Jumio vs Sumsub vs deepidv: The Mobile Driver's License Era
Jumio, Sumsub, and deepidv compared on verifiable digital credential support after the five-agency CIP FAQ made mobile driver's licenses bank-grade ID.
Sep 11, 20265 min
Read more
Client identity verification for lawyers in Canada in 2026: the Federation model rule, Ontario, BC, Quebec and Alberta requirements, accepted methods, and remote verification.
Client identity verification for lawyers in Canada is not optional, and in 2026 it looks nothing like it did five years ago. Every lawyer and paralegal in the country now works under client identification and verification rules that set out exactly who you must identify, when you must verify, and which methods count. Get it wrong and you are exposed to a law society audit, a discipline complaint, and in the worst case a role in a money-laundering scheme you never saw coming.
The rules trace back to a single source. The Federation of Law Societies of Canada writes a Model Rule on Client Identification and Verification, and each provincial and territorial law society adopts a version of it. The most consequential change in years landed on January 1, 2025, when law societies aligned with the Federation's updated model rule and finally permitted true remote verification, provided the technology confirms a government document is genuine. A video call on its own no longer counts.
This guide walks through the current framework: the Federation model rule, the provincial requirements in Ontario, British Columbia, Quebec, and Alberta, the difference between identification and verification, the accepted verification methods, the exemptions, and the move to remote verification. It also explains how deepidv, a verification engine and agentic compliance suite, gives law firms compliant, remote client verification with a defensible audit trail.
Lawyers sit at a chokepoint for money movement. Real estate closings, trust accounts, and corporate transactions all pass funds through legal practices, which makes law firms a target for laundering. The Financial Action Task Force, the global standard-setter for anti-money-laundering measures, has long flagged legal professionals as gatekeepers who can be exploited to move illicit proceeds.
Here is the wrinkle that makes Canada distinct. In 2015 the Supreme Court of Canada ruled in Canada (Attorney General) v. Federation of Law Societies of Canada that key provisions of the Proceeds of Crime (Money Laundering) and Terrorist Financing Act could not apply to lawyers, because forcing lawyers to act as state agents against their own clients breached solicitor-client privilege under sections 7 and 8 of the Canadian Charter of Rights and Freedoms. As McMillan LLP explains, the practical result is that lawyers do not report to FINTRAC, Canada's financial intelligence unit, the way banks and real estate brokers do.
That exemption did not remove the obligation. It moved it. The law societies stepped in with their own client identification and verification rules, self-regulated and enforced through the professional discipline process. So the duty to know your client sits with your law society, not with the federal government.
Suggested read: Remote Client Verification for Canadian Law Firms
The Federation's Model Rule on Client Identification and Verification was first adopted in 2008 and has been amended repeatedly, most recently in 2023, with the remote-verification amendments taking effect across provinces on January 1, 2025. The Federation drafts; the fourteen law societies enact. That means the core structure is national, while the exact rule numbers and a few details vary by jurisdiction.
Two obligations sit at the center of the model rule.
The distinction matters because verification is the heavier lift. You can act on many matters with identification alone. The moment money moves through your hands, the verification clock starts.
Getting this trigger right is the single most common compliance question in Canadian practice. The rule is consistent across the model.
You must identify every client, and any third party you are instructed to act for, whenever you are retained to provide legal services on a new matter. This is a low bar of information collection, and it applies broadly.
You must verify identity when you engage in or give instructions in respect of the receipt, payment, or transfer of funds, other than certain excluded transactions. The Law Society of Ontario frames it plainly: verification is required every time you handle money for a client. Real estate transactions, estate administration with disbursements, and corporate deals that move funds all cross this line.
There are notable carve-outs. Verification is generally not required when funds move only by electronic funds transfer, when they are paid to or received from a financial institution, public body, or reporting issuer, or when they come from a peace officer or public official acting in an official capacity. These carve-outs recognize that the counterparty is already a regulated or trusted entity.
Under the current rules, a lawyer can verify an individual client's identity using one of three methods. Understanding all three is what lets a firm choose the workflow that fits a remote practice.
| Method | What it requires | Works remotely? |
|---|---|---|
| Government-issued photo ID | An authentic, current, government photo ID; the document must be authenticated as genuine, not just viewed | Yes, with technology that confirms authenticity |
| Credit file | A credit file from a Canadian credit bureau that has existed for at least three years, matching the client's name, address, and date of birth | Yes |
| Dual process | Two pieces of information from two different reliable and independent sources | Yes |
This is the classic approach. You look at a valid, current, government-issued photo identification document, confirm it is authentic, and confirm the name and photo match the person in front of you. Acceptable documents include a passport, a provincial driver's licence, or another government-issued credential with a photo. The Government of Canada's identity documents guidance illustrates the kinds of federal credentials that qualify.
The key 2024-2025 change: you must now authenticate the document, meaning use a process or method to determine that it is true and genuine. Simply holding a licence up to a webcam does not authenticate it. That is why remote use of this method now depends on verification technology.
Here you request the client's credit file directly from a Canadian credit bureau such as Equifax Canada or TransUnion Canada, confirm the file has been in existence for at least three years, and confirm that the name, address, and date of birth match what the client gave you. Because it does not depend on physically inspecting a document, this method has always worked at a distance.
The dual process method lets you rely on any two of three categories of information, each drawn from a different reliable and independent source that is not the client. The categories are information confirming name and address, information confirming name and date of birth, and information confirming that the client holds a deposit account, credit card, or loan with a financial institution. A property tax assessment plus a bank statement, for instance, can satisfy the test. The sources must be independent of each other and of the client.
