Part 2: Professional risk - ACSP identity verification options

Our risk partners Karen Eckstein Ltd give a summary on a topical issue below           

ACSP identity verification – the 3 options available

One key mistake that we see many firms making is assuming that the ACSP identity verification requirement is identical to the existing AML obligations and that the existing AML checks will suffice for ACSP. The two are very different – not only because ACSP is, as we understand, from a verification point of view, a one and done process, whereas AML is an ongoing process with an additional need to monitor and risk assess.

It is important that firms understand the differences and update their policies and processes and train staff in the new regime, not merely seek to replace one with the other, to avoid exposing staff and the firm to penalties, potential offences and risk.

There are 3 options available:

1. Ask clients to verify their own ID

This is allowed under the system, but the process isn’t simple, and many clients may get it wrong.

2. Use IDVT (Identity Document Validation Technology)

This is likely to be the most efficient route for many firms. IDVT enables firms to verify biometric documents like passports via secure tech, and can also support AML compliance, (although risk assessments will still be required) reducing duplication to an extent.

3. Train staff in manual document verification

If your firm prefers not to invest in technology to solve the problem, you’ll need to send staff on approved document verification training. Merely viewing documents, even in person, is not sufficient unless the verifier is properly trained. This approach involves time, cost, and operational setup.

---

What are the risks of the various options?

The risk of using option 1 is that clients make errors in trying to verify their own identity and then ask the firm to do it for them, if the firm isn’t set up to do so, they risk losing the client. Further, we expect many firms will see clients expecting this to be done for them by their advisers and tensions creeping into the relationship if the firm does not offer it.

Option 2 is likely to be the most popular, and, in our view, lower risk, so long as firms are aware of the difference between AML compliance and ACSP compliance and have appropriate processes in place to ensure compliance with both.

Option 3 is going to require the training of specific individuals within the firm and then ensuring that those individuals undertake the verification and then taking the risk that they perform the verification correctly.

---

What processes should firms be considering implementing?

Once firms have registered as ACSP- they should keep a careful note of the details registered – including the email address used for registration.

Firms should consider who should be added as a user on the account, noting that users don’t need to verify their identity, can file on behalf of clients and verify people’s identities for Companies House.

Users can be given one of 3 roles when added

• account owners – can update the authorised agent’s details, and add and remove all users

• administrators – can add and remove administrators and standard users

• standard users – cannot add and remove other users

Users can be removed from the account at any time. Once a user is removed, they will no longer be able to access the account or services for the registered ACSP.

Firms should consider amending their document retention policy and processes so that any identity information obtained in order to comply with ACSP is kept for at least 7 years from verification. If that information is also used for AML purposes, then it needs to be kept for 5 years from the end of the client relationship as well.

Firms should consider implementing a process to ensure that any changes in the firm’s details- change of details held about the authorised agent have to be notified in 14 days.

Firms can also consider what to charge for undertaking the ACSP process for clients- some firms are thinking of charging between zero to £100 for the service.

---

Another article in the professional risk series that supports this topic can be found here:

Part 1: "ACSP in practice"