Opening an account, applying for a mortgage or accessing a public service increasingly happens through a digital channel. In each of these interactions, someone must trust that the person on the other side is who they claim to be. Canada already has many of the pieces needed to build that trust: public registries, provincial digital credentials and verification services operating at scale. The challenge is to connect them through common rules. That is why we champion the Pan-Canadian Trust Framework (PCTF).
1. Why digital trust is now an economic issue
Identity fraud has grown in both volume and sophistication in recent years. Published data shows this clearly:
- The incidence of synthetic identity fraud rose from 2.8% in Q2 2023 to 8% in Q2 2024 (Equifax Canada, 2024).
- Canadians reported more than $704 million in fraud losses in 2025, and only 5% to 10% of frauds are reported (Canadian Anti-Fraud Centre). Nasdaq Verafin estimates total Canadian fraud losses at approximately $3.4 billion in 2025.
- First-party fraud, where applicants use their real identity but misrepresent their financial information, increased 31% year over year between Q4 2024 and Q4 2025 (Equifax Canada, 2026).
These costs are not borne by banks alone. A nurse moving from Nova Scotia to Alberta can wait weeks for her credentials to be verified. Mortgage approvals still depend on manual employment and income verification, and full approval commonly takes 7 to 14 days after pre-approval. Many processes are still designed for paper.
At the same time, 71% of Canadians believe that collaboration between the public and private sectors is the best path to building digital identity frameworks (DIACC, 2022). There is public support to move forward, and a shared standard can help make that progress possible.
2. What the Pan-Canadian Trust Framework is
The PCTF is a trust framework: a set of rules, criteria and conformance requirements that helps digital identity services from different providers, sectors and jurisdictions recognize one another.
Three characteristics define it:
It is modular. The framework is organized into components that cover each part of the trust process: Verified Person, Verified Organization, Authentication, Credentials, Digital Wallet, Trust Registries, Privacy, Notice & Consent and Infrastructure, among others. An organization can certify against the components that match the service it provides.
It is public and built by consensus. The PCTF is a free resource, developed by DIACC with the participation of federal, provincial and municipal governments, financial institutions, telecommunications providers, technology providers and civil society.
It can be verified. DIACC’s certification program assesses services against PCTF criteria through an independent audit. Certified services are listed on DIACC’s public Trusted List.
The PCTF bridges the gap between regulation and its practical application. It is already having a concrete impact: six provincial law societies (Alberta, Manitoba, Ontario, British Columbia, Saskatchewan and Nova Scotia) point lawyers to DIACC resources in their client identification guidance, and Manitoba’s guidance tells lawyers to use a DIACC-certified service.
The framework also rests on principles such as privacy by design, with no centralized identity databases; a non-digital alternative for every service; respect for provincial authority over their own credentials; and Canadian control over the rules of digital trust.
3. What it aims to achieve
In our 2031 strategic vision, we set out four priorities:
- Reduce fraud through AI-supported verification, while defending against attacks that also use AI.
- Demonstrate economic return through measurable sector programs, starting with finance and lending, followed by healthcare, workforce mobility and supply chains.
- Reduce regulatory burden by mapping the PCTF to existing obligations, such as those of FINTRAC, OSFI and provincial regulators.
- Protect Canada’s digital sovereignty and ensure no one is left behind.
We have set measurable targets for 2031, against a 2024 baseline: cut annual identity fraud losses in half, reduce compliance costs by 20% to 30% for organizations adopting PCTF-aligned workflows, and expand access to digital credentials from 25% to 90% of the population.
To move toward these targets, the framework is expected to evolve along three lines:
- Criteria for the use of AI in verification, with publication targeted for late 2026.
- Regulatory mapping, starting with FINTRAC and continuing with a mapping between the PCTF and the PCMLTFA (Canada’s Proceeds of Crime (Money Laundering) and Terrorist Financing Act).
- Sector profiles, so that sectors such as real estate, energy and finance can certify against a tailored profile of a single framework.
