Overview
Effective January 1, 2024, the Law Society’s temporary emergency measure allowing licensees to virtually verify client identity without authentication ended. Licensees must now authenticate an individual’s government-issued ID, meaning the licensee must use a process or method to determine if the ID is true and genuine and cannot do so virtually. Bylaw 7.1 (made under the Law Society Act) allows two methods of verification virtually: the credit file method and the dual process method. Licensees can also use an agent to verify identity. The Notice to the Profession dated July 27, 2023 and additional resources from the LSO can be found here.
Due to the COVID-19 public health measures and mobility restrictions, the LSO changed the requirement of in-person verification when verifying government-issued photo identification. This change enabled licensees to verify client identity by leveraging video conferencing technology and other virtual communication methods during the COVID-19 lockdown, ensuring that legal services remained accessible.
To assist in the authentication process, a variety of virtual authentication services are widely available to lawyers. This article identifies licensees’ requirements to virtually verify client identity via the government-issued photo identification method, and summarizes two virtual authentication services available, Treefort and DocuSign Identify.
LSO Virtual Authentication Requirements
Under By-Law 7.1, the client identification and verification requirements now include six main elements:[1]
- Identification. Obtaining basic identification information about the client and any third party that the client is acting for or representing.
- Verification. Verifying the identity of the client or third party where the lawyer or paralegal is engaged in or giving instructions in respect of the receipt, payment, or transfer of funds (a “financial transaction”). Additional steps are required when verifying the identity of minors and organizational clients.
- Source of Funds. Obtaining source of funds information from the client where there is a financial transaction.
- Monitoring. Periodically monitoring the professional business relationship with the client when retained in respect of a financial transaction that is ongoing.
- Record Keeping. Recording and retaining all information acquired during the identification and verification process.
- Withdrawal. If at any point while retained, including while obtaining identification and verification information, withdrawing from representation if the lawyer or paralegal knows or ought to know that they would be assisting in fraud or other illegal conduct.
Licensees can virtually verify client ID through the government issued photo identification document method, which requires verifying government issued photo ID, excluding municipal government photo IDs.[2]
Where client IDs will be virtually authenticated, licensees must use a process or method to determine whether an individual’s government-issued photo ID is authentic, valid, and current and other information used must be valid and current.[3]
The process or method that is selected must:[4]
- Verify that the clients' identification document is true and genuine.
- Verify that the clients’ identification document is valid and current.
- Comply with the licensees’ recordkeeping obligations.[5]
Step 1: Verifying a true and genuine identity document.
Licensees may assess the authenticity of the government-issued photo identification document by:
- Asking the individual to scan their government-issued photo identification document using the camera on their mobile phone or electronic device and sending this scanned image by secure means, or, asking the individual to show the original identification document during the video conference, and
- Using technology to compare the features of the government-issued photo identification document against
- known characteristics (e.g., size, texture, character spacing, raised lettering, format, design)
- security features (e.g., holograms, barcodes, magnetic strips, watermarks, embedded electronic chips), or
- markers (e.g., logos, symbols).
Step 2: Verify a valid and current authenticated identity document.
Licensees may assess the validity and currency of the authenticated government-issued photo identification document by:
- Comparing the name and features of the video image of the individual during the virtual meeting to the name and photo on the authenticated government-issued photo identification document, or
- Asking the individual to take a photo of themselves using the camera on their mobile phone or electronic device and using a software application to apply biometric technology (e.g., facial recognition technology) to compare the features of that photo to the photo on the authenticated government-issued photo identification document. Licensees should also compare the name of the government-issued photo identification document with the name provided by the individual.
Step 3: Comply with recordkeeping obligations.
Licensees may comply with their recording keeping obligations by keeping a record of:
- The method of verifying the client’s identification, with the applicable date,
- The process followed to determine whether the government-issued photo identification document is authentic,
- Efforts that made to confirm that it is valid and current.
The Client-Verification Form (Individual) is a valuable resource for fulfilling recordkeeping obligations, and is available here: (Client Verification Form (Individual)).
Directory of Authentication Services
There are several technology services available to help authenticate identity documents. The Digital Identification and Authentication Council of Canada (DIACC) Directory provides a directory of authentication services, combining government-issued photo identification cards with biometric facial scans. While not exhaustive, the directory serves as a valuable resource.
Licensees may consider using the technology products identified in the DIACC Directory, products that use similar authentication technologies, or any other products that meet the authentication requirements discussed above and comply with the licensees’ obligations under the Law Society’s rules and by-laws. However, it is important to remember that different service providers might not use the same underlying technology as the services listed in the DIACC Directory to authenticate identity documents.
Additional information about virtual verification of identity is available on the Law Society’s website including resources for licensees and links to archived continuing professional development programs available at no cost.
Exploring Virtual Authentication Services: Treefort and DocuSign Identify
Two virtual authentication services, Treefort and DocuSign Identify, offer innovative solutions to streamline the client identity verification process.
