Remote Client Onboarding and Digital ID Checks Under the UK Money Laundering Regulations

Most accountancy firms now take on clients without meeting them. That raises a practical question under the UK Money Laundering Regulations 2017 (MLRs): is a scanned passport sent by email enough, or do you need a digital identity service, and which one? This guide sets out what HM Treasury, HMRC and the government's digital identity team have published, using the pages we could read. It also flags where we could not confirm the position. It sits alongside our guides to KYC and customer due diligence for accountancy practices and AML supervision of accountancy firms.

The legal hook: regulation 28

HMRC's Economic Crime Supervision Handbook (page ECSH33357) explains that, under regulation 28(19) of the MLRs, information can count as coming from a reliable, independent source where it is obtained through an electronic identification process, including a "trust service". The process must be secure from fraud and misuse and must give enough assurance to manage the money laundering and terrorist financing risk. HMRC also stresses that electronic verification is not reliance: the business still carries out its own customer due diligence and stays liable for any failures.

HM Treasury's 2026 guidance on digital identities

HM Treasury published guidance on 26 February 2026 called Using digital identities with the Money Laundering Regulations, which the page describes as approved guidance for the purposes of compliance with the MLRs. According to that guidance:

• firms can verify a customer's identity, and the identity of company directors, using digital identity services that are certified against the UK digital identity and attributes trust framework and listed on the public DVS Register, which the Office for Digital Identities and Attributes (OfDIA) maintains;
• digital verification services that are not certified and registered cannot reliably be treated as suitable for MLR identity verification;
• a digital identity does not cover all of customer due diligence, so firms must still assess the purpose and intended nature of the relationship, keep records in line with regulation 40, and carry out their own customer risk assessments; and
• firms remain ultimately liable for any customer due diligence failures when they use these services, and should apply enhanced due diligence where their own risk assessment calls for it.

The guidance points firms to sector guidance from their supervisor, naming HMRC and the Consultative Committee of Accountancy Bodies (CCAB) for accountancy.

What the government's digital identity team adds

A blog post on the OfDIA "Enabling digital identity" site, dated 20 August 2026, adds detail. It says identity checks must meet a level of confidence under the GPG 45 standard (low, medium, high or very high), and that regulated businesses choose the level for each customer based on their risk assessment. It also says that attributes, such as address, PEP status or sanctions status, are separate from identity verification and fall outside the MLR guidance. The post says that for individual customers regulation 28 obligations can be met only through certified and registered services. That wording is firmer than the HM Treasury page, which says non-certified services cannot reliably be treated as suitable. Because this is a blog post rather than approved guidance, check your supervisor's current position before relying on either phrasing.

What HMRC expects from electronic checks

HMRC's handbook page distinguishes a proper electronic check from simply collecting documents by email or messaging app. It says a check may be enough on its own if it draws on multiple sources or multiple points in time, includes qualitative checks on the strength of the information, or uses a provider that meets HMRC's criteria. A single-source check at one point in time, such as one electoral roll check, is not normally enough alone. The exception HMRC gives is a single source issued by a government authority with cryptographic security features, such as the Home Office eVisa system.

Before relying on a provider's data, HMRC suggests considering whether the provider:

• is registered with the ICO to store personal data;
• is accredited or certified through a recognised governmental or industry process;
• uses multiple positive sources and also accesses negative sources, such as identity fraud and deceased persons databases;
• keeps verified data up to date or re-verifies it within set periods; and
• shows transparently which checks were run, the results and the level of certainty they give.

HMRC adds that where the customer is not met in person, a business may send a link to upload identity documents and a selfie holding the ID, which gives a level of assurance that the customer is who they claim to be. It says confirmed PEP matches need an enhanced due diligence review, that policies should set out how failed checks and red flags are handled and escalated, and that firms should be able to keep the verification evidence or assurance level returned. HMRC does not endorse any provider: choosing one is the business's decision.

A practical checklist

These are our suggestions, built on the sources above, not official guidance:

• Check that any digital identity provider you use appears on the DVS Register, and record the date you checked.
• Decide the confidence level you need for each client from your risk assessment, and write down why.
• Keep identity verification separate from the rest of due diligence: record the purpose and nature of the engagement, run PEP and sanctions screening, and consider source of funds where the risk calls for it. Our guide to politically exposed persons covers the PEP step.
• Write procedures for failed or "refer" results, including who reviews them and how they escalate.
• Test where the provider stores your records, and whether you can still access them if you change provider.

What we could not confirm

• We did not read the text of regulation 28 itself, only HMRC's and HM Treasury's descriptions of it.
• We did not read the CCAB accountancy sector guidance or the guidance of individual professional-body supervisors, which may add requirements.
• We did not check the details of GPG 45, the DVS Register entries, or provider pricing.
• HMRC's handbook page and the 2026 HM Treasury guidance describe the position in different terms, and we could not tell whether HMRC has updated its page to match.

Frequently asked questions

Is a photo of a passport sent by email enough?

HMRC says collecting documents by email or messaging app differs from a check through an identity database or service, and a single-source check is not normally enough alone. Take a risk-based view and follow your supervisor's guidance.

Does using a digital identity service move the liability?

No. Both HMRC and HM Treasury say the firm remains liable for customer due diligence failures.

Where can I build my AML knowledge?

Our CPD courses cover compliance topics for accountants and finance professionals.