GPG45 confidence levels shape identity proofing and service friction

At a glance

What this is: NHI Mgmt Group's analysis, drawing on OneID's blog post: GPG45 sets the UK identity proofing confidence levels and determines whether a check reaches medium or high assurance by combining evidence quality, fraud checks and verification.

Why it matters: IAM, KYC and digital onboarding teams need a clear mapping between assurance level and service risk, because under-scoping identity proofing creates compliance gaps while over-scoping it drives avoidable drop-off and manual work.

Context

GPG45 is the UK government's common framework for proving and verifying identity, and it matters because regulators and procurement teams often specify a confidence level rather than a single control. In practice, that turns identity proofing into an assurance question, not just a document-checking exercise.

The governance issue is how to match the required confidence level to the service risk without making the process unnecessarily difficult for the customer. Regulatory and Audit Perspectives is relevant here because the obligation is usually framed in terms of evidence, auditability and retained assurance, not user experience alone.

At medium or high confidence, the challenge is not one signal but the combination of evidence strength, validity, activity history, fraud checks and verification. That makes GPG45 a scored identity model, not a binary yes or no decision.

Key questions

Q: How should organisations choose the right level of identity proofing for different user journeys?

A: Organisations should match identity proofing strength to the risk of the transaction, not apply one standard everywhere. Low-risk actions can use lighter checks, while regulated or high-impact journeys need stronger evidence, including document, database, and biometric validation. The goal is to reduce fraud without creating unnecessary friction that drives abandonment or weak workarounds.

Q: Why can a strong identity document still fail to reach higher assurance?

A: Because GPG45 is not based on one evidence point. A document can be genuine and still leave gaps in activity history, fraud risk or verification that the person presenting it is the true owner. Higher assurance depends on the combined profile, so a weakness in one element can prevent the journey from reaching medium or high.

Q: What happens when identity proofing is set too high for the use case?

A: Customers face more steps, more drop-off and more manual review, often without any real governance gain. Over-scoping assurance can move cost into operations, slow onboarding and reduce completion, especially when the service risk only justifies a lower confidence level. The result is friction without proportionate security value.

Q: How do auditors assess whether identity verification is defensible?

A: They look for evidence that the required confidence level was reached, that the provider can show how the level was derived, and that the record can be retained for later challenge. A defensible process is auditable, repeatable and aligned to the service risk, not just a one-off successful check.

Technical breakdown

How GPG45 scores identity confidence

GPG45 does not add identity evidence into one simple total. It scores five elements, strength, validity, activity history, identity fraud and verification, then maps the resulting profile to a confidence level. That design matters because a weakness in one element can hold back the overall result even when the other checks are strong. In operational terms, the framework is asking whether the evidence is real, whether it belongs to the claimed identity, whether that identity has existed over time, and whether the person presenting it is the same person who owns it. See the NHI Lifecycle Management Guide.

Practical implication: Treat each element as a separate governance checkpoint rather than assuming a strong document check is enough.

Why medium and high confidence are not interchangeable

Medium confidence is suitable for many mainstream regulated journeys, but high confidence is for cases where the consequences of a false identity are materially greater. The difference is not cosmetic. High confidence usually requires stronger evidence, more than one source, fraud screening and a live binding step such as liveness checking. That means the assurance uplift comes from a broader evidentiary base, not simply more friction. For programme owners, the key question is whether the service risk justifies the added operational and customer burden.

Practical implication: Set the required confidence level from the service risk first, then test whether the journey still completes at that level.

What makes a GPG45 provider defensible

A defensible provider is one that can evidence the claimed confidence level, not merely say it supports it. In practice, that means using multiple authoritative data sources across the five elements, having independent certification under the UK trust framework, and producing a record that shows how the level was reached. The important distinction is between a provider that can occasionally pass and one that can reliably evidence the result for most users without forcing a manual fallback. That is what makes the control audit-ready rather than just operationally convenient. Read the Ultimate Guide to NHIs: Regulatory and Audit Perspectives.

