Insurance & Insurtech Compliance in Canada

Canada is open to digital insurance distribution. Insurers are licensed by each province, and federally incorporated insurers are also supervised prudentially by the Office of the Superintendent of Financial Institutions. Anti-money laundering rules are federal and apply mainly to life insurance and annuities, enforced by the Financial Transactions and Reports Analysis Centre of Canada.

The main obstacle for a new entrant is the two-layer structure: a federal identity and reporting regime that applies to some products and not others, and a provincial conduct regime that differs between Ontario, Québec and British Columbia, including for online sales.

1. Who regulates this sector

Other provinces and territories have their own insurance regulators; this guide uses Ontario, Québec and British Columbia as the reference provinces.

2. Licensing and authorisation

Insurance licensing is provincial. In Ontario, every insurer undertaking insurance or carrying on business in the province must hold a licence from FSRA's Chief Executive Officer, and no person may engage in the business of insurance there without one (Insurance Act, R.S.O. 1990, c. I.8, s. 40). Agents are licensed separately under Part XIV of the same Act. In British Columbia, insurance companies need a business authorisation under the Financial Institutions Act, RSBC 1996, c. 141, and no one may act as an insurance agent or salesperson without a licence issued by the Insurance Council of British Columbia (ss. 171(2) and 174). A restricted insurance agent licence for non-insurance businesses that sell insurance incidentally to their goods or services takes effect on 1 January 2027 under the Restricted Insurance Agent Licence Regulation, published on 18 December 2025. In Québec, a firm may sell without a natural-person adviser only through a compliant "digital space", and an insurer may sell through a distributor, a non-insurance business offering insurance as an accessory to its goods, under Title VIII of the Act respecting the distribution of financial products and services (CQLR c. D-9.2, s. 408). Distributor products are limited to travel, short-term vehicle rental, payment card, funeral and replacement insurance (s. 424).

Insurers incorporated federally, and foreign insurers operating branches in Canada, are also governed by the Insurance Companies Act, S.C. 1991, c. 47, and supervised by OSFI.

FSRA supervises insurer and intermediary conduct under its Fair Treatment of Customers in Insurance guidance (GR0008APP, effective 1 January 2021). In Ontario, carrying on insurance business without a licence is prohibited (s. 40(2)), and FSRA can impose administrative penalties of up to CAD 200,000 on a firm and CAD 100,000 on an individual per contravention (Ontario Insurance Act, s. 441.5).

3. AML, KYC and customer due diligence

Life companies and foreign life companies under the Insurance Companies Act, and life insurance companies regulated by a provincial Act, are reporting entities under the PCMLTFA, s. 5(c). Life insurance brokers and agents are covered under s. 5(i), except when acting as a managing general agent (PCMLTFR, s. 17). Where an agent is an employee of an insurer or broker, the employer carries the obligations, but both must report suspicious transactions. Title insurers are reporting entities when they provide a title policy to a property purchaser, and must verify the purchaser's identity (PCMLTFR, ss. 64.7 and 102.2). Property and casualty, health and other non-life insurance is not otherwise covered.

Who must be identified, and when

Information record

Required for the sale of an annuity or life policy under which the insurer will receive, or remit to a beneficiary, CAD 10,000 or more over its duration, regardless of payment method (PCMLTFR, s. 22). The policyholder or annuitant must be verified within 30 days of creating the record (s. 105(7)(h)); the beneficiary record is created before the first remittance.

Large cash and virtual currency

Receipt of CAD 10,000 or more in cash, or virtual currency of equivalent value, triggers identification and a report, with amounts received within 24 hours aggregated (PCMLTFR, s. 18 and FINTRAC guidance).

Politically exposed persons

Reasonable measures to determine whether a person who makes a lump-sum payment of CAD 100,000 or more, or a beneficiary who will receive CAD 100,000 or more, is a politically exposed person, a head of an international organisation or a family member or close associate (PCMLTFR, s. 117).

Exemptions

No identification is required for exempt policies under the Income Tax Regulations, group life policies with no cash surrender value or savings component, registered annuity policies and registered retirement income funds, or annuities funded directly from a registered pension plan. These exemptions never apply to large cash, virtual currency or suspicious transactions.

A business relationship starts the second time identity must be verified, which triggers ongoing monitoring and the duty to keep client information up to date. For entity clients, beneficial ownership information must be obtained and reasonable measures taken to confirm it. Reinsurance is exempt except for suspicious transaction reporting.

