A client emails three months of payslips and bank statements to you with their National Insurance number typed into the body of the message. They did exactly what they were asked. Nobody told them there was another way to send in this information.
Your firm now holds sensitive financial information in an unencrypted mailbox. The connection may have been encrypted in transit, but you can't verify it was encrypted at every point. And if anyone gains access to the inbox, there are no checks applied to prevent access to all the content.
This guide covers how to ask for documents and personal details, how to make the request easy to answer securely, and how the approach changes for fact finds, proof of income, letters of authority, and identity documents. For more on the documents you send to clients, see our guide to sending suitability reports and review packs securely.
Contents
Decide What You Need Before You Ask
Every document a client sends is something your firm then has to protect, store, and eventually delete. Before you ask, list the documents and details the case actually needs, and the period each one should cover.
Where a lender, provider, or platform sets the requirements, work from their current list rather than a generic one. Requirements differ on how many months of statements or payslips they want, and asking for the wrong set means a second request and a second round of documents.
Check whether your firm already holds the information needed for this request. Use the case requirements to decide what needs updating, rather than asking the client to resend an entire pack by default.
Send the Request Securely, So the Reply Comes Back the Same Way
One way to collect documents is to send the request as a secure message with a protected reply route.
The client opens that message and replies within the secure service with their attachments, rather than using the ordinary reply button in their inbox. A client portal or upload service can also provide a protected route where your firm already uses one.
With Mailock, clients can reply securely, including with attachments, without creating a Mailock account. The reply is encrypted with AES-256 encryption, just as with the initial message.
"All personal information, like bank details and national insurance numbers, we will request via Mailock. We then get clients to reply within the secure email system so that they know it's safe."
Fraser Bone, Financial Adviser, Simple Financial Services
A familiar process can help clients recognise your communications. Familiar branding alone does not establish that a request is genuine, so give clients a known way to check before sending anything unexpected.
Tell clients in advance how your requests will arrive, and how to check one that looks unusual, using contact details they already trust rather than simply relying on the details in the message.
Make the Request Easy to Answer
A simple law that experienced advisers will know well - a client who can't work out what you want them to send will send what they have, by whatever route is quickest. A clear request saves both of you time and effort.
What to Put in a Document Request
- Each document by name, and the period it should cover.
- How to send it: reply to this secure message and attach the files.
- Which format works best, such as PDFs downloaded from online banking.
- Any details to leave out of the subject line and of ordinary email.
- Who to contact if something doesn't work, and how.
Ask for readable files in the required format. Where the lender or provider accepts a downloaded PDF, that may be easier for the client than photographing several pages. Their current document requirements determine which formats are suitable.
Note that it's important to keep identifiers out of places they don't need to be. A National Insurance number or account number belongs inside the secure reply, not in a subject line, a text message, or an ordinary email that says "see attached".
The ICO's guidance on encryption and data transfer explains the protection encryption provides in transit and the remaining risks once information arrives.
Adapt the Request to the Document
The same request-and-reply process can cover most of what advisers collect. What changes is what you need the client to do, and whether a file is the right thing to ask for at all.
Fact Finds and Client Questionnaires
A fact find gathers a great deal of personal and financial information in one place. If the client completes it in your firm's own system, they may not need to send a separate file back. If they complete a form, they can return it as an attachment to a secure reply.
Some sections are easier to complete together. A short call to go through the parts a client finds difficult can often save several rounds of questions shuffling back and forth by email.
Payslips, Bank Statements, and Proof of Income
Proof of income is where volume becomes the problem. A mortgage case can need several months of payslips and statements for each applicant.
"If you were doing a mortgage today, I would be asking you for 3 months of bank statements, 3 months of payslips - all of your documentation. Some of that may be collected by the adviser when they are with the client, but a lot of it was being sent to us by unsecured email. We needed a system where we could send documents to them, and they could send them back to us on a secure basis."
Deb Owen, Administration Manager, Rapport Financial Strategists
For clients who are unsure whether they can email a bank statement at all, our guide to whether it's safe to email bank details explains the risks in plain terms, and sending bank statements securely covers the client's side of the process.
National Insurance Numbers and Account Details
NI numbers and bank details are data, not documents, and there might be no file to attach. That makes them easy to send carelessly: a number typed into a text message or an ordinary email reply. Ask for them inside the secure request, and ask the client to reply with them there.
Letters of Authority
Where your firm asks a client to return a letter of authority, a secure reply can carry the completed document back.
