Electronic identity verification for clients

Q: What are the limits of electronic checks?

Screening is not verification. ICAEW reviewers have warned that many electronic tools mainly screen for sanctions, politically exposed persons and adverse media rather than verifying identity. ICAEW's own client screening service is described as checking names against risk data and expressly not verifying identity. Identity is only one part of CDD. The HM Treasury guidance says firms should not assume a digital identity meets every part of customer due diligence, such as assessing the purpose and intended nature of the relationship, and that the firm remains liable for any failure when it uses a provider. Single sources are weak. ICAEW notes that one source, such as the electoral register, is not usually sufficient. Beneficial owners need more. Regulation 28(9) says a firm does not meet its beneficial owner duties by relying solely on information delivered to Companies House. See beneficial ownership verification. Records must survive the contract. Regulation 40 requires CDD records to be kept for five years from the end of the relationship, and the HM Treasury guidance tells firms to check that the service can meet this. ICAEW suggests asking whether results can be downloaded or are held only in the provider's cloud. Fabricated documents. ICAEW's June 2026 article on economic crime red flags notes that AI has made fabricated documents and artificial identities more convincing, so independent evidence and professional scepticism still count.

Q: What does this look like on a real file?

Illustration only. A practice takes on a new two director company remotely. Director A completes a certified DVS check through the provider's app, which matches her passport chip to a live selfie. The practice saves the result report to its own system. Director B lives overseas and holds a passport the provider cannot read. The practice follows AMLG11400 paragraph 14.6: it obtains the same type of documents it would for a UK resident, has a copy certified, checks the document details carefully and records each step. It verifies the company against the register, asks the company for its own register of members to corroborate ownership rather than relying solely on the PSC entries, screens all names for sanctions and PEP status, and records the purpose of the engagement and a medium risk rating with reasons.

Electronic identity verification lets a practice confirm who a client is through a digital check instead of inspecting original documents. Under regulation 28(19) of the Money Laundering Regulations 2017 it counts as reliable, independent evidence only if the process is secure from fraud and misuse and gives real assurance that the person is who they claim to be. Since 2026, HMRC, HM Treasury and the CCAB guidance all point firms towards services certified against the UK digital verification services trust framework and listed on the DVS register, and an uncertified service cannot be relied on alone.

Tax investigation insurance from £108.75 a year (£9.06 a month).Pays up to £100,000 of your accountant's fees if HMRC opens an enquiry. No excess. Buy online in a few minutes.

See my price in 2 questions How the cover works Accountant? Offer cover to your clients or call 01795 841 310

What does the law say about verifying identity electronically?

Regulation 28(2) of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (the MLRs) requires a firm to identify its customer and verify that identity. Regulation 28(18) defines “verify” as verifying on the basis of documents or information obtained from a reliable source which is independent of the person being verified.

Regulation 28(19) then says that information may be treated as coming from a reliable and independent source where it is obtained by an electronic identification process and that process is:

secure from fraud and misuse; and
capable of providing assurance that the person claiming a particular identity is in fact that person, to the degree needed to manage the money laundering and terrorist financing risk.

The same test appears in the enhanced due diligence rules. Regulation 33(6)(b)(iii) lists non face to face relationships “without certain safeguards, such as an electronic identification process which meets the conditions set out in regulation 28(19)” as a factor pointing to higher risk. A good electronic check is therefore not only a convenience: it is the safeguard that stops a remote client relationship being treated as higher risk on that ground alone.

Timing still applies. Regulation 30(2) requires verification before the business relationship is established, with a limited exception in regulation 30(3) where verification is completed as soon as practicable, it is necessary not to interrupt normal business and there is little risk.

What is the DVS trust framework and why does it decide which tools count?

HM Treasury and the Department for Science, Innovation and Technology published joint guidance in February 2026, Using digital identities with the Money Laundering Regulations, which states that it is approved guidance for MLR purposes. It explains that the UK digital identity and attributes trust framework was first developed in 2020, draws on Good Practice Guide 45 on proving and verifying identity, and is technology and sector neutral.

Providers are certified against the framework by an independent conformity assessment body overseen by UKAS. Certified services can then be listed on the DVS register, which the Office for Digital Identities and Attributes maintains under the Data (Use and Access) Act 2025, and they can be removed if they breach the framework. The guidance says certified and registered services are a reliable and independent source with an appropriate level of anti impersonation assurance, and that firms can use them to meet regulation 28 for individuals and for verifying company directors. Services that are not certified, and so not on the register, “cannot reliably be deemed suitable” for MLR identity verification.

HMRC repeats this in its own supervised business guidance at AMLG11400 (paragraph 14.5), and the 2026 CCAB guidance for the accountancy sector, as summarised by ICAEW, adds that a service not on the register cannot be relied on alone and the firm will need alternative evidence of identity.

Worried about an HMRC check? Tax investigation insurance pays your accountant’s fees if HMRC opens an enquiry or compliance check. Solar Protect cover pays up to £100,000 with no excess. It never pays tax, interest or penalties.

