The three types build on each other, so the differences are easier to hold in mind as a ladder than as a menu.
ID (Identity Document)
Checks a government identity document, compares its photo with a live selfie, and runs a liveness check.
A completed ID check gives you evidence that the document is genuine, that a live person presented it, and that the person matches the photograph.
KYC (Know Your Customer)
Includes the ID check, then adds address, date-of-birth, age, credit-activity, and mortality checks.
This is the check that corroborates what the person has told you against other identity data sources.
AML (Anti-Money Laundering)
Includes the full KYC check, then adds politically exposed person (PEP) and sanctions screening.
These screening checks are the only components AML adds over KYC. If screening evidence is not what you are looking for, KYC is the proportionate choice. Choosing AML anyway asks more of the client without answering a question you had.
Which Check for Which Situation
The table below is a starting point for a conversation with your own risk and compliance colleagues. It is not a substitute for your firm's policy.
Situation
Usual starting point
Why
Opening a new client relationship remotely
KYC
There is no relationship history to fall back on, so the details the client has given you are worth corroborating as well as confirming the document and the person.
Onboarding where your firm is within scope of the Money Laundering Regulations
AML
Firms in scope commonly gather screening evidence alongside identification, and screening is what AML adds to the KYC checks.
Acting on a change to bank or payment details
KYC
The instruction could move money, so firms often want fresh evidence about both the person and their details, even for a client they have dealt with for years.
Recovering a dormant or locked client record
ID
The contact route on file may be part of the problem. The immediate question is whether a real person holds a genuine document in that name.
Confirming a known client before releasing a sensitive document
ID
You already hold and trust the client data. What you are missing is evidence that the person is real and matches their document.
A periodic or event-driven review of an existing client
KYC
Addresses and circumstances drift between reviews, so refreshing the details you hold is usually the point of the exercise.
A higher-risk relationship, or one where a PEP or sanctions match is plausible
AML
PEP and sanctions screening is the part AML adds, and it is the reason to choose it over KYC.
A sanctions-sensitive transaction in a business that is not otherwise regulated
AML
UK financial sanctions can apply to any person or entity in the UK, and to UK persons abroad, whether or not wider due diligence rules apply to the business. The regime is administered by the Office of Financial Sanctions Implementation.
Making sure only the intended person opens a message
None of the three
This is an access question, answered by recipient authentication such as an email code, an SMS code, or a question only the right person can answer.
The government's guidance on checking someone's identity sets out how evidence strength, activity history, and fraud checks fit together. It is a useful cross-check on thresholds you set.
What Firms Do, by Sector
The patterns below describe what firms in each sector commonly do and why. They are not statements of what any particular firm is required to do.
Obligations depend on the firm, the activity, the relationship, the transaction, and the professional guidance that applies, so treat your own policy and your regulatory guidance as the authority.
Financial Advice and Wealth Management
The main moments when the requirements for a check arise are a new client, a change to personal or payment details, a pension or investment instruction, and a periodic review.
Advice firms commonly run identity evidence as one input to their own client due diligence (often referred to as CDD), then handle suitability, authority, and escalation separately.
Where a firm is within scope of the Money Laundering Regulations, screening usually sits alongside identification rather than replacing it, which is why AML tends to be the onboarding choice and KYC the review choice. The FCA publishes financial crime guidance for the financial services firms it regulates.
"Advisers judge a verification step by what it does to the client conversation. If someone has to stop, find a portal, and start again, that turns into a call back to the office and a case that sits still for a week."
Carole Howard, Head of Networks, Beyond Encryption (Mailock)
Legal Practice
Remote onboarding is the moment that most often prompts a check, followed by sensitive instructions later in a case.
Firms commonly want the client step to be simple and recognisable, because a client who abandons a verification journey becomes a phone call, a paper form, or a delay.
Case risk, beneficial ownership, and source of funds are separate processes. An ID, KYC, or AML check contributes identity and screening evidence to an individual's file only. The Law Society publishes anti-money laundering guidance for solicitors, and HMRC sets out supervision responsibilities for the sectors it supervises.
Providers and Platforms
Pension providers, insurers, and platforms usually interact with the customer at a claim, a transfer, a beneficiary change, or a detail change rather than at onboarding.
The common question at these points is whether the person making contact is the customer already on the record, rather than who they are from a standing start.
That shapes the choice. An ID check answers the returning-customer question directly. KYC may be the step up where a record is older or the detail being changed is significant. AML comes in where a new kind of relationship or a screening trigger is involved.
An identity check and a recipient access check both involve a person proving something, but they are not the same type of control.
Recipient authentication gates who can open a message. An email code, an SMS code, or a question shows that someone can reach an inbox, reach a phone, or supply an expected answer. An identity check evidences who someone is. There is no 'success' factor that controls access to a message - only a results pack that is clear of flags or flagged to review.
Still Not Sure Which Check Fits?
Talk it through against your own onboarding and review process with our team.
It is worth being equally clear about the other boundaries of an identity check performed using Mailock, or other technology.
An identity check is not:
A decision. A check returns evidence. Your firm assesses it, weighs it against everything else it knows, and decides.
A company check. These checks verify people. They are not KYB (know your business) checks on a company, and they do not identify or verify beneficial owners.
A guarantee. A clear result with nothing marked to review is evidence that the selected checks completed without a flag. It is not proof that there is no fraud or sanctions risk.
How It Works in Mailock
Once you know which check you need, sending it is easy.
You choose ID, KYC, or AML and send the request from the Mailock Outlook add-in or the web app.
Your client opens a secure email, photographs a supported passport or driving licence, and takes a live selfie, with no new Mailock account or app to install.
The results pack comes back to you by secure email, showing what completed, what was found, and what needs attention.
No. A stronger check asks more of the client and creates more exception handling, so it costs completion as well as money.
Match the check to the consequence and to your firm's risk assessment rather than defaulting to AML.
Does a KYC Check Verify a Company or Its Beneficial Owners?
No. These checks verify people.
Company and beneficial-owner work is separate and is not part of the current Mailock package, so talk to us about your use case if you need both scoped.
Does an AML Check Mean Someone Is Safe to Onboard?
No. It provides identity, data-corroboration, PEP, and sanctions evidence for your team to review.
Your firm assesses the result alongside other risks and makes the decision.
Does a Completed Check Prove Someone Can Give an Instruction?
No. Identity and authority are different questions.
A completed check does not show that a person is authorised to act on an account, a trust, or an estate.
What Happens if a Check Is Flagged?
The results pack identifies the check that needs attention and includes the available reasons or evidence, so your team can review it against your own policy rather than reading a pass or fail.
Sam Kendall works on digital marketing for Mailock by Beyond Encryption, helping build B2B marketing activity around research, first principles, and sustainable growth. He writes about marketing effectiveness, positioning, customer communications, and digital culture, with longer-form work published at ATNL.net.
.png?)
Sam Kendall
.svg)
Previous post