Digital ID and the Money Laundering Regulations: A Simple Guide to Remote Checks

A new client lives at the other end of the country and wants to get started this week. You won't meet them in person, so how do you check they are who they say they are?

For most financial services firms, the answer might start with the Money Laundering Regulations. They don't require you to meet a client face to face, and they allow identity to be verified electronically. In February 2026, the government also published guidance on how digital identity services fit with those rules.

This guide explains, in plain terms, what the regulations expect, what they mean when you deal with clients at a distance, and how firms put digital checks into practice.

It is a breakdown of the official guidance, not legal advice. How they apply to your firm is a decision for your compliance team and your Money Laundering Reporting Officer (MLRO).

Contents

• What Do the Money Laundering Regulations Ask For?
• Can You Check a Client's Identity Remotely?
• What Does the 2026 Digital Identity Guidance Say?
• Beyond the Identity Check: Data Checks and Screening
• What Do Financial Services Firms Need to Do?
• How Firms Put Remote Checks Into Practice
• Explaining a Digital Check to Your Client

What Do the Money Laundering Regulations Ask For?

The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, usually called the Money Laundering Regulations or MLRs, set out what regulated businesses must do to stop their services being used for money laundering or terrorist financing.

The FCA, which supervises financial services firms under the MLRs, says they typically apply to banks, building societies, investment managers, financial advisers, investment firms, payment and e-money institutions, and consumer credit lenders, among others. Mortgage brokers and general insurers are not bound by them, although they still need controls against financial crime.

The key relevant requirement to client checks is customer due diligence (CDD) - Regulation 28 sets out what that involves:

The regulations describe what a firm needs to establish, and they don't require a face-to-face meeting to establish it.

Can You Check a Client's Identity Remotely?

In short, yes. Regulation 28(19) says information from an electronic identification process counts as coming from a reliable, independent source. The process has to be secure from fraud and misuse, and able to verify that the person claiming an identity really is that person, to the degree needed to manage the money laundering risk.

Distance is still something to weigh. Regulation 33 lists non-face-to-face relationships among the factors a firm must consider when deciding whether a situation is high risk. It qualifies that: the factor applies to relationships "without certain safeguards", such as an electronic identification process that meets the Regulation 28(19) conditions.

The financial sector's own guidance goes into more detail. The FCA points firms to the guidance from the Joint Money Laundering Steering Group (JMLSG), whose current Part I says that, with appropriate controls in place, non-face-to-face business may not pose a higher risk.

It also says a remote check has two jobs. The firm needs to show that the person exists, and that the person applying is that person. Where identity is checked electronically or the client isn't present, the JMLSG expects an extra step that links the person to the identity. The options it lists include:

• biometric checks, such as facial recognition with a liveness check;
• a one-time code sent to a verified mobile phone;
• requiring the first payment to come from an account in the client's name at a UK or EU regulated bank.

What Does the 2026 Digital Identity Guidance Say?

On 26 February 2026, HM Treasury and the Department for Science, Innovation and Technology published Using Digital Identities With the Money Laundering Regulations. It is approved guidance for the purposes of the MLRs, and it explains how the government's digital identity standards fit with customer due diligence.

Those standards are the UK digital identity and attributes trust framework. Digital identity services can be independently certified against it. Certified providers can join the digital verification services (DVS) register, a public list kept by the Office for Digital Identities and Attributes.

The guidance says the same certified services can also be used to verify company directors. It adds that services which aren't certified and registered can't reliably be treated as suitable for identity verification under the MLRs.

Certification belongs to the service that carries out the check. Firms often reach a checking service through another product, such as a client portal, a CRM, or a secure email platform like Mailock.

The register lists the provider that runs each certified service, so the question to ask is which service carries out the check, and what the register says about it.

The guidance also sets out what a digital identity doesn't do. Firms should:

• keep making their own assessment of each client's risk, and apply enhanced due diligence where it's needed;
• not assume a digital identity covers every part of due diligence, such as understanding the purpose and intended nature of the relationship;
• make sure the service lets them meet the record-keeping rules in Regulation 40, which means keeping a copy of the documents and information used for due diligence for five years after the relationship ends.

The firm stays responsible. The guidance says firms remain ultimately liable for any failure to apply due diligence properly when they use a digital identity service.

Beyond the Identity Check: Data Checks and Screening

A document-and-selfie check answers one question: is this person who they claim to be? Customer due diligence asks more than that. The government guidance describes it as giving firms reasonable satisfaction that clients are who they say they are, and that there are no legal barriers, such as sanctions, to providing the service.

That's why products sold as KYC or AML checks often add further checks to the identity check. These results can support both standard and enhanced due diligence, and they fall into three broad groups.

Data Checks Against Other Records

Electronic data checks compare the client's details, such as their name, address, and date of birth, with other records. The JMLSG describes two kinds of information.

Positive information helps show that a person exists. Negative information, such as fraud databases and registers of deceased people, helps guard against someone using another person's identity.

