Why a Firm Keeps Asking Who You Are

Verification is not one event

Most people meet identity checks once, at the start, and file the experience under paperwork completed. The account opens, trading begins, and the subject appears closed. Then a request for documents arrives two years later with nothing obviously prompting it, and it reads as suspicion.

It usually is not. A firm's obligation is to know who its client is on an ongoing basis, not to have known once, and that single difference explains almost every request that arrives at an unexpected moment. Verification is a process with several distinct stages, each triggered by something different, and the stages are worth telling apart because what they ask for and what happens if they go unanswered are not the same.

The first stage: who you are

Onboarding establishes identity and address, and it is the lightest of the stages because it is answering the narrowest question. A document showing who you are, a document showing where you live, and a set of declarations about occupation, income and what the account is for.

The declarations are the part that gets least attention and does the most work later. They are not a survey. They set the expectation against which everything the account subsequently does is compared, so an occupation entered carelessly, or a purpose chosen from a dropdown without much thought, becomes the baseline that later activity is measured against. Answering them accurately is the cheapest thing available at this stage, because the alternative is explaining a mismatch that was never a mismatch in reality.

The second stage: where the money came from

Identity and funds are separate questions, and the second is heavier. Establishing who you are is a matter of documents you already hold. Establishing where money came from means evidence tying it to a lawful origin — employment records, tax filings, business accounts, the contract for a sale, or statements showing accumulation over time.

What catches people is the timing rather than the request. Firms frequently onboard on identity alone and ask about funds only when something makes the question live: a deposit larger than the account's stated profile, an unusual funding pattern, a higher-risk factor in the file, or a withdrawal request. That last one is the ordinary case and the most frustrating, because it puts the heaviest evidential step between a client and their money rather than between a client and their first trade. The documents involved are not quick to obtain, and they take exactly as long whether they are gathered in advance or in the middle of a payout.

The third stage: staying known

The stage that surprises people most is the one with no trigger at all. Firms are required to keep client records current and to keep monitoring, so a request can arrive purely because a review cycle came due for an account with that risk rating.

It has two halves that behave differently. Keeping the record current is mechanical: documents expire, addresses change, declarations stop being true, and the firm has to fix that. Monitoring is comparative: funding and trading are checked against the profile the account described at opening, so a change on the client's side that was never notified shows up as a discrepancy. A promotion, a business sold, an inheritance, a move abroad — each is an ordinary life event and each makes an account stop matching its own file. Telling the firm at the time is a two-minute job. Explaining it retrospectively, against a query, is not.

The heavier tier, and what actually triggers it

Above the standard checks sits a heavier tier applied where a firm's own risk assessment calls for it. It asks for more evidence and involves approval further up the organisation, and the important thing about it is what puts an account there.

The triggers are structural rather than behavioural: a jurisdiction the firm treats as higher risk, an ownership structure it cannot see through, a prominent public role held by the client or a family member, or funding that does not match the profile. None of those is a finding about conduct. Being classified this way is a statement about the checking required, not about the client, and it is one reason the tone of a request can feel disproportionate to anything the client has done — because it is not responding to anything the client has done.

What a request actually is, and what to do with it

The practical shape of all this is simpler than the framework behind it. A request for documents is a condition on continued normal service, and the lever behind it is access: firms can and do restrict activity, and payments out in particular, until a file is current.

Three things follow. Documents are worth assembling before they are asked for, because the elapsed time is the same either way and only its position changes. Changes on your side are worth notifying when they happen, because the file is what an account is measured against. And an unanswered request does not expire — it becomes a restriction, which is a slower thing to undo than the reply would have been. Where a request seems disproportionate, the firm's complaints procedure and the regulator behind it are the route, and both work better with a record of what was asked, what was sent, and when.