You have advised a client for years. Their identity was checked when they joined, and the evidence is on file. Now an email arrives asking for a withdrawal, using a contact address you have not seen before. What connects this request to the person you know?
For independent financial advisers (IFAs) and advice firms of all sizes, that can be a familiar problem. Long-standing clients move house, change contact details, and send requests between meetings.
The risk continues after onboarding. Cifas members recorded more than 78,000 account-takeover cases in 2025, up 6% on 2024. Those are filings across sectors, rather than a measure of fraud against advisers, but they show why an established account can still be a target.
For firms within scope of the Money Laundering Regulations, the obligations continue too. The FCA's guidance on ongoing monitoring explains the need to keep knowledge of the client relationship current. Meeting clients face to face or confirming a remote request through another channel can contribute to that picture, but they only go so far.
So, is a full identity check at onboarding enough?
Let's look at what a check tells you, what happens afterwards, and where another check may fit.
An identity check at onboarding provides evidence about an individual when the relationship begins. It gives you a record to refer to when that client returns.
It cannot, by itself, establish who controls a mailbox or phone number several years later, or whether the client authorised a particular instruction.
The age of the file is only part of the picture. The communication route, the request, and the information available later can all differ from the circumstances in which the original check was completed.
"An onboarding record gives a firm a starting point. When a later request arrives by email, the team still needs to understand what connects that request to the client it knows."
Paul Holland, Founder and CEO, Beyond Encryption (Mailock)
You may know the client well. You still need to know whether it's them asking you to act today.
What Are the Obligations After Onboarding?
For firms subject to the relevant Money Laundering Regulations, Regulation 28(11) requires ongoing monitoring of the business relationship. That includes scrutiny of transactions and reviewing records to keep customer due diligence information up to date.
Regulation 27 also addresses existing customers: due diligence at appropriate times on a risk-based approach, relevant changes in circumstances, and doubts about earlier identification or verification information.
The FCA's Financial Crime Guide, FCG 3.2.5, describes risk-sensitive ongoing monitoring. Its good-practice examples include periodic and event-driven reviews.
Ongoing monitoring is broader than running another ID check. These sources do not prescribe a fresh document-and-selfie check for every instruction. Which requirements apply, and the firm's response, depend on its activities, the risk, and the circumstances.
What About Meeting in Person?
Meeting clients in person can help you recognise who you're dealing with. A review meeting can also bring changes to light: a new address, different financial circumstances, or plans for a withdrawal.
The FCA identifies using contact with customers to update due diligence information as good practice. An in-person meeting gives you an opportunity to do that and to discuss an instruction directly with the client.
A face-to-face meeting doesn't, by itself, test a passport for signs of alteration or check the client against sanctions lists. Document-fraud checks, customer-data checks, and screening involve separate processes.
That knowledge doesn't automatically carry over to every later email. A client you saw last month might now be writing from a compromised account. A relative who attended the meeting might contact you later with a request of their own.
For firms within scope, ongoing monitoring still applies between meetings.
When a Familiar Client Makes a Remote Request
What happens when a client changes their details, asks for a withdrawal, or brings a relative into the conversation? These examples show what you might need to confirm, and which checks could help.
A New Contact Address
A client writes from a new email address and asks for future documents to go there. You have their identity evidence on file, but does this new address belong to them?
A conversation through an established contact route can help you confirm the change with the client. Sending a confirmation only to the newly supplied address leaves that connection untested.
A Sensitive Instruction Between Reviews
A withdrawal request arrives between scheduled meetings. You recognise the name and writing style, but the client hasn't discussed the request with you in person.
A callback using an established number may help clarify the request, but a familiar voice alone is less reassuring when fraudsters can clone someone's voice. National Trading Standards has documented criminals using voice clones to simulate consent for payments.
A fresh document-and-selfie check could add current identity evidence if your firm's assessment calls for it. If that review also calls for updated customer-data checks or sanctions screening, a callback or document check alone won't provide those results.
Regular Messages Using an Established Mobile Number
The client's identity was checked remotely or in person, and their mobile number was connected to that relationship. Later documents are sent using secure email with an SMS access code, such as Mailock's recipient authentication.
The access check adds evidence that someone using that number opened the message. A shared-answer challenge can provide another access control. These records can contribute to the communication history considered during a review, but neither method repeats the original identity check or monitors the client's wider activity.
The connection also depends on what has happened since the number or answer was established. A changed number, shared phone, compromised account, or disclosed answer can weaken it. Repeated successful access checks don't resolve those possibilities by themselves.
Someone Else Joins the Exchange
A relative emails to help a long-standing client and asks you to send documents directly to them. There may be a perfectly legitimate explanation.
Knowing who the relative is and knowing what they may do are separate questions. An identity check can provide evidence about that person. The client's permission or the representative's authority needs to be established separately, and a risk review might decide they also need to complete an up-to-date identity check.
A Change or a Discrepancy in the Client File
A client tells you they've changed their surname and moved house. That is a change in circumstances to consider when reviewing the information you hold. It doesn't automatically mean every check needs repeating.
