Travel & Hospitality Compliance in Canada

Canada is open to online travel businesses: no federal licence is needed to sell flights, hotel rooms or packages online. The rules that shape identity handling are spread across federal aviation security and border law (Public Safety Canada, Transport Canada, the Canada Border Services Agency and Immigration, Refugees and Citizenship Canada) and provincial accommodation and short-term rental law in Ontario, British Columbia and Québec.

The biggest obstacle for a new entrant is fragmentation. A booking platform serving all three provinces faces three different host-registration and guest-record regimes, while an airline selling online must build its check-in flow around federal watch-list screening that switches off online boarding passes for some passengers.

1. Who regulates this sector

2. Licensing and authorisation

There is no general federal licence for online travel agencies, hotels or booking platforms.

Air carriers

Carriers holding Canadian aviation documents must comply with the Secure Air Travel Act and its regulations before boarding or carrying any person (Secure Air Travel Act, s. 6(1)). Carriers flying to Canada must also arrange data transmission with the CBSA before starting service; the CBSA asks new carriers to contact it at least six months ahead (Memorandum D2-5-11, para. 60).

Short-term rental platforms, BC

A platform service provider must itself be registered with the province, as must each host's listing (Short-Term Rental Accommodations Act, SBC 2023, c. 32, ss. 6 and 7). Registration lasts up to one year (s. 8).

Tourist accommodation, Québec

Every establishment renting to tourists for 31 days or less must be registered with the Minister and receives a certificate with a registration number (Tourist Accommodation Act, CQLR c. H-1.01, ss. 2, 4 and 6.1). Platforms must name a representative established in Québec (Tourist Accommodation Regulation, s. 9.1).

Currency exchange

A travel business that exchanges currency as a business is a money services business and must register with FINTRAC before operating, even if it also holds a provincial registration.

Operating an unregistered establishment in Québec carries fines of $5,000 to $50,000 for a company, rising to $10,000 to $100,000 once registration has been refused, suspended or cancelled (ss. 28 and 29). Ontario has no provincial host-registration scheme.

3. Identity framework (AML rules do not apply)

The Proceeds of Crime (Money Laundering) and Terrorist Financing Act lists the businesses it covers in section 5. Airlines, hotels, tour operators, travel agencies and accommodation platforms are not among them, so they have no customer identification programme, suspicious transaction reporting or record-keeping duty under that Act for travel sales.

Two activities bring a business into scope:

Foreign exchange dealing

Exchanging one currency for another is a money services business activity (s. 5(h)(i)). FINTRAC treats a business as a money services business even without advertising if it conducts foreign exchange of more than $1,000 in a single transaction, with transactions within 24 hours added together. A foreign currency exchange ticket must record the customer's name, address, occupation and date of birth for exchanges of $3,000 or more.

Passing payments to suppliers

FINTRAC treats a business that receives payment instructions and acts as an intermediary between a buyer and a separate supplier of goods or services as remitting funds. A business that only takes payment for what it supplies itself is excluded. Platforms remitting traveller payments to hotels or tour operators should assess their position.

Otherwise, identity in travel is governed by the Secure Air Travel Act, the Customs Act and the Immigration and Refugee Protection Act, and provincial guest-register laws. Sanctions laws apply to every business regardless of sector.

4. Identity verification and onboarding

Air travel: booking to boarding

For flights within Canada and international flights to or from Canadian airports where passengers are screened, the Secure Air Travel Regulations (SOR/2015-181) set the identity steps:

• At booking. By 72 hours before departure (or when booked, if later) the carrier must collect each passenger's full name, date of birth and gender, offer the chance to give a Canadian Travel Number, and send these with travel document, booking and flight data to the Minister (ss. 2.1, 2.3 and 2.4).
• At the gate, domestic flights. Each passenger who appears to be 18 or older must show one valid Canadian government photo ID with full name and date of birth, a passport, a NEXUS card or another listed document, or two pieces of Canadian government ID (s. 3(1)).
• At the gate, international flights. A passport, NEXUS card or listed immigration document (s. 4).
• How the check is done. Staff compare the names on the boarding pass and the ID and, for photo ID, the passenger's entire face with the photograph (s. 4.1(1)). A passenger who does not resemble the photograph may not be carried unless a health professional's note explains the change (s. 7).

The screening authority repeats this check at the security checkpoint for anyone who appears to be 18 or older (Canadian Aviation Security Regulations, 2012, ss. 8.2 to 8.5). Neither rule specifies authentication technology, liveness or an assurance level.

