UK digital identity trust framework: DVS register and AML use
The UK digital identity trust framework explained: the DVS register of 65 certified services, their use for money-laundering checks since February 2026, right-to-work rules, and what replaced the cancelled digital ID.
In short
The UK digital identity trust framework is the government rulebook that identity services are certified against. Certified services go on a public register, which listed 65 services from 47 providers on 30 September 2026.[1] Since 26 February 2026, regulated firms can meet the identity verification part of Regulation 28 of the Money Laundering Regulations with a certified and registered service.[2]
- GOV.UK One Login has 23 million users, but only government services can use it.[3][4]
- The national digital ID was cancelled on 21 July 2026.[5]
- Accept first: a certified service, with a document check as the fallback.
The United Kingdom has no national electronic ID (eID) that a business can plug into, and since July 2026 no plan to build one.[5] It has a digital identity trust framework instead: statutory rules, now called the UK digital verification services (DVS) trust framework, owned by the Office for Digital Identities and Attributes (OfDIA) in the Department for Science, Innovation and Technology (DSIT).[6]
This guide covers every UK scheme, the law behind the register, how certified services count for money-laundering, right-to-work and age checks, and a launch checklist. For the wider picture, read our guide to digital ID in the UK.
The UK digital identity trust framework at a glance
The framework began as the UK digital identity and attributes trust framework (DIATF) and was renamed. Version 1.0 was published on 9 June 2026 and took effect on 1 September 2026, subject to UKAS accreditation of the certification bodies. Certificates under the older beta version expired on 31 March 2026, and five providers left the register on 1 April 2026.[6]
Sources: DVS register, 30 September 2026[1]; Government Digital Service, 16 September 2026.[3]
No UK scheme is on the EU list of notified eID schemes: the UK left the EU.[7]
| Scheme | Operator | Users (date) | Credential | Assurance and EU notification | Data returned | Private-sector access | Didit status |
|---|---|---|---|---|---|---|---|
| GOV.UK One Login | Government Digital Service (DSIT on the register)[1] | 23 million (Sep 2026)[3] | Password and code, or passkey[4][3] | GPG 45 medium[8] Not EU-notified | Names, date of birth, address, passport or licence details, email, phone[9] | No: central government only[4] | Not open to businesses |
| GOV.UK Wallet | Government Digital Service[10] | Veteran Card: 15,000+ (Jan 2026)[10] | Government credentials[10] | Not published Not EU-notified | Credentials checked by certified DVS providers[10] | Not yet downloadable[11] | Coming soon |
| Certified DVS services | 47 providers[1] | 65 services (Sep 2026)[1] | Varies by provider | DVS trust framework[6] Not EU-notified | Varies by provider | Yes, for Regulation 28 checks[2] | On request |
| National digital ID | Government (proposed) | None: cancelled 21 Jul 2026[5] | Was to be phone-based[12] | None Not EU-notified | Was to hold name, date of birth, residency status, photo[12] | Cancelled | Cancelled |
| GOV.UK Verify | Government | Almost 10 million accounts at closure[13] | None | None Not EU-notified | None | Closed | Closed |
So the first thing a business can accept is a certified service from the register: GOV.UK One Login serves government only, and GOV.UK Wallet cannot be downloaded yet.[4][11]
How the digital identity trust framework works in law
The legal basis is Part 2 of the Data (Use and Access) Act 2025, "Digital verification services".[14] The Act received Royal Assent on 19 June 2025.[15] Sections 28 to 44 and section 50 commenced on 1 December 2025, making the framework and the register statutory.[6][16]
| Section | What it does | Status, 5 October 2026 |
|---|---|---|
| s.28 | The DVS trust framework | In force[6] |
| s.29 | Supplementary codes: right to work, right to rent, DBS | In force[6] |
| s.32 | The DVS register | In force[6] |
| s.39 | Registration fees | None charged or planned[6] |
| s.45 | Public bodies may share data with a registered service at the user's request | Not commenced[6] |
| s.50 | Trust mark, "UK CertifID" since March 2026 | In force[6] |
| s.55 | Right-to-work and right-to-rent checks by a "DVS-registered person" | Amends immigration law[14] |
Data (Use and Access) Act 2025, Part 2.[14]
Only services certified against version 1.0 and registered may use the UK CertifID mark.[6] On 30 September 2026, 42 registered services were certified for right to work, 35 for right to rent and 29 for DBS checks.[1]
Money-laundering checks
The Money Laundering Regulations 2017 (MLR) already accepted electronic identification as a reliable, independent source:
Regulation 28(19)Money Laundering Regulations 2017
"it is obtained by means of an electronic identification process, including by using electronic identification means or by using a trust service (within the meanings [...] Regulation (EU) No 910/2014)" and the process "is secure from fraud and misuse and capable of providing assurance that the person claiming a particular identity is in fact the person with that identity".
