platforms to disclose seller data, and failure to comply with such requirements is itself a separate offence.

FINTRAC Penalties: PCMLTFA Violations

FINTRAC enforces the PCMLTFA through administrative monetary penalties (AMPs) and, for the most serious violations, through criminal referrals to the RCMP (Royal Canadian Mounted Police). The penalty framework was strengthened by 2019 PCMLTFA amendments:

FINTRAC publishes all AMP decisions on its website, creating reputational exposure beyond the monetary penalty itself. Since 2019, FINTRAC has issued penalties against banks, credit unions, foreign exchange dealers, and MSBs for compliance programme deficiencies.

Provincial Privacy Penalties

Under Loi 25, Quebec's CAI can impose administrative penalties of up to C$25,000,000 or 4% of worldwide turnover for serious violations. For PIPEDA violations, the OPC does not have direct order-making powers, but matters can be referred to the Federal Court, which can award damages and make compliance orders. BC and Alberta OIPC commissioners have order-making powers that can require corrective action and, in Alberta, award damages.

Automating Marketplace KYC in Canada

Manual seller verification is not scalable: a Canadian marketplace onboarding 5,000 new sellers per year faces over 60,000 individual document checks across passports, provincial driver's licences, SIN confirmation letters, Business Number confirmation letters, Certificates of Incorporation, and GST/HST registration documents — automated verification is the only operationally viable path to sustained compliance.

CheckFile provides automated document verification through a multi-layer analysis pipeline — structural, metadata, and cross-document consistency checks — that handles the full range of seller documents required under the CRA's platform reporting rules, the PCMLTFA, and applicable provincial privacy law. The platform supports 3,200+ document types across 32 jurisdictions, enabling verification of both Canadian-resident and international sellers on a single workflow.

Key automation capabilities relevant to Canadian marketplace seller KYC include:

• Identity document verification: Passport and provincial driver's licence / photo ID checks against structural templates, including Quebec, Ontario, British Columbia, Alberta, and other provincial formats
• Business registration document verification: Corporations Canada Certificate of Incorporation format validation; provincial incorporation certificate checks; Business Number (BN) format validation
• Tax number verification: GST/HST registration number format checks (9-digit BN + RT suffix); SIN format validation (note: SIN digit content should not be stored beyond the minimum period required for CRA reporting)
• Bank account detail validation: Canadian financial institution routing code format checks (institution number + transit number + account number), with Interac e-Transfer identifier validation
• Cross-document consistency: Automated flagging where the name on a provincial driver's licence does not match the name on a CRA Business Number confirmation letter or Corporations Canada certificate
• Audit trail generation: Timestamped verification records held for the six-year CRA retention period; FINTRAC-compliant record retention for MSB-status platforms (five years from the last transaction)
• Privacy-by-design: Data minimisation controls and configurable retention periods to support PIPEDA, Loi 25, and PIPA compliance

Platforms can integrate CheckFile via API to trigger document checks at the point of seller onboarding, with results returned in under 30 seconds for most document types. For high-volume use cases, batch processing supports verification of queued seller documents outside peak traffic windows.

For pricing and volume tiers relevant to Canadian marketplace operators, see our pricing page.

Frequently Asked Questions

Do Canada's platform reporting rules apply to foreign marketplaces with Canadian sellers?

Yes. The CRA's Reporting Rules for Digital Platform Operators apply not only to platform operators residing in Canada, but also to foreign-resident platforms that have a nexus to Canada — including platforms where sellers are Canadian residents. A US-based marketplace hosting Canadian sellers must comply with the CRA reporting rules in the same way as a Canadian-resident platform. Foreign platforms that are already registered under another qualifying jurisdiction's implementing legislation may be able to rely on exchange-of-information provisions to discharge their CRA obligation through a single filing.

When does my marketplace become a Money Services Business under the PCMLTFA?

Your marketplace is likely an MSB if it transmits funds between buyers and sellers (including holding funds in escrow or float), converts proceeds from one currency to another, accepts or disburses virtual currencies on behalf of sellers, or issues stored-value instruments redeemable at multiple merchants. The determination is fact-specific: if your platform merely facilitates a connection between buyer and seller and the payment flows entirely through a third-party licensed payment processor, you may not be an MSB. However, if your platform touches, holds, or converts funds at any point in the transaction, you should seek legal advice before concluding you are out of scope.

What happens if a seller refuses to provide their Social Insurance Number?

If a seller refuses to provide their SIN (or equivalent tax identifier for non-Canadian resident sellers), platforms must make reasonable efforts to obtain the information, including at least two follow-up requests before the annual reporting deadline. If the seller still refuses, the platform must close or suspend the seller's account — it cannot simply omit a non-cooperative seller from the CRA return. The seller's refusal must be documented. Where refusal is linked to suspected tax evasion or money laundering, the platform should consider whether it has an obligation to file a Suspicious Transaction Report (STR) with FINTRAC.

Does my marketplace need a separate privacy policy for Quebec sellers?

Your marketplace does not necessarily need a separate privacy policy exclusively for Quebec, but your privacy notice must comply with Loi 25's requirements when collecting personal information from Quebec residents. Practically, this means your consent mechanism must be specific, informed, and freely given; you must identify a person responsible for personal information protection and publish their contact details; and your privacy notice must be available in French for Quebec users. If you use third-party KYC or document verification tools, your data processing agreements with those vendors must be reviewed for Loi 25 compliance, as Loi 25 imposes obligations on businesses that communicate personal information to service providers.

What is the CRA filing deadline for platform reporting?

The annual CRA return must be filed by 31 January following the end of each calendar year. For the 2024 calendar year (the first reporting period), the deadline was 31 January 2025. For 2025 data, the deadline is 31 January 2026. Platforms that were not yet operational at the start of a calendar year but launched during the year are still required to file a return for the partial year, covering sellers who were active during the platform's operational period. The CRA has not publicly announced a grace period for new platforms, so it is prudent to treat the 31 January deadline as firm.

---

This article is for informational purposes only and does not constitute legal advice. Consult a qualified Canadian tax or compliance professional.