Talk to usTry the demo

Country Guide, United Kingdom: The Digital Verification Services Trust Framework

Regulation and standards

For: Product owner, compliance lead or procurement lead who buys or builds identity checks for the United Kingdom market

How the UK rulebook formerly called the digital identity and attributes trust framework works: the Act, the register, the roles, levels of confidence, biometric rules and what is still moving.

For information; not legal advice.

If you sell or buy identity checks in the United Kingdom, you will meet a government rulebook and a register that lists who has been assessed against it. Versions before 1.0 were titled the UK digital identity and attributes trust framework. The 1.0 publication is titled the UK digital verification services trust framework, and the sections below use that name. The two titles refer to different versions of the same document. This guide explains what the rulebook is, what the law behind it says, who takes part, what it asks for in biometric checks and fraud controls, and what it does not do.

It is a reading guide to the published texts. It does not say that any product meets them, and it does not say what a UK regulator will accept in a particular sector.

What it is, in one paragraph

The government describes the trust framework as the set of rules and standards that show what a good digital identity looks like. Providers of digital verification services can have their service independently assessed against it. A service that passes is listed on a public register. Taking part is voluntary: relying parties do not need to be assessed to adopt digital identities, and the framework states that it does not set out the design of a centralised or mandatory national digital identity system.

The three layers

The Act

The legal basis is Part 2 of the Data (Use and Access) Act 2025. Section 27 says the Part contains provision to secure the reliability of digital verification services by means of a trust framework, supplementary codes, a register, an information gateway and a trust mark. It defines digital verification services as verification services provided to any extent by means of the internet. Verification services, in turn, are services provided at the request of an individual which consist in ascertaining or verifying a fact about the individual from information provided otherwise than by the individual, and confirming to another person that the fact has been ascertained or verified. The phrase matters. The regime is about a fact that someone else can rely on, whether an identity or a single attribute such as age, not about a login.

The provisions on the framework, the register and the trust mark were commenced on 1 December 2025. Section 28 requires the Secretary of State to prepare and publish the trust framework. Section 31 requires the framework, together with any active supplementary code, to be reviewed at least every twelve months. Section 32 requires a publicly available register of persons providing digital verification services. Section 33 provides for registration of a provider that applies and holds a certificate, from a conformity assessment body of the kind the Act describes, saying that its services are provided in accordance with the framework. Section 50 allows a trust mark to be designated for use in providing digital verification services, and it may not be used by anyone who is not registered for those services.

The trust framework and supplementary codes

The framework sets out rules on organisational governance, information security, privacy and data protection, technical specifications and user experience. Supplementary codes build on it for particular uses. At the time of the annual report there were codes for digital right to work, right to rent and Disclosure and Barring Service checks, and a service assessed against a code must also be assessed against the matching version of the framework.

The register and the trust mark

The register is a public list of registered services that shows the service name, the provider, the role types, supplementary codes and the dates the certificate was issued and expires. The Office for Digital Identities and Attributes, called OfDIA below, checks each applicant before listing it and re-checks listed providers. The checks it describes include the ownership chain for national security risks, outstanding proceedings, prior convictions for corruption, bribery or money laundering, directors, and the provider's marketing material. The annual report counted 64 services from 46 providers on the register as of July 2026. The trust mark, designated in March 2026, will be issued under licence to providers that are assessed against version 1.0 and listed on the register.

Which version applies now

This is the part most likely to be wrong in a copied slide, so the dates are given as the primary texts state them.

  • The framework went through alpha versions 0.1 and 0.2, a beta version 0.3 and a gamma version 0.4.
  • The statutory gamma version published on 1 December 2025 was the first statutory trust framework under section 28 of the Act.
  • Version 1.0 was published on 9 June 2026.
  • According to the annual report of 14 July 2026, version 1.0 was to take effect on 1 September 2026, subject to the successful approval of conformity assessment bodies by the national approval service, UKAS.
  • The text of version 1.0 itself says it comes into force on the date the first conformity assessment body is approved to assess against it, which will be no earlier than 1 September 2026.
  • Section 0 of version 1.0 sets the conditions under which the earlier gamma 0.4 versions remain valid, and a provider on gamma should read them as a schedule.
  • Certificates issued against gamma 0.4 stay valid and are audited against those versions, until one of three things happens: 27 months have passed since the day version 1.0 comes into force, the service uplifts to version 1.0 and holds a certificate for it, or the gamma certificate expires.
  • A new certificate against the statutory gamma 0.4 can still be obtained after version 1.0 comes into force in two cases: the application was made before that day and the certificate was issued after it, or the applicant already holds a gamma certificate and applies again before it expires and within 15 months of that day.
  • Beta certificates were due to expire on 31 March 2026, and the annual report records that five providers left the register on 1 April 2026 for that reason.

