ID document verification
Canadian and US driver's licences, passports, PR cards and provincial ID, read front and back. The barcode or the passport's machine-readable zone is checksummed and cross-checked against the printed page.
Legal and law firms
Client identification and KYC for law firms in Canada.
Verified government ID, a live face match and liveness, and a kept record, for the client you onboard by video call as much as the one across your desk. ShieldID supports your firm's client-identification and verification procedures; it does not replace your professional judgment or your law society's rules.
Nothing on this page is legal advice. It describes what ShieldID's product does. Requirements for client identification are set by your law society, FINTRAC and applicable privacy law.
The problem, in your words
You are opening a file for someone you may never meet.
Remote retainers, out-of-province clients and video-call closings are routine now. The identification step has to keep up without becoming a liability of its own.
Remote onboarding
A new client signs a retainer over video and emails a photo of their driver's licence. There is no reliable way to tell, from a JPEG, whether the document is genuine or whether the person on the call is the person on the ID.
Borrowed or synthetic identity
A matter opened under someone else's name, or under a real name attached to a fabricated or altered document, is a risk to the firm as well as to the client whose identity was used.
A file review or audit asks for evidence
Months or years later, your firm needs to show what identification steps were actually taken and when — not just that a photocopy sits in a folder somewhere.
A worked example
How it plays out for a fictional firm.
Alder & Voss LLP is a fictional three-lawyer real-estate and corporate practice. A new purchaser client is instructing them entirely by phone and video. Here is one file, start to finish.
The retainer is opened
A paralegal sends the new client a ShieldID verification link by email ahead of the intake call, with a short note explaining why it is being asked for.The client verifies on their own phone
They photograph their passport, take a short liveness challenge and give their consent to the check, on their own device, in a few minutes.The firm receives per-field verdicts
Name, date of birth, document number and expiry each carry their own result against the passport's machine-readable zone, alongside a face match reported against a fixed decision line and a liveness result.The lawyer makes the identification determination
ShieldID reports evidence, not a pass or fail decision on the client. The lawyer reviews the report alongside their own file-opening checklist and professional obligations, and proceeds.A file review, eighteen months later
The firm's compliance lead is asked to show how this client's identity was verified. She pulls the Activity Ledger entry: when the link was sent and opened, when consent was given, the verified result, and who at the firm reviewed it. The retained ID image is long since purged; the record of the check is not.
What matters most for this
The checks that support a client-identification file.
Every check below runs on every verification, on every plan. None of it is an optional extra a firm can skip to save a few dollars.
Face match
The selfie taken on the client's own phone is compared with the document portrait, and reported against a fixed decision line rather than a bare percentage.
Liveness detection
A short guided challenge, tracked on 478 facial landmarks over at least ten frames, so a photo or a screen replay of someone else does not pass as the client.
No refusals by document type
A foreign passport, an out-of-province licence or an unfamiliar provincial ID is read field by field rather than rejected because the layout is unrecognised. Verdicts are reported per field, not per document.
A kept record
Every step around the check is entered in the Activity Ledger, append-only and enforced by the database, so the firm has more than a photocopy on file.
English and French
The verification flow and the portal are available in both languages, for a Quebec-facing file or a bilingual practice.
For file reviews and audits
What the Activity Ledger gives your firm.
A client-identification step without a record is a memory, not a file. Every action around a ShieldID verification is entered in an append-only Activity Ledger, enforced by the database: entries can be added, never edited or deleted, not by you and not by us.
What's on the record
- Today
- When the verification link was opened, when the client gave consent, the verified or failed result, and who at your firm reviewed it — each with a timestamp.
- Why it matters here
- A file review, a client complaint or an internal audit can ask what identification steps were taken and when. You answer from the ledger rather than a recollection of an email thread.
- Reading the evidence is itself logged
- Opening the network and device detail behind an entry needs a written reason of at least twelve characters, and that request is itself recorded as FORENSIC_DETAIL_ACCESSED.
On the way
- Per-image view and download events
- Exactly who opened the ID photo itself, separate from the result summary.
- Decision events
- Your own file-opening decision, and the reason, recorded against the verification.