Source: legislation.gov.uk, regulation 28[17]
Guidance from HM Treasury and DSIT on 26 February 2026 tied this to the register:
Guidance, 26 February 2026Using digital identities with the Money Laundering Regulations
"entities are able to fulfil their obligations under Regulation 28 of the MLRs by verifying a customer's identity using certified and registered digital identity services"
Source: GOV.UK, HM Treasury and DSIT[2]
It covers identity verification, not all customer due diligence: you still establish the purpose and intended nature of the relationship, and sector guidance such as the Joint Money Laundering Steering Group (JMLSG) guidance still applies.[2] The MLR changed again with SI 2026/621 on 30 June 2026, and the JMLSG says its guidance "is currently being updated".[18]
Watch out
According to an OfDIA blog post of 26 February 2026, services that are not certified and registered "cannot reliably be deemed suitable". Check the register entry of any provider you rely on.
Right to work, right to rent and DBS
Certified services can run right-to-work and right-to-rent checks only for people with a valid British or Irish passport (or Irish passport card); everyone else uses the Home Office online check with a share code. An employer can be fined up to £45,000 for a first breach.[5]
Age checks and age-restricted sales
Under the Online Safety Act 2023, Ofcom lists methods capable of highly effective age assurance: open banking, photo ID matching, facial age estimation, mobile network operator checks, credit card checks, digital identity services and email-based age estimation. Self-declaration does not qualify.[19] With age estimation, Ofcom expects a challenge age and a second check below it.[20] It counted over 69 million age checks on the services it analysed between July and December 2025.[21]
In June 2026 the Home Office laid regulations letting customers at licensed premises in England and Wales prove their age with registered DVS providers.[13] Sector supervisors for finance, gambling and telecoms add their own expectations; this guide does not summarise them.
From BritCard to the register: the timeline
- 19 June 2025Royal AssentData (Use and Access) Act 2025.[15]
- 1 December 2025StatutoryFramework and register commence.[6]
- 26 February 2026AML useCertified services count for Regulation 28.[2]
- 1 September 2026Version 1.0Framework 1.0 takes effect.[6]
The DVS trust framework, from Act to register.
- 2021LaunchThe government sign-in launches.[3]
- 26 September 2025Digital IDNational digital ID announced.[12]
- 21 July 2026CancelledNational digital ID dropped.[5]
- End of 2027CredentialsTarget for government credentials in digital form.[22]
Government identity products, launched and cancelled.
The national digital ID was announced as mandatory for right-to-work checks by the end of the Parliament.[12] The mandatory element was dropped on 15 January 2026, and the new government cancelled the programme on 21 July 2026. The Commons Library sees "no indication" that GOV.UK One Login and GOV.UK Wallet are affected.[5]
The digital driving licence has been in a private staff trial since December 2025, with a wider rollout promised for 2026; on 5 October 2026 the wallet still could not be downloaded.[10][11] The EU Digital Identity (EUDI) Wallet deadline of 24 December 2026 applies to EU Member States, not the UK.[23]
What the user sees with GOV.UK One Login
Businesses cannot connect to GOV.UK One Login, but its 23 million users know its steps, and those steps shape what UK users expect.[3] If a service needs a proven identity, the user picks the GOV.UK One Login app, security questions online, or a Post Office branch.[24]
Sign in
Email, password and a code, or a passkey.
Continue
1The service sends the user to sign in.
Choose a way
App, security questions or Post Office.
Use the app
Answer security questions
2The user picks a route.
Scan your photo ID
Hold your passport to the phone to read the chip.
Start scan
3The app scans the ID and reads the chip.
Scan your face
We match your face to your ID photo.
4A face scan links person and document.
Identity saved
- NameShared
- Date of birthShared
- AddressShared
5The service receives the attributes it asked for.
