Client Identity Verification: How to Know Who You're Signing With

Client identity verification is the step where you confirm that the person on the other side of an agreement is who they claim to be, before anyone signs anything. Accountants, law firms, and financial services teams have to run it by law. Everyone else should run it because remote onboarding has become the easiest place in a business to impersonate someone.

Here's the thing most guides skip. A signature and an identity are two separate questions. An e-signature proves a document wasn't altered after it was signed. It says nothing about whether the human who clicked "sign" is the client you think you onboarded. You need both, and they're checked by different machinery.

This guide covers what client identity verification actually inspects, which businesses are legally obliged to do it, and how to run the check inside your signing flow instead of bolting it on afterwards. If you already handle signed files and want the other half of the problem, see our guide to online document verification.

Onboarding a client you've never met in person used to be rare. Now it's the default, and the weak point moved with it. The fraud isn't usually sophisticated. It's a scanned passport that belongs to someone else, forwarded in an email thread nobody checked.

The document looks fine because it is fine

Most rejected onboarding fraud involves a genuine identity document used by the wrong person. The passport is real. The photo is real. The holder just isn't the one sending it. Visual inspection of a scan can't catch this, which is why liveness checks exist, and why "we asked for a copy of their ID" isn't verification.

Nobody owns the check

In a lot of firms the identity step lives in one person's inbox. Sales collects the ID, someone forwards it to compliance, compliance files it, and the engagement letter goes out through a different tool entirely. When a regulator later asks which document was on file when the client signed, the answer takes a week to assemble. Sometimes it can't be assembled at all.

Worth noting: this is a records problem as much as a fraud problem. Plenty of firms did verify the client properly and simply can't prove it two years later.

"Verifying a client" sounds like one action. In practice it's four checks that answer different questions, and you can pass some while failing others.

Document authenticity

The system reads the identity document and tests whether the document itself is genuine: security features, fonts, the layout of the template for that country and issue year, and whether the printed text matches the machine-readable zone and the chip. Template mismatches are the most common catch here.

Liveness

A short selfie or video confirms a real person is present right now, and that their face matches the document photo. This is the check that stops the borrowed-passport case, and it's the one firms skip most often because it adds friction to onboarding.

Screening

Sanctions lists, politically exposed person lists, and adverse media. For regulated firms this isn't optional, and it has to be repeated, not run once at onboarding.

Binding the result to the signature

This last one gets forgotten. A verification that finishes in one system and a signature collected in another leaves you with two records and no proven link between them. Bind the verified identity to the document hash at the moment of signing and you get a single evidence chain instead of two filing cabinets.

Fair warning: no identity check is a fraud guarantee. Generative models now produce document images that fool pixel-level forensics fairly often, which is exactly why chip and machine-readable-zone comparison matters more each year than image analysis does. We wrote about that shift in AI document verification.

Some businesses verify clients because it's sensible. Others do it because a regulator will fine them if they don't. If you're in the second group, the rules set out what evidence you keep and for how long.

Two things people get wrong about this table. First, the obligation usually attaches *before* the relationship starts, not at the first transaction, which means the check belongs at the engagement-letter stage. Second, several of these regimes accept remote verification explicitly, so "we need them in the office" hasn't been true for years.

For agreements that also need a specific signature tier under eIDAS, the identity check and the signature level interact. A qualified electronic signature already carries a verified identity from a trust service provider, which is covered in our qualified electronic signature guide.

The regime behind that requirement is anti-money-laundering law, and the two are routinely confused: see KYC vs AML for what each one actually covers.

The order of operations decides how much your evidence is worth later. Verify first, then sign, and keep the two joined.

Verify before the document opens

The client gets a link, completes the document check and liveness step, and only then reaches the agreement. Nothing to sign until the identity clears. It sounds obvious, but the common pattern is the reverse: send the contract, chase the ID afterwards, hope it arrives.

