Notifications
Clear all
Topic starter
07/06/2026 8:18 pm
TL;DR: FINTRAC’s 2026 PCMLTFA amendments expand identity verification, recordkeeping, and ongoing monitoring obligations across more sectors, while OneSpan argues that organisations can use those requirements to reduce onboarding friction and strengthen fraud controls. The real test is whether identity verification is treated as a compliance checkbox or as governed identity infrastructure.
NHIMG editorial — based on content published by OneSpan: FINTRAC identity verification strategy and compliance planning
By the numbers:
- Only 5.7% of organisations have full visibility into their service accounts.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures.
Questions worth separating out
Q: How should organisations reduce identity verification friction without weakening FINTRAC compliance?
A: Organisations should replace purely manual document handling with risk-based workflows that validate authenticity, capture evidence, and escalate exceptions cleanly.
Q: Why do online identity verification workflows create more governance pressure than in-person checks?
A: Online workflows remove physical inspection, so organisations have to prove identity through documents, biometric signals, and evidence trails instead of direct human presence.
Q: What do teams get wrong when they treat identity verification as a one-time compliance task?
A: They often stop at the approval decision and fail to preserve the records needed to explain how that decision was made later.
Practitioner guidance
- Map identity verification friction points Review the full customer journey from intake to decision and identify where manual document review, repeated resubmission, or exception handling creates delay.
- Add document authenticity checks to online workflows Use authenticity validation for government-issued photo IDs, including checks for forgery, photocopy reuse, screen display, and replay attempts.
- Build auditable evidence summaries Store the evidence that supported each identity decision, including document checks, verification outcomes, and escalation notes.
What's in the full article
OneSpan's full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step guidance on how to assess your current identity verification journey for friction and compliance gaps.
- Detailed examples of document authenticity checks, including forgery, photocopy, replay, and screen-display detection.
- Practical implementation considerations for facial biometrics, liveness detection, consent capture, and audit trails.
- A closer look at how OneSpan frames FINTRAC-ready versus FINTRAC-optimized operating models.
👉 Read OneSpan's analysis of FINTRAC identity verification strategy →
FINTRAC identity verification: what IAM teams need to change?
Explore further
07/06/2026 10:10 pm
FINTRAC compliance now sits at the intersection of human identity verification and governed evidence handling. The amended PCMLTFA requirements are not just asking whether an organisation can identify a person, but whether it can prove the identity decision was made with defensible controls, durable records, and enough assurance for online and in-person transactions. That pushes identity verification into the same governance class as access control and auditability. Practitioners should treat identity evidence as part of the control surface, not as paperwork.
A few things that frame the scale:
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, 46% confirmed and 26% suspected, according to the 2024 ESG Report: Managing Non-Human Identities.
- That same research found that enterprises that have experienced a compromised NHI averaged 2.7 separate incidents in the past 12 months.
A question worth separating out:
Q: Who is accountable when automated identity verification supports regulated onboarding?
A: The organisation remains accountable for the control outcome, even when software performs document checks, biometric matching, or audit logging. FINTRAC expectations do not disappear because the workflow is automated, so governance, review thresholds, and evidence retention still need clear ownership.
👉 Read our full editorial: FINTRAC identity verification changes what IAM teams must govern