Simplified from GOV.UK guidance; illustrations, not the real app.
The app needs an iPhone 8 or later on iOS 16.7, or Android 10, and reads a UK photocard driving licence, a UK passport, a non-UK chipped passport, a biometric residence permit or card, or a Frontier Worker permit. Expired passports are refused. At the Post Office, staff scan the ID and take a photo, and the result usually arrives within a day. Once proven, the identity is saved for next time.[24]
Choosing a route by use case
In the UK, the rule behind a check decides the route. Start from the obligation.
1Name the rule behind the check
Money laundering, immigration status or age.
Which obligation applies
Certified DVS service
Identity verification; add the rest of due diligence.
Certified service or share code
Certified service for British or Irish passports.
Highly effective age assurance
Estimation with a challenge age, or an ID check.
2Keep a document route for everyone else
Chip reading, liveness and face match.
| Use case | What the rules point to | Basis |
|---|---|---|
| Fintech | Certified DVS service for identity; the rest of due diligence stays with you | MLR reg. 28[17][2] |
| Crypto | The same route where the firm is supervised under the MLR | Guidance[2] |
| Gambling | Identity and age checks; the supervisor's rules on top | Not covered here |
| Telecoms | No UK eID to connect; certified service or document | Not covered here |
| Marketplaces | Highly effective age assurance for adult content | Ofcom[19] |
| Mobility | Licence checks; DVS providers test the digital licence in 2026 | GDS[10] |
People without a UK digital identity
With no national eID, every customer goes through a provider, a document or a foreign eID.
Foreign residents
Document or share code
- GOV.UK One Login takes chipped non-UK passports
- EU or EEA ID cards at the Post Office
- Share code for work and rent
GOV.UK; Commons Library
Minors
Age assurance
- No government credential to download yet
- Ofcom methods do the work
- OfDIA backs the under-16 social media plan
Ofcom; OfDIA
EU customers
EU eID or EUDI Wallet
- eIDAS means named in reg. 28(19)
- National eIDs exist today
- Wallets from 24 December 2026
Regulation (EU) No 910/2014
Sources for the three routes: the GOV.UK One Login identity page,[24] the Commons Library,[5] the wallet page,[11] Ofcom[19] and OfDIA.[6] Regulation 28(19) names eIDAS electronic identification means, so an EU customer's national eID fits its wording.[17] See eID schemes by country and the EUDI Wallet guide.[23]
Launch checklist for the United Kingdom
- Map each check to its rule: MLR, work, rent, DBS, online safety or alcohol.
- Confirm your provider's entry and codes on the DVS register.[1]
- Record the purpose and nature of each relationship separately.[2]
- Track the JMLSG update for SI 2026/621.[18]
- Add a share-code route for people without British or Irish passports.[5]
- Set a challenge age if you use facial age estimation.[20]
- Keep a document route with chip reading for everyone else.
How Didit helps with UK identity checks
Didit runs eID verification and document checks in one workflow. Didit adds UK digital identity schemes on request, and GOV.UK Wallet and OneID are on Didit's roadmap. What you can run in the UK today:
- Document checks for 14,000+ document types in 220+ countries and territories, with NFC chip reading at $0.15.
- Passive liveness and a face match: the full KYC check costs $0.33.
- AML screening against 1,300+ sanctions, PEP and watchlists at $0.20, monitoring at $0.07 per person per year.
- Age estimation at $0.10, with borderline results sent to an ID check.
If your policy relies on the 26 February 2026 guidance, check the DVS register entry of every provider you use.
Didit provides
- Document, chip, liveness and face checks
- AML screening and monitoring
- The evidence of every check
Stays with you
- Your risk assessment and policies
- Which provider you rely on for Regulation 28
- The onboarding decision
Plan your UK identity checks with us
Tell us which UK checks you run, and start with the document route today.
Key takeaways
- The UK digital identity trust framework has been statutory since 1 December 2025; version 1.0 applies from 1 September 2026.
- The DVS register listed 65 certified services from 47 providers on 30 September 2026.
- Since 26 February 2026, certified and registered services meet the identity verification part of MLR Regulation 28.
- GOV.UK One Login serves government only; the national digital ID was cancelled on 21 July 2026.
Frequently asked questions
What is the UK digital identity trust framework?
