Identity Checks: The Next Step for Secure Email

Identity checks are already part of everyday work for regulated firms. We're changing the way those checks fit into the customer relationship.

Mailock already helps firms exchange sensitive information through email without requiring recipients to create an account or install a single-use app. Our forthcoming Identity, KYC and AML checks apply the same principle to high-fidelity identity verification and screening.

We spoke to Paul Holland, Mailock's founder and CEO, about why we're bringing identity checks into secure email, where the friction exists today and what firms should expect from the new journey.

Why Bring Identity Checks Into Mailock?

For Paul, the starting point is that firms already have ways to perform identity verification, KYC and AML screening.

Some processes are manual. Others use specialist digital services. The opportunity is not to invent a lighter substitute for those checks, but to improve the journey around them.

Mailock has always been built around making regulated communication easier to complete without weakening the controls around it.

Identity checks extend that principle into another part of the customer relationship.

"Can we provide people with technologies that help them solve difficult regulated data problems, but keep it as simple as possible? That is the challenge every day."

Paul Holland, Founder and CEO, Beyond Encryption (Mailock)

The proposition is simple: keep the quality of the identity check, but remove unnecessary friction around it.

Where Does the Friction Come From Today?

The identity check itself is only part of the process.

Firms still have to initiate it, collect the right information, move between systems and bring the result back into their workflow.

That can mean manually keying details into another system, sending a separate link, retrieving results from a specialist service and retaining the evidence in the right place. For the customer, it can mean another account, another password, a separate app or an unfamiliar portal.

Those extra steps are particularly noticeable when the relationship normally happens somewhere else.

If an adviser and client already communicate by email, moving one part of that relationship into a separate environment can make a routine request feel more complicated than it needs to be.

So Why Start the Identity Journey in Email?

Because that is often where the relationship is already happening.

With Mailock, the sender can initiate a check from Outlook or the Mailock web app, the customer then receives a secure email from the firm and completes the check on their smartphone.

The underlying document, biometric, identity-data and screening work still uses specialist, certified, and highly accurate identity technology. What Mailock changes is the journey around it.

We are not replacing high-fidelity identity verification with a lighter email-based check. We are bringing high-fidelity identity and screening checks into a familiar email journey.

What Will the Mailock Identity Check Journey Look Like?

Identity, KYC and AML checks will soon be available to Mailock Pro accounts. So how will they work?

A sender starts the check from Outlook or the Mailock web app. The client receives the request by secure email and completes it on their phone without creating another account or installing an app.

The client photographs a supported passport or driving licence and takes a live selfie. Additional checks and screening are then run as required. Mailock supports three check types:

• Identity: government identity document, face match and liveness.
• KYC: Identity plus address, date of birth, age, credit-activity and mortality checks.
• AML: KYC plus politically exposed person (PEP) and sanctions screening.

Mailock uses LexisNexis Risk Solutions for the underlying identity and data checks. LexisNexis Risk Solutions IDVerse handles document authentication, liveness and face matching, while IDU corroborates customer details and performs PEP and sanctions screening.

LexisNexis reports that IDVerse achieves 99.998% face-match accuracy and IDU draws on more than 2.85 billion UK consumer data points.

Mailock brings the results together in a comprehensive pack delivered by secure email for the firm's team to review (Enterprise users can arrange secure transfer into a CRM or document system).

How Is Identity Verification Different From Recipient Authentication?

Paul is clear that bringing identity checks into Mailock does not turn them into another form of recipient authentication.

The two controls answer different questions.

Encryption protects message content. Recipient authentication controls access to a message. An email code shows access to an inbox, SMS shows access to a mobile number and a question-and-answer challenge tests knowledge the sender expects the recipient to know.

Identity verification provides stronger independent evidence that the person completing a check corresponds to the identity they claim.

"An address - email or physical - itself, is not confirmation of who's behind the address. You need something richer that enables you to do more because you know who that person is."

Paul Holland, Founder and CEO, Beyond Encryption (Mailock)

Putting both capabilities in the same platform means firms can use the level of assurance appropriate to the task without changing the surrounding communication channel.

Should You Always Use the Strongest Check?

No. The strongest check is not automatically the right check.

The level and type of assurance should reflect the action being taken, the firm's risk assessment and the evidence it already holds.

This is an illustrative framework, not a compliance standard.

Each organisation must set its own thresholds, accessible alternatives and exception routes based on its risk context and policies.

What Does a Successful Identity Check Actually Tell the Firm?

The important distinction is between identity evidence and the firm's final decision.

HMRC guidance distinguishes identifying a customer from verifying that identity using reliable, independent evidence.

HM Treasury and DSIT guidance also explains how certified and registered digital verification services can support identity verification under the Money Laundering Regulations while responsibility for customer due diligence remains with the firm.

Mailock returns a secure results pack containing the overall result, individual check results and the supporting evidence available.

That evidence can inform the firm's decision and provide a record of what was checked at the time.

For Paul, that brings the proposition back to the principle Mailock started with: give firms the controls and evidence they need, while keeping the customer journey as familiar and straightforward as the task allows.

FAQs

What Is an Identity Check in Mailock?

An authorised sender requests the check from Outlook or the Mailock web app. The client photographs a supported government identity document and takes a live selfie on their phone.

How Is an Identity Check Different From Recipient Authentication?

Email and SMS checks show access to a contact route. A question-and-answer check tests expected knowledge. An identity check checks a supported government identity document and compares its photograph with a live person.

Does the Client Need Another Account or App?

No. The client starts from the secure email in their inbox and completes the check on their phone without creating an account or installing an app.

What Does the Sender Receive?

A secure, comprehensive results pack containing the overall result, individual check results and the supporting evidence available. Enterprise customers can arrange secure transfer into a CRM or document system.

Does an Identity Check Make the Compliance Decision?

No. It supplies evidence at the time of the check. The requesting organisation remains responsible for its risk assessment, customer decision, record keeping and any further due diligence.

References

Logins Gone Wild: The State of Consumer Overwhelm, Beyond Encryption, 2024

ECSH33326: Identification and Verification, HM Revenue & Customs, accessed 2026

Using Digital Identities With the Money Laundering Regulations, HM Treasury and Department for Science, Innovation and Technology, 2026

IDVerse, LexisNexis Risk Solutions

IDU, LexisNexis Risk Solutions

Reviewed by

Sam Kendall, 21.08.26

This content is for general information only and is not legal advice.