The government's guidance page for the scheme was updated on 21 September 2026 to describe version 1.0 and to rename the framework throughout. The guidance page does not say that the first conformity assessment body has been approved to assess against version 1.0, nor which services have been assessed against it. This article therefore treats the commencement of the new version as unconfirmed: the sources give a date no earlier than 1 September 2026 and a condition, and none of the sources read here records that the condition was met. A reader who needs the current position should read section 0 of the most recent publication and look at the register, which is the only place that shows what a given service has been assessed against.

Who takes part

The framework recognises five roles with services that can be assessed.

  1. Identity service providers check identities.
  2. Attribute service providers collect, create or check attributes.
  3. Holder service providers hold identities or attributes over time, such as a wallet.
  4. Orchestration service providers are hubs that let relying parties work with several services; version 1.0 adds the first rules written for them, including that they must be able to tell their customers whether the services they orchestrate are on the register.
  5. Component service providers supply parts of an identity checking or authentication process, such as biometric verification.

One organisation can fulfil several roles and must then follow the rules for each. An identity service provider does not have to perform every step itself, but it is responsible for the overall process and its outcome, and may contract with component providers or other third parties for parts of it. A relying party, such as a bank using a service to onboard customers, does not need to be assessed itself, but the framework expects the provider to pass contract terms down to it and its practices must not undermine the framework's principles.

Who assesses

A provider must have its service assessed by a conformity assessment body that is approved by OfDIA and recognised by the national approval body, UKAS, against the international standard for bodies that assess products, processes and services. The government scheme page says a certificate issued by a body that is not approved is not valid under the scheme, and that only certificates from bodies that UKAS has recognised against the framework count for joining the register. If there is suspicion that the rules are not being followed, the investigation of an assessed service is launched by the body the provider contracted with.

Levels of confidence and GPG 45

The framework lets identities be checked to four levels of confidence: low, medium, high and very high. It does not say how to reach a level. That is set out in a separate guidance document, How to check someone's identity, known as Good Practice Guide 45 or GPG 45. The guidance scores parts of the identity checking process and combines the scores into identity profiles, which map to the levels. Profiles have codes: for example the low level has profiles L1A, L1B, L1C, L2A, L2B and L3A, and the medium level has M1A to M1D, M2A to M2C and M3A.

For an identity service provider, the obligation is one of explanation. It must use GPG 45 as the methodology to explain its service and show how each aspect maps onto it, for instance by detailing the kinds of evidence and checking methods that reach a medium level of confidence. It must be able to share with relying parties the strength, validity, activity history, identity fraud and verification scores its service can reach, and how it combines them. If it uses third-party components, it must describe how each maps onto the relevant part of GPG 45. On expired documents the framework says a provider must not use them if in-date documents are available, and that passports may be accepted for no more than 12 months after expiry.

A buyer should read this as a language for comparing services. A level of confidence is a statement about the checking process against identity risks, and it is not a promise about any one transaction.

What it asks about biometrics

Section 12.8 of the framework sets rules that apply to any provider using biometrics. They sit alongside data protection law: biometric data used for identification is special category data. The Information Commissioner's guidance on biometric recognition says that if you use a biometric recognition system you are processing special category biometric data, and that its decisions are statistically informed estimates and should not be interpreted as a matter of fact. The ICO added a notice that, because of the Data (Use and Access) Act, the guidance is under review.

The framework's own rules are specific.

