What’s changed in the new digital verification services trust framework?

The government has announced the new 1.0 version of the trust framework (formerly the digital identity and attributes trust framework).

Along with a nice new name, it includes several helpful additions that affect how digital verification companies operate, as well as the businesses that use them.

MLROs, heads of compliance and similar should familiarise themselves with the changes, as it’s becoming more and more important to use a certified company for KYC, KYB and AML checks.

So what’s new?

More focus on digital ID and how it should be checked

Last week, the government formally gave the green light for FCA-regulated firms to use digital IDs to meet KYC/AML rules.

If a service is certified against the trust framework and listed on the DVS register, it can be reliably used to verify a customer’s identity and address digitally.

If it isn’t certified, it can’t “reliably be deemed suitable” any more.

Given this shift, version 1.0 of the framework tightens and clarifies the roles for new digital ID wallets and the companies checking them, which is calls “holders” and “orchestrators” respectively.

Holders must provide much richer information to the companies that rely on them, and orchestrators must be able to confirm whether the services they connect to are on the government’s official DVS register.

This should make it easier for regulated firms to understand exactly what they rely on and not have to treat digital ID as a black box.

A new trust mark

There is now a formal UK CertifID trust mark.

Services that have been independently audited to meet framework requirements can show it on their websites and marketing material, similar to schemes like Cyber Essentials Plus and ISO 27001.

For compliance teams, this is supposed to become an easy shorthand for “can I go with this service?”

New restrictions on what certified companies can do with the data

Version 1.0 tightens how the data collected during verification can be used.

Certified providers are explicitly disallowed from:

• Profiling users for third-party marketing purposes
• Creating aggregate datasets that could reveal sensitive information about users (properly anonymised datasets are fine)

These prohibitions now also apply to metadata about that data, like the confidence level people were verified to or the kind of evidence they used.

Useful guidance for vouching and inclusion

The most practically important change is the rewritten vouching guidance.

Vouching has always existed within GPG45, but it was very difficult to put it to practical use and stay compliant.

The updated guidance makes it clearer how you can verify people without good evidence using a trusted referee, and more ways to do so.

This matters for two reasons.

First, 11 million people in the UK do not hold a passport or driving licence. Over-reliance on document uploads excludes legitimate customers and damages conversion.

Second, AI-generated document fraud is improving rapidly. Photo ID scans are becoming easier to fake and harder to detect. A resilient KYC strategy can’t rely on document scanning alone.

Vouching provides a safe, compliant fallback route for people who don’t yet have good digital evidence.

You can read the entire 1.0 version of the digital verification services trust framework on GOV.UK here.

Vouchsafe is a certified DVS that helps firms replace traditional document checks with safe, easy digital ID acceptance, with flexible fallbacks for those without.

Try it today, free for 14 days. No credit card required.