Jan 15, 2015 in Papers & Projects by DIACC
DIACC Comments and Recommendations: Proposed Changes to AML Regulations for Minister of Finance Advisory Board 2014
Background on Digital ID and Authentication Council of Canada….
The Digital Identification and Authentication Council of Canada (DIACC) is the non-profit coalition of public and private sector leaders committed to developing Canada’s system for digital identification and authentication to enable Canadians’ full and secure participation the global digital economy.
We are committed to unlocking economic opportunities for Canadian consumers, and businesses by providing the framework to develop a robust, secure, scalable and privacy-enhancing digital identification and authentication ecosystem that will decrease costs for everyone while improving service delivery and driving GDP growth.
DIACC’s members and advisors include leaders from both the federal and provincial levels of government as well as representatives from small and large businesses, charities, and privacy commissioners.
We operate transparently and participation is open to all Canadians. Our current membership includes all of Canada’s major financial institutions and credit unions, telecommunications companies, departments within the Canadian Federal, Provincial and Municipal governments, and technology providers).
Comments:
The Digital ID and Authentication Council of Canada appreciates the opportunity to contribute to the process of reviewing the proposed changes to the Department of Finance/FINTRAC AML regulations.
Our membership consists of a broad cross section of stakeholders (including Canada’s largest financial institutions, telecommunications companies, departments within the Canadian Federal, Provincial and Municipal governments, and technology providers). We were founded specifically to create an environment for strong implementation of digital ID and authentication experiences and to stimulate Canada’s digital economy.
From our members, the DIACC has collected a panel of experts to review the proposed Department of Finance/FINTRAC regulation changes in the short time provided and agree that at first glance the current proposals represent an improvement over the current regulations.
The DIACC does caution that changes to the regulatory environment will impact many sectors and the consultation process to-date could benefit from engaging a wider set of stakeholders. If not written and applied correctly, new regulations can bring about unintended consequences and create significant challenges in the long term.
The DIACC would appreciate clarity regarding the outcomes intended by the Department of Finance and FINTRAC.as well as an opportunity to more fully consult with our membership
With the understanding that more time is required to fully consider the impact of these proposed changes the DIACC provides the following comments and recommendations for your consideration.
Proposed Department of Finance/FINTRAC Regulatory Changes
To ascertain the identity of an individual and confirm their personal information, it is proposed to allow Reporting Entities to use any one of the following methods:
a) A government-issued photo ID, if the person is physically present. This could include a driver’s licence, provincial health card (where permitted by the province), passport, permanent resident card, Secure Certificate of Indian Status, other government-issued photo identity cards or a valid foreign equivalent of any of these documents that contain an issue date and an expiry date;
DIACC Comments
Consider the requirement / ability to validate a Government issued ID when the individual is not physically present. There are several highly reliable methods and sources that can validate the ID (including ensuring that the ID is not forged) and even conduct facial recognition, electronically if desired. Our proposed revisions are highlighted below:
A government-issued photo ID and comparison to the individual being identified. if the person is physically present. This could include a driver’s licence, provincial health card (where permitted by the province), passport, permanent resident card, Secure Certificate of Indian Status, other government-issued photo identity cards or a valid foreign equivalent of any of these documents that contain an issue date and an expiry. The identification can be conducted in person, or through a reliable method that is able to validate authenticity of the ID and compare to the individual being identified.
b) Confirmation by a government or public body that is authorized in Canada to verify the identity of individuals, which may be done electronically. Provincial identity management systems are continuously being updated to reflect new technologies and pressures. In anticipation of future developments, this method would capture potential services that provinces may choose to provide to businesses with respect to confirming the identity of individuals (i.e., clients) in an online environment. It is our understanding that these services are not currently offered by provinces;
DIACC Comments
Consider expanding to all government jurisdictions. Proposed revisions highlighted below:
Confirmation by a government or public body that is authorized in Canada to verify the identity of individuals, which may be done electronically. Federal, Provincial, Territorial and Municipal identity management systems are continuously being updated to reflect new technologies and pressures. In anticipation of future developments, this method would capture potential services that provinces Federal, Provincial, Territorial and Municipal jurisdictions and may choose to provide to businesses with respect to confirming the identity of individuals (i.e., clients) in an online environment. It is our understanding that these services are not currently offered by provinces;
c) A reliable Canadian credit file with at least three years of history;
d) An independent and reliable identification product that is based on personal information in respect of the person and a Canadian credit history of the person of at least three years (e.g., relevant professional identity authentication services that use an individual’s credit information); or
Alternatively, it is proposed that a Reporting Entity could also identify an individual by using any two methods listed below using different sources of information.
DIACC Comments
Under Dual Methods there are several references to using other reliable sources. We suggest removing the comment that the source has to be in Canada. With growth in international companies, the limitation of the company being based in Canada is restrictive. We would also need to consider how to verify New to Canada individuals, where a significant portion of the data may be in a different jurisdiction and would provide value when combined with the Canadian data.
a) Verifying the name, address and, where available, other identifying information of the individual on the basis of a document or electronic data from a reliable and independent source in Canada. This could include government-issued ID that does not have a photo;
DIACC Comments
Consider removing limitations only allowing reliable sources in Canada. Proposed revisions highlighted below:
Verifying the name, address and, where available, other identifying information of the individual on the basis of a document or electronic data from a reliable and independent source in Canada. This could include government-issued ID that does not have a photo;
b) Verifying the name, date of birth and, where available, other identifying information of the client on the basis of a document or electronic data from a reliable and independent source in Canada;
DIACC Comments
Consider removing limitations only allowing reliable sources in Canada. Proposed revisions highlighted below:
Verifying the name, date of birth and, where available, other identifying information of the client on the basis of a document or electronic data from a reliable and independent source in Canada;
c) Verifying that the person has a deposit or credit card account in their name with a Canadian financial entity which was the subject of CDD measures specified in the Regulations (e.g., by using the cleared cheque method, viewing an original paper or electronic bank or credit card statement, or by performing an electronic transaction that would allow the individual’s name to be verified).