DIATF Certification Grows Up: What Certified Digital Identity Providers Mean for Banks' Own KYC Reliance

TrustSphere Network

11 hours ago

6 min read

Beneficial ownership and identity documentation review

For most of its life, the UK's digital identity certification scheme has been something banks watched rather than acted on: a well-intentioned government pilot with a growing register but no statutory weight, useful for right to work checks and little else in a regulated financial services context. That changed in stages through late 2025 and 2026, and TrustSphere's house view is that the change is now substantive enough that treating certified digital verification services as a footnote in a bank's customer due diligence policy is no longer a defensible position.

The scheme, now formally the UK digital verification services trust framework rather than its earlier "digital identity and attributes" name, moved onto a statutory footing on 1 December 2025 and, in early 2026, was joined by explicit guidance from government and HM Treasury on how a certified provider can be relied on under the Money Laundering Regulations. That combination, a statutory register plus a named legal basis for reliance, is a materially different proposition from the voluntary pilot banks have been able to politely ignore since 2023.

Our view is not that banks should rush to outsource identity verification wholesale to certified third parties. It is that the question of whether, and how far, to rely on a certified digital verification service is now a live governance decision with a documented standard behind it, rather than a vendor risk question banks could previously defer indefinitely. A head of financial crime who has not put this in front of their risk committee this year is behind where the framework itself now sits.

What actually changed, and when

The framework's evolution is easier to follow as a timeline of concrete steps than as a single reform. Part 2 of the Data (Use and Access) Act 2025 came into force on 1 December 2025, placing the trust framework, its supplementary codes, the public register and the certification scheme onto a statutory basis for the first time. At that point, according to the Office for Digital Identities and Attributes' own account, 48 digital verification service providers and 57 certified services transferred onto the new statutory register, replacing the non-statutory version that had operated since April 2025.

Roughly two months later, in early 2026, DCMS worked with HM Treasury to publish guidance under the Money Laundering Regulations setting out how certified and registered digital verification services can be treated as reliable, independent sources of identity verification for regulated firms carrying out customer due diligence under Regulation 28. That guidance is the piece that turns certification from a reputational signal into something with a defined legal function inside a bank's own compliance process.

Most recently, the trust framework itself has begun a version upgrade. The current, most recent 1.0 publication was published in June 2026, and the transition period from the outgoing 0.4 version began on 2 September 2026, giving existing certified services a minimum of fifteen months to uplift. Certification against the 1.0 publication also, for the first time, entitles a provider to display the CertifID trust mark, a visible signal the government intends the public and business users to recognise.

What is settled, what is transitional, and what is still an open question

It is settled that the register and certification scheme now sit on a statutory footing under the Data (Use and Access) Act 2025, that HM Treasury and DCMS guidance exists naming Regulation 28 reliance as a legitimate use of certified DVS, and that the register is a live, queryable source banks can check today for a provider's certification status and scope.

It is transitional, not yet settled, that the underlying technical standard is mid-upgrade. Providers certified against the outgoing 0.4 version have, depending on their existing audit cycle, up to a 2028 deadline to move to 1.0, and both versions remain valid for reliance purposes during that window. A bank building a reliance policy today needs to accommodate providers sitting on either version for at least the next eighteen months, and should expect the register's presentation of certification status to keep evolving as it did through its own November 2025 redesign.

What remains genuinely open, and where TrustSphere would caution against overreading government's own framing, is how far individual institutions' own due diligence policies and internal audit functions will actually move to accept certified DVS reliance in place of, rather than alongside, existing verification steps. The guidance clarifies the legal basis for reliance. It does not, and cannot, tell a bank's own model risk or third-party risk function that reliance is automatically appropriate for every customer segment and risk rating. That judgement remains squarely the bank's own, and is likely to be the slower-moving half of this reform.