4. Where trust breaks down today: the identity gap
At DIACC, we have examined this problem with representatives from the real estate, energy and financial sectors, and the findings are set out in our latest sector report, From Registries to Reality. The pattern repeats across all three: systems verify attributes, but not always the person or actor behind them. A land registry confirms who holds title to a property, but not that the person requesting a transfer is that titleholder. A financial institution verifies a customer at onboarding and then verifies them again several times, without reusing what it already knows. We call this the identity gap, and it is one of the points where fraud gets in.
Three points from that work matter here:
A credential is only as reliable as the process that bound it to a person. Identity verification before issuance, biometric binding to the holder and authentication at the point of presentation reduce the risk of a verified credential ending up in someone else’s hands.
Verification is a continuous process. A check at onboarding establishes an identity, but on its own it does not ensure confidence in what is asserted under that identity afterwards. Assurance needs to hold at issuance, at each use and throughout the life of the credential.
Data should be verified at the source, and only what is needed should be shared. The growth of first-party fraud shows that checking identity is not enough when what is falsified is the information itself. Income verified by the party that holds the data is much harder to falsify. And if a lender only needs to know that income has been verified, it does not need to receive full bank statements.
AI-enabled fraud adds to this pressure. Deepfakes, injection attacks against remote onboarding, synthetic identities and presentation attacks target the binding between the person and the credential rather than the credential itself. That is why our report recommends treating deepfake, injection and synthetic identity attacks as design conditions for remote onboarding.
5. The role of technology providers
A trust framework defines what needs to be demonstrated, but it is technology providers who put those requirements into practice. We see their role mainly in four dimensions:
Closing the identity gap. Document verification, biometric matching against the document, liveness detection and authentication at the time of the transaction are the capabilities that connect a person to a registry, an account or a credential.
Defending that binding against AI-enabled fraud. Detecting deepfakes, injection attacks and synthetic identities is part of what makes remote verification reliable.
Maintaining trust over time. Providers that assess every use of an identity, not just onboarding, make it possible to reuse credentials without increasing risk.
Backing their claims with evidence. This is where PCTF certification adds value: it provides an independent third-party assessment against public criteria. For a regulated organization, choosing a certified service can reduce due diligence work and help it justify its decisions to the regulator.
A growing number of providers, including international providers with a presence in Canada, have already certified their verification services against the Verified Person component; Facephi is one example.
For providers seeking to align with the framework, in addition to respecting its principles and offering deployment options that meet each jurisdiction’s sovereignty requirements, we encourage them to take part in sector programs, document results and share what they learn with regulators. The framework improves with real-world evidence.
The next step: connecting what already exists
Canada has already come a long way in digital identity. It has the BC Services Card; Quebec’s Bill 82 on digital identity, passed in October 2025; the country’s first mobile health card in Alberta; and services such as Interac’s Sign-In Service, which supported more than 141 million interactions with government services in 2024. The next step is to connect these initiatives: close the identity gap, make registries interoperable and give each sector an economic reason to adopt a common framework.
Registries, credentials and trust frameworks have one thing in common: they all depend on being able to confirm that there is a verified person behind each transaction. Achieving this is a shared responsibility among governments, organizations and technology providers. The PCTF offers a common foundation to move forward together in that direction.
About the author
Joni Brennan is President of the Digital ID and Authentication Council of Canada (DIACC), a role she has held since 2015. She has worked in digital identity standards for more than 20 years, beginning with the Liberty Alliance in 2003 and including six years as Executive Director of the Kantara Initiative. At DIACC she helped members co-develop the Pan-Canadian Trust Framework and oversees its certification program. She also chairs IDPro, the global professional association for identity practitioners.
About DIACC
Established in 2012, DIACC is a non-profit strategic alliance of public and private sector members committed to advancing full and beneficial participation in the global digital economy by promoting PCTF adoption and conformity assessment. DIACC prioritizes personal data control, privacy, security, accountability, and inclusive people-centred design. To learn more about DIACC, please visit https://diacc.ca/.