Practical implication: Require proof of level coverage and retained evidence for every completed check, not a marketing claim about compliance.

NHI Mgmt Group analysis

GPG45 is best understood as an assurance model, not a document-checking standard. Its value is that it translates identity evidence into a confidence level that a regulator, bank or public service can understand. That makes the framework useful precisely because it separates evidence quality from business risk, which is how identity governance should work when the cost of a wrong decision is uneven across services. Practitioners should treat the level as the control objective, not the artefact itself.

Medium confidence and high confidence solve different governance problems. Medium is enough where the consequence of a mistaken identity is limited, but high is designed for materially sensitive journeys where fraud, impersonation or downstream abuse would have serious impact. The practical implication is that teams should stop asking whether they can prove identity in general and start asking whether they can prove it to the exact level the use case requires.

The named concept here is assurance-to-friction trade-off governance. The higher the confidence level, the more evidence, checks and customer effort the journey demands. That trade-off is not a product issue, it is a programme design choice, and the wrong choice either weakens assurance or depresses completion. Identity teams should manage that trade-off explicitly instead of discovering it through abandonment and manual review volumes.

Reusable evidence changes the economics of high-assurance identity, but not the governance requirement. A passkey-secured returning-credential flow can reduce repeat friction, yet the service still has to prove it reaches the required confidence level and retain a defensible trail. The governance point is that convenience does not replace assurance, it only changes how often the user has to pay the cost. Practitioners should keep those two concerns separate when selecting proofing journeys.

What this signals

Confidence-level governance will keep replacing binary pass or fail thinking. As more regulated services rely on identity proofing, teams will need to manage the level requirement as a policy decision, not an implementation detail. That means onboarding, fraud, compliance and audit stakeholders will need a shared view of when medium is acceptable and when high is non-negotiable.

Assurance-to-friction trade-off management will become a core IAM discipline. Services that chase maximum confidence without checking completion will push users into manual paths and operational queues. The stronger programme design question is how to preserve evidence quality while keeping the number of users who finish the journey high enough for the service to work.

For practitioners

• Define the required confidence level first Map each regulated journey to the exact GPG45 level it must satisfy before evaluating providers or redesigning the workflow.
• Break the check into five control elements Review strength, validity, activity history, identity fraud and verification separately so one weak signal cannot be hidden by a stronger one elsewhere.
• Test completion at the required assurance level Measure how many users finish the journey at the target level without manual fallback, because a provider that shifts most cases to operations has not solved the problem.
• Retain evidence for audit and challenge Store the level reached and the contributing evidence so you can explain how the identity was verified if a regulator, customer or internal reviewer asks.

Key takeaways

• GPG45 turns identity proofing into an assurance decision, with four levels that map to different service risks.
• The framework's five scored elements mean strong evidence alone is not enough if validity, history or verification are weak.
• Teams should choose the confidence level first, then test whether the journey still completes without excessive manual fallback.

Related NHI Mgmt Group resources: NHI Lifecycle Management Guide · Ultimate Guide to NHIs: Regulatory and Audit Perspectives · IAM and Identity Provider Buyer's Guide

Key terms

• Identity proofing: The process of verifying that a person is who they claim to be before granting or restoring access. In higher-risk recovery paths, proofing can include stronger evidence checks such as government ID validation or liveness-based facial verification so the assurance level matches the sensitivity of the request.
• Activity History: Activity history is the recorded sequence of user or system actions within a platform. It gives security and IT teams a practical view of operational behaviour, which helps with troubleshooting, forensic investigation, and proving that governance controls were followed during changes or incidents.
• Verification Binding: The control step that ties the evidence and the claimed identity to the living person presenting the application. It is what makes the check more than document validation, because it connects the proofing process to the actual user behind the request.
• Assurance To Friction Trade-off: The relationship between higher identity assurance and the effort required from the user to complete the journey. As assurance rises, so does the number of checks, which can improve confidence but also reduce completion if the design is not managed carefully.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.