Legal and law firms
Client identification and KYC for law firms in the United States.
Verified government ID, a live face match and liveness, and a kept record, for the client you onboard by video call as much as the one across your desk. ShieldID supports your firm's client-identification and verification procedures; it does not replace your professional judgment or your state bar's rules.
Nothing on this page is legal advice. It describes what ShieldID's product does. Requirements for client identification are set by your state bar, applicable state and federal law, and your own counsel.
The problem, in your words
You are opening a file for someone you may never meet.
Remote retainers, out-of-province clients and video-call closings are routine now. The identification step has to keep up without becoming a liability of its own.
Remote onboarding
A new client signs a retainer over video and emails a photo of their driver's license. There is no reliable way to tell, from a JPEG, whether the document is genuine or whether the person on the call is the person on the ID.
Borrowed or synthetic identity
A matter opened under someone else's name, or under a real name attached to a fabricated or altered document, is a risk to the firm as well as to the client whose identity was used.
A file review or audit asks for evidence
Months or years later, your firm needs to show what identification steps were actually taken and when — not just that a photocopy sits in a folder somewhere.
A worked example
How it plays out for a fictional firm.
Alder & Voss LLP is a fictional three-lawyer real-estate and corporate practice. A new purchaser client is instructing them entirely by phone and video. Here is one file, start to finish.
The retainer is opened
A paralegal sends the new client a ShieldID verification link by email ahead of the intake call, with a short note explaining why it is being asked for.The client verifies on their own phone
They photograph their passport, take a short liveness challenge and give their consent to the check, on their own device, in a few minutes.The firm receives per-field verdicts
Name, date of birth, document number and expiry each carry their own result against the passport's machine-readable zone, alongside a face match reported against a fixed decision line and a liveness result.The lawyer makes the identification determination
ShieldID reports evidence, not a pass or fail decision on the client. The lawyer reviews the report alongside their own file-opening checklist and professional obligations, and proceeds.A file review, eighteen months later
The firm's compliance lead is asked to show how this client's identity was verified. She pulls the Activity Ledger entry: when the link was sent and opened, when consent was given, the verified result, and who at the firm reviewed it. The retained ID image is long since purged; the record of the check is not.
What matters most for this
The checks that support a client-identification file.
Every check below runs on every verification, on every plan. None of it is an optional extra a firm can skip to save a few dollars.
Face match
Liveness detection
Every jurisdiction, not just the common ones
A kept record
English and French
For file reviews and audits
What the Activity Ledger gives your firm.
A client-identification step without a record is a memory, not a file. Every action around a ShieldID verification is entered in an append-only Activity Ledger, enforced by the database: entries can be added, never edited or deleted, not by you and not by us.
What's on the record
- Today
- When the verification link was opened, when the client gave consent, the verified or failed result, and who at your firm reviewed it — each with a timestamp.
- Why it matters here
- A file review, a client complaint or an internal audit can ask what identification steps were taken and when. You answer from the ledger rather than a recollection of an email thread.
- Reading the evidence is itself logged
- Opening the network and device detail behind an entry needs a written reason of at least twelve characters, and that request is itself recorded as FORENSIC_DETAIL_ACCESSED.
On the way
- Per-image view and download events
- Exactly who opened the ID photo itself, separate from the result summary.
- Decision events
- Your own file-opening decision, and the reason, recorded against the verification.
- Purge receipts
- A ledger entry each time an image is automatically deleted on its retention timer.
- CSV export
- A spreadsheet export for a file review — the Activity Log is currently readable only through the JSON API, with no dedicated export feature yet.
How it fits your practice
Three ways to plug it in.
Pick the one that matches how your firm already opens files.
Hosted link or QR code
Send a client a verification link ahead of an intake call, or show a QR code in the boardroom for a client who is present but whose ID you have not yet checked. No app install, and your desktop never needs a camera.
API
One REST API for a practice-management or client-intake system: create a session, send the link, receive a signed webhook when the result is in. Sandbox sessions are never billed.
Trust Ledger
If your firm already uses our e-signature sibling product for retainers or closing documents, an identity check can sit alongside that signed record.
Privacy and consent
What to know, and what to ask your own counsel.
Nothing on this page is legal advice. Whether client identification is required for a given matter, what your state bar's client-identification rules ask for, and how long a firm must keep identification records, are questions for your own state bar and your firm's counsel.
- ShieldID reports verdicts and evidence — name, date of birth, address, document number and photo, each on its own — not an accept-or-decline decision. The client-identification determination is your firm's professional judgment to make.
- The client's consent to the check is captured on their own device, before capture begins.
- ID images are purged automatically on a short timer, seven days by default, configured for the service as a whole; keep your own file note if your record-keeping obligations call for a longer trail.
- Data is processed and stored on ShieldID's own servers in Canada, not a public cloud and not a US data center. ShieldID holds no certification for US privacy law. Check your own state bar's rules and applicable state privacy law before relying on this alone.
How this compares
Against a photocopy and a phone call.
Categories, not vendor names. "Typical enterprise IDV" describes what we found across the identity-verification market broadly; your mileage will vary by vendor.
| Capability | ShieldID | Typical enterprise IDV | Manual checks |
|---|---|---|---|
| Confirms the ID itself is genuine, not just a legible photocopy | Yes | Usually | No |
| Confirms the client is the person in the photo, live | Yes | Usually | No |
| Works for a client you will never meet in person | Yes | Usually | No |
| Reads an unfamiliar or foreign document instead of refusing it outright | Yes | Rarely | Depends on staff |
| Leaves a searchable, dated record for a file review | Yes | Not offered to the customer | A paper file, if kept |
| Available in English and French | Yes | Depends on the vendor | Depends on staff |
Objections, answered
What compliance leads and lawyers ask first.
Straight answers, including where the answer is "check with your own counsel."
Does this satisfy my state bar's client identification rules?
We do not say that it does. ShieldID gives you verified government ID, a live face match, liveness detection and a kept record to support your client-identification and verification procedures. What your state bar requires, and whether this meets it, is a question for your own state bar's rules and your professional judgment.
Does this satisfy our Customer Identification Program or AML obligations?
ShieldID gives you a documented, repeatable identity check with a record behind it, evidence you can use inside your own compliance program. Whether it satisfies a specific regulatory requirement for your firm is a question for your compliance counsel, we do not claim a certification that does not exist.
What if the client's document is foreign or unfamiliar?
ShieldID reads whatever it can from any document and reports each field's own verdict, rather than refusing a document because its layout is unrecognized — useful for an international or newcomer client where a rigid document list would fail you.
Can we trust how a client's ID is handled?
ID images are encrypted at rest and purged automatically on a short timer, seven days by default. The Activity Ledger records who accessed a verification and when; opening the underlying network and device evidence needs a written, logged reason.
How long can we keep the verification record if our retention obligations require it?
The Activity Ledger entry itself has no purge job and persists for the life of the account. The ID image behind it is purged on a short timer, seven days by default; keep your own file note in the meantime if your obligations call for a longer trail on the document itself.
What you see
A client verified remotely, with the evidence on file.
Your client verifies on their own phone, wherever they are. The result shows what was read from their passport and how each check came out.
Questions
Straight answers for law firms.
See it on a real file
Run one sandbox verification before you send it to a client.
Sandbox sessions are never billed. Try the flow yourself, then decide whether it fits your intake process.
Not legal advice. Check your own state bar's rules and your firm's counsel before relying on this for client identification.