Politically Exposed Person Screening

Regulation 35 requires firms to have systems to find out whether a client, or a client's beneficial owner, is a politically exposed person (PEP), or a family member or known close associate of one. PEPs are people entrusted with prominent public functions, such as ministers, members of parliament, and senior judges.

If a client is a PEP, the firm must assess the risk and decide the extent of enhanced due diligence. The regulations treat UK (domestic) PEPs as starting from a lower level of risk than PEPs from other countries.

Sanctions Screening

UK financial sanctions apply to everyone in the UK and to UK persons anywhere in the world. Under the general guidance from the Office of Financial Sanctions Implementation (OFSI), a firm that holds or deals with the funds of a designated person must freeze them, must not make funds available to that person, and must report to OFSI.

Designated people are listed on the UK Sanctions List. Screening clients against it helps a firm find out whether it's dealing with one.

Screening at onboarding is a snapshot. A PEP or sanctions check shows the position on the day it runs. Ongoing monitoring under Regulation 28(11), and keeping up with changes to the sanctions list, need their own arrangements.

What Do Financial Services Firms Need to Do?

Putting the official sources together, these are the main points for a firm that checks clients remotely. Each comes from the regulations, the FCA, or the guidance named. Your MLRO decides how they apply to your firm.

• Assess the risk first. The FCA expects firms to assess the risks their business faces, and to assess the risks of new technology before launching it.
• Give staff clear procedures. In its 2025 review of due diligence, the FCA found that most firms had documented procedures for verifying customer identity, but few gave staff enough practical guidance.
• Know who your provider is. Find out which service actually carries out the check, including when it sits behind another product, and look that service up on the DVS register. The JMLSG also expects firms to understand what checks a service runs and what its results mean.
• Link the person to the identity. Electronic checks should show both that the person exists and that the applicant is that person, using steps such as a liveness check or a one-time code.
• Complete other aspects of due diligence. Understanding the relationship, PEP and sanctions screening, identifying the owners of company clients, and ongoing monitoring all sit outside a document-and-selfie identity check.
• Do more where the risk is higher. Regulation 33 requires enhanced due diligence in higher-risk cases, on top of the standard checks.
• Keep the evidence. Regulation 40 requires firms to keep a copy of the documents and information they obtained for due diligence, and supporting records of transactions, for five years after the relationship ends. The JMLSG adds that a provider should let the firm capture and store the information used to verify an identity, or a record of the level of assurance reached. After the five years, personal data must be deleted unless an exception applies.

How Firms Put Remote Checks Into Practice

These fictional examples show how the rules above can turn into everyday steps. They show common approaches, not a procedure to copy. Your firm's own policy sets the actual steps.

A New Client Who Lives Far Away

A wealth management firm takes on a client who lives 200 miles from its nearest office. Instead of asking for certified copies by post, the adviser sends the client a request using a certified digital identity service. The client photographs their passport and takes a live selfie on their phone, and the result comes back to the firm.

The check covers who the client is. The adviser still records why the client wants the relationship and what they plan to invest, because the identity result doesn't cover those obligations.

A Client Who Already Has a Digital ID

A client says they already have a digital identity app, which they used when opening a bank account, and asks if they can use it instead of a new check. The JMLSG recognises that a client may offer a digital identity they already hold, as long as the firm considers the provider against the same criteria it would apply to any other.

Accepting it involves more than it might seem. Under the trust framework, the firm would be a relying party: the client agrees to share their verified details from the app, and those details reach the firm through the app provider's own service.

That usually needs an arrangement with the provider, either directly or through a service that connects to several. A screenshot or forwarded copy of the app doesn't come from the provider, so it doesn't carry the same assurance.

The firm doesn't need its own certification to be a relying party. Before relying on the identity, it would typically check:

• that the app's service is on the DVS register;
• the level of confidence the identity was checked to, which certified providers must be able to share with relying parties;
• that it receives a record of what was shared, and when, that it can keep under Regulation 40.

If the firm has no way of receiving identities from that provider, the client can complete the firm's usual check instead.

A Remote Case That Needs a Closer Look

A new client wants to invest a large sum quickly and turns down every offer of a video call. The JMLSG says firms should consider whether a client is deliberately avoiding face-to-face contact.

A completed identity check doesn't completely settle that question. If the firm decides the case is higher risk, Regulation 33 requires enhanced due diligence on top of the standard checks, and the firm's own policy and MLRO set what that involves, digital or otherwise.

A Company Client

A small company asks to open an investment account. Its director completes a digital identity check from their phone, which the government guidance says certified services can be used for.

That check covers the director as an individual. Regulation 28 also asks for the company's details and its beneficial owners, and a personal identity check doesn't provide either.

"Before turning to remote checks, agree the practical details: who sends the request, what staff do when a check doesn't pass, and where the result is kept. Those are the questions that slow a team down once checks are live."