Now suppose a new document shows a different date of birth from your original record. It could be an old typing error, or it could raise doubts about the earlier identification. Your firm may need fresh identity or customer-data evidence to investigate the mismatch. An SMS code sent to the usual number won't explain it.
Keep Identity, Access, and Authority Clear
Start with the question you need to answer: who is this person, who can open the message, or who is authorised to give the instruction?
An identity check supplies evidence about a person. An SMS or question-and-answer access check tests the condition set for opening a message. Where the contact details or shared answer were established with an identified client, that history is relevant, but it doesn't turn each access check into fresh proof of identity.
Contact details and circumstances can change over time, but an identity result doesn't simply expire after a set number of months. The sources cited here set no universal rechecking interval. Your firm's review needs to consider what has changed, any doubts about the information held, and the risk of the current request.
An access record can show that protected content was opened. It cannot establish that the client read every attachment, accepted a proposal, or authorised a withdrawal.
“Another check” can mean several things. Confirming a contact detail, obtaining fresh identity evidence, updating customer information, and reviewing screening results serve different purposes.
Examples that may prompt a firm to review its existing evidence include:
Doubts about the original identity information. A discrepancy or suspected impersonation may raise a question that the earlier record no longer answers.
A material change in the relationship. New personal details, a different representative, or activity inconsistent with the known client can prompt a review of the information held.
A large or unusual request. A withdrawal far outside the client's previous pattern may raise questions about identity, the instruction, or the wider transaction. Size alone does not prescribe a particular check.
A periodic or event-driven review. The firm's review may identify customer information or screening evidence that needs updating.
Regulation 27 and the FCA guidance provide the source context for these examples. They are prompts for the firm's qualified team, rather than a rule that each event requires the same identity-check package.
The information needed determines which check is relevant. A document-and-selfie check can add identity evidence. Additional customer-data checks may corroborate details such as an address. Politically exposed person and sanctions screening answer different questions again.
Products described as “Know Your Customer” (KYC) or “Anti-Money Laundering” (AML) checks bundle selected evidence; the labels do not mean that a firm's full due diligence or AML work has been completed. An identity result also cannot replace a review of the purpose of an unusual transaction.
Explaining Another Check to a Long-Standing Client
A client who has known their adviser for years may reasonably ask, “Why do you need to check me again?” A request arriving without an explanation can feel impersonal, particularly after a recent meeting.
"If a firm decides it needs another check, the client should understand why the request has arrived and how to complete it. That explanation is especially important when the client has dealt with the adviser for years."
Carole Howard, Head of Network Sales, Beyond Encryption (Mailock)
For an ordinary identity refresh, the explanation can be simple: what needs updating, what the client will be asked to do, and how they can confirm the request with their adviser. It should describe the real reason for the request, rather than suggest the FCA requires a new selfie for every withdrawal.
Before the Client Starts Another Check
Explain what is being refreshed, using the firm's approved wording.
Describe the steps, the information requested, and where privacy information is available.
Give the client a familiar way to confirm the request or ask for help.
Where a review involves suspected financial crime, the firm's compliance team needs to determine what can be communicated. A routine client explanation is not a template for discussing an investigation.
If you ask a long-standing client to complete another check, explain what it is for and what happens next. That conversation belongs alongside the check, whichever service or communication route you use.
From Mailock
Reviewing Identity Checks After Onboarding?
See how Mailock sends ID, KYC, and AML check requests from Outlook or the web app and returns the results by secure email. Walk through the client's steps and the results pack with our team.
An onboarding check gives you a starting point. Later checks depend on what has changed, what you already know, and what you are being asked to do.
FAQs
Does Every Later Instruction Need a New Identity Check?
The sources above describe a risk-based approach, not a fresh document-and-selfie check for every instruction. The firm determines the appropriate response through its professional processes.
Is There One Rechecking Interval for Every Advisory Firm?
The sources cited here do not set one universal identity-rechecking interval for all advisory firms and clients. Firms need arrangements appropriate to the requirements and risks that apply to them.
Does Seeing Clients in Person Remove Ongoing Monitoring?
No. For firms within scope, ongoing-monitoring duties still apply. Meetings give you opportunities to discuss changes and update information, but they don't confirm who sent a later remote instruction.
Can SMS or a Security Question Replace an Identity Check?
They can control message access and provide evidence about use of an established contact route or shared answer. They do not repeat a document-based identity check or establish authority to act.
Does a Successful Check Authorise a Client Instruction?
No. Individual identity evidence does not, by itself, establish authority for a specific instruction or ownership of a receiving bank account.
Does Mailock Monitor the Client Continuously?
Its individual ID, KYC, and AML check requests return results for review. They are not an automatically refreshed monitoring service, and recipient access checks do not monitor the client's wider activity.
Sam Kendall works on digital marketing for Mailock by Beyond Encryption, helping build B2B marketing activity around research, first principles, and sustainable growth. He writes about marketing effectiveness, positioning, customer communications, and digital culture, with longer-form work published at ATNL.net.
Sam Kendall
.svg)
Previous post