From £108.75 a year (£9.06 a month) for individuals, £117.57 for sole traders and £207.50 for companies and partnerships, including IPT and the £20 admin fee.

See my price in 2 questions or call 01795 841 310.

★★★★★ Rated 4.9 out of 5 on Trustpilot from over 160 reviews

How does a digital identity check actually work?

ICAEW’s helpsheet on electronic client due diligence describes three stages where electronic resources can help:

Identification: gathering information about the client and, for an organisation, its beneficial owners.
Risk assessment: deciding how much evidence is needed, which the firm must still do itself whatever system it uses.
Verification: validating against independent, authoritative sources that the identity is genuine and belongs to the person presenting it.

Verification is the hard part. The helpsheet points out that being given a passport number does not prove the person is the holder, and that stronger systems use photo analysis to test the authenticity of documents, facial recognition, or a unique code sent to the subject. Those features are what link the document to the living person, and they are what the regulation 28(19) test is looking for.

What are the limits of electronic checks?

Screening is not verification. ICAEW reviewers have warned that many electronic tools mainly screen for sanctions, politically exposed persons and adverse media rather than verifying identity. ICAEW’s own client screening service is described as checking names against risk data and expressly not verifying identity.
Identity is only one part of CDD. The HM Treasury guidance says firms should not assume a digital identity meets every part of customer due diligence, such as assessing the purpose and intended nature of the relationship, and that the firm remains liable for any failure when it uses a provider.
Single sources are weak. ICAEW notes that one source, such as the electoral register, is not usually sufficient.
Beneficial owners need more. Regulation 28(9) says a firm does not meet its beneficial owner duties by relying solely on information delivered to Companies House. See beneficial ownership verification.
Records must survive the contract. Regulation 40 requires CDD records to be kept for five years from the end of the relationship, and the HM Treasury guidance tells firms to check that the service can meet this. ICAEW suggests asking whether results can be downloaded or are held only in the provider’s cloud.
Fabricated documents. ICAEW’s June 2026 article on economic crime red flags notes that AI has made fabricated documents and artificial identities more convincing, so independent evidence and professional scepticism still count.

How should electronic checks be combined with other evidence?

The 2026 CCAB guidance added a section, based on JMLSG guidance, setting a hierarchy of reliable and independent documents with a passport as the preferred evidence. HMRC’s AMLG11400 lists acceptable photographic documents (passport, photocard driving licence, national identity card and others) and says at least one form of evidence should include a photograph. Where a certified electronic service cannot complete a check, these documents are the fallback.

A practical file usually combines:

a certified DVS check, or original documents seen by the firm, for each individual;
registry evidence for any company, plus the firm’s own work on ownership and control;
sanctions and PEP screening, recorded separately from identity verification (see sanctions checks for accountants);
a note of the purpose and intended nature of the engagement and the client risk rating.

ICAEW reviewers have also said that obtaining and reviewing original identification documents remains one of the strongest forms of verification, so an electronic check is an alternative route to the same standard, not a lower one. Higher risk clients will need more, as described in enhanced due diligence.

What should a practice ask before choosing a provider?

ICAEW’s helpsheet suggests firms assess and document whether a system draws on multiple independent, authoritative sources, how often its data is updated, what integrity checks it runs, whether results can be retrieved for the retention period, how it shows the client is who they claim to be, and what protects it from fraud and misuse. To that list a firm should now add the simplest question of all: is this service certified and on the DVS register? If it is not, the HM Treasury guidance means it cannot be the only evidence.

What does this look like on a real file?

Illustration only. A practice takes on a new two director company remotely. Director A completes a certified DVS check through the provider’s app, which matches her passport chip to a live selfie. The practice saves the result report to its own system. Director B lives overseas and holds a passport the provider cannot read. The practice follows AMLG11400 paragraph 14.6: it obtains the same type of documents it would for a UK resident, has a copy certified, checks the document details carefully and records each step. It verifies the company against the register, asks the company for its own register of members to corroborate ownership rather than relying solely on the PSC entries, screens all names for sanctions and PEP status, and records the purpose of the engagement and a medium risk rating with reasons.

What mistakes do firms make with digital ID?

Treating a sanctions or adverse media screen as identity verification.
Using a service that is not on the DVS register as the only evidence.
Keeping only a pass or fail flag, with no record of what was checked.
Losing access to results when the subscription ends, breaching regulation 40.
Rechecking every client on a fixed cycle. ICAEW reviewers said firms need not obtain fresh documents merely because existing ones have expired if the client’s circumstances and risk are unchanged, although HMRC’s AMLG11411 refers to replacing expired documents, so firms should follow their own supervisor’s guidance. The general rules are in customer due diligence for accountants.

Solar Protect runs fee protection schemes for accountancy and bookkeeping practices. See how our accountant schemes work or read fee protection schemes for accountants.

Related Accountapedia entries

Sources

Reviewed by Christine Anderson, Broker, Solar Protect. Last reviewed 8 October 2026. Part of Accountapedia, the Solar Protect guide to UK tax and accounting. This page is general information, not personalised advice.