What are the security checks that I can make on a PDF file being transferred between server and the client?
"Security" is a bit too broad here.
If you're looking for integrity checks -- that is, "has the file been altered in transit?" -- then what you need is a checksum. Just about any cryptographic hash will do (except MD5 and older, maybe avoid SHA-1 as well for new projects), so SHA-256 for example is a fine choice.
Of course, if you want the recipient to be able to crypographically verify the checksum, then what you're after is a digital signature. Roughly: you checksum the file, you then you encrypt the checksum with your private key, which means anyone in possession of your public key can decrypt the checksum, compare the checksum against the file, and verify that it's the one you signed.
Don't implement this yourself directly; use GnuPG or PGP. They've worked out the details that I glossed over.
If by "security" you mean "secrecy" -- if instead you want to guarantee that the file is only readable by the person you intend to send it to, then you encrypt the file using the person's public key (using the standard combination of asymmetric and symmetric ciphers), which means that only the intended recipient can decrypt it.
Again; use GPG or PGP. They do it right.
If you want to have both, then do both. The combination is also supported.
If you are worried about the file being the same as the one you requested from the server, you may want to look into Checksums. These can tell you if the file has been altered in any way between server and client. A good example of this is that when a server allows mirroring of files. A checksum is usually shared on the mirror that will match the checksum of the original file that was served on the main web server. You can also use it to see if someone got ahold of your file and altered it between server and client by calculating the checksum locally and matching it to the one provided by the server.