Verifying Client Identity Remotely: Digital ID for Accountants

Most accountancy clients are now onboarded without ever sitting across a desk from a partner. That raises a practical question: what counts as acceptable identity verification when you cannot see the client's passport in person? In February 2026 the government published guidance on using digital identities with the Money Laundering Regulations, which sets out how certified digital identity services can be used to meet the identity verification requirement. This guide explains what that guidance says, where certification fits, which parts of due diligence a digital check does not cover, and how to build a remote onboarding process that you can defend to your supervisor. It is general information, not legal advice, and you should check the government guidance and your own supervisor's current requirements before you change your procedures.

What the government guidance says

The guidance, published on 26 February 2026, says firms can meet their obligation to verify a customer's identity under regulation 28 by using certified and registered digital identity services. The same approach can be used to verify company directors. It explains that the UK digital identity and attributes trust framework (DIATF) sets the standards that providers must meet, and that the framework is technology-neutral and sector-neutral. To be certified, a provider has to show an independent conformity assessment body, overseen by the United Kingdom Accreditation Service (UKAS), that its service meets the framework.

Certified providers can apply to be listed on the digital verification services (DVS) register, which the Office for Digital Identities and Attributes maintains under the Data (Use and Access) Act 2025. Providers can be removed from the register if they breach the framework or fail to fix minor non-conformities promptly. According to the guidance, registration signals that a provider is a reliable source of identity information, independent of the person being verified, and helps confirm that the person claiming an identity really is that person.

What if the provider is not certified?

The guidance says that digital verification services that are not certified, and therefore not on the register, cannot reliably be treated as suitable for identity verification under the regulations. In practice you should check the register before you sign up to a tool, ask your provider for evidence of certification, and add a second check if it has none. Our guide to the 2026 amendments to the Money Laundering Regulations explains how this fits with the other changes this year, including the point that the money laundering reporting officer (MLRO) is responsible for the decision.

What a digital check does not do

This is the part most firms under-read. The guidance is clear that firms should not assume digital identities fulfil all aspects of customer due diligence (CDD). Specifically:

• You still assess risk. Firms must still carry out their own customer risk assessment and apply enhanced due diligence where appropriate.
• You still understand the relationship. A digital identity does not tell you the purpose and intended nature of the business relationship.
• You remain liable. Firms stay ultimately liable for any failure to apply CDD properly, even when they use a digital identity service.
• You still keep records. The service must meet the record retention requirements in regulation 40.
• Ownership still needs tracing. Identifying the individual behind a company is a separate step. Our guide to ultimate beneficial ownership for accountants covers how to trace it.

Is using a digital identity provider "reliance"?

No. HMRC's guidance on reliance says that using an independent identity provider is not reliance under regulation 39. That matters because reliance has its own conditions and does not extend to enhanced due diligence. For firms that do rely on another regulated business for CDD, see our guide to relying on third parties for customer due diligence.

Remote onboarding as a risk factor

HMRC's handbook lists non-face-to-face relationships without suitable safeguards among the situations that can carry inherently higher risk. A certified digital identity check is a suitable safeguard for the identity part of the process, but a firm with an unusual client, an unexpected jurisdiction or inconsistent information should still consider enhanced due diligence. HMRC also says that where a client gives false or stolen identification, or false information, and the firm proposes to continue dealing with them, enhanced due diligence is required. Our guide to enhanced due diligence for accountants explains what that involves.

A remote onboarding process you can defend

1. Choose a certified provider. Check the DVS register and keep a copy of the evidence.
2. Record who approved it. Note that the MLRO or equivalent signed off the tool and the date.
3. Verify the individual. Run the check, and keep the result in the client file as the regulations require.
4. Understand the work. Record the purpose and nature of the relationship and the expected source of funds, which a digital check will not supply.
5. Trace ownership. For companies, identify and verify the beneficial owners.
6. Assess risk. Rate the client, and apply enhanced measures if something does not fit.
7. Handle failures. If the check fails, or the client cannot complete it, do not proceed until you have another satisfactory route. If CDD cannot be completed, regulation 31 applies.

The guidance points to sector-specific advice, including from CCAB for accountancy, so read that alongside the government guidance. Our CPD courses can help train your team on the process.

Frequently asked questions

Can I verify a client's identity entirely online?

The government's February 2026 guidance says firms can meet the regulation 28 identity verification requirement using certified and registered digital identity services, so long as they also meet their other obligations.

What does certified mean?

The provider has shown an independent conformity assessment body, overseen by UKAS, that its service meets the UK digital identity and attributes trust framework, and can be listed on the DVS register.

Can I use an uncertified tool?

The guidance says it cannot reliably be treated as suitable for identity verification. Do not rely on it alone.

Does a digital check satisfy all of CDD?

No. You still need to assess risk, understand the purpose of the relationship and trace beneficial owners.

Who is liable if the provider gets it wrong?

The firm. The guidance says firms remain ultimately liable for any failure to apply CDD properly.