Reporting and records

Life insurers, brokers and agents file Suspicious Transaction Reports, Listed Person or Entity Property Reports, Large Cash and Large Virtual Currency Transaction Reports, and electronic funds transfer reports where applicable. Since 1 October 2025 the property-reporting duty covers persons subject to sanctions under the Special Economic Measures Act and the Justice for Victims of Corrupt Foreign Officials Act as well as UN and Criminal Code listings. Records must be kept for at least five years (PCMLTFR, s. 148), and every reporting entity must run a compliance programme with a compliance officer, written policies, a risk assessment, training and a two-yearly effectiveness review.

4. Identity verification and onboarding

PCMLTFR s. 105(1) and FINTRAC's guidance Methods to verify the identity of persons and entities set five methods for individuals:

Insurers may also use an agent or mandatary to verify identity on their behalf under a written agreement, obtaining all the information used as soon as feasible; the insurer remains responsible (PCMLTFR, s. 106, FINTRAC guidance effective 1 October 2025). For corporate policyholders, existence is confirmed from a certificate of incorporation or a public registry record, and beneficial owners holding 25% or more must be identified with reasonable measures to confirm accuracy.

5. Digital channels: what's different

Bottom line: the federal identification triggers and methods are channel-neutral, but a remotely checked photo ID must be authenticated by technology, and Québec and British Columbia add rules for policies sold through a website or app.

Remote photo ID

FINTRAC permits the photo ID method when the person is not physically present only if the insurer has a process to authenticate the document, for example by comparing an ID captured with a phone camera against known characteristics and security features such as holograms, barcodes or embedded chips. The insurer must then confirm the name and photo belong to the applicant, by live video comparison or a selfie compared with facial recognition.

Québec: selling without an adviser

Under the Regulation respecting Alternative Distribution Methods (CQLR c. D-9.2, r. 16.1), a firm selling without a natural person must use a digital space that keeps a way to reach a representative visible at all times (s. 8), discloses coverage, exclusions and premiums before contract (s. 9), recaps the client's information and choices immediately before contract (s. 11), and can detect and automatically suspend a transaction where information is inconsistent or the client is ineligible (s. 14). All information collected from and given to the client must be entered in the client record (s. 17), and the firm may not choose the product automatically for the client (s. 18).

British Columbia: electronic agents

An insurance company, agent or salesperson that sells through an electronic agent must meet any prescribed requirements and the rules of BCFSA or the Insurance Council (Financial Institutions Act, s. 92.2). The binding standard in practice is BC's Insurer Code of Market Conduct, which every BC-authorised insurer has had to adopt and comply with since 1 April 2024: Principle 5 requires distribution strategies that give consistent consumer protections whatever the distribution model (BCFSA Regulatory Statement 23-015).

6. Data protection and biometrics

Insurers in most provinces are subject to the Personal Information Protection and Electronic Documents Act; Québec and British Columbia have their own private-sector privacy statutes. FINTRAC notes that clients must be told their personal information is collected, but not that it is included in reports to FINTRAC.

The Office of the Privacy Commissioner's guidance on biometrics for businesses (11 August 2025) treats biometric information as sensitive and states that express consent is, as a general rule, the appropriate form of consent for collecting, using or disclosing it, including templates. In Québec, identity may be verified with a biometric process only if the process has been disclosed to the CAI in advance and the person gives express consent; only the minimum characteristics needed may be used, and a biometric database must be disclosed to the CAI at least 60 days before it goes into service (Act to establish a legal framework for information technology, CQLR c. C-1.1, ss. 44 and 45). A remote flow that uses facial comparison in Québec therefore needs a consent step and a prior CAI disclosure, or a non-biometric alternative.

7. Sector-specific obligations

Oversight of agents and distributors

FINTRAC holds the insurer responsible when an agent or mandatary verifies identity incorrectly. Provincial rules add oversight duties. Québec requires insurers distributing through third parties to notify the AMF and supervise those distributors. In British Columbia, BCFSA has reminded insurers that they remain responsible for fair treatment outcomes regardless of distribution channel, and that it can act against unlicensed sales, including by businesses that will need a restricted licence from 1 January 2027 (Advisory 26-004).

Claims and payouts

Life beneficiaries must be verified and screened before the first payout. Non-life claims carry no AML identity duty; provincial conduct rules apply instead: FSRA's Unfair or Deceptive Acts or Practices Rule, s. 5, (in force since 1 April 2022) treats unreasonable delay, bad faith and unclear claims communication as unfair claims practices; Principle 10 of BC's Insurer Code requires claims to be examined diligently and settled fairly through a simple, accessible procedure; and Québec's Insurers Act, s. 50, requires sound commercial practices, including fair treatment of clients. Québec has also enacted a duty for life insurers to find out whether insured persons have died and inform unclaimed beneficiaries for three years (Insurers Act, s. 72.1) [Adopted, effective date not yet set]; a separate provision already in force lets them obtain death information from the registrar of civil status under a written agreement (s. 72.2).

