Perpetual KYC: Continuous Customer Monitoring for Canadian Institutions 2026

Perpetual KYC (pKYC) is transforming how Canadian financial institutions manage anti-money laundering (AML) and anti-terrorist financing (ATF) compliance. Rather than verifying a customer's identity once at onboarding and scheduling periodic reviews every one to three years, pKYC means continuously monitoring customer risk profiles and updating them whenever material changes occur. In Canada, this approach responds directly to expectations under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) and FINTRAC's compliance guidance, which require ongoing monitoring as a core element of any AML/ATF program.

This article is provided for informational purposes and does not constitute legal or regulatory advice. Regulatory references reflect the position as of May 24, 2026. Consult qualified legal counsel for advice specific to your institution.

Canadian Regulatory Framework: PCMLTFA, FINTRAC, and OSFI

The PCMLTFA and its regulations require reporting entities to conduct ongoing monitoring of business relationships and to keep customer information up to date. Section 9.4 of the PCMLTFA imposes ongoing monitoring obligations that include: keeping customer identification information up to date, monitoring for suspicious transactions, and reassessing client risk on a risk basis throughout the relationship.

FINTRAC's compliance guidance for ongoing monitoring is explicit: reporting entities must have documented policies and procedures for ongoing monitoring, must conduct monitoring appropriate to the client's risk level, and must have processes in place to detect material changes in customer circumstances that would affect their risk rating.

OSFI (Office of the Superintendent of Financial Institutions) adds a prudential supervisory layer for federally regulated financial institutions (FRFIs): the B-10 guideline on third-party risk management and OSFI's AML/ATF supervisory expectations require FRFIs to demonstrate a robust, risk-based monitoring framework that goes beyond calendar-driven reviews.

Key Canadian AML/ATF Regulatory Bodies

Beneficial Ownership and the CBCA Amendments

Canada amended the Canada Business Corporations Act (CBCA) to require private corporations to maintain registers of individuals with significant control (ISC). Perpetual KYC systems for Canadian institutions should be connected to corporate registry data, including the ISC registers, to detect changes in beneficial ownership that trigger review obligations under FINTRAC's ongoing monitoring requirements.

For a broader overview of KYC obligations, see our KYC complete guide for businesses and our AML red flags and suspicious activity indicators guide.

Why Periodic Review Cycles Are Insufficient in Canada

FINTRAC's examination framework has consistently cited deficiencies in ongoing monitoring as a primary finding in compliance examinations. Institutions that rely solely on periodic reviews — without event-driven triggers — risk failing to detect material changes in customer risk between review cycles.

According to the ACFE 2024 Report to the Nations, manual periodic controls detect only 37% of fraud cases, with a median detection delay of 87 days. In the Canadian context, with significant cross-border activity with the US and global banking relationships, this detection gap represents meaningful regulatory exposure.

Compliance professionals in Canada frequently ask: "What triggers an off-cycle KYC review?" FINTRAC's guidance identifies the following mandatory triggers regardless of scheduled review dates:

• Detection of suspicious activity or filing of a Suspicious Transaction Report (STR).
• New sanctions listing by OSFI's Consolidated Sanctions List, UN, or OFAC.
• Knowledge that customer identification information has changed or is no longer accurate.
• Detection of a material change in the customer's beneficial ownership or corporate structure.
• Adverse media indicating criminal exposure.

Periodic vs. Perpetual KYC in the Canadian Context

The Four Pillars of pKYC in the Canadian Context

1. Event-Driven Trigger Management

Canadian pKYC implementations should define a structured taxonomy of trigger events aligned with FINTRAC's ongoing monitoring guidance. High-priority triggers include: OSFI Consolidated Sanctions List match (immediate action required), FINTRAC advisory relating to a customer (immediate review), and STR filed on the customer (mandatory review within defined timeframe). Lower-priority triggers enter a defined review queue.

2. Continuous Sanctions Screening

OSFI maintains a Consolidated Canadian Sanctions List combining UN Security Council sanctions, Canadian autonomous sanctions, and the Special Economic Measures Act (SEMA) sanctions. This list is updated frequently and must be screened against continuously.