Passenger data to the border agency

For inbound flights, every commercial air carrier must send the CBSA advance passenger information (name, date of birth, citizenship, gender, travel document type and number, booking reference) no later than check-in, and booking record data at departure, under s. 107.1 of the Customs Act and s. 269 of the Immigration and Refugee Protection Regulations (Memorandum D2-5-11, paras. 21 to 33). The CBSA returns an automated board/no-board message based on whether the traveller holds the required visa or electronic travel authorization (eTA). The carrier remains responsible for the boarding decision (para. 47).

Electronic travel authorization

Visa-exempt foreign nationals (other than United States citizens and permanent residents) must hold an eTA to fly to or transit through Canada, and since 5 June 2026 to travel by vessel directly from Saint-Pierre-et-Miquelon (IRPA s. 11(1.01); IRPR s. 7.1(1)). An eTA lasts five years or until the passport expires.

Hotels and short-term rentals

Provincial guest-register laws require businesses to record what the guest provides; they do not prescribe a document check. In Ontario the register holds one guest's name and primary residence (Accommodation Sector Registration of Guests Act, 2021, s. 2(2)), plus phone number and on-site vehicle details (O. Reg. 292/25, s. 2(1)). In British Columbia the hotel keeper must record the name and home address of the guest and every member of the party, arrival and departure dates and vehicle details, and may not provide accommodation until the information is given (Hotel Guest Registration Act, RSBC 1996, c. 205, ss. 2 and 3). Québec's Tourist Accommodation Act and Regulation contain no guest-register duty: they verify the establishment and its listing, not the guest.

Currency exchange

Where identity must be verified for a money services business transaction, FINTRAC accepts government-issued photo ID for a customer who is not physically present only if the business has a process to authenticate the document, such as technology that compares the scanned document against known security features.

5. Digital channels: what's different

Bottom line: online channels change who must check what. Airlines lose the self-service boarding pass for flagged passengers, and booking platforms in Ontario, BC and Québec carry their own register and host-verification duties that a hotel front desk does not.

Self-service check-in is conditional

If the Minister reports that a passenger's details match a listed person, or has not responded by the start of check-in, the carrier must not let the passenger obtain a boarding pass at a self-service machine or online (Secure Air Travel Regulations, ss. 2.6(2) and 2.8(2)). Online check-in flows therefore need a fallback that routes the passenger to a desk without disclosing why, because carriers may not reveal whether anyone is a listed person (Secure Air Travel Act, s. 20(3)).

Platforms carry registers and host checks

Ontario prescribes online accommodation platforms, meaning electronic marketplaces that broker short-term stays of under 28 days and are paid for it, as businesses that must keep a guest register (O. Reg. 292/25, ss. 1 and 3). In British Columbia, major and medium platforms must confirm each listing's provincial registration number before posting, within 24 hours of any change and at least once every 24 hours, stop serving a listing within 24 hours if validation fails, and cancel its future bookings; minor platforms re-check monthly (Short-Term Rental Accommodations Regulation, B.C. Reg. 268/2023, ss. 13.1 and 13.2). In Québec, a platform may not show a listing without a valid registration number and expiry date or allow bookings of under 32 days in an unregistered establishment, and must check the number against the certificate or, optionally, the Minister's validation API (Tourist Accommodation Act, ss. 20.1 and 20.2; Regulation, ss. 9.2 and 9.3).

Pending changes

Québec's duty for platforms to report listing data to the Minister (Tourist Accommodation Act, s. 20.2(2)) [Adopted, effective date not yet set]. Federal privacy reform under Bill C-36 [Bill, not enacted] would affect how identity data captured online is governed.

6. Data protection and biometrics

Private-sector travel businesses are governed by the Personal Information Protection and Electronic Documents Act (PIPEDA), or by Québec's and British Columbia's own private-sector privacy Acts where those apply.

The Office of the Privacy Commissioner's guidance on biometrics (adopted 11 August 2025) treats biometric information that can uniquely identify a person as sensitive in every context. Express consent is generally required; biometrics may be made a condition of service only where integral to the service, and otherwise customers must be offered an alternative. The guidance favours one-to-one verification over one-to-many identification and templates kept under the customer's control. These points matter for facial check-in, contactless hotel arrival and selfie-based ID checks.

Québec's rules are binding rather than advisory. No one may require identity to be verified or confirmed by a biometric process without first disclosing it to the CAI and obtaining the person's express consent; only the minimum characteristics may be used, and they must be destroyed once the verification's purpose is met (Act to establish a legal framework for information technology, CQLR c. C-1.1, s. 44). A database of biometric characteristics must be disclosed to the CAI at least 60 days before it goes into service, and the CAI may suspend or prohibit it (s. 45).