Technology, outsourcing and authentication

For federally regulated insurers, OSFI Guideline B-13 (Technology and Cyber Risk Management, in effect since 1 January 2024) expects risk-based identity and access controls, including multi-factor authentication, and Guideline B-10 (Third-Party Risk Management) confirms the insurer remains accountable for outsourced functions, which includes identity verification vendors.

Sanctions

Life insurers, brokers and agents must report to FINTRAC immediately any property of a listed person or entity in their possession or control, which covers Criminal Code terrorist listings, UN measures and Canadian autonomous sanctions. In practice this means screening policyholders at issue and beneficiaries before payout.

8. Risk indicators and red flags

FINTRAC life insurance indicators

• Third-party premiums: other parties pay premiums or are involved in the policy without clear reason.
• Overpayment and refund: a premium is overpaid and the surplus is refunded to another party.
• Mixed funding: premiums or deposits come from several different sources.
• Bank-account use: repeated top-ups followed by frequent partial redemptions.
• Early cancellation: surrender soon after purchase, or early redemption that makes no economic sense.
• Interest in exit costs: more interest in cancellation terms than in the policy's long-term value.
• Beneficiary anomalies: the same beneficiary on multiple policies, or no clear link between policyholder and beneficiary.

9. Enforcement and penalties

FINTRAC imposes administrative monetary penalties per violation, classified as minor (up to CAD 40,000), serious (up to CAD 4,000,000) or very serious (up to CAD 20,000,000), with a series of minor violations treated as serious once the total reaches CAD 400,000 (Administrative Monetary Penalties Regulations, SOR/2007-292, ss. 4 and 5). The cap per prescribed violation is CAD 4,000,000 for an individual and CAD 20,000,000 for an entity, and the total on one notice is capped at the greater of those amounts and 3% of gross global revenue (PCMLTFA, s. 73.1). After a violation, FINTRAC must require a compliance agreement, and refusal or breach can lead to a compliance order. Knowing contraventions are criminal offences, with fines of up to CAD 5,000,000 and five years' imprisonment on indictment (s. 74).

Provincially, FSRA penalties reach CAD 200,000 for a firm and CAD 100,000 for an individual per contravention, with summary penalties of up to CAD 25,000. On 23 June 2025, FSRA imposed a CAD 25,000 penalty and licence conditions on a life insurance agent who repeatedly stated on applications that premium funds came directly from his clients, following a Financial Services Tribunal decision (2025 ONFST 4).

10. Recent changes and what to watch

• 15 June 2026: Bill C-36, the Protecting Privacy and Consumer Data Act, introduced [Bill, not enacted]. It would replace Part 1 of PIPEDA; as of October 2026 it has had first reading only.
• 26 March 2026: Strengthening Canada's Immigration System and Borders Act (S.C. 2026, c. 4) raised FINTRAC penalties and made compliance agreements mandatory [In force]. Its requirement for reporting entities to enrol with FINTRAC [Adopted, effective date not yet set] awaits an order in council.
• 18 December 2025: British Columbia published the Restricted Insurance Agent Licence Regulation [Adopted, effective 1 Jan 2027]. Listed non-insurance businesses selling incidental insurance will need a restricted agency licence from the Insurance Council.
• 1 October 2025: Title insurers became reporting entities, and identity verification by an agent or mandatary under a written agreement took effect [In force].
• 1 October 2025: Listed-person property reporting extended to persons sanctioned under the Special Economic Measures Act and the Sergei Magnitsky Law [In force]. Screening lists must include the Consolidated Canadian Autonomous Sanctions List.
• 11 August 2025: Privacy Commissioner's biometrics guidance for businesses adopted [In force]. Express consent is the default for facial comparison.
• Pending: Ontario amendments restructuring insurance agent licensing (2024, c. 20, Sched. 10) [Adopted, effective date not yet set].

11. What this means for identity verification

Product scope decides the flow: a life policy or annuity reaching CAD 10,000 over its duration needs full verification within 30 days, while exempt and non-life products need only the provincial conduct steps. Remote flows must authenticate the ID document itself (security features, chip or barcode data) and bind it to the applicant with a live or selfie face comparison and a name match, with the procedure written into the compliance programme. Credit file and dual-process checks give a non-biometric route, useful in Québec. Beneficiaries need a second verification event before the first payout, together with PEP and sanctions screening at CAD 100,000. Records of the method, document number and date must be kept for at least five years.