FINTRAC's guidance requires that sanctions screening cover not only the customer but also all beneficial owners with significant control. For entities connected to sanctioned jurisdictions (currently including Russia, Iran, North Korea, and others under Canadian autonomous sanctions), enhanced continuous monitoring is expected.

3. Transaction Monitoring Integration

Canadian institutions must monitor transactions for suspicious activity under PCMLTFA section 7. Modern pKYC architectures integrate transaction monitoring outputs as triggers for customer profile updates, creating a feedback loop between behavioral anomalies and customer record maintenance.

CheckFile's platform covers over 3,200 document types across 32 jurisdictions, enabling continuous verification for Canadian institutions managing clients across provinces and cross-border relationships. For technical integration details, see our document validation API guide.

4. Provincial Privacy Compliance: PIPEDA and Quebec's Loi 25

Processing customer personal data for AML/ATF purposes has a clear legal basis under PIPEDA (consent is not required when collection is for the purpose of preventing fraud or for law enforcement purposes). However, the Personal Information Protection and Electronic Documents Act (PIPEDA) still requires data minimisation — collect only what is necessary for the specific AML purpose.

In Quebec, Loi 25 (Loi modernisant des dispositions législatives en matière de protection des renseignements personnels) imposes additional requirements, including mandatory privacy impact assessments (PIAs) for new systems processing personal data and strict data breach notification timelines. Institutions operating in Quebec must ensure their pKYC system complies with Loi 25 in addition to PIPEDA.

Implementation Roadmap for Canadian Institutions

Step 1: Align with FINTRAC's Ongoing Monitoring Guidance

Review FINTRAC's 2023 guidance on ongoing monitoring and assess your current policies against its requirements. Identify gaps between your current calendar-driven review process and the event-driven model FINTRAC expects.

Step 2: Connect to Canadian Data Sources

Integrate with: OSFI Consolidated Sanctions List, provincial corporate registries (Corporations Canada, SEDAR+, provincial registry databases), FINTRAC advisories, and adverse media sources. For Quebec clients, include REQ (Registre des entreprises du Québec) data feeds.

Step 3: Document Your Program

FINTRAC expects full documentation of the ongoing monitoring program: policies and procedures, risk-based criteria for trigger events, SLAs for alert processing, and training records. This documentation is the primary evidence in a FINTRAC compliance examination.

Minimum Review Frequencies in the Canadian Context

Frequently Asked Questions

What does FINTRAC expect from a perpetual KYC program?

FINTRAC expects documented policies defining trigger events and response protocols, audit logs of all alerts and decisions, evidence that alerts are resolved within defined timeframes, and training records. During examinations, FINTRAC inspectors sample customer files and trace the complete monitoring history from onboarding through ongoing review.

How does pKYC interact with Canada's Suspicious Transaction Report (STR) obligations?

When the pKYC system detects an event that generates a reasonable ground to suspect money laundering or terrorist financing, the institution must file a Suspicious Transaction Report with FINTRAC within 30 days of detecting the suspicious activity. A well-designed pKYC system generates structured data for the STR automatically, reducing filing time and improving report quality.

Does Quebec's Loi 25 affect how pKYC data is processed?

Yes. Loi 25 requires organisations subject to Quebec law to conduct a Privacy Impact Assessment (PIA) before implementing new information systems that process personal data at scale — which includes pKYC systems. The Commission d'accès à l'information du Québec (CAI) supervises Loi 25 compliance. AML/ATF purposes provide a legal basis for data processing, but Loi 25's transparency, minimisation, and PIA requirements still apply.

What FINTRAC penalties apply for inadequate ongoing monitoring?

FINTRAC can impose administrative monetary penalties under PCMLTFA ranging from $1 to $100,000 per violation for individuals and $1 to $500,000 per violation for entities. Serious violations can result in publication of non-compliance findings, which carries significant reputational consequences. Criminal referrals are possible for the most serious violations.

---

To build a complete AML/ATF compliance program, see our compliance audit checklist and our document compliance guide. Visit CheckFile, explore our security architecture, or review our pricing plans.