You need to check a client's identity, but they aren't coming into the office. What do you send them, what will they need, and what do you get back?
With Mailock, an ID check examines a client's identity document and compares the photo with a selfie. A KYC check goes further, checking details such as their address and date of birth. An AML check also includes screening for sanctions and politically exposed persons.
This guide walks you through the process, from sending the first email to receiving the results. We'll explain what each check includes, what your client needs to do, and how to help if they get stuck.
Your firm's procedures determine which checks are needed and how the results are assessed. Here, we'll focus on arranging the check and helping the client complete it.
About our product: This article is about Mailock, which is made by Beyond Encryption, the publisher of Need to Know. Read our editorial policy.
Start with the type of check your firm has asked you to run. ID, KYC, and AML aren't interchangeable. In Mailock, each adds to the information returned by the previous one, as described in the check coverage.
ID: Identity Document
An ID check examines a government identity document and compares its photograph with a live selfie. It also runs a liveness check, which tests whether a live person is present during the selfie step.
KYC: Know Your Customer
The KYC check includes the ID check and adds checks of customer details: address, date of birth, age, credit activity, and mortality records. These provide further information to compare with what you hold about the client.
AML: Anti-Money Laundering
The AML check includes the ID and KYC checks, then adds politically exposed person (PEP) and sanctions screening. The screening results are returned for your firm's review.
These are the names of Mailock's check packages. Other services may bundle checks differently, so look at what is included rather than relying on the label. An AML package supplies selected evidence; it doesn't complete all of a firm's anti-money laundering work.
Before your first request, make sure identity checks have been enabled for your organisation and your user account. Mailock requires an approval process for both.
Then check the details for this client:
The check type: ID, KYC, or AML, as specified by your firm's process.
The contact details: the email address for the invitation and the mobile number for the SMS access code.
The document: a supported passport or driving licence. Confirm the relevant country and document type are supported before asking the client to start.
Check the destination before sending sensitive information. Take particular care if the request involves a recently changed email address or phone number. Sending a code to a newly supplied number only shows that someone can use that number.
3. Tell the Client What to Expect
A request to photograph a passport and take a selfie can feel intrusive if it arrives without warning. Tell the client why you're asking, how the email will arrive, and who they can contact if they want to check it's genuine.
Explain the phone steps before they start. They'll need access to the mobile number receiving the SMS code, a phone with a camera, and their supported identity document. They won't need to create a Mailock account or install an app.
"If you're asking a client to photograph their passport and take a selfie, explain that before the email arrives. Give them a familiar person to call if they have questions, rather than leaving them to decide whether an unexpected request is genuine."
Carole Howard, Head of Network Sales, Beyond Encryption (Mailock)
For example, once you've explained the reason for the check, you could describe the steps like this:
Explaining the Check to Your Client
"I'll send you a secure email with a request to complete the check on your phone. You'll enter a text-message code, photograph your supported passport or driving licence, and take a live selfie. You don't need a new account or app. If anything is unclear, call me on our usual number before continuing."
Adjust the explanation to the client and the check you're sending. Include where they can find the relevant privacy information, and give anyone who can't use the phone process a way to discuss that with you.
4. Send the Request
In the Mailock workflow, you start the request from the Outlook add-in or the web app. Choose the required check type, enter the client's details, and send the request by secure email.
Make sure you're requesting a check on the intended person. If someone is helping a client, be clear who needs to complete it. Checking a representative's identity doesn't establish their authority to act for the client.
Let the client know the request has been sent and how to reach you if it doesn't arrive. That also gives you a chance to catch a mistyped address before the client spends time looking for the email.
5. Follow the Client's Steps
It helps to know what the client is looking at when they call with a question. The current process has three main stages:
Open the secure email. The client enters a code sent to their phone by SMS to access the request.
Photograph the document. They follow the instructions to capture their supported passport or driving licence.
Take a live selfie. The check compares their face with the document photograph and runs the liveness check.
The SMS code controls access to the request. The document and selfie provide separate identity evidence. Entering the code successfully doesn't replace those steps.
For KYC and AML requests, the selected additional checks form part of the results returned to you. The client doesn't carry out PEP or sanctions screening themselves.
If the Client Gets Stuck
Ask which step they have reached. An email that hasn't arrived, an SMS code they can't receive, and a document they can't photograph are different problems. Knowing where they've stopped makes it easier to explain the problem to your support team.
If the document isn't supported, or the client can't use the digital process, explain what you can do next under your firm's arrangements. Avoid repeatedly resending the same request when the reason they can't finish hasn't changed.
Keep the client informed about who is helping them. If you're going to be away, make sure an authorised colleague can find the correspondence and pick up the question.
6. Receive the Results and Arrange the Review
When the check has been processed, Mailock returns the results pack by secure email. It includes an overall summary, the individual checks run, and the available evidence or reasons for review, together with copies of the identity documents.
Read the individual results as well as the summary. If a check needs attention, the pack identifies it and provides the available detail. Your firm's reviewer decides how to assess that information and what follow-up is needed.
"The person reviewing a check needs to see what was checked and which parts need attention. A result is much easier to follow when the original request and the returned evidence can be found together."
Paul Holland, Founder and CEO, Beyond Encryption (Mailock)
Keep the returned correspondence with the appropriate client or matter record, using your firm's access and data-handling arrangements. The pack contains personal information, so consider who needs access when sharing it internally.
From Mailock
Want to See a Remote Check From Start to Finish?
Learn how Mailock sends ID, KYC, and AML requests, guides clients through the phone steps, and returns the results by secure email.
Once you've received the results, let the client know whether you need anything further, using the wording agreed by your firm. If they contacted you for help during the check, follow up on that question too.
FAQs
Does the Client Need an Account or App?
No. In the Mailock process described here, the client opens a secure email and completes the document-and-selfie steps on their phone without creating a Mailock account or installing an app.
Is Emailing a Passport Photo the Same as Completing an ID Check?
No. The remote ID check described here examines the document, compares its photograph with a live selfie, and checks for liveness. An emailed image alone doesn't provide those results.
Can These Checks Verify a Company?
The Mailock checks described here concern individuals. They don't provide company or know-your-business (KYB) checks, or identify a company's beneficial owners.
Does an AML Check Complete Our Due Diligence?
No. The package returns selected identity, customer-data, and screening results. Your firm's wider due diligence remains separate. For sector requirements, use the guidance relevant to your firm, such as the FCA's Financial Crime Guide for financial services, alongside your firm's procedures.
Does the AML Check Keep Screening the Client Afterwards?
No. It returns screening results for that request. It isn't an automatically refreshed monitoring service. Our article on checks after onboarding explains why later requests and changes can raise new questions.
Sam Kendall works on digital marketing for Mailock by Beyond Encryption, helping build B2B marketing activity around research, first principles, and sustainable growth. He writes about marketing effectiveness, positioning, customer communications, and digital culture, with longer-form work published at ATNL.net.
Sam Kendall
.svg)
Previous post