Sending Suitability Reports and Review Packs Securely, and Evidencing Delivery

The review meeting is tomorrow, but your client hasn't replied to the pack you sent last week. You don't know whether they've read it, had trouble opening it, or simply haven't had time.

Calling to check is straightforward when you have one report to follow up. Across a diary full of reviews, it becomes harder to keep track of who has received what and which clients need help before their meeting.

Those packs also carry sensitive financial information. However you send them, the method needs to protect the contents, be easy for the client to open, and leave a record you can use on the file.

This guide follows a pack from preparation to follow-up, for suitability reports, annual review packs, valuations, and pension transfer paperwork. It also explains what delivery and access records can and can't tell you. For the wider picture, see our page on secure client communications for financial advisers.

Contents

• Before You Send the Report
• Make the Pack Easy to Open and Reply To
• Know What Your Delivery and Access Records Show
• Use the Record to Plan Your Follow-Up
• Adapt the Process to the Documents
• Keep a Copy, and Help the Client Keep Theirs
• Choose a Sending Route Your Clients Can Use

Before You Send the Report

A report can contain the right advice and still go to an old email address, arrive with an out-of-date attachment, or leave the client unsure what to do. So check the recipient and the documents first, then choose the access check.

Check the address against the client record, rather than relying on an autocomplete suggestion, and open each attachment to confirm it's the final version for this client. For joint clients or an authorised representative, confirm who should receive the documents and whose contact details the access check will use.

Then choose the access check to suit the information and the client's circumstances. Mailock's recipient authentication options include a one-time SMS code, a question and answer, and a one-time email code. Each checks something different: an email code shows only that the person can get into that mailbox, while an SMS code adds a check against the mobile number you specify.

Finally, write a cover note the client can act on. Name the attached documents, explain which sections need attention, and say how the client can ask questions. For example: "Please read the recommendation and charges sections before our review on Thursday. Reply securely with any questions you'd like us to cover."

Make the Pack Easy to Open and Reply To

With Mailock, you compose the message in Outlook or the web app and attach the documents. Mailock applies AES-256 encryption to the message and attachments. The client receives a notification in their inbox, follows the link, and completes any access check you've applied before opening the protected message.

You can attach the review documents to the same secure message, so the client doesn't have to work through a separate password for each file. That was a practical improvement for Gresham Financial Strategies, which had previously protected each review, illustration, and valuation individually.

"Clients would get their reviews, illustrations, valuations, all individually password-protected… which was a pain for us because we had to do them individually, and a pain for the clients because they had to open them individually as well."

David Turner, Director, Gresham Financial Strategies

The Gresham case study has more on that change. If your review packs routinely contain several sensitive documents, count the time your team and your clients spend on separate passwords when you compare sending routes.

Clients can also reply securely, including with attachments, without creating a Mailock account. That gives them a protected way to ask about the recommendation or return paperwork, so explain the secure reply route in the cover note.

Know What Your Delivery and Access Records Show

The word "received" can hide several different events. A message may have left your system, reached a mailbox, or been accessed through a secure service. Keep those events distinct when you write a file note or discuss the record with a client.

Standard email receipts only cover part of that. Microsoft's receipt guidance distinguishes a delivery receipt, which shows that a message reached the mailbox, from a read receipt, which the recipient can decline and some email systems don't support. Neither receipt shows that an attached report was read.

A secure email service records a further step. Mailock's message tracking shows the recipient, subject, sent time, and whether the protected message content was accessed. Its read notifications give a time-stamped record of that access and confirm that any security steps you applied were completed.

A completed access check has its own limits. Its value depends on the check selected and the accuracy of the contact details used. A code or shared answer should not be described as conclusive proof of the named client's identity.

Use the Record to Plan Your Follow-Up

Before you send, decide when someone will check for access and who will contact the client if they haven't opened the pack. Time that check against the meeting, decision, or deadline, leaving room to fix a wrong number or talk the client through opening the message.

For example, you send an annual review pack on Monday for a Thursday meeting. On Wednesday, you check the access record. If there's no access event, call the client to find out whether they saw the notification, could complete the check, and can use that delivery route.

If the message has been accessed, ask whether the client has had time to read the report and which points they want to discuss. Message access alone doesn't tell you how much of the pack they read. Record the follow-up and any questions alongside the documents.

"When I talk to advisers, the question is rarely whether to protect a suitability report. It's how to stop chasing. Knowing a client has accessed their pack before the review meeting changes the first five minutes of that conversation."

Carole Howard, Head of Networks, Beyond Encryption (Mailock)

The access record helps you decide whom to contact; the conversation is what shows you what the client understood. The FCA's consumer understanding review describes firms testing their communications and using customer feedback to improve them, including smaller firms that use follow-up calls and short questionnaires.

Follow-up also covers mistakes. If you sent the wrong attachment or used the wrong address, revoke future access promptly and follow your firm's incident process. Revocation can't retrieve copies already downloaded, so check what happened before sending a corrected pack, and record which version replaced the earlier one.

Adapt the Process to the Documents

The same sending process can support several types of advice document. The main changes are what you need the client to do and how much time you have to follow up.

Annual Review Packs and Valuations

For recurring reviews, use clear file names and a consistent subject line, such as "Your annual review pack: October 2026". Keep a copy of the pack as sent, so you can show which valuation and report the meeting covered. Genius Wealth Management is one firm that sends valuation reports and other sensitive documents through Mailock.

