That's a problem. Treating KYC and AML as synonyms creates gaps in a Canadian reporting entity's compliance framework. KYC/CDD/EDD obligations are legal and sector-specific under the PCMLTFA and FINTRAC guidance; they are not a single generic commercial checklist. This article breaks down what each term actually means, how they interact under the PCMLTFA, and what it takes to build a program that satisfies both.
TL;DR
- KYC verifies identity and risk at onboarding; AML is the full monitoring, reporting, and risk framework
- Both are mandatory under the PCMLTFA, enforced by FINTRAC
- Onboarding is largely front-loaded; AML runs for the life of the relationship
- KYC findings must feed ongoing AML risk management—not sit unused in a file
AML vs KYC: Quick Comparison
| Factor | AML | KYC |
|---|---|---|
| Scope | Broad framework: identification, monitoring, reporting to prevent financial crime | Narrower process: verifying identity and assessing risk at onboarding |
| Regulatory basis | PCMLTFA, enforced by FINTRAC | A component requirement within PCMLTFA/FINTRAC guidance |
| Timing | Ongoing through the relationship, calibrated by sector, prescribed triggers, business relationship (BR) status, risk rating, and activity - not bare continuous monitoring of every client the same way | At prescribed identification triggers (often onboarding), then refreshes driven by BR formation, risk, and transaction/activity events - not a single universal "periodic refresh" calendar |
| Core activities | Transaction monitoring, STRs, sanctions screening, recordkeeping | ID verification, CDD, EDD for high-risk clients |
| Responsibility | Compliance officer and senior management | Front-line onboarding staff, compliance analysts |
The pattern here matters: KYC is one input into a much larger machine. A reporting entity can nail KYC at the door and still fail its AML obligations if nothing happens with that information afterward.
What is AML?
AML (anti-money laundering) refers to the laws, policies, and procedures designed to stop criminals from disguising illicit proceeds as legitimate funds. In Canada, it's mandated under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) and enforced by FINTRAC.
A compliant AML program isn't optional paperwork. It is a statutory requirement under PCMLTFA s.9.6 and PCMLTFR s.156.
Who Must Comply with AML in Canada
AML obligations apply broadly across Canada's financial ecosystem:
- Banks and credit unions
- Money services businesses (MSBs)
- Virtual asset service providers and crypto platforms
- Real estate brokerages
- Casinos and life insurance companies
Canada's Department of Finance found 19 sectors and products exposed to "very high" inherent money-laundering risk. Profit-oriented crime generates billions in proceeds annually that could be laundered through Canadian channels.
Enforcement is not theoretical. FINTRAC published a $9,185,000 AMP against a Canadian bank on 2 May 2024 (imposed 9 April 2024) for failures to:
- Assess ML/TF risk
- Apply special measures for high-risk situations
- Conduct ongoing monitoring
- File required suspicious transaction reports
The issue was not a missing KYC form. It was an AML program that was not functioning end to end.
What is KYC?
KYC — know your customer — is the identity verification and risk assessment process conducted when onboarding a client. It's a subset of AML, not a replacement for it.
FINTRAC mandates specific identity-verification methods, including:
- Government-issued photo ID — must be authentic, current, and match the client's name and appearance
- Credit file method — a Canadian credit file at least three years old, drawing from multiple sources
- Dual-process method — combining two of: name/address, name/date of birth, or name plus a qualifying financial account, from two independent sources
- Affiliate or member reliance — using verification already completed by an affiliate or member organization
- Reliance on another reporting entity — relying on prior identity verification by another FINTRAC reporting entity
Standard due diligence works for most clients. Enhanced Due Diligence (EDD) kicks in for higher-risk customers, such as politically exposed persons (PEPs), where deeper scrutiny and more frequent review are required.
Use Cases of KYC
KYC shows up at every stage of the client lifecycle:
- Opening a new account
- Establishing a new business relationship
- Periodic reviews and information refreshes
- Trigger events (unusual activity, changes in beneficial ownership)
It's especially critical for banks, MSBs, real estate businesses, and virtual asset service providers — sectors where anonymity and transaction speed raise exposure.
Those same pressures show up in day-to-day screening friction. LSEG's 2026 research found that 80% of Canadian financial institutions reported screening-related delays at least occasionally, and 26% of North American institutions believe automation could meaningfully improve screening effectiveness. Digital onboarding is closing some gaps, but it hasn't eliminated them.
AML vs KYC in Canadian Regulatory Practice
Here's where the distinction gets practical. FINTRAC examinations don't treat AML program design and KYC execution as separate checklists. They assess whether the two are actually connected.
