Once a year, every 1Office client receives an email asking them to complete identity verification again through our KYC partner, Ondato. Every year, a number of clients pause when this email arrives and wonder whether it is genuinely from us. That reaction makes complete sense. An unexpected request to photograph your ID and take a selfie understandably triggers caution. It is a genuine, legally required process, not a one-off request we invented. Every regulated accounting and corporate service provider in the EU is required to do this at least once a year, on the same basis that your bank and any payment provider you use already does. This guide explains exactly why the annual re-verification exists, what it involves, and how to confirm for yourself that any request you receive is genuinely from us.
This request is genuine. It is a legal obligation we are required to meet.
1Office is a regulated provider of accounting and corporate services. Under EU anti-money laundering law, we are legally required to re-verify the identity of every client at least once a year. This applies to every client, every year, with no exceptions, because the law does not allow exceptions.
Why This Exists
Why your accountant has to verify your identity again, every single year
Know Your Customer (KYC) requirements come from EU anti-money laundering legislation, most recently consolidated and strengthened under the EU's Anti-Money Laundering Directive framework (AMLD) and the newer Anti-Money Laundering Regulation (AMLR). These rules apply to a specific list of regulated entities: banks, payment institutions, currency exchanges, lawyers, notaries, and accounting and corporate service providers. 1Office falls into the last category in every country where we operate.
The rules do not just require identity verification once, at the start of the relationship. They require ongoing due diligence, meaning the regulated entity must periodically confirm that the information it holds about a client is still accurate and that the client's risk profile has not changed. For standard-risk clients, the accepted interval across the industry is once every 12 months. This is not a 1Office-specific policy. It is the same standard your bank applies, which is why your bank periodically asks you to confirm your details or re-verify your identity through an app, and why every other regulated accounting firm operating in Estonia, Sweden, Finland, the UK, and Lithuania does the same thing.
What happens if a client does not complete the annual re-verification
This is the part that matters most practically. If identity re-verification is not completed, 1Office is not permitted under AML law to continue providing services to that client. This is not a commercial decision we are making to pressure clients into action. It is a regulatory restriction: a regulated entity cannot maintain a business relationship with a client whose identity it cannot currently verify. If the annual KYC request is ignored, accounting services, filings, and platform access can be suspended until verification is completed. This is precisely why some clients who set the email aside, assuming it was not genuinely from us, later found themselves unable to access their accounting services, sometimes with a filing deadline approaching.
If you ignore the annual KYC email assuming it is spam, the requirement does not disappear. It simply remains outstanding, and your account access or service delivery may be paused until it is resolved. The fastest and simplest path is always to complete the two-minute verification when the request first arrives.
Contact your country team directly using the phone number or email on our official website, not the contact details in the email itself, and we will confirm it for you.
How to Verify It Is Genuine
How to confirm a KYC request actually came from us
It is reasonable to want to verify any unexpected request before acting on it. Here is exactly how to check, without needing to trust anything in the email itself.
A genuine 1Office KYC request will always have these characteristics
- The verification link goes to a domain belonging to Ondato (ondato.com), our official KYC partner, not an unfamiliar or misspelled domain
- The request only ever asks for an EU member state passport or national ID card, a selfie, and sometimes a proof of address, never your card details, banking passwords, or one-time codes
- It is sent to the email address registered with your 1Office account, and references your company name or client reference
- You can independently verify it by contacting your country team using contact details found on 1office.co, not by replying to the email or calling a number found inside it
- It will never ask you to pay anything to complete the verification
The Process
How the annual Ondato re-verification actually works
The process itself takes most clients under five minutes. Here is exactly what to expect.
-
1
You receive an email with a personal verification link
The email comes from 1Office and contains a secure link to Ondato's verification platform. This is sent to all directors and beneficial owners of your company, since AML law requires verification of every individual with significant control or management authority, not just the primary contact.
-
2
Open the link on a mobile phone
The process works on desktop but is faster and more reliable on a mobile phone, because the camera quality is typically better and the document scanning step is optimised for mobile cameras. Poor photo quality is the single most common reason a submission is rejected and needs to be redone.