What this means operationally, for people, data and governance

The most immediate operational consequence sits with customer due diligence policy documents themselves. A policy written before this framework existed will not distinguish, as the government's own guidance now requires firms to think about, between the GPG 45 "level of confidence" that a certified identity check must express and the separate "attribute" data, sanctions or PEP status, address confirmation, that a provider may also supply. Firms relying on a DVS provider for both identity and attribute checks need that provider certified as both an identity service provider and an attribute service provider, and need their own policy to say so explicitly rather than treating the output as one undifferentiated data feed.

Data governance teams have a related task: mapping which of their existing onboarding data flows pass through a provider on the statutory register versus a provider that has never sought certification, since the two carry different weight under Regulation 28 and different audit expectations from internal and external reviewers. Vendor risk and procurement functions need a standing process to check register status at onboarding and periodically thereafter, given certification is time-limited and subject to surveillance audits, not a one-off badge.

For the second line and internal audit, the practical task is building a defensible position on where the bank does and does not rely on certified DVS output, calibrated to customer risk rating, and being able to show a risk committee why. "The provider is on the register" is a necessary condition for reliance under the guidance. It is not, on its own, a sufficient justification for a specific reliance decision on a specific customer segment, and examiners are likely to test that distinction directly.

What this means for each part of the market

Tier 1 banks carry the most complex task, because their KYC estates span the widest range of customer risk profiles and jurisdictions, and a blanket reliance policy is unlikely to be appropriate across all of them. The practical work is segment-by-segment: lower-risk retail onboarding is the plausible early candidate for genuine reliance, while higher-risk corporate and correspondent relationships will likely continue to warrant a bank's own verification regardless of a provider's certification status.

Challengers and fintechs, many of whom already use certified or near-certified digital identity vendors for onboarding, are closer to being able to formalise existing practice under the new statutory basis than to needing to build anything new. The task for this group is largely documentation: showing a supervisor that existing vendor use maps cleanly onto the Regulation 28 reliance basis rather than sitting in an undocumented grey area.

Technology vendors, including the identity verification platforms this week's companion vendor assessment examines, now have a genuine commercial incentive to pursue and maintain certification, since it is the clearest available signal of reliability to a market of increasingly sophisticated buyers. Vendors that have not sought certification, or that let it lapse, should expect that omission to become a harder question in procurement conversations than it has been to date.

Regulators and supervisors, principally the FCA in this context, will need to align their own supervisory expectations with a scheme now sitting under a different department's statutory framework, and firms should watch for FCA guidance that references the DVS trust framework directly rather than treating it as adjacent to its own AML expectations.

Corporates and consumers stand to gain from faster, more consistent onboarding as reliance matures, but only if the underlying due diligence judgement described above is done properly rather than treated as a compliance shortcut.

Conclusion

The DIATF's journey from pilot to statutory scheme with a named legal basis for reliance is a genuine milestone, not incremental housekeeping. It gives banks a real, checkable standard to reference when deciding how much weight to place on a third-party identity check. It does not do the underlying risk-based judgement for them, and the institutions that treat certification as a substitute for that judgement, rather than an input to it, are the ones most likely to find their reliance policy tested and found wanting.

Suggested Next Steps

Check the current version of the DVS register against your existing onboarding vendor panel to identify which providers hold statutory certification today.

Update customer due diligence policy to distinguish explicitly between GPG 45 identity verification outcomes and separately certified attribute data from the same provider.

Build a segment-by-segment reliance position, rather than a blanket policy, calibrated to customer risk rating and agreed with the risk committee.

Establish a standing process to re-check provider certification status at renewal and surveillance audit intervals, not only at initial vendor onboarding.

Sources: DVS measures in the Data Act have come into force, Office for Digital Identities and Attributes, How digital verification services can help businesses meet their obligations under the Money Laundering Regulations, DCMS/OfDIA, Commencing transition from the 0.4 to 1.0 trust framework, OfDIA, UK digital verification services trust framework collection, GOV.UK/DSIT, Enabling the use of digital identities in the UK, GOV.UK/DSIT, TrustSphere Risk Index, April 2026.