Collecting identity documents from new clients

A new client says yes on Monday. By Wednesday you would like to start, and the one thing in the way is identity: a passport photo with the corners cut off, a utility bill from last year, a driving license photographed under a kitchen light. It is the least interesting part of onboarding and the one you are not allowed to skip.

In many countries the law makes accountants and bookkeepers verify who their clients are before the work starts. This guide covers what to ask a new client for, how to word the request so the copy is usable the first time, how to handle companies and their owners, and how to keep the copies safe afterwards. It is practical guidance, not legal advice: your anti-money laundering supervisor's rules come first, so check what your supervisor requires.

When you must verify identity

In the United Kingdom, accountancy service providers, bookkeepers and tax advisers are covered by the Money Laundering Regulations and must carry out customer due diligence. HMRC's guidance describes it plainly: identify your customers and check they are who they say they are. You apply it when you establish a business relationship, when you have doubts about information a client gave you, when you suspect money laundering, and for existing clients when their circumstances change. If you have doubts about a client's identity, the guidance says you must stop dealing with them until you are sure.

In Ireland, the Criminal Justice (Money Laundering and Terrorist Financing) Act 2010 designates accountants, auditors, tax advisers and external bookkeepers, and customer due diligence applies to them too. Anti-money laundering law in the UAE and in EU countries such as Germany, France, Spain and the Netherlands also requires accountants to verify their clients' identity.

Elsewhere the rules differ by country and by the kind of work. Many firms in other countries still ask for identity documents in certain situations, for example before acting for a client with a tax authority. Whatever your location, your supervisor or professional body sets the detail: which documents count, how you verify them, and how long you keep them.

What to ask an individual for

HMRC's guidance says that in practice you obtain a customer's name, a photograph on an official document that confirms their identity, and their residential address and date of birth. It suggests a government-issued document such as a passport, and documents such as utility bills or bank statements for the address. Most firms turn that into three items.

Two rules prevent most of the second requests. Ask for two different documents, so a driving license used as photo ID is not sent again as proof of address. And state the age limit for the address document in the request itself, in months, rather than saying "recent". Many firms use three months; use whatever your own policy says.

Companies, partnerships and their owners

For a business client you need to understand who is behind it. HMRC's guidance calls this the beneficial owner: usually the person who owns or controls the customer, or on whose behalf the work is done. For a company that means the people with significant control as well as the directors you deal with.

• The company's registered name and number, and its registered office address
• A current extract of the official company record, or the details to look it up yourself
• The names of the directors and of everyone who owns or controls the company
• Photo ID and proof of address for each person your policy says you must verify
• For a partnership or trust, the deed or agreement that shows who controls it

In the UK, Companies House made identity verification mandatory for directors and people with significant control from 18 November 2025. That is a separate requirement from your own due diligence. Whether and how you may take it into account is a question for your supervisor, not for a checklist.

Collect identity for each person as its own set of items, named after the person. "Photo ID: Mira Chen" and "Photo ID: Tom Reed" are easy to track. "IDs for the directors" is how one of them goes missing for three weeks.

How to ask so the copy is usable

A client who has never been asked for identity by an accountant may find the request odd. Say why in one sentence, then make each item specific enough that there is only one right answer.

Before and after, for the item that causes most of the trouble:

• Before: "Please send proof of address."
• After: "A utility bill, council tax bill or bank statement dated within the last 3 months, showing your name and home address. Not a mobile phone bill. Not the same document as your photo ID."

Ask for identity in the same request as the rest of onboarding, at the top of the list, rather than in a separate email that can be overlooked. The new client onboarding checklist shows the rest of that request and the order that unblocks your work.

Checking what arrives

Look at identity documents the day they arrive, while the client still has the passport on the table. A week later they are traveling with it.

• The name matches the engagement letter and the other document, including middle names and spelling
• The photo ID is in date on the day you check it
• All four corners and the whole photo are visible, with no glare or fingers over the text
• The address document is within your age limit and shows the home address, not a business address
• The two documents are different documents from different sources
• For a company, you have one set for every person your policy names
• You recorded who checked it, when, and how, as your policy requires

If a copy is unusable, say exactly why and what to send instead. "The photo is too dark to read the expiry date, could you take it again near a window?" gets a new photo the same day. "We need a better copy" gets the same photo again.

Keeping the copies safe

Identity documents are the most sensitive files a client sends you, and the ones most often left in an inbox. A passport scan attached to an email sits in the client's sent folder, your inbox, your colleague's inbox if it was forwarded, and every backup of all three. The comparison in secure ways to collect client documents covers the options in detail.

Three practical rules help most:

• Collect through an upload, not an attachment. Then the copy lives in one place you control.
• Keep for the period your rules set, then delete. HMRC's guidance says due diligence records are kept for five years from the date the business relationship ends. Your supervisor may say more. Set a reminder at the end of each relationship.
• Limit who can open them. Not everyone in the firm needs to see a client's passport. Store identity documents where only the people who verify them can reach them.

Questions

Doing this with Pingtail

Pingtail collects the copies; it does not verify identity, which stays your firm's job. The ready-made checklists include identity documents as required items where the law makes accountants verify identity: the UK has its own identity checks request with photo ID and proof of address worded as above, and the new client checklists for Ireland, the UAE, Germany, France, Spain and the Netherlands ask for an identity document. A photo that is too small or too dark is refused before it uploads. Every file is encrypted with its own key before it is stored, you choose how long files are kept, and you can delete one file or all of a client's files at any time. See the full request on the new client onboarding page. You can try it on yourself first: send a test request to your own email and upload the wrong file on purpose.