- Purge receipts
- A ledger entry each time an image is automatically deleted on its retention timer.
- CSV export
- A spreadsheet export for a file review — the Activity Log is currently readable only through the JSON API, with no dedicated export feature yet.
How it fits your practice
Three ways to plug it in.
Pick the one that matches how your firm already opens files.
Hosted link or QR code
Send a client a verification link ahead of an intake call, or show a QR code in the boardroom for a client who is present but whose ID you have not yet checked. No app install, and your desktop never needs a camera.
API
One REST API for a practice-management or client-intake system: create a session, send the link, receive a signed webhook when the result is in. Sandbox sessions are never billed.
Trust Ledger
If your firm already uses our e-signature sibling product for retainers or closing documents, an identity check can sit alongside that signed record.
Privacy and consent
What to know, and what to ask your own counsel.
Nothing on this page is legal advice. Whether client identification is required for a given matter, what your law society's client-identification and verification rules ask for, and how long a firm must keep identification records, are questions for your own law society and your firm's counsel.
- ShieldID reports verdicts and evidence — name, date of birth, address, document number and photo, each on its own — not an accept-or-decline decision. The client-identification determination is your firm's professional judgment to make.
- The client's consent to the check is captured on their own device, before capture begins.
- ID images are purged automatically on a short timer, seven days by default, configured for the service as a whole; keep your own file note if your record-keeping obligations call for a longer trail.
- Data is processed and stored on Crown Stack's own self-managed servers; ShieldID does not publish a physical location, city or data-centre name, and holds no PIPEDA certification. Check your own law society's rules and, for Quebec files, Quebec's privacy legislation, before relying on this alone.
How this compares
Against a photocopy and a phone call.
Categories, not vendor names. "Typical enterprise IDV" describes what we found across the identity-verification market broadly; your mileage will vary by vendor.
| Capability | ShieldID | Typical enterprise IDV | Manual checks |
|---|---|---|---|
| Confirms the ID itself is genuine, not just a legible photocopy | Yes | Usually | No |
| Confirms the client is the person in the photo, live | Yes | Usually | No |
| Works for a client you will never meet in person | Yes | Usually | No |
| Reads an unfamiliar or foreign document instead of refusing it outright | Yes | Rarely | Depends on staff |
| Leaves a searchable, dated record for a file review | Yes | Not offered to the customer | A paper file, if kept |
| Available in English and French | Yes | Depends on the vendor | Depends on staff |
Objections, answered
What compliance leads and lawyers ask first.
Straight answers, including where the answer is "check with your own counsel."
Does this satisfy my law society's client identification and verification rules?
We do not say that it does. ShieldID gives you verified government ID, a live face match, liveness detection and a kept record to support your client-identification and verification procedures. What your law society requires, and whether this meets it, is a question for your own law society's rules and your professional judgment.
Is ShieldID FINTRAC-compliant?
We do not claim a certification that does not exist. ShieldID reports verified ID, face match and liveness evidence, which can support client-identification steps; whether it satisfies FINTRAC's methods for a given matter is for your firm and your compliance counsel to determine.
What if the client's document is foreign or unfamiliar?
ShieldID reads whatever it can from any document and reports each field's own verdict, rather than refusing a document because its layout is unrecognised — useful for an international or newcomer client where a rigid document list would fail you.
Can we trust how a client's ID is handled?
ID images are encrypted at rest and purged automatically on a short timer, seven days by default. The Activity Ledger records who accessed a verification and when; opening the underlying network and device evidence needs a written, logged reason.
How long can we keep the verification record if our retention obligations require it?
The Activity Ledger entry itself has no purge job and persists for the life of the account. The ID image behind it is purged on a short timer, seven days by default; keep your own file note in the meantime if your obligations call for a longer trail on the document itself.
What you see
A client verified remotely, with the evidence on file.
Your client verifies on their own phone, wherever they are. The result shows what was read from their passport and how each check came out.
Questions
Straight answers for law firms.
See it on a real file
Run one sandbox verification before you send it to a client.
Sandbox sessions are never billed. Try the flow yourself, then decide whether it fits your intake process.
Not legal advice. Check your own law society's rules and your firm's counsel before relying on this for client identification.