Most clients complete their ID check without any questions, but some will want to know who Firmcheck is, where their data goes, or why they need to verify again after doing it with Companies House. This is more likely in the run-up to the 18 November Companies House deadline.
If you haven't sent the check yet, our guide to pre-warning clients before sending verification requests helps reassure them that the request is genuine. If a client has already raised concerns, you can copy the template below, fill in the details in square brackets and send it from your own email.
Good to know: a client who is unwilling to verify their identity can itself be a risk factor, so it's worth considering this in their client risk assessment.
Subject: Your identity check: how it works and how your data is protected
Hi [Client name],
Thanks for asking about the identity check. Here's a quick overview.
Why we need it. As your accountants, we're legally required under the Money Laundering Regulations 2017 to verify the identity of our clients. We use Firmcheck, a specialist compliance platform for accounting firms, to do this securely. Firmcheck Limited is a UK-registered company (no. 11997004) and is registered with the Information Commissioner's Office (ZB428150).
If you've already verified with Companies House. The verification you completed with Companies House is for their own register. The regulations require us to carry out and keep our own records, so we can't rely on another organisation's check in place of ours.
How it works. You'll receive an email from us with a secure link that is unique to you, so please don't forward it. Using a phone or another device with a camera, you'll take a photo of your passport or driving licence and a proof of address, then take a quick selfie. The selfie is compared with your ID photo to confirm it's you. [If we've also asked you to scan your passport chip, you'll do this in the Firmcheck app, which confirms your passport is genuine.] We may also check your name against sanctions and politically exposed persons lists, which is a standard legal requirement.
Who sees the results. Only our firm. Your information isn't shared with anyone else, used for marketing or used to train AI. [A member of our team reviews every result, so no decision is made by a computer alone.]
Where your data is stored. Your data is held in secure UK data centres (Amazon Web Services) and is encrypted both in transit and at rest. The face-matching step is carried out by a specialist provider using technology certified under the UK Government's digital identity trust framework. Some processing takes place in New Zealand and Ireland, both of which the UK recognises as having adequate data protection standards.
What's kept. No "faceprint" or biometric template is stored after the check. Your selfie and ID images are kept securely in your file with us as part of our legal records. The face-matching provider removes your personal details from its systems after 90 days.
How long we keep it. We keep your records for as long as the law requires, generally five years after our relationship ends, and then delete them.
Keeping you safe. Neither we nor Firmcheck will ever ask for your passwords or payment details as part of this check. If you receive a request like that, please don't respond, and contact us directly instead.
Firmcheck complies with UK GDPR and the Data Protection Act 2018. If you have any questions about your data or your privacy rights, just get in touch with us.
Kind regards,
[Your name]
[Firm name]
Our Security and privacy FAQ covers how Firmcheck handles data in more depth, written for firms rather than clients.