TL;DR: The scrapping of a universal government digital ID does not alter the need for verified identity in right-to-work, right-to-rent, AML and age checks, because the digital driving licence and certified wallet-based services continue, according to OneID. The governance question is no longer whether identity proofing exists, but which regulated provider and assurance model firms trust.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on OneID's blog post: The cancelled universal digital ID does not remove the need for identity verification, and certified wallet-based services and the digital driving licence continue to fill that gap.
Why it matters: This matters because identity and compliance teams still have to verify real people to a defined standard, even when political plans for a central credential change.
Context
Identity proofing is the process of establishing that a person is who they claim to be, but the mechanism used to do that can change without changing the underlying obligation. In this case, the policy debate shifted, while the need for verified identity in regulated interactions remained in place.
The article treats the digital driving licence as evidence that the market for verified identity is still moving, even when one central government scheme is removed. That is typical of digital identity programmes: delivery and governance often outlive the political framing around them.
Key questions
A: Organisations should verify that the provider has completed the relevant accreditation process, demonstrates strong controls for privacy, security, fraud prevention, risk management, and technical integrity, and can sustain those controls through ongoing assessments. For regulated identity use, trust depends on evidence, not marketing. The right approach is to confirm that the provider can meet the required assurance level for the intended transactions and data handling.
Q: Why does removing a central digital ID card not remove identity risk?
A: Because the risk sits in the verification process, not only in the card itself. Organisations still need to know who a person is, how the assertion was issued, whether the provider is certified and whether the disclosed attribute is sufficient for the decision being made.
Q: What happens when a business asks for more identity data than it needs?
A: It increases privacy exposure, complicates compliance and creates more value in the data than the transaction requires. A better model is selective disclosure, where the relying party receives only the specific verified fact needed for the check and nothing else.
Q: Which teams remain accountable when digital identity is used for AML, age or right-to-work checks?
A: The business team making the decision remains accountable, even when a certified digital identity service supplies the evidence. Identity providers can support the check, but they do not own the organisation’s legal duty to apply the right policy, confidence level and recordkeeping controls.
Technical breakdown
Why wallet-based identity proofing still works without a central ID card
Wallet-based identity proofing separates the presentation of a verified attribute from the storage of every other identity detail. A relying party asks for one fact, such as age or right to work, and the holder discloses only that fact from a certified wallet or service. The system depends on prior issuance, trust framework controls, and binding between the credential and the holder. Removing a universal card does not remove those control requirements; it simply changes where verification happens and who operates it. See the Digital Identity, eID and Identity Wallets Guide.
Practical implication: design identity journeys around certified attribute sharing rather than waiting for a central credential to exist.
How decentralised identity verification shifts assurance away from the state
A decentralised model means the verifier, the wallet, and the source of the attribute may be different parties. That reduces the need for a single citizen register, but increases the importance of certification, auditability, and relying-party discipline. In practice, the security question becomes whether the provider can prove the attribute came from an authoritative source and whether the verifier used the right level of confidence for the transaction. The model is more flexible than a monolithic ID card, but it is only as trustworthy as the controls around issuance, orchestration, and revocation. See the National Digital ID Schemes Map.
Practical implication: validate the source, confidence level, and certification status of any digital identity service before relying on it.
Why the digital driving licence is an access-control problem, not just a convenience feature
A digital driving licence is not just a replacement document. It is a selective-disclosure control that can reveal one attribute without exposing the full licence record. That is relevant to access control because the relying party should receive the minimum information needed for the decision. The same pattern shows up across age checks, right-to-work checks, and customer onboarding: the credential has to be bound to the person, the verifier has to trust the issuer, and the disclosed attribute has to be scoped to the purpose of the check. See the Mobile Driving Licence (mDL) Guide.
Practical implication: treat selective disclosure as part of access design, not as a user-experience enhancement.
Threat narrative
Attacker objective: The objective is to exploit weak identity verification or over-disclosure to pass checks, gain service access, or erode trust in regulated onboarding.
- Entry occurs when an organisation accepts identity evidence without validating the source, assurance level, or certification status of the provider.
- Credential access happens when the business accepts more identity data than the transaction requires, increasing the value of the disclosure and the harm if it is misused.
- Impact is compliance failure, poor customer experience, or reliance on an identity proofing path that cannot stand up to regulatory scrutiny.
Breaches seen in the wild
- Poland ArcGIS password leak 2023: An ArcGIS login emailed in 2020 was published from stolen mail in 2023 and still worked, exposing Polish military and infrastructure maps.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Digital identity programmes are now infrastructure, not politics. The cancellation of a universal government credential does not change the operational reality that landlords, employers, banks and retailers still need to verify people. That means identity governance has to be built around certified services, assurance levels and relying-party controls rather than around any single national scheme. The practical conclusion is that the control plane survives the policy headline.
