Identity proofing in the UK now relies on certified providers

At a glance

What this is: NHI Mgmt Group's analysis, drawing on OneID's blog post: UK identity proofing no longer depends on a single national ID card, and regulated checks now run through a certified market of registered providers.

Why it matters: This matters to IAM, fraud, and compliance teams because the control problem shifts from debating a national credential to governing provider assurance, auditability, and fit-for-purpose verification.

By the numbers:

• The public register listed 46 registered providers offering 64 certified services across identity, attribute, orchestration, holder and component roles.
• In the past year, 13 million people used OneID to prove something about themselves.
• The 2026 Digital Identity Sectoral Analysis estimated the UK digital identity sector at 275 firms.
• The 2026 Digital Identity Sectoral Analysis estimated about £2,027 million in annual revenue for the UK digital identity sector.

Context

Identity proofing is the process of establishing that a person is who they claim to be before a regulated service proceeds. In the UK, that problem is now handled through a certified provider market rather than a single national credential, which changes how organisations think about trust, assurance, and auditability.

The important governance shift is that the state stepped back from a mandatory central ID design, but the duty to verify identity and age did not disappear. That leaves businesses responsible for selecting the right certified provider, proving the basis of their checks, and retaining the evidence that their chosen route meets the legal and operational need.

Key questions

Q: How should organisations choose a digital identity verification platform for global onboarding?

A: Start with the markets you serve, then test whether the platform can recognise the documents, scripts, and regulatory patterns that matter in those markets. Prioritise biometric matching, liveness detection, API quality, and configurable workflows, because onboarding only scales when the control can adapt without creating manual exceptions.

Q: Why is attribute-based identity proofing better than collecting full identity records?

A: Because it narrows the data flow to the minimum needed for the transaction. If a business only needs to know whether someone meets an age threshold, a yes or no is easier to justify, safer to store, and less exposed than copying the full source record into another system.

Q: What should security teams check before trusting a certified identity service?

A: They should verify the service type, the certification status, and the evidence trail for the specific check being performed. Certification is only useful if it aligns with the actual control need, and if the business can show why that provider was acceptable for the regulated activity.

Q: How do digital identity schemes affect accountability when something goes wrong?

A: They do not remove it from the relying party. The organisation still owns the risk assessment, the compliance decision, and the audit trail, even when a certified provider performs the identity step. That division is deliberate, because outsourcing verification is not the same as outsourcing accountability.

Technical breakdown

How certified identity proofing replaces a central ID model

The UK model separates the act of proving identity from the idea of a universal state credential. Instead of one database-backed ID card, a regulated service asks a certified provider to confirm a specific claim about a person, such as identity or age. The architecture matters because it avoids creating a single identifier that can be reused across services. Each check is scoped to the question asked, and the person shares only the information needed for that purpose. The trust model therefore depends on certification, registry visibility, and limited disclosure, not on one central store of identity records. Read the Ultimate Guide to NHIs: What are Non-Human Identities.

Practical implication: Treat provider certification and scope limitation as the control objectives, not the presence of a national credential.

Why assurance is now a provider governance problem

The register exists to make provider standing checkable before a business relies on it. That turns identity proofing into a governance decision about assurance, not just a user experience decision about speed. A business still owns the legal duty, but the provider carries the specialised verification step under a certified framework. For IAM and compliance teams, the practical challenge is to align risk appetite, data minimisation, and audit evidence with the provider type they choose. A single age check, a full onboarding check, and an orchestration service are not interchangeable, even if they all sit in the same market.

Practical implication: Define which certified service type matches the control need before you approve it for onboarding or age assurance.

Why attribute-based checks reduce overcollection

Attribute-based verification confirms one fact without exposing the full underlying record. If a service only needs to know whether someone is over eighteen, the system can return a yes or no rather than the date of birth itself. This is a privacy and governance pattern as much as a technical one, because it limits the data flow to the minimum required for the transaction. It also reduces the temptation to build a broader profile than the use case justifies. For security teams, that narrower disclosure model is a useful counterweight to overcollection in onboarding and fraud controls.

Practical implication: Design verification flows so the relying party receives only the attribute required for the decision.