Suggested read: Real Estate Lawyer Identity Verification in Canada
The national framework is consistent, but you practise under your own law society's rules. Four of the largest jurisdictions show how the model rule reads on the ground.
If you practise in more than one province, do not assume the rules are identical. Confirm the current rule text with your home law society and, for national files, with the Canadian Bar Association resources on the know-your-client regime.
The rules include exemptions that reduce the burden in defined situations. Knowing them prevents both over-collection and under-compliance.
Exemptions are narrow and fact-specific. When a transaction sits near a boundary, document your reasoning and, where the risk warrants it, verify anyway.
The defining change of this decade is that remote verification is finally sanctioned nationwide, but only when it is done properly. During the pandemic, law societies allowed lawyers to eyeball a licence over videoconference. That temporary measure is gone. As the Law Society of Alberta clarified, remote videoconference by itself is no longer a compliant way to use the photo ID method.
What replaced it is stronger. Under the January 2025 model-rule amendments, a lawyer may verify a client's identity virtually using authentication technology that confirms a government-issued photo ID is genuine and matches the client, or by using an agent to do so. This is a meaningful upgrade, because document authentication catches forgeries that a human staring at a webcam never could. The Public Prosecution Service of Canada and provincial fraud units regularly prosecute cases built on fabricated identity documents, and the point of authentication technology is to stop that document before a retainer is signed.
Remote verification also has to survive an audit. Whatever method and technology you use, you must keep dated records of the steps taken, the information obtained, and the source. That evidentiary trail is where many firms fall short, and it is precisely where the right software carries the load.
Suggested read: Peer-to-Peer Marketplace Safety and Verification
deepidv was built to do the two things the rules now demand at once: confirm that a government document is authentic, and confirm that the live person presenting it is the human named on it. Our core verification engine reads and authenticates identity documents from more than 200 countries and territories, checks security features, and runs face-matching against the document photo. That answers both the "is the ID genuine" and the "does it match the client" tests the law societies require for remote use of the photo ID method.
The harder threat is synthetic. Generative tools can now produce a convincing fake licence and a convincing fake face on the same call. Our underlying technology adds face liveness and an AI Detection layer that flags deepfakes, injected video, and AI-generated selfies, so a firm is not fooled by a presentation attack during a remote retainer. Our deepeye analysis extends that scrutiny to the document image itself, catching tampering and manipulation that the eye misses.
For a busy practice, the workflow matters as much as the checks. Our agents run the process end to end. Arc orchestrates the verification steps and routing, Luna handles the client-facing capture experience so the person on the other side is guided rather than confused, and Arbiter applies the decision logic and produces the dated, exportable record of what was checked, when, and how. That record is the audit trail your law society expects, generated automatically rather than reconstructed after the fact.
While the client-identity use case sits squarely in legal practice, the same engine powers verification across high-trust exchanges. The way we verify both parties in a transaction on our marketplaces product, confirming the human on each side while validating what is being exchanged, is the same rigor a firm needs when a stranger walks in with a document and a request to move money. You can review deployment options and volumes on our pricing page.
Identification means collecting basic information about who your client is, such as their name, address, and occupation, and it is required for every new matter. Verification means confirming that the client truly is that person using reliable, independent documents or data, and it is required mainly when you receive, pay, or transfer funds. Identification is the lighter, always-on obligation; verification is triggered by handling money.
Verification is required when you engage in or give instructions about receiving, paying, or transferring funds on a client's behalf, subject to specific exemptions. Common triggers include real estate closings, estate disbursements, and corporate transactions that move money. Transfers that occur purely by qualifying electronic funds transfer, or that involve a financial institution, public body, or reporting issuer, are generally excluded.
There are three accepted methods: the government-issued photo ID method, the credit file method, and the dual process method. The photo ID method requires authenticating a valid government document. The credit file method uses a Canadian credit bureau file that has existed for at least three years. The dual process method relies on two pieces of information from two different reliable and independent sources.
Yes. Since the January 1, 2025 model-rule amendments, lawyers may verify identity virtually using authentication technology that confirms a government photo ID is genuine and matches the client, or by using an agent. A plain video call is no longer sufficient on its own, because the earlier pandemic exemption for videoconference-only verification has ended in provinces such as Ontario, British Columbia, and Alberta.
No. In Canada (Attorney General) v. Federation of Law Societies of Canada, 2015 SCC 7, the Supreme Court held that the anti-money-laundering provisions could not constitutionally apply to lawyers, so lawyers do not report to FINTRAC the way banks and real estate brokers do. Instead, each law society enforces its own client identification and verification rules through the professional discipline process.
A firm must keep dated records of the verification steps taken, the information obtained, the method used, and the source of that information, and retain them for the period set by its law society. These records must be produced on a law society audit. Verification software that generates a timestamped, exportable log of exactly what was checked and when makes meeting this obligation far simpler than reconstructing files by hand.
Go live in minutes. No sandbox required, no hidden fees.
Jumio, Sumsub, and deepidv compared on verifiable digital credential support after the five-agency CIP FAQ made mobile driver's licenses bank-grade ID.
Sumsub, 1Kosmos, and deepidv compared for GENIUS Act stablecoin CIP compliance: bank-grade identification, watchlist screening, and the 12-month build window.
Jumio, Trulioo, and deepidv compared for AUSTRAC Tranche 2 compliance: enrolment-to-examination readiness, SMR quality, and AML programs that match practice.