Retention pulls in two directions: Ontario registers must be kept for about six years, while biometric data must be destroyed once its purpose is met. Keeping register records separate from facial templates satisfies both.

7. Sector-specific obligations

Police access to guest registers

In Ontario, police may obtain part of a register by court order where there are reasonable grounds to believe a person is a victim of human trafficking or at imminent risk, and may demand to view it without an order in urgent cases. Businesses must comply within the time set or, for urgent demands, immediately (Accommodation Sector Registration of Guests Act, 2021, s. 4). In British Columbia, hotel registers must be open to police inspection at all times (Hotel Guest Registration Act, s. 4).

Confidentiality of watch-list results

Air carriers and reservation system operators may not disclose information about a listed person, or whether anyone is or was listed, except as the Act allows (Secure Air Travel Act, s. 20(3)). App messages and service scripts must be designed accordingly.

Passenger notices online

The Air Passenger Protection Regulations govern how air prices and passenger rights are presented on websites, apps and itinerary documents.

8. Risk indicators and red flags

Travel and hospitality identity-abuse indicators

• Name mismatch at the gate: a significant difference between the boarding pass and the ID must be reported to the Minister at once.
• Face does not match photo ID: the passenger may not be carried without a medical explanation.
• Altered passenger data: changing travel document details to obtain a "board" result can attract CBSA penalties.
• Anonymous or group bookings: Ontario links guest registers to human trafficking, where accommodation is used to move victims while staying anonymous.
• False guest details: giving false register information is an offence in Ontario.
• Invalid or reused host registration numbers: false or expired numbers on listings are an offence in Québec.
• Split currency exchanges: several exchanges within 24 hours that together exceed $1,000.

9. Enforcement and penalties

Bill C-31 would raise the statutory ceiling for passenger-rights violations by corporations to $1,000,000 (Canada Transportation Act, s. 177(1)(b), as proposed). On 13 June 2025 the CTA announced administrative monetary penalties of $64,800 against British Airways for 36 violations of the passenger information requirements in subsections 5(2), 5(3) and 5(5) of the Air Passenger Protection Regulations. The CTA publishes each notice of violation, including those against foreign carriers selling to Canadians online.

10. Recent changes and what to watch

• 15 June 2026 [Bill, not enacted] Bill C-36 would replace Part 1 of PIPEDA with the Protecting Privacy and Consumer Data Act. It is at second reading in the House of Commons.
• 5 June 2026 [In force] eTA required for visa-exempt travellers arriving by vessel directly from Saint-Pierre-et-Miquelon. Ferry operators and agencies selling those trips should check eTA status.
• 6 May 2026 [Bill, not enacted] Bill C-31, a budget implementation bill, would move air passenger rights rule-making from the CTA to the Minister of Transport, allow complaints to be resolved by third parties and raise the maximum penalty per violation for corporations to $1,000,000. It passed second reading on 3 June 2026 and is at committee in the House of Commons.
• 1 January 2026 [In force] Ontario's Accommodation Sector Registration of Guests Act, 2021 and O. Reg. 292/25 replace the Hotel Registration of Guests Act and extend registers to online platforms.
• 2 and 23 June 2025 [In force] BC platforms must stop serving listings without a valid provincial registration number and cancel their future bookings.
• 21 December 2024 [Proposed, consultation closed 6 Mar 2025] Proposed amendments to the Air Passenger Protection Regulations are still not final; the Regulations were last amended in 2022.

11. What this means for identity verification

Documents. Air check-in and boarding rely on passports, NEXUS cards, Canadian government photo ID and listed immigration documents. Domestic boarding accepts two non-photo Canadian government IDs; international boarding does not.

Remote methods. No travel rule requires remote document authentication or liveness, but self-service check-in must be able to divert a passenger to a desk. Online currency exchange using photo ID needs document authentication.

Biometrics. Facial matching at check-in or arrival requires express consent, an alternative route for customers who decline and destruction of templates once their purpose is met; in Québec, prior disclosure to the CAI is mandatory and a biometric database must be declared 60 days before use.

Regional variation. Ontario needs guest registers, BC daily host-number checks and Québec certificate-based host checks.

Retention and re-checks. Ontario registers run for about six years; Québec platforms keep host certificates for one year after expiry and validation confirmations for one year. Re-validate BC listings at least daily for major and medium platforms, and whenever a listing changes.