But providers often set their own requirements, including which signatures they accept and how they want the letter sent to them. Check the provider's current requirements before the client signs, so the letter is in the format needed.
Letters of authority remain a well-known delay in advice: we backed the #LogYourLoAPain campaign to measure how much time they take.
Identity Documents
A scan attached to an email shows what a document looks like, but nothing has checked that it's genuine or that it belongs to the person who sent it. Where you need to verify an identity document, a client can complete an identity check instead, photographing a supported document within the check itself; our guide to running remote ID checks for clients explains the journey.
Note that the results pack for an identity check can include document copies, so file it with the rest of the client record.
Mortgage Brokers: The Same Process, More Documents
Brokers can collect large document packs on tight timelines: identification, proof of income, bank statements, and proof of address, for each applicant, often across several rounds as a case develops.
"With the pandemic, so much of what we do is online now, which means clients are sending me passports, bill copies, bank statements, and driving licences regularly. This is crucial information, and it's important under GDPR that clients' documents are safe and secure."
Craig Esplin, Mortgage and Protection Adviser, Fair Deal Mortgages
The lender's own upload portal might be where the documents end up. But secure email covers the earlier step: getting documents from the client to the broker, before the broker packages and submits the case.
Clients differ in how they may want to do that. Mortgage Advice Bureau uses Mailock so that clients who prefer email have a secure option alongside portals. As Graham Bennett, the Group's Head of Information Security and Data Protection, puts it: "we work with both portals and email because it's vital to provide options that fit all client needs."
Decide Where the Documents Go Next
Receiving documents securely only covers their journey to the firm. Your process also needs to say where the documents go next: who handles the reply, where the client record is kept, and how any downloaded or duplicate copies are managed.
If a client sends more than you asked for, or something you don't need, deal with it under your firm's data-handling and retention arrangements rather than keeping it by default.
Your compliance team sets those rules; the request is where you can stop unneeded documents arriving in the first place.
"Most of the risk in collecting documents is set before the client ever replies. If the request says exactly what's needed and how to send it back, the client sends it that way. If it doesn't, they use whatever they used last time."
Carole Howard, Head of Networks, Beyond Encryption (Mailock)
Choose a Route Your Clients Can Use
The right route depends on how your clients work and what your firm already uses.
A client portal can suit regular exchanges and give clients a lasting place to find their documents. A configured upload link may suit a one-off collection, although its permissions and expiry need to fit the request.
Secure email suits clients who would rather reply to a message than create another login, and it works for a one-off request without setting up an account.
If your firm considers messaging apps, its assessment needs to cover records, access, and document handling as well as encryption; our article on whether WhatsApp is secure enough for sensitive information explains why.
From Mailock
Collecting Client Documents by Email?
Learn how Mailock lets clients reply securely with their documents, without creating an account.
Start a free Mailock Pro trial
Whichever route you use, test it as a client would: send a sample request without real client data, reply with a few attachments, and check what arrives. That shows you where the instructions need to be clearer before a real client gets stuck.
The Wrap Up
Ask only for what the case needs, and make the secure reply route clear from the first request. Once the documents arrive, handle them under your firm’s filing and retention process. Start with your next document request: check that it tells the client exactly what to send, which period to cover, and how to return it securely.
FAQs
Can a Client Reply Securely Without a Mailock Account?
Yes. A client can reply securely to a Mailock message, including with attachments, without creating an account.
Is It Safe for a Client to Email a Bank Statement?
Ordinary email may be encrypted in transit, but anyone who can get into the inbox it arrives in can open the attachment, so a reply to a secure request is the safer route. Our guide to whether it's safe to email bank details covers the risks and other options.
Should I Ask Clients to Email a Copy of Their Passport?
If you need to verify who the client is, an identity check is usually a better route than an emailed scan: the client photographs their document within the check, and the results come back to you by secure email. If your process needs a copy of the passport itself, ask for it as an attachment to a secure reply.
What If a Client Sends Documents by Ordinary Email Anyway?
Follow your firm's data-handling process and, if disclosure is suspected, its incident process. Explain how to use the protected reply route for the next exchange.
References
Encryption and Data Transfer, Information Commissioner's Office, accessed 2 November 2026
Reviewed by
Sam Kendall, 02.11.26
Read our editorial policy.
This content is for general information only and is not legal advice.
Sam Kendall
.svg)
Previous post