Why did CPABC introduce the new client identification and verification Rule?

Client identification and verification (CIV) is not, in principle, a new concept for CPAs. However, to mitigate the risks of fraud and other financial crimes, it is becoming increasingly important for CPAs to confirm the identity of their clients. Accordingly, the new CIV requirements under Rule 219 necessitate that members and registered firms obtain, verify, and record certain information regarding their clients when providing specified services.

Many other industries and sectors, such as banking, also have CIV requirements under FINTRAC¹ and other regulators. Implementing CIV processes is one of the most effective ways to combat money laundering and other financial crimes.

Who do the new client identification and verification rules apply to?

Rule 219 applies to members and firms who provide specified services and specified transactions. The Rule does not apply to members providing professional services to their employer.

When do the new client identification and verification rules apply?

The CIV requirements under Rule 219 apply to members and registered firms who provide specified services and/or specified transactions. However, the new requirements do not apply to members who are providing professional services to their employers.

Rule 219.1 codifies the requirement to obtain and record basic information about their clients (identify) when providing specified services. Specified services include:

1. advice respecting a specified transaction,
2. advice respecting the use of corporations or other legal entities, or
3. private-sector bookkeeping services

Rule 219.2 similarly codifies the requirement for members and registered firms to confirm or verify information about their clients when providing services in relation to a specified transaction. A specified transaction is similar to FINTRAC triggering activities and includes:

1. the receipt or payment of funds or virtual currency,
2. the purchase or sale of securities, real property, or business assets or entities,
3. the transfer of funds, virtual currency or securities by any means, or
4. the giving of instructions in connection with any activity referred to paragraphs (a) to (c).

What am I required to do?

Members and registered firms are required to obtain and maintain certain information about their clients when they are engaged by a client to provide specified services and/or specified transactions. This is to ensure that the client is who they say they are and to assist in reducing the possibility of fraud or other illegal activity.

What does client identification mean?

Client identification involves obtaining certain information from clients regarding their/the organization’s identity. It includes:

1. for a client who is an individual:
   1. the client’s full name and contact information;
   2. the address of the client’s place of work or employment, if applicable; or
2. for a client that is an organization:
   1. the organization’s full name, business address and business telephone number;
   2. the name, position and contact information for individuals confirming or communicating, on the organization’s behalf, its engagement of the member or registered firm to provide specified services;
   3. if the client is an organization other than a financial institution, public body or public company,
      1. the general nature of the type of business or activity engaged in by the client, and
      2. the organization’s incorporation or business identification number and themplace of issue of its incorporation or business identification number.

What does client verification mean?

Rule 219.2 includes additional requirements for a member or registered firm providing professional services to a client other than a financial institution, public body or public company in respect of a specified transaction.

These additional requirements are consistent with the prescribed means to verify a client’s identity set out by the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC).

CPABC chose to rely on FINTRAC for the methods of verifying clients’ identity to maintain consistency with existing requirements. Further information about FINTRAC identification and verification requirements can be found here.

What are examples of Specified Services that practitioners may be performing?

The following are some examples of what could be considered as performing specified services.

1. Providing advice with respect to the use of corporations or other legal entities.

   This may include all advice provided to clients that involves the use of a corporation or other legal entity such as:

   1. A CPA provides tax advice to a client suggesting they set up a corporation for their business.
   2. A CPA advises a client on how to set up a holding company to own shares in an operating company.
   3. A CPA provides advice on forming a limited partnership or joint venture between two businesses to pursue a real estate development project.
      
      
2. Providing private sector bookkeeping services.

   This may include providing bookkeeping services to clients who are not in the public sector, such as:

   1. Providing bookkeeping services to a for-profit private client, such as a furniture manufacturer.
   2. Providing bookkeeping services to a professional corporation, such as a doctor or dentist.
   3. Providing bookkeeping services to a not for profit, such as a charity.
      
      
   Please note that bookkeeping services provided to public sector (government) entities are not scoped into the client identification/verification requirements.
   
   
3. Providing advice with respect to a specified transaction.

   This may include providing advice (not instruction) for specified transactions, such as:

   1. Providing advice with regard to how to structure and pay a client invoice payable.
   2. Providing advice with respect to a share purchase (or sale) transaction.
   3. Providing advice with respect to a wire-transfer of funds from a client’s account to a subsidiary for the client.

What are examples of specified transactions that practitioners may be performing on behalf of clients?

Generally, specified transactions will involve directing the movement of clients’ assets, or moving the clients’ assets, on their behalf. The following are some examples of what could be considered as performing specified transactions.

1. The receipt or payment of funds or virtual currency:
   1. A CPA is instructed by a client to disburse funds to pay taxes or to pay a supplier, contractor, or investor as part of business operations. Facilitating a payment on behalf of a client qualifies as a specified transaction.
   2. A CPA assists a client by receiving a payment on their behalf and then transferring the funds to the client.
   3. A CPA assists a client in paying or receiving cryptocurrency as part of a business deal or investment.
      