  • Alternatives. For identity profiles up to and including medium, a provider that offers a biometric check and a non-biometric check must offer the non-biometric alternative at the same time.
  • Test reporting. A provider must be able to demonstrate in a biometric testing report that it has considered whether its false match and false non-match counts suit its security and usability needs, whether its attack presentation and bona fide presentation classification error rates suit its needs, and whether performance is consistent across demographics.
  • Standards. It must follow industry standards that cover performance, presentation attack detection, security testing and bias reduction, such as the 19795 and 30107 series, or show that it has processes to reach the same outcomes.
  • Two kinds of test. Performance testing measures matching of a person to a reference such as a passport photograph; security testing measures susceptibility to attacks, including presentation attacks, injection attacks and cyber attacks.
  • Who tests. Testing can be external, by an independent laboratory recognised under the international laboratory arrangement, or internal, following a recognised methodology that meets international standards.
  • Fit to context. A test report must state the test environment and how it relates to the service; the example given is that reports about a building entry system are not suitable evidence for a remote onboarding system on a mobile device.
  • Transparency. Providers must explain biometric performance and security to relying parties, to partner services and to users, including how testing was done, and tell users what happens to their biometric data, including retention and whether it is used to train neural networks.

The article on presentation attack detection testing explains the testing vocabulary that this section uses. The article on how to read a face recognition evaluation covers the matching side.

Fraud management and inclusion

Section 12.4 requires monitoring for misuse, impersonation, synthetic identity, takeover and document fraud, across all channels used to deliver the service. Where relevant, a provider must check whether there is a link to previous known fraud at registration and at intervals, and must monitor repeated failures of evidence checks that a user should pass. Fraud audits are required at least annually. An identity checked at a low level of confidence, recently repaired or recently linked to fraud activity is treated as higher risk and needs additional security policies.

The framework also makes inclusion a rule, not a preference. Version 1.0 extends the inclusion and accessibility rules, which previously applied to a subset of providers, to all assessed providers, and the guidance on vouching was rewritten to make vouching evidence easier to create and share in lower-risk uses. Providers submit annual inclusion monitoring reports, and the 2025 findings reported that 60 percent of the organisations surveyed met the Web Content Accessibility Guidelines 2.0 at medium conformance or higher. The government names as an obstacle the lack of access to government-held data as an alternative source for people without a driving licence or passport.

What the market looks like

The annual report cites the 2026 digital identity sectoral analysis, published on 8 July 2026. It identified 275 firms providing digital identity products and services in the UK and estimated annual revenue at 2,027 million pounds in 2024 to 2025. Among providers, 75 percent were involved in identity or attribute verification, and the most common sub-categories were document-based verification at 60 percent and biometrics and liveness detection at 57 percent. Those are the report's figures for the sector, and they count firms, not services on the register.

What is still moving

The annual report lists the next steps, and they bear on any plan that depends on the UK.

  • OfDIA plans a machine-readable layer of the register so that relying parties can check programmatically that a service is listed, with a planned launch in winter 2026.
  • The information-sharing power in section 45, which will let public authorities disclose information about an individual to registered providers at the individual's request, awaits a code of practice that must be approved by Parliament; the aim is to publish it by the end of 2026.
  • OfDIA is exploring whether to publish rules for digital age verification, possibly as a supplementary code, and says it is working with colleagues across government on supporting the use of registered services under the Money Laundering Regulations and for proof of age in the sale of alcohol.
  • OfDIA is reviewing the security and fraud sections of the framework and plans to publish a working draft on GitHub before finalising the next version.

The article on the UAE rules for remote onboarding shows a regulator-led approach to the same question, where the rule sits in a central bank rulebook. The UK approach is different in kind: the state sets a voluntary rulebook and a register, and sector regulators decide where to rely on it.

Questions to ask a provider

  • Is the service on the register, for which roles, and against which version of the framework and which supplementary codes?
  • Which identity profiles does the service reach, and how does each check map onto GPG 45?
  • Is there a biometric testing report, who produced it, and does the test environment match your channel?
  • Is a non-biometric route offered alongside a biometric one for the profile you need?
  • How are repeated evidence failures monitored, and what is reported back to you?
  • What do you pass down to your own users about retention and training use of their biometric data?

Where this sits in a verification flow

A flow built on NeuroVision KYC places the identity steps in one session: document, selfie, liveness and face match, with the scenario assembled in an editor. The document step detects, classifies and reads IDs, including printed and handwritten text and the machine readable zone with its checksum. The face match step compares the selfie with the portrait on the document in a one-to-one comparison, and includes foreign-face detection and an age check against the date of birth. The liveness step is active: the person moves the face closer through two ovals. This article does not state that these steps meet the trust framework or that any service is on the register.

To see how these steps look in your own scenario, contact the team.

Sources

All sources were fetched on 27 October 2026.

Ready to talk?

Tell us what you are building and we will help you plan the integration.

Talk to us