Digital identity verification in the United Kingdom is governed by two closely linked concepts: the UK digital verification services (DVS) trust framework and Good Practice Guide 45 (GPG45).
Understanding how they relate to each other helps businesses choose identity verification providers with confidence and understand what level of assurance a given check actually provides.
The Fraud Problem Behind the UK’s Push for Digital Identity Standards
The UK isn’t formalising GPG45 and the digital verification services trust framework in a vacuum. It’s responding to a fraud problem that keeps breaking its own records.
What Is the UK Digital Verification Services Trust Framework?
The trust framework is a rulebook published by the UK government that sets the minimum standards a digital identity service must meet to be considered reliable and secure.
It covers:
- The roles involved in an identity check
- The privacy and security requirements providers must follow
- The certification process that allows a provider to demonstrate it meets the standards
Organisations that want their identity checks to be recognised as meeting government standards should look for providers certified against the trust framework by an approved conformity assessment body.
What Is GPG45 and How Does It Fit In?
Good Practice Guide 45 is the technical guidance referenced within the trust framework for carrying out an identity check. It sets out five elements that contribute to how confident an organisation can be in an identity.
Based on how these elements are combined, GPG45 defines four levels of confidence: low, medium, high, and very high. A medium level of confidence might be reached through a straightforward document and data check, while a high level typically requires stronger evidence and confirmation that the identity has existed over time and genuinely belongs to the person presenting it.
Digital Identity and Money Laundering Regulations
The trust framework doesn’t replace existing AML legislation. It works alongside the Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017.
In practice, that means:
- Firms subject to AML obligations can use a certified digital identity service
- This can help meet Customer Due Diligence requirements
- The service must deliver a confidence level appropriate to the risk involved
Ready to Strengthen Your Identity Verification Approach?
NameScan’s ID Verification service lets businesses confirm a customer’s identity in minutes rather than days, checking submitted documents against issuing-authority data and, where required, matching a live facial scan against the government-issued ID on file.
Customers can complete the check themselves via a personalised SMS or email link, with results delivered straight to a dashboard — typically within one to two minutes — making it a practical way to strengthen KYC and AML compliance without adding manual review overhead.
Frequently Asked Questions
Is GPG45 a legal requirement?
GPG45 itself is guidance, but it is referenced within the UK digital verification services trust framework, which has been placed on a statutory footing. Sector regulators may also require a specific GPG45 confidence level for particular use cases.
What are the four GPG45 confidence levels?
Low, medium, high, and very high, based on the strength and validation of the identity evidence used, how well it was verified against the applicant, and any known fraud risk.
How do I know if an identity provider is certified against the trust framework?
Certified providers are assessed by an approved conformity assessment body. Organisations can check current certifications through the published list of approved bodies referenced in the trust framework guidance.
Does GPG45 replace physical document checks?
Not necessarily. GPG45 sets out how evidence, including physical or digital documents, should be validated and verified. Many providers combine document checks with biometric and database checks to reach higher confidence levels.
How does GPG45 relate to AML compliance in the UK?
UK guidance confirms digital identities that meet the trust framework and an appropriate GPG45 confidence level can support Customer Due Diligence obligations under UK money laundering regulations, alongside other required checks.
0 Comments