      
2. The purchase or sale of securities, real property, or business assets or entities:
   1. As part of a real estate sale for a client, the CPA instructs a lawyer to complete the sale of a piece of land owned by the client.
   2. The CPA purchases shares of a business on behalf of a client.
   3. The CPA instructs a lawyer to sell some assets as part of the sale of a client’s business.
      
      
3. The transfer of funds, virtual currency or securities by any means:
   1. A CPA facilitates or instructs a wire transfer of funds from a Canadian company to its foreign subsidiary as part of an intercompany loan or capital injection.
   2. A CPA assists a client in transferring cryptocurrencies from a personal wallet to a corporate investment account.
   3. A CPA instructs a lawyer to transfer shares from one related party to another on behalf of a client.

Am I required to verify identity for every specified transaction performed?

Rule 219.2(1)(b) states that when performing a specified transaction on behalf of a client, the CPA must verify the identity of the client using a method that is permitted under the guidance issued by FINTRAC.

The Proceeds of Crime (Money Laundering) and Terrorist Financing Act (“PCMLTFA”), SOR/2002-184, sections 155(1) and (2), states that there is no requirement to verify the identity of a person or entity for subsequent transactions if you:

• used one of the accepted methods as per the PCMLTFA regulations for the initial transaction; and
• have no reason to believe that the information has changed.

However, once you perform a second specified transaction on behalf of a person or entity, there could be the requirement to put business relationship monitoring into place. More information on how to implement business relationship monitoring can be found at Business relationship requirements.

What methods to verify identity are consistent with FINTRAC?

The method to verify identity consistent with FINTRAC depends on whether you are verifying the identity of a person or an entity.

FINTRAC has 5 methods that are used to verify a person’s identity:

1. Government-issued photo identification method
2. Credit file method
3. Dual-process method
4. Affiliate or member method
5. Reliance method

FINTRAC has 3 methods to verify an entity’s identity:

1. Confirmation of existence method
2. Reliance method
3. Simplified identification method

Details on each of the methods for both persons and entities can be found on FINTRAC’s website here. FINTRAC has included detailed descriptions on how to use each of the methods, as well as videos on how to properly perform each of the methods. These are key tools that will help inform practitioners on how to comply with the requirement to verify identity under rule 219.2.

What is the “source of funds”?

The term "source of funds" refers to the origin of the money utilized or intended for a specific transaction. This includes the economic activities or actions that generate the funds, details identifying the individual or entity supplying the funds (if they are not the client), and the relationship between the client and the entity or person providing the funds.

What does inquire into the source of funds mean?

Rule 219.2 also includes a requirement that practitioners engaged in financial transactions on behalf of their clients inquire into the source of funds.

Information regarding the source of funds should be obtained from the client and recorded, with the applicable date, including, but not limited to the following:

• full name of the payer and their contact information;
• relationship of the payer to the client (or vice versa if your client is the payer);
• the date on which the money was received from the payer;
• information about how the money was generated (e.g., bank loan, savings from salary, settlement funds);
• the form in which the money was received by the accountant (e.g., cheque, bank draft);
• the full name and address of all financial institutions or other entities through which the payer processed or transmitted the money to the accountant/firm;
• any other information relevant to determining the source of money.

Understanding the source of “money” and its appropriateness is the core of anti- money laundering. You have a positive duty to make enquiries about financial transactions that you facilitate.

What am I looking for in the source of funds inquiries?

Members and registered firms will need to obtain and record information about the source of funds when they are engaged to provide professional services including a specified transaction, as it is a key component to anti-money laundering and preventing engagement in any activity that assists in or encourages any dishonesty, crime or fraud.

During the source of funds inquiries, be aware of whether the information being provided is consistent with your knowledge of the client and their financial realities. If there are any red flags additional inquiries may need to be done to ensure that the source of funds are not problematic. If additional inquiries cannot satisfy concerns regarding source of funds, advice from services a lawyer may assist with the process.

In making source of funds inquiries, the information that is obtained from the client should confirm that the source and the funds are legitimate and not tied to any illegal activities. This information may include:

• the full name, occupation and contact information of the payer;
• the relationship of the client to the payer (the payer may be the client);
• the economic activity or action that generated the funds;
• the date on which the funds were received by the member or registered firm from the payer;
• the form in which the funds were received by the member or registered firm;
• the full name and address (including country) of all financial institutions or other entities through which the payer processed the funds or transmitted the funds to the member or registered firm; and
• any other information relevant to determining the source of funds.

When should source of funds checks be done?

Details regarding the source of funds should be gathered from the client during the identity verification process and prior to any payment, receipt, or transfer of funds.

What are examples of red flags members and registered firms should be looking for?

The information about the source of funds provided by the client should correspond with what is already known about the client and the transaction. In certain cases, the member or registered firm may encounter information that raises suspicions or "red flags." Some potential red flags regarding the source of funds include:

• The funds originate from a source that seems unusual given the circumstances, is unexplained, appears overly complex, or cannot be verified.
• Multiple funding sources are involved, such as several bank accounts or numbered company accounts, without a reasonable explanation.
• Funds are withdrawn from a foreign bank with no clear connection to the client, especially if that bank is located in a high-risk jurisdiction for money laundering.
• A significant portion of the funding comes from cash or intricate crypto assets.
• Financing is sourced from a lender other than a bank or credit institution without a rational explanation or economic basis.
• The amount of funds provided for a transaction seems disproportionately large compared to the client’s income without a clear rationale.
• There is a notable increase in capital for a recently established company, or large contributions are made to the same company in quick succession, without a logical explanation.