Attach the result to the signature

When the client signs, the verification result, the timestamp, and the document hash are written together. That hash is a fingerprint of the file's exact contents. Change one character afterwards and it stops matching, so you can show both that the document is unmodified and that the verified person is the one who signed it. Chaindoc anchors that record on a blockchain so the timestamp doesn't depend on our own database being trustworthy, which matters when the other side is disputing you.

Keep the file retrievable

Verification evidence you can't find is verification you didn't do. Store the check, the document, and the audit trail in one place, with role-based access so only the people who need client identity data can open it. Anyone can then confirm a finished document independently through signature verification.

Running the check properly changes three things, and only one of them is compliance.

You can prove it later

A complete record shows which identity was verified, by what method, and which exact document that person signed. During an audit that's the difference between a short conversation and a file reconstruction. The audit trail is the artefact that carries this.

Disputes get shorter

Non-repudiation means a signer can't credibly claim they never agreed. Bind a verified identity to a hashed document and "that wasn't me" stops being an argument, because the evidence answers it directly.

Onboarding actually speeds up

This one surprises people. Firms assume identity checks slow things down, and a manual one does. An automated check clears in under a minute and removes the back-and-forth of chasing scans by email, which is where the real days were going.

Honest caveat: it does add a step for the client, and some clients will drop out at it. If your onboarding is a low-value self-serve signup, a full document-and-liveness check may cost you more in abandonment than it saves in fraud. Match the depth of the check to what's at stake.

You don't need to replace your existing stack to add this. Three moves, in order.

1. Decide which clients get which check

Not everyone needs the same depth. Write down the tiers: a low-value renewal might need an email and a signature, a new corporate client with a large engagement needs document, liveness, and screening. Regulated firms won't have much discretion here, the rules set the floor. Everyone else should still write the policy down, because inconsistent checks are worse than shallow ones.

2. Put the check in front of the signature

Move the identity step into the same flow as the agreement so the client does one journey, not two. A common mistake at this stage: teams keep the old email request "just in case" and end up with two parallel processes and two sets of records. Retire the old one properly.

3. Re-run screening on a schedule

Sanctions and PEP status change. A client who cleared in March can appear on a list in October, and a check you ran once is a check that's now out of date. Set a review interval, then actually keep it: quarterly for higher-risk clients, annually for the rest.

What to review each cycle:

• Screening results against current lists
• Who in your team can open client identity records, and whether they still need to
• Documents that have expired since onboarding
• Whether the verification evidence is still retrievable in one click

A few practices that separate firms who pass audits from firms who scramble.

Collect the minimum

Identity data is the most sensitive category you'll hold. Under GDPR you keep what you need for as long as the rules require, and no longer. Storing extra copies of passports "to be safe" is the opposite of safe.

Restrict access by role

Recruiters, sales, and support rarely need to see a client's identity document. Give access to the compliance and legal roles that require it, review the list on a schedule, and log every time a record is opened.

Don't accept a photo of a photo

A screenshot of an ID sent over chat isn't verification, whatever the file quality. If it didn't come through a check that tested the document and confirmed a live person, treat it as an unverified claim.

Train the people who onboard

The staff who talk to clients are the ones who'll be pressured to skip the step for an important account. They need to know they're allowed to say no, and who to escalate to when a client pushes back. Most control failures I've seen weren't technical.

Client identity verification stopped being a banking formality once onboarding moved fully remote. If you're regulated, the rules tell you what to collect and how long to keep it. If you're not, the reason to do it anyway is simpler: you're about to enter a binding agreement with someone you've never met.

Get the sequence right and most of the difficulty disappears. Verify the person, then let them sign, then keep the verification and the signed document attached to each other. A check that lives in a separate system from the signature is the one that fails you two years later, when the only question that matters is which identity signed which file.

Further reading

The requirements above come from the EU Anti-Money Laundering Directives, the UK Money Laundering Regulations 2017, and the FinCEN Customer Identification Program rules. For the signature side, eIDAS Regulation 910/2014 sets the tiers.

Compare plans on the Chaindoc pricing page, or read more guides in the Chaindoc blog.