Effective January 1, 2022 the Law Society of Ontario (“LSO”) has updated its requirements for client identification and verification, as it relates to anti-money laundering.
Prior to this amendment, the LSO had drawn a clear distinction between identifying a client (obtaining and recording basic information about them) and verifying a client, who is not face-to-face, through an independent source (from their government-issued photo ID) to confirm that they are who they purport themselves to be.
What was acceptable previously?
The Law Society’s practice guidelines surrounding COVID-19 suggest that “until further notice, the Law Society will interpret the requirement that lawyers and paralegals verify the identity of their client face-to-face as not requiring the lawyer or paralegal to be in the physical presence of the client. Rather, alternative means of verification such as face-to-face verification via video conference will be permitted.”
This method of verification leaves lawyers open to potential issues as there is no way to verify that the person appearing on the screen is indeed the person who they purport to be or that they are a live human being. Deepfakes (a video in which a person’s face or body has been digitally altered), 3D masks and photographs are techniques that can be used to commit fraud and so this method of just viewing someone via video conference is not a secure way to verify a client’s identity.
Utilizing the government-issued ID method is another approach to verifying a client’s identity. An original, valid and current government-issued document (except one issued municipally) with a client’s name, photograph and a unique identifying number can be presented. The name and the photograph on the document must match the individual being verified.
It was easier to validate the authenticity of an ID when it was viewed in person by looking at the documents’ characteristics and security features. However, in today’s virtual world the ability to validate these documents requires technology to determine their authenticity, as well as that of the individual presenting them. The LSO does not require that technology be used to perform this authentication. The requirement states only that the name and photograph must match and that the document used is original and authentic. Similar to face-to-face, the potential for fraud exists with this method as it is the lawyer’s responsibility to ensure that the person on-screen is who they say they are and that the document being used is valid. Given the multiple ways that fraudsters can fool the system (Deepfakes, #D masks etc.), this method is not a secure or fraudproof way to verify a client’s identity.
Now, in addition to the previous guidelines, the LSO has also approved two additional methods for client identity verification purposes:
Credit File Method -
This method allows lawyers and paralegals to verify an individual’s identity by relying on information that is in their credit file. The file must be located in Canada, have been in existence for at least three years and the info in the file must match the name, date of birth and address provided by the individual. The credit file request must be conducted at the time of verification.
Although this method of verification offers lawyers some peace of mind that the information they are using to verify the client is being provided by a neutral third party, this still leaves room for potential fraud as the client interaction is taking place via video conference and there is no way to authenticate that the person is who they say they are or that the credit file being pulled belongs to them. There is no liveness or biometric checks being performed so a lawyer can not have complete confidence that the verification of the identity of their client is fraudproof.
Dual Process Method -
This method requires that lawyers and paralegals rely on any two of the following pieces of information to verify identity
i) Information from a reliable source that contains the individual’s name and address (such as a Driver’s License)
ii) Information from a reliable source that contains the individual’s name and date of birth (such as a citizen certificate) and/or
iii) Information containing the individual’s name confirming that they have a deposit account, a credit card or other loan amount
The dual-process method has the added benefit of not only viewing and verifying the individual’s source documents but also by incorporating technology into the process proving that the individual in fact matches the ID they have presented. With this method, both biometric matching (a process of authenticating a person, by comparing their physiological attributes to information that has already been collected) and liveness detection (a process to determine if the computer is interfacing with a live human and not an impostor) are performed. The combination of these checks will give a lawyer the confidence to know that the verification process has been carried out to the highest standard, the same as those used in the financial industry as outlined by the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC).
Vaultie and the Dual Process Method
Vaultie fills the gap that exists, which leaves lawyers and paralegals susceptible to unknowingly participating in fraud, depending on the method of identity verification used. By incorporating the dual process method, we have developed a digital identity verification solution that takes the guesswork out of authenticating ID for members of the bar. We tether fraud-resilient verifiable credentials to legal documents by anchoring data to blockchain and creating digital trails that can always be authenticated by both parties to the agreement and other relevant 3rd parties.
This digital signature technology goes above and beyond the minimum practice requirements, safeguarding your business, your clients, and your professional reputation against unwittingly participating in fraudulent activities. Vautlie works with lawyers across all areas of the bar to ensure that they are performing their due diligence to the highest standards to verify that their clients are exactly who they say they are. Contact us today to learn more about how we can help seamlessly integrate this technology into your practice.