It is the set of government rules that identity providers are certified against, formerly DIATF and now called the UK digital verification services trust framework. It became statutory on 1 December 2025, and version 1.0 applies from 1 September 2026.[6]
How many services are on the DVS register?
The register listed 65 certified services from 47 providers on 30 September 2026. Of those, 42 were certified for right to work, 35 for right to rent and 29 for DBS checks.[1]
Can a regulated firm use a certified service for AML checks?
Yes. Guidance from HM Treasury and DSIT of 26 February 2026 says firms can meet their Regulation 28 obligations with certified and registered digital identity services. The purpose and intended nature of the relationship stay with the firm.[2]
What is UK CertifID?
It is the government trust mark for digital verification services, designated in March 2026. Only services certified against version 1.0 and registered may use it.[6]
Does it cost anything to join the DVS register?
No. The Act allows fees, but OfDIA charged none in its first reporting period and does not plan to for now.[6]
What happened to the UK national digital ID?
It was announced on 26 September 2025 and cancelled on 21 July 2026. GOV.UK One Login and GOV.UK Wallet continue.[5]
Can my business use GOV.UK One Login?
No. It is open to central government departments and agencies, and free for government services. Its 23 million users sign in to more than 250 government services.[4][3]
Can a certified service do right-to-work checks for any worker?
No. It can check only people with a valid British or Irish passport or Irish passport card. Other workers use a Home Office share code.[5]
Does the UK recognise EU eIDs for AML?
Regulation 28(19) of the MLR names electronic identification means under EU eIDAS as a reliable source, if the process is secure from fraud and misuse. No UK scheme is on the EU list of notified schemes.[17][7]
Sources
- DVS register (download, last updated 30 September 2026), DSIT, Office for Digital Identities and Attributes.
- Using digital identities with the Money Laundering Regulations, HM Treasury and DSIT, 26 February 2026.
- How we made it easier for millions of users to sign into government services, Government Digital Service blog, 16 September 2026.
- About GOV.UK One Login, GOV.UK One Login.
- Digital ID (CBP-10369), House of Commons Library, 4 September 2026.
- OfDIA 2026 annual report on the operation of Part 2 of the Data (Use and Access) Act 2025, Office for Digital Identities and Attributes, 14 July 2026.
- Overview of pre-notified and notified eID schemes under eIDAS, European Commission, read 5 October 2026.
- Checking your users' identities, GOV.UK One Login.
- Choose which user attributes your service can request, GOV.UK One Login technical documentation.
- Making the government's first digital wallet a reality, Government Digital Service blog, 21 January 2026.
- GOV.UK Wallet, GOV.UK, read 5 October 2026.
- New digital ID scheme to be rolled out across UK, Prime Minister's Office, 26 September 2025.
- Managing digital identity, National Audit Office, September 2026.
- Data (Use and Access) Act 2025, Part 2, legislation.gov.uk.
- Data (Use and Access) Act 2025 collection, GOV.UK.
- DVS measures in the Data Act have come into force, OfDIA blog, 1 December 2025.
- The Money Laundering Regulations 2017, regulation 28, legislation.gov.uk, up to date to 4 October 2026.
- Current guidance, Joint Money Laundering Steering Group.
- Age checks to protect children online, Ofcom, 16 January 2025.
- Guidance on highly effective age assurance (Part 3 services), Ofcom, 24 April 2025.
- Report on the use of age assurance, Ofcom, 15 July 2026.
- Digital driving licence coming this year, DSIT, 21 January 2025.
- Commission Implementing Regulation (EU) 2025/848 on the registration of wallet-relying parties, EUR-Lex, Official Journal of 7 May 2025.
- Proving your identity with GOV.UK One Login, GOV.UK.
To combine certified UK checks, documents and your EU customers' national eIDs in one flow, see eID verification with Didit.
Verify UK customers in one workflow
Documents, chip reading, liveness and AML screening, with eIDs where your users have them.
Related articles
- Cl@ve integration in Spain: who can connect and what to use instead
- PhilSys verification: how businesses check the National ID
- OpenID4VP verifier guide: accepting the EUDI Wallet
- eIDAS regulation explained: what eIDAS 2 (2024/1183) changes
- Smart-ID API: a developer's guide to RP API v3
- National digital identity worldwide: models, leaders, standards