If several colleagues prepare reviews, give one person responsibility for checking access and recording the next action, so two people don't chase the same client.

KIDs and Other Disclosures

For a key information document (KID) or another regulated disclosure, establish the applicable document and timing requirements with your compliance team. Schedule the send and follow-up around those requirements; a timestamp alone can't show whether a disclosure was provided correctly or in time.

Some of those disclosures are changing. The FCA's consumer composite investment rules introduce a product summary, with an optional transition period that began on 6 April 2026 and the rules fully in force from 8 June 2027. During the transition, check which disclosure applies to each product.

Pension Transfer Documents

Transfer paperwork can pass between the client, advisers, and pension schemes, and may contain transfer values, scheme references, and personal details. Check each recipient's role and send them only the material needed for that exchange.

"Pension transfer paperwork carries some of the most valuable information an adviser ever sends. Clients still want it in their inbox, so the protection has to sit around the email they already know how to use, with a check they pass and a record the adviser can rely on."

Paul Holland, Founder and CEO, Beyond Encryption (Mailock)

Tell the client in advance how you'll send the documents, and how to contact your firm if a request looks unexpected. A familiar logo or photograph can be copied, so ask clients to check any unusual request using contact details they already trust.

Secure email protects the document exchange, but it isn't part of assessing the transfer. The advice and the scheme's due diligence need their own processes: The Pensions Regulator's transfer guidance sets out checks for trustees and scheme managers.

Keep a Copy, and Help the Client Keep Theirs

A subject line and timestamp alone won't tell a future reviewer which version of a report the client received. Save the report, the supporting documents, and subsequent communications on the client file, and keep the sending and access information with them under your firm's record-keeping process.

Clients need to keep their copies too. Mailock messages expire after a period set by the sender's plan, and recipients can download a copy before then, as the message-expiry FAQ explains. Include clear saving instructions in the cover note, and help clients who can't manage that themselves.

Where a durable medium is required, expiry and the client's ability to keep a copy become part of the assessment. The FCA's explanation of the criteria covers personally addressed information, storage accessible for an adequate period, and unchanged reproduction. A secure link or a download option doesn't, by itself, establish that every applicable requirement has been met.

For the relevant MiFID retail-client communications, PS25/13 made electronic communication the default from 12 January 2026. Our articles on the FCA's durable medium shift and digital-by-default delivery cover the change in detail.

Choose a Sending Route Your Clients Can Use

The right route depends on how often a client logs in, what they can open, and what record you need afterwards.

A portal may suit clients who regularly use an online document library. Check its access controls, retention arrangements, and view or download logs. For a client who rarely logs in, a secure email may be easier to act on; for someone who cannot use either route, arrange an accessible alternative.

Ask clients what they'd prefer rather than assuming. In our 2024 research with 1,000 UK adults, 7% preferred receiving documents through a portal rather than post or email. That's general consumer research, not a finding about your firm's clients, so check whether the process works for the people you advise.

For clients who prefer email, Mailock adds encrypted content, recipient access checks, secure replies, and a record of message access. It can sit alongside a portal, so you don't have to move every client to one channel.

An encrypted attachment can also protect a file when it's correctly configured. The ICO's encryption guidance advises sharing the key through a separate communication channel, so factor in the work of delivering the password, helping the client open the file, and recording their response.

For larger firms and providers, automated secure delivery can support document sends from your own systems.

Whichever route you're considering, test the full exchange before using it with clients: send a sample pack without real client data, open it as a recipient, reply, and inspect the access record. That gives you a practical basis for deciding whether it fits your reviews.

Record any access problems during the test and how you resolved them. Use those findings to write clear client instructions and agree who will help anyone who gets stuck.

FAQs

Does a Mailock Read Notification Prove the Client Read the Report?

It records access to the protected message and completion of any applied security steps. That doesn't establish who personally completed the check or whether they read, understood, or accepted the recommendation. Keep the access record alongside the report, replies, and relevant file notes.

Can a Client Reply Without Creating a Mailock Account?

Yes. Clients can reply securely, including with attachments, without creating an account. Explain that route in the cover note so they know how to return questions or paperwork.

What If the Client Hasn't Accessed the Pack Before Their Review?

Contact them to find out why. Check the address, whether they saw the notification, and whether the access step worked. Arrange help or another suitable route, and consider whether they have enough time to review the documents before the meeting.

Does Secure Email Automatically Meet Durable Medium Requirements?

Your firm needs to assess the applicable requirements and the complete arrangement for delivery and retention. Consider whether the information is personally addressed, can be stored for future reference for an adequate period, and can be reproduced unchanged, including after a secure message expires.

References

Add Delivery Receipt to Track an E-Mail Message, Microsoft Support

Consumer Understanding: Good Practice and Areas for Improvement, Financial Conduct Authority, 2026

PS25/20: Supporting Informed Decision Making: Final Rules for Consumer Composite Investments, Financial Conduct Authority, 2025

Dealing With Transfer Requests, The Pensions Regulator

Durable Medium, Financial Conduct Authority, updated 2023

PS25/13: The MiFID Organisational Regulation, Financial Conduct Authority, 2025

Digital Account Fatigue: How Login Overload Impacts Engagement, Beyond Encryption, research conducted 2024

Encryption Scenarios, Information Commissioner's Office

Reviewed by

Sam Kendall, 28.10.26

Read our editorial policy.

This content is for general information only and is not legal advice.