The real governance question is who can assert identity, not whether identity proofing exists. Decentralised models move trust from a central register to a network of certified providers, source systems and wallets. Digital identity wallets become valuable only when certification, auditability and revocation are understood as part of the control design. The practitioner takeaway is to govern the trust chain, not the app icon.
Selective disclosure is becoming the default pattern for compliant identity checks. The digital driving licence illustrates a move away from over-sharing full identity documents toward releasing one verified fact at a time. That reduces unnecessary exposure, but only if relying parties ask for the minimum data needed and can justify the transaction purpose. The practitioner takeaway is to align disclosure scope with the business decision being made.
Certification will matter more than brand familiarity in the next phase of digital identity. The article points to a regulated market, a public register and formal trust framework rules. That shifts selection away from convenience and toward evidence that a provider can satisfy assurance, governance and lifecycle requirements. The practitioner takeaway is to treat provider selection as a control decision, not a procurement preference.
What this signals
Verification by attribute will overtake document-centric identity checks. The article points to a practical shift away from asking people to upload full documents and toward proving one fact at a time. That pattern will increasingly shape onboarding, age assurance and right-to-work design, especially where privacy minimisation and auditability must coexist.
Provider certification becomes the new trust anchor. As more organisations consume identity assertions from external services, the quality of the certification regime matters more than the presence of a shiny consumer-facing wallet. Practitioners should expect procurement, legal and security teams to share responsibility for deciding which identity pathways are acceptable.
Digital identity governance will move closer to supplier risk management. The operational question is no longer whether a scheme exists, but whether each provider in the chain can sustain assurance, revocation and evidence quality over time. That makes onboarding, monitoring and offboarding of identity suppliers a standing control requirement.
For practitioners
- Validate the identity proofing path Map each regulated use case to the specific assurance level and certified provider path it needs, then reject any flow that cannot evidence source trust, binding and revocation.
- Minimise disclosed attributes Require only the attribute needed for the transaction, such as age or right to work, and stop accepting full-document uploads where selective disclosure is available.
- Check provider certification before integration Verify that any digital identity service you consume is listed on the public register and covered by the relevant trust framework before it is allowed into production workflows.
- Align compliance ownership with the relying party Keep AML, right-to-work, right-to-rent and age-check accountability with the business team that makes the decision, even when a certified identity service supplies the evidence.
Key takeaways
- The scrapping of a universal government credential does not remove the practical need for verified identity in regulated business processes.
- The strongest pattern in the article is decentralised identity proofing, where certified providers and wallets replace a single central card.
- Practitioners should focus on assurance levels, selective disclosure and provider certification rather than waiting for one national identity scheme.
Related NHI Mgmt Group resources: Digital Identity, eID and Identity Wallets Guide · National Digital ID Schemes Map · Public Sector Identity Security Guide · Mobile Driving Licence (mDL) Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-63, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the technical controls, while GDPR defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| GDPR | Art.5 — Principles relating to processing of personal data | Selective disclosure and minimisation are central to the article's identity-sharing model. |
| Recommendation — Apply data minimisation and purpose limitation when designing digital identity checks. | ||
| NIST SP 800-63 | SP 800-63A — Enrollment and Identity Proofing | The article centres on verified identity and assurance for regulated checks. |
| SP 800-63C — Federation | The public register and wallet model rely on trusted identity assertions across parties. | |
| Recommendation — Use SP 800-63A to align identity proofing strength with each relying-party use case. Use SP 800-63C to govern identity assertions shared between providers and relying parties. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Identity proofing directly affects who is authorised for regulated transactions. |
| Recommendation — Tie identity assurance to authorisation decisions instead of treating them as separate controls. | ||
| NIST SP 800-53 Rev 5 | IA-8 — Identification and Authentication (Non-Organizational Users) | The article is about verifying external people such as customers, tenants and workers. |
| Recommendation — Apply IA-8 to validate external user identity before allowing regulated access or transactions. | ||
Key terms
- Digital Identity Trust Framework: A trust framework defines the rules providers must follow to operate identity services safely and consistently. In UKDIATF, it sets expectations for privacy, security, accessibility, and consent so users and relying parties can depend on certified identity services with measurable assurance.
- Selective Disclosure: Selective disclosure is the practice of sharing only the identity attributes needed for a specific decision. In credential-based systems, it reduces oversharing, lowers retention burden, and limits exposure when a verifier does not need the full record to make a trustworthy judgment.
- Identity proofing: The process of verifying that a person is who they claim to be before granting or restoring access. In higher-risk recovery paths, proofing can include stronger evidence checks such as government ID validation or liveness-based facial verification so the assurance level matches the sensitivity of the request.
- Relying Party: A relying party is the application or service that consumes an authentication assertion or token and grants access based on the identity proof it receives. In federation designs, its configuration quality directly affects whether trust decisions remain consistent and secure.
Deepen your knowledge
The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity and secrets management in a way that helps security and identity teams work from the same control model. It is relevant wherever identity evidence, assurance and lifecycle decisions shape your programme.
Published by the NHIMG editorial team on October 27, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org