When using IdentityCheck with XPM (Xero Practice Manager), one of the most common questions we receive is:
“How do I control who gets the ID verification email?”
This guide walks you through how email addresses are handled in XPM, and how to select or de-select individuals to receive identity verification requests — especially useful when working with clients that have multiple contacts, such as families or business entities.
📬 Where Emails Live in XPM
There are two places in XPM where an email address can be stored:
Client-level email address
This sits at the top of the client record (see Red area in screenshot)
Often used for the main contact in a family or organisation.
Contact-level email address
Found within the “Contacts” section inside a client record (see Green area in screenshot)
You can have multiple contacts under one client.
⚠️ Important: IdentityCheck’s KYC Command can only be triggered from the client-level — not individual contacts.
🚀 What Happens When You Trigger KYC?
When you trigger an ID check from a client record, IdentityCheck:
Sends a unique verification email to every email address listed in the client record.
Tracks completion using unique verification links.
Updates the KYC Status for the matching email address only.
✅ When Sending to Multiple People is Useful
In some cases, sending ID checks to multiple recipients is exactly what you want — for example:
Joint clients (like a couple or a family trust)
Company directors under one entity
Each person will get their own verification link, and you’ll be able to track each one independently.
⚠️ Common Issues (And How to Fix Them)
1. Unwanted Emails Being Sent
If you store multiple email addresses for a single client (e.g. personal and work), both will receive the ID check request unless you take action.
Fix:
Use just one email address at the client-level if only one person needs to complete the check.
Or, use the Exclude option (see below).
2. Confusing KYC Status
Let’s say one of the recipients completes the verification using their secondary email.
You check the client record — and see the KYC Status is blank. Why?
Explanation:
The KYC status updates only for the exact email used to complete the check. If that email isn’t set as the primary in the client-level field, it won’t show in the main view.
Fix:
Check all contact-level emails for updated KYC status.
Consider simplifying to one main email if that works for your use case.
✂️ How to Exclude an Email from Receiving ID Verification
If you want to keep multiple emails but avoid sending to one of them, you can:
Go into the Contact section of the client record
Find the email address you want to exclude
Select ‘Exclude’ from “KYC Status” dropdown
This prevents the ID check from being triggered to that email, while still keeping it in your records.
👨💻 Need Help?
If you’re unsure how your client emails are set up or need help adjusting your process, our team is here to assist.