Weak KYC breaks the entire AML program. If identity verification is inconsistent or beneficial ownership isn't properly captured, every downstream control (risk scoring, transaction monitoring, suspicious transaction reporting) inherits that weakness. Documented evidence should show that:
- CDD findings directly inform the entity's risk assessment
- Risk ratings drive the intensity of ongoing monitoring
- Changes in customer information trigger reassessment
A recent case illustrates the cost of getting this wrong. A virtual-currency MSB faced a FINTRAC AMP of $176,960,190 in 2025, under appeal to Federal Court where that status applies.
FINTRAC's findings weren't limited to one weak spot. The entity failed to assess and document ML/TF risks, didn't consider product, delivery-channel, and technology risks, and had deficiencies spanning business relationships, ongoing monitoring, and KYC practices simultaneously.
That's the integration failure in a single case: KYC gaps, risk assessment gaps, and monitoring gaps compounding each other.
Regulatory scrutiny is also shifting. FINTRAC's examination approach increasingly weighs operating effectiveness: whether the program actually works when tested, not whether policy documents simply exist on paper.
For entities facing findings or preparing for an examination, this is where senior, practitioner-level judgment matters. Understanding what FINTRAC expects operationally, not just textually, is the difference between a defensible response and a scramble. That operational intersection is where AlphaDelta supports Canadian reporting entities.
Building an Effective AML/KYC Compliance Program
A program that can be explained with evidence under examination is built on a few non-negotiable elements.
Foundational structure:
- An appointed compliance officer with real authority and resource access
- Documented policies and procedures
- Senior officer accountability, with board oversight where the entity's governance provides for it
Risk-based design. CDD and EDD measures should be tailored to the entity's actual products, customers, and delivery channels rather than copied from a generic template. A mortgage lender's risk profile looks nothing like a crypto exchange's.
Ongoing obligations don't stop after onboarding. Intensity and frequency are risk-, sector-, business-relationship-, and transaction-triggered - not a universal continuous TM plus fixed periodic KYC refresh for every client in every sector:
- Transaction monitoring calibrated to the entity's products, channels, and risk profile
- KYC information updates and enhanced measures when risk, relationship, or transaction triggers require them (especially for higher-risk clients)
- Regular staff training
- Recordkeeping for a minimum of five years under the PCMLTFA, retrievable within 30 days of a FINTRAC request
FINTRAC also requires a documented effectiveness review at least every two years, testing whether the program's design, risk assessment, and training actually function in practice. This is where many entities discover, sometimes too late, that their KYC and AML processes were never properly linked.
An independent review is often the clearest way to surface that disconnect before a regulator does. AlphaDelta structures effectiveness reviews around whether the program is current, appropriately designed, and operating effectively.
Engagements use document review, interviews, walkthroughs, and file sampling to produce evidence-backed findings. Every engagement includes one optional findings clarification session within 90 days of the final report. If FINTRAC formally initiates a compliance examination within 12 months of the final report, AlphaDelta will provide up to 10 hours of review-related senior advisory support at no additional cost.
Leadership capability under ambiguity often decides whether a program can be explained in practice. Well-documented policies help, but examiners probe how leaders reason through edge cases and escalate risk - judgment no checklist fully captures.
Conclusion
AML and KYC are complementary priorities. KYC establishes who your customer is. AML gives that information purpose within a live risk management framework.
If you're unsure whether your organization's KYC findings genuinely feed your ongoing AML monitoring and risk assessment, that's worth investigating now, not during a FINTRAC exit meeting.
An independent effectiveness review, particularly if your biennial deadline is approaching or you've had recent program changes, is the most direct way to find out.
Frequently Asked Questions
What are the AML and KYC processes?
KYC involves verifying customer identity and conducting due diligence at onboarding. AML is broader: transaction monitoring, suspicious transaction reporting, sanctions screening, and ongoing risk management across the relationship.
What is KYC in anti-money laundering?
KYC is a foundational subset of AML. It specifically covers verifying who your customer is and assessing their risk level, feeding that information into the broader AML program.
What are the three stages of AML?
Money laundering—not AML itself—typically moves through three stages: placement (introducing illicit funds into the financial system), layering (obscuring the source through complex transactions), and integration (returning the funds as apparently legitimate money).
Is KYC mandatory in Canada?
Yes. Canadian reporting entities must maintain KYC programs under the PCMLTFA and FINTRAC rules, including customer identification and beneficial ownership requirements. U.S. institutions face comparable obligations under the Bank Secrecy Act and FinCEN.
What is AML and KYC compliance?
AML compliance means adhering to the full regulatory framework (in Canada, the PCMLTFA) covering identification, monitoring, and reporting. KYC compliance refers specifically to meeting identity verification and due diligence obligations at onboarding.
What is a red flag during KYC verification?
Common red flags include inconsistent or mismatched identification documents, reluctance to disclose beneficial ownership information, and a customer profile that doesn't align with their expected transaction activity or stated occupation.