CPABC Code of Professional Conduct – Rule 219

DEFINITIONS:

For the purpose of Rule 219 and the related Guidance:

“financial institution” means a “financial entity” as defined in the Proceeds of Crime (Money Laundering) and Terrorist Financing Regulations (Canada), SOR/2002-184;

“funds” has the same meaning as in the Proceeds of Crime (Money Laundering) and Terrorist Financing Regulations (Canada), SOR/2002-184;

“organization” includes a corporation, partnership, fund, trust, cooperative, or unincorporated association, but does not include an individual;

“public body” means

1. a ministry, department or agent of the government of Canada, British Columbia or another province or territory of Canada,
2. a “local public body” as defined in the Freedom of Information and Protection of Privacy Act, or a similar body incorporated under the laws of Canada or another province or territory, or
3. a subsidiary of a public body whose financial statements are consolidated with those of the public body;

“public company” means an organization that is

1. a reporting issuer as defined under the applicable securities legislation of a province or territory of Canada,
2. a corporation whose shares are traded on a stock exchange that is prescribed by the Income Tax Act (Canada) and operates in a country that is a member of the Financial Action Task Force on Money Laundering, or
3. controlled by an organization described in paragraph (a) or (b);

“specified services” means

1. advice respecting a specified transaction,
2. advice respecting the use of corporations or other legal entities, or
3. private-sector bookkeeping services;

“specified transaction” means

1. the receipt or payment of funds or virtual currency,
2. the purchase or sale of securities, real property, or business assets or entities,
3. the transfer of funds, virtual currency or securities by any means, or
4. the giving of instructions in connection with any activity referred to paragraphs (a) to (c);

“virtual currency” has the same meaning as in the Proceeds of Crime (Money Laundering) and Terrorist Financing Regulations (Canada), SOR/2002-184.

RULES:

219.1 Requirement to identify client

1. A member or registered firm who is engaged by a client to provide specified services must obtain and record all of the following information
   1. for a client who is an individual:
      1. the client’s full name and contact information;
      2. the address of the client’s place of work or employment, if applicable; or
   2. for a client that is an organization:
      1. the organization’s full name, business address and business telephone number;
      2. the name, position and contact information for individuals confirming or communicating, on the organization’s behalf, its engagement of the member or registered firm to provide specified services;
      3. if the client is an organization other than a financial institution, public body or public company,
         1. the general nature of the type of business or activity engaged in by the client, and
         2. the organization’s incorporation or business identification number and the place of issue of its incorporation or business identification number.
            
            
2. Subrule (1) does not apply to a member who is providing professional services to their employer.
   
   
3. When a member or registered firm has obtained and recorded the information concerning the identity of an individual client under subrule (1)(a), the member or registered firm is not required subsequently to obtain and record that information about the same individual unless the member or registered firm has reason to believe that the information has changed or is inaccurate.

219.2 Requirement to verify client identity

1. When a member or registered firm provides professional services to a client other than a financial institution, public body or public company in respect of a specified transaction, the member or registered firm must
   1. obtain from the client and record, with the applicable date, information about the source of the funds, virtual currency or other property that is the subject of the specified transaction, and
   2. verify the identity of the client using a method that is permitted under the guidance issued by the Financial Transactions and Reports Analysis Centre of Canada.
      
      
2. Subrule (1) does not apply to
   1. a member who is providing professional services to their employer, or
   2. a member or registered firm who is acting in the capacity of a person who is
      1. authorized by law to carry on the business of, or to monitor the business or financial affairs of, an insolvent or bankrupt person, or
      2. authorized to act under a security agreement.

219.3 Responsibilities of members and registered firms under Rule 219

1. A member or registered firm is not required to repeat compliance with Rule 219.1 or 219.2 when another member or registered firm or a professional colleague who has complied with the applicable requirements of Rule 219.1 or 219.2 or equivalent requirements of a provincial CPA body
   1. engages the member or registered firm to provide professional services to a client as an agent, or
   2. refers a matter to the member or registered firm for the provision of professional services.
      
      
2. The responsibilities of a member under Rules 219.1 and 219.2 may be fulfilled by the member’s registered firm on their behalf.

Footnotes

1. The Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) is the country’s financial intelligence unit and its anti-money laundering and anti-terrorist financing supervisor.
   
   FINTRAC’s mandate is to facilitate the detection, prevention, and deterrence of both money laundering and terrorist financing, while also ensuring the protection of the personal information under its control.

The information in this document was current and accurate when it was published (see date at the top). While we try our best to update and remove old documents, there is a chance we miss some. Always refer to the most recent version of the Act, Bylaws, or Code (linked) posted on the CPABC website as the wording therein prevails over information in this document. If you think we did miss an update or removal, please confirm with us at ProfessionalAdvisory@bccpa.ca.