-
3
Photograph your passport or national ID card
Only passports or national ID cards issued by an EU member state are accepted. Driving licences and residence permits are not valid documents for this process, regardless of which country issued them. Make sure all four corners of the document are visible, the photo is in focus, and there is no glare across the document.
-
4
Take a selfie for facial verification
Ondato's system compares your selfie against the photo on your ID document to confirm you are the person named on the document. Make sure you are in good lighting and looking directly at the camera, without sunglasses, hats, or face coverings.
-
5
Verification is typically completed within minutes
Ondato's system processes most submissions automatically and near-instantly. In a small number of cases, a manual review is required, which can take up to one business day. You will receive confirmation once verification is complete, and no further action is needed until next year's cycle.
Ondato is a licensed KYC and identity verification provider used by regulated financial and corporate service companies across Europe. 1Office uses Ondato rather than building identity verification in-house because it is a specialised, independently audited system designed specifically for AML compliance. Using an established third-party KYC provider is itself a recognised good practice under AML regulation, not a sign of anything unusual.
What Is Checked and Why
What information is collected and how it is used
| What is requested | Why |
|---|---|
| EU passport or national ID card | Confirms your identity matches the person registered as a director or beneficial owner of your company. |
| A live selfie | Confirms the person completing the verification is the same person shown on the ID document, preventing identity fraud. |
| Proof of address (occasionally requested) | Required for certain risk categories or jurisdictions under local AML rules. Not requested for every client. |
| Confirmation of beneficial ownership details | AML law requires regulated entities to know who ultimately owns and controls a client company, not just who manages it day to day. |
This information is processed by Ondato under its own data protection and security obligations, and is used by 1Office exclusively for AML compliance purposes. It is not shared with marketing partners, is not used for any purpose beyond regulatory compliance, and is handled under the same data protection standards that apply to any regulated financial or accounting service in the EU.
FAQ
Frequently asked questions about annual KYC re-verification
Is the annual KYC email from 1Office genuine?
Yes. It is a legally required identity re-verification that every regulated accounting and corporate service provider in the EU must carry out at least once a year for every client, under anti-money laundering law. The same requirement applies to your bank and any other regulated financial service you use. You can independently confirm any specific request by contacting your country team directly through the contact details on 1office.co, rather than through the email itself.
What happens if I do not complete the annual re-verification?
Under AML law, a regulated provider cannot continue a business relationship with a client whose identity cannot be currently verified. If the annual KYC request is not completed, accounting services, filings, and platform access may be suspended until verification is finished. This is a legal restriction on 1Office, not a commercial choice, so there is no way to waive or skip it.
Why do I need to do this every year instead of just once?
Initial identity verification at onboarding confirms who you are at that moment. Ongoing due diligence, required under EU AML regulation, confirms that information remains accurate over time and that nothing material has changed. Once-a-year re-verification for standard-risk clients is the accepted industry interval applied across regulated banks, payment providers, and accounting firms throughout the EU.
Which documents are accepted for Ondato verification?
Only passports or national ID cards issued by an EU member state are accepted. Driving licences and residence permits are not valid for this process, regardless of issuing country. If you do not hold an accepted EU document, contact your 1Office country team to discuss alternative verification arrangements.
Is it safe to upload my ID and take a selfie through this link?
Yes, provided the link goes to Ondato's official platform (ondato.com), which is a licensed identity verification provider used by regulated companies across Europe. The platform is designed specifically for secure document and biometric verification under EU data protection standards. If you have any doubt about a specific link, do not click it. Instead, contact your country team directly through 1office.co and we will resend or confirm the request through a verified channel.
Will I ever be asked for payment details or passwords through this process?
No. The KYC process only ever requests an identity document, a selfie, and occasionally proof of address. It will never ask for banking passwords, payment card numbers, one-time login codes, or any payment of any kind. Any message requesting these alongside an identity verification link is not a genuine 1Office or Ondato communication, and should be reported to your country team immediately.
How long does the verification take?
Most clients complete the process in under five minutes, and automated verification is typically confirmed within minutes of submission. A small number of cases require manual review, which can take up to one business day. Using a mobile phone with good lighting for the document photo and selfie significantly reduces the chance of needing to redo the submission.
Questions about a KYC request you received?
Contact your country team directly and we will confirm whether a request is genuine, resend it through a verified channel, or help with any part of the process.