NHI Mgmt Group analysis

Certified identity markets are a governance substitute for a central ID card, not a softer version of the same model. The key design choice is not whether identity proofing exists, but where trust is anchored and how it is evidenced. A register of certified providers creates a governance layer that lets organisations verify standing before they rely on a service. For identity, fraud, and compliance teams, that means assurance moves from politics to control selection and audit proof.

Identity proofing becomes materially safer when the check is limited to the question being asked. Attribute-based verification changes the privacy posture because it allows a relying party to learn one fact without pulling in the entire identity record. That reduces data exposure, lowers retention pressure, and makes the check easier to justify under minimisation principles. Practitioners should treat this as a control design choice, not just a user experience improvement.

Provider diversity creates resilience, but it also creates selection risk. A market with dozens of certified services gives businesses options, but options only help when the organisation has a clear standard for selecting the right service type. Without that, teams can overbuy, under-verify, or rely on the wrong assurance layer for the regulated activity. The practical conclusion is simple: map each verification use case to a defined service class and evidence requirement.

The UK model shows that digital identity governance works best when the relying party keeps accountability. Certification can standardise the provider side, but it does not remove the business's responsibility for risk assessment, customer due diligence, or audit trail integrity. That split is healthy, because it prevents a false assumption that a certified provider automatically solves the whole compliance problem. Practitioners should keep ownership of the control decision even when the verification step is outsourced.

What this signals

Verification governance will increasingly hinge on service classification. As digital identity markets mature, the practical risk is not lack of capability but incorrect routing of checks to the wrong service type. IAM and fraud teams should expect more scrutiny of whether a business asked for identity, age, or attribute assurance and whether the provider choice matched that need.

Attribute minimisation should become the default in onboarding design. Organisations that can ask for a yes or no should resist building flows that capture more than the transaction requires. That reduces exposure, shortens retention obligations, and makes the verification step easier to defend in audit and privacy reviews.

Provider certification becomes a control input, not a procurement footnote. The more regulated the activity, the more important it is to align provider standing, evidence, and internal accountability. Teams that treat certified identity services as a governance control will be better positioned than teams that treat them as a convenience layer.

For practitioners

• Define the verification question first Separate identity, age, and attribute checks before selecting a provider so the service matches the regulated decision you need to make. See the NHI Lifecycle Management Guide.
• Check provider standing on the public register Use the GOV.UK register to confirm the provider is certified for the specific service type before you accept it into onboarding or age assurance flows.
• Limit disclosure to the minimum necessary Prefer flows that return a yes or no, or the narrowest required attribute, instead of collecting or retaining the full underlying identity record.
• Preserve your own audit trail Keep the internal rationale for why a certified provider was chosen, what level of assurance was required, and how the result was used in the decision.

Key takeaways

• The UK identity proofing model now depends on certified providers rather than a single national credential, which shifts the governance question to provider selection and assurance.
• Attribute-based checks matter because they reduce disclosure to the minimum necessary, which improves privacy posture and simplifies audit justification.
• Practitioners should map each regulated use case to the correct certified service type and keep their own evidence trail, even when a third party performs the check.

Related NHI Mgmt Group resources: Database Credential and Access Security Guide · NHI Lifecycle Management Guide · Ultimate Guide to NHIs: Regulatory and Audit Perspectives

Key terms

• Identity proofing: The process of verifying that a person is who they claim to be before granting or restoring access. In higher-risk recovery paths, proofing can include stronger evidence checks such as government ID validation or liveness-based facial verification so the assurance level matches the sensitivity of the request.
• Attribute Verification: Attribute verification is the act of confirming a specific fact about a person rather than establishing full account access. It matters when a business needs evidence for onboarding, regulatory checks, or higher-risk actions without repeatedly collecting more identity data than necessary.
• Relying Party: A relying party is the application or service that consumes an authentication assertion or token and grants access based on the identity proof it receives. In federation designs, its configuration quality directly affects whether trust decisions remain consistent and secure.
• Certified Identity Service Provider: A certified identity service provider is an organisation authorised to deliver digital identity checks under a recognised trust framework. It provides a controlled method for verifying identity and supporting employment checks, giving employers a structured way to digitise onboarding while maintaining assurance and consistency.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore it if your role involves authentication, lifecycle governance, or deciding how trust should be assigned across modern identity programmes.