The United Kingdom has begun the operational transition to version 1.0 of its Digital Verification Services Trust Framework, establishing the first statutory version of the framework under the Data (Use and Access) Act 2025.
The Office for Digital Identities and Attributes identified September 1 as the planned effective date, subject to accreditation of the first conformity assessment body able to certify services against the new rules. The public Digital Verification Services Register now includes version 1.0 as a framework filter.
The framework sets requirements for organizations that verify identities or attributes and want their services listed on the statutory register. It is intended to give relying organizations a consistent basis for assessing whether a provider follows defined security, privacy, fraud-management and governance practices.
Version 1.0 expands the framework beyond identity and attribute service providers by defining holder, orchestration and component services. Holder services store and present digital information for users, while orchestration services coordinate interactions among multiple parties and component services supply capabilities used within a broader certified service.
The rules retain four identity confidence levels: low, medium, high and very high. Providers must establish those confidence levels through the government’s Good Practice Guide 45, which evaluates evidence strength, validation, identity activity, identity fraud checks and the process used to confirm that an applicant matches an identity.
Organizations must undergo independent conformity assessment before joining the register. Registered services that meet the applicable requirements can use the UK CertifID trust mark, giving businesses and consumers a visible indication that a service is operating within the statutory system.
The government published the version 1.0 pre-release for business readiness earlier this year. Existing providers were given time to prepare for reassessment as the framework moved from the earlier beta system into the legal structure created by the 2025 Act.
The transition affects providers working across onboarding, employment checks, financial services and other regulated identity processes. Recent certification of digital identity services has shown how vendors use the framework to demonstrate compliance to customers that rely on remote document and biometric verification.
OfDIA is responsible for maintaining the trust framework, operating the register and overseeing compliance. Its annual report says the statutory system is intended to support reusable digital identities while allowing people to choose among certified public and private services.
Sources: GOV.UK, OfDIA, DVS Register
–
By Ali Nassar-Smith