Treefort: A Rising Authentication Service Provider
Treefort is an authentication service provider based in Edmonton, Alberta. In October 2019, Treefort entered a ground-breaking agreement with the Law Society of Alberta (LSA), facilitating the LSA's participation in its service launch. Specializing in real estate transactions, Treefort currently provides identification verification and fraud prevention services.
Treefort is planning to expand its portfolio of products to offer electronic signatures and online video conference capabilities. [6]
Treefort’s Virtual ID Verification Process[7]
Virtual ID Verification with Treefort starts with a signer receiving a message via email or text, providing a link to initiate the verification process. Signers undergo a two-step verification by entering a code sent to their smartphone. Signers review Treefort’s privacy policies and information, and consent is given in the following step. A readiness checklist is presented to ensure that the signer has their ID with them. Signers select their current home address and proceed to upload a photo of their ID document, which can be a passport, driver's license, residence permit, or national identity card. Facial verification scans are conducted with signer’s consent. For additional security, signers can be asked to confirm their primary bank account details by logging into their mobile banking application. Signers may be asked to upload a secondary ID document. The verification process concludes with a "Complete!" message, confirming successful ID verification, and a confirmation email is sent to the requesting party.
User tutorials for Treefort’s Virtual ID Verification process are available here.
DocuSign: A Global Leader in E-Signatures and Authentication Services
Founded in 2003, DocuSign has emerged as a global leader in e-signature technology, serving over a million customers and hundreds of millions of users across 180 countries. DocuSign Identify refers to DocuSign’s comprehensive portfolio of enhanced signer identification and authentication capabilities.[8]
DocuSign Identify offers:[9]
- ID Verification: digital identity proofing of signers via verification of passports, driver licenses, or ID cards, knowledge-based authentication (KBA) questions, or electronic IDs.
- SMS/Call Authentication: multi-factor authentication via text message or phone call
- ID solutions for digital signatures: meet requirements for Advanced and Qualified Electronic Signatures
- Network of trust service solutions: Identify is extensible with service providers around the world
In July 2023, DocuSign expanded its portfolio with Liveness Detection, a feature leveraging AI for biometric analysis to confirm a signer’s identity, physical presence during the signing process, and the authenticity and currency of their IDs.[10] To achieve this, signers capture a live video selfie, which Docusign suggests is more secure compared to the alternatives of uploading of taking of a photo in real-time. The use of Liveness is advantageous due to signers responding to specific prompts, aiding in the detection of spoofing, potential use of fake webcams or emulators, and ensuring that the signer was genuinely present during the video selfie capture.[11]
DocuSign Identify’s Virtual ID Verification Process[12]
Virtual ID verification begins with the signer receiving an email containing a verification link. New user identities undergo verification through various options, including government-issued IDs, electronic or bank-based IDs, and knowledge-based questions. Existing users may be authenticated using a simple 2-factor authentication via SMS or phone call.
During ID verification, DocuSign Identify employs artificial intelligence to ensure:
- The ID is current
- The name matches the envelope as specified by the sender (see also Improve Name Matching to Boost ID Verification Success Rate)
- The MRZs (machine readable zones), such as the barcode, decode information that is consistent with the rest of the ID Visual features/holograms
- There is no evidence of fonts tampering, letter spacing, holes or other defects in the ID
- No calls are made to government databases, as many require dedicated privileges
Users have the flexibility to set the maximum number of verification attempts before the virtual document envelope is locked. ID documents can be reviewed by trained DocuSign agents available 24/7. For record-keeping purposes, users can select metadata information they wish to extract, such as verification status, name, address, or a copy of the ID document.
Upon successful verification, DocuSign provides a certification of completion, including details of the verification process such as signing status, signer events, signature, location of the IP address, type of ID method used, and the time and date. A confirmation email is sent to the requesting party, ensuring transparency and accountability in the authentication process.
User tutorials for DocuSign's Virtual ID Verification process are available here.
A Reminder for the Future
While these changes, effective January 1, 2024, apply solely to virtual verification of individual identities, the trajectory towards technological advancements and the ongoing threat of illegal activities highlights the importance of identifying useful authentication solutions. As some title insurance companies and lenders may adopt preferred technologies, the legal community must remain vigilant in leveraging these advancements to ensure both efficiency and security in identity verification processes. These enhanced rules will impact real estate lawyers specifically as they are engaged to facilitate the transfer of funds for their clients. On-demand discussions on ID verification are available via OBA CPD videos 11th Annual Professionalism Issues For Business Lawyers and Priority Pd: Important Updates On Virtual Verification Of Client Identity. Be on the lookout for future CPD programming on this topic to better prepare yourself, your practice and your staff.
[5] Ibid at “commentary 2 - . “How do I comply with the requirements for virtual verification with authentication?”
Any article or other information or content expressed or made available in this Section is that of the respective author(s) and not of the OBA.