KYC Requirements

KYC Requirements

Know Your Customer (KYC) is a regulatory framework that requires businesses to verify the identity of their clients before and during the business relationship. As a C-Band Mailbox operator, you are subject to KYC requirements in both the United States and Canada. These requirements exist to prevent money laundering, terrorist financing, fraud, and identity theft. This guide provides a comprehensive overview of the KYC regulatory framework in both countries, minimum verification requirements, enhanced due diligence triggers, and ongoing monitoring obligations.

Canada - KYC Regulatory Framework

PIPEDA (Personal Information Protection and Electronic Documents Act)

PIPEDA governs how private-sector organizations collect, use, and disclose personal information during commercial activities. As a mailbox operator collecting renter identification:

• You may only collect personal information for a legitimate, stated purpose
• You must obtain meaningful consent before collecting personal information
• You must protect personal information with appropriate security safeguards
• Renters have the right to access and correct their personal information held by you
• You must retain personal information only as long as necessary for the stated purpose or as required by law

FINTRAC Requirements Under PCMLTFA

The Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) establishes KYC obligations enforced by FINTRAC:

• Verify the identity of every renter before providing services
• Collect sufficient information to establish the renter's identity
• Conduct ongoing monitoring of the business relationship for unusual activity
• Maintain records of all identification and verification activities
• File reports for suspicious transactions and other prescribed activities

Quebec - Law 25 (Additional Privacy Requirements)

If you operate in Quebec, be aware of Law 25 (Act to modernize legislative provisions as regards the protection of personal information), which imposes additional privacy requirements. C-Band Mailbox handles many of these obligations at the platform level; Quebec operators should consult the Operator Terms & Conditions and contact C-Band support for guidance:

• Mandatory Privacy Impact Assessments for certain data processing activities
• Designated privacy officer requirement
• Enhanced consent requirements
• Mandatory breach notification to the Commission d'acces a l'information (CAI)
• Data portability rights for individuals

Minimum KYC - Canada

For every Canadian renter, you must collect and verify:

• Government-issued photo ID (passport, driver's license, provincial ID, PR Card, or Secure Certificate of Indian Status)
• Proof of address dated within 90 days (utility bill, bank statement, CRA Notice of Assessment, or lease)
• Completed and signed Canada Post authorization form

United States - KYC Regulatory Framework

BSA (Bank Secrecy Act) Framework

The Bank Secrecy Act establishes the foundation for US anti-money laundering regulations. While CMRAs are not classified as financial institutions under the BSA, C-Band Mailbox requires operators to follow these practices as part of USPS CMRA regulations and platform requirements:

• Requires financial institutions and certain other businesses to maintain records and file reports that are useful in preventing financial crimes
• Enforced by FinCEN (Financial Crimes Enforcement Network)
• While mailbox operators are not traditional BSA-covered entities, CMRA regulations incorporate many of the same principles

Customer Identification Requirements (Aligned with USPS CMRA Regulations)

Note: PATRIOT Act Section 326 CIP requirements apply to financial institutions, not directly to CMRAs; the practices below follow the same principles and are required by USPS CMRA regulations and C-Band platform requirements.

C-Band Mailbox requires operators to implement a Customer Identification Program (CIP) consistent with USPS CMRA regulations (PS Form 1583) and platform requirements:

• Verify the identity of every customer (renter) before establishing a business relationship
• Collect and verify: full legal name, date of birth, address, and identification number (SSN or other government ID number)
• Maintain records of the identification information collected and the methods used to verify identity
• Check customer names against government lists of known or suspected terrorists or other sanctioned individuals (OFAC SDN List)

State-Level CMRA Regulations

In addition to federal requirements, many states have their own CMRA regulations that may impose additional KYC requirements. Check your state's specific regulations for any additional obligations.

Minimum KYC - United States

For every US renter, you must collect and verify:

• Government-issued photo ID (passport, state driver's license, state ID, military ID, or Green Card)
• Secondary ID / proof of address dated within 90 days (utility bill, bank statement, lease, or vehicle registration)
• Completed PS Form 1583, notarized (in-person notary or RON where permitted)

Enhanced Due Diligence (EDD)

Certain situations require additional scrutiny beyond the standard KYC process. Enhanced Due Diligence is triggered when:

• High-Volume Commercial Accounts: Business renters expecting significantly higher mail volumes than typical personal accounts
• Foreign Nationals: Renters who are not citizens or permanent residents of the country where you operate. Additional verification may include passport verification and visa status confirmation.
• Politically Exposed Persons (PEP): Individuals who hold or have recently held prominent public positions (government officials, senior politicians, judicial officials). PEPs present a higher risk due to their potential exposure to corruption.
• Unusual Activity Patterns: Any renter whose activity patterns raise red flags (see the AML Compliance guide for detailed red flag indicators)

Ongoing Monitoring

KYC is not a one-time process - it requires ongoing vigilance:

• Monitor renter activity for changes in patterns (sudden increase in mail volume, unusual forwarding destinations)
• Track document expiry dates and ensure renters update expired IDs
• Review renter accounts periodically for compliance with all KYC requirements
• File Suspicious Activity Reports (SARs) or Suspicious Transaction Reports (STRs) when warranted
• Update renter records when information changes

Record Keeping

Maintain comprehensive KYC records for a minimum of three (3) years after the renter's account is terminated (per the Operator Terms & Conditions Section 8). FINTRAC requires five (5) years for certain records - follow the longer retention period to ensure compliance in both countries.

Annual Compliance Review

Conduct an annual review of your KYC program to ensure it remains current and effective:

• Review and update KYC policies and procedures
• Verify all active renter accounts have current, complete documentation
• Review staff training records and provide refresher training
• Check for regulatory changes that may affect your KYC obligations
• Document the review results and any corrective actions taken

For detailed AML compliance information, see AML Compliance. For the document verification process, refer to Document Verification Guide.

Disclaimer: This article provides general guidance and does not constitute legal advice. Regulatory requirements may change. Consult a qualified legal professional for advice specific to your situation and jurisdiction.

For additional support, visit our Help Center or submit a support ticket.