What is electronic identity verification (eIDV)?

Electronic identity verification, or eIDV, is checking a client’s identity with software instead of paper documents seen in person. Under regulation 28 of the Money Laundering Regulations 2017 an electronic process counts as a reliable, independent source when it is secure from fraud and misuse and gives enough assurance that the person is who they claim to be for the money laundering risk involved.

When does an electronic check count as a reliable source?

Regulation 28(19) treats information as coming from a reliable, independent source when it is obtained through an electronic identification process and that process meets two conditions.

• It is secure from fraud and misuse.
• It can give assurance that the person claiming an identity really is that person, to the degree needed to manage the money laundering and terrorist financing risk.

The Legal Sector Affinity Group guidance adds the practical point. A firm should be able to show its supervisor that the system establishes that the client is the person, not just that the identity exists. Running a search and filing the result is not, on its own, complete due diligence.

What kinds of eIDV are there?

• Database checks. The client’s name, address and date of birth are matched against credit, electoral and other records. Quick, but they confirm that an identity exists, not that the person in front of you holds it. Data from one source alone is weak.
• Document checks. The client photographs their passport or licence and software checks the image for signs of tampering. Better, but a photo of a document can be forged.
• Chip and biometric checks. The client holds a chip-based passport or identity card to their phone. The app reads the chip by NFC and checks the issuer’s digital signature, then a liveness check matches the client’s face to the chip photo. This ties the person to the document and the document to its issuer.

What firms typically do

1. Choose the level of check to fit the client and matter risk, and record why. Higher risk work warrants the stronger checks.
2. Understand the tool. Know its inputs, its data sources, what each result means and how it meets regulation 28. LSAG expects firms to be able to explain this.
3. Check that documents are in date and that the details match the rest of the file.
4. Read the result, do not just file it. Surprising results can mean a data entry error or an impostor.
5. Combine the identity result with the rest of client due diligence, including beneficial owners, the purpose of the matter and source of funds.
6. Plan for clients without chip-based ID, and use other verification routes for them rather than turning them away.

Common mistakes

• Treating a pass from a database search as proof that the client is who they say.
• Relying on a provider’s result without knowing what it actually checked.
• Using the same light check for every client regardless of risk.
• Forgetting that identity is only one part of AML checks. See What are AML checks for law firms?
• Assuming one check meets every rule. The money laundering test and the HM Land Registry test are different. See What is the HM Land Registry Safe Harbour?

Is eIDV enough when you never meet the client?

Not automatically. LSAG treats acting for a client without meeting them as a risk factor for the practice-wide risk assessment. An eIDV platform can help manage that risk but is not a guaranteed fix. The firm must still be satisfied that it makes sense not to have met the client, and consider whether enhanced due diligence is needed. Text-only contact is higher risk than video or phone.

What should a firm look for in a provider?

• Chip reading by NFC with signature checks, not only a photo of the document.
• A liveness check that resists photos, masks and replayed video.
• Clear outputs that say what was checked and what passed or failed.
• Certification against the UK digital verification services trust framework, which gives independent assurance about a service.
• Records the firm can keep for five years after the relationship ends.

Kord’s app reads the client’s passport chip by NFC and runs liveness and face match checks as part of AML checks for law firms.

Questions firms ask

What does eIDV stand for?

Electronic identity verification. It covers any check of a person’s identity done with software, from database searches to chip and biometric checks.

Can law firms use electronic ID verification?

Yes, the Money Laundering Regulations allow it where the process is secure from fraud and misuse and gives enough assurance about the person. The firm stays responsible for choosing a suitable tool and understanding its limits.

Is a database check enough on its own?

Usually not for anything above low risk. It shows that an identity exists, not that your client holds it. LSAG notes that data from one source alone is unlikely to be strong verification.

What if the client has no passport with a chip?

Use another route that fits the risk, such as other documents, a certified copy or a database check combined with further evidence. Do not refuse the work only because the client lacks a chip-based document.

Does eIDV replace source of funds checks?

No. It verifies identity only. Source of funds, beneficial owners and the purpose of the matter are separate parts of client due diligence.

How long must eIDV records be kept?

For five years after the business relationship ends, as with other client due diligence records.

Sources

• Money Laundering Regulations 2017, regulation 28
• Legal Sector Affinity Group AML guidance for the legal sector (2025)
• HM Land Registry practice guide 81
• UK digital verification services trust framework