Adam Byford, COO, Beyond Encryption (Mailock)

How the Request Reaches the Client

Clients are told to be wary of unexpected links, especially ones that ask for a photo of their passport. How the request arrives can decide whether a client trusts it enough to start.

Some firms send it from a contact the client already knows, with an explanation in the same message. Some send it inside a secure email that the client unlocks with a code sent to their mobile, like they would with Mailock - a firm sends an identity-check request from Outlook or the web app, and the client opens it with an SMS code.

The client would then photograph a supported passport or driving licence and take a live selfie on their phone, and the results pack comes back to the firm by secure email. Our guide to choosing an identity check explains the ID (Identity Document), KYC (Know Your Customer), and AML (Anti-Money Laundering) check types.

In Mailock, the KYC check can add address, date-of-birth, age, credit-activity, and mortality checks to the identity check, and the AML check can add PEP and sanctions screening.

Whichever service you use, a check labelled KYC or AML supplies evidence for your process.

It doesn't mean the firm's full due diligence is complete.

Explaining a Digital Check to Your Client

A remote check goes more smoothly when the client knows it's coming. A short explanation from the adviser can be the difference between a check finished the same day and one left sitting in an inbox.

"Most clients are happy to prove who they are. What puts them off is a request they weren't expecting, with nothing to say why it's needed. Tell them what's coming and how to check it came from you, and they're far more likely to finish it."

Paul Holland, Founder and CEO, Beyond Encryption (Mailock)

Before you send the request, it helps to cover a few points with the client, by phone or in your usual correspondence.

Some clients won't be able to complete a digital check, for example because they don't have a smartphone or a current photo ID.

The JMLSG notes that people who can't reasonably be expected to produce standard evidence of identity shouldn't be unreasonably denied access to financial services, so your procedures need another route for them.

Digital identity gives firms a recognised way to check clients they may never meet. The duties around it stay the same: know who the client is, understand the relationship, match the checks to the risk, and keep the evidence.

FAQs

Do the Money Laundering Regulations Allow Remote Identity Checks?

Yes. Regulation 28(19) treats information from a secure electronic identification process as coming from a reliable, independent source, as long as it gives enough assurance that the person is who they claim to be.

Is a Client I Never Meet Automatically High Risk?

No. Regulation 33 lists non-face-to-face relationships as a risk factor where they happen without safeguards, such as a suitable electronic identification process. The firm weighs it with the other risk factors.

Does a Digital Identity Check Complete Customer Due Diligence?

No. It can verify who a client is, but the firm still needs to understand the purpose of the relationship, identify the owners of company clients, monitor the relationship, and apply enhanced due diligence where the risk is higher.

Does an Identity Check Include PEP and Sanctions Screening?

Not by itself. A document-and-selfie check verifies identity. PEP and sanctions screening are separate checks, although some products sold as AML checks include them.

How Can I Tell If a Digital Identity Service Is Certified?

Search the government's DVS register. It lists the providers and services certified against the UK digital identity and attributes trust framework, with their certificate dates. If a check reaches you through another product, look up the service that carries out the check.

How Long Do I Need to Keep Identity Check Records?

Regulation 40 requires a copy of the documents and information obtained for due diligence, and supporting records of transactions, to be kept for five years after the business relationship ends, or after an occasional transaction is complete.

References

Using Digital Identities With the Money Laundering Regulations, HM Treasury and the Department for Science, Innovation and Technology, 26 February 2026

The Money Laundering Regulations 2017, Regulation 28: Customer Due Diligence Measures, legislation.gov.uk, current text checked 20 October 2026

The Money Laundering Regulations 2017, Regulation 33: Obligation to Apply Enhanced Customer Due Diligence, legislation.gov.uk, current text checked 20 October 2026

The Money Laundering Regulations 2017, Regulation 35: Enhanced Customer Due Diligence: Politically Exposed Persons, legislation.gov.uk, current text checked 20 October 2026

The Money Laundering Regulations 2017, Regulation 40: Record-Keeping, legislation.gov.uk, current text checked 20 October 2026

Money Laundering and Terrorist Financing, Financial Conduct Authority, updated 11 February 2026

Firms' Customer Due Diligence Processes and Controls: Our Findings, Financial Conduct Authority, 8 April 2026

Prevention of Money Laundering/Combating Terrorist Financing: Guidance for the UK Financial Sector, Part I, Joint Money Laundering Steering Group, October 2026, especially paragraphs 5.3.79 to 5.3.90 and 5.3.109

Find Registered Digital Verification Services, Office for Digital Identities and Attributes, GOV.UK

UK Financial Sanctions General Guidance, Office of Financial Sanctions Implementation, updated 12 May 2026

The UK Sanctions List, Foreign, Commonwealth and Development Office, updated 16 October 2026

UK Digital Identity and Attributes Trust Framework (0.4), Department for Science, Innovation and Technology, 25 November 2024

Reviewed by

Sam Kendall, 20.10.26

Read our editorial policy.

This content is for general information only and is not legal advice.