Topic starter
30/10/2026 2:20 pm
TL;DR: GPG45 defines low, medium, high and very high confidence for UK identity proofing, according to OneID, and the five scored elements of strength, validity, activity history, fraud risk and verification determine whether a service can evidence the level it needs. The governance problem is not just proving identity, but proving it at the right assurance level without pushing too much manual review or customer friction into the flow.
Editorial analysis by NHI Mgmt Group, based on content published by OneID: “GPG45 and levels of confidence: how to reach medium or high”.
Key questions
Q: How should organisations choose the right level of identity proofing for different user journeys?
A: Organisations should match identity proofing strength to the risk of the transaction, not apply one standard everywhere.
Q: Why can a strong identity document still fail to reach higher assurance?
A: Because GPG45 is not based on one evidence point.
Q: What happens when identity proofing is set too high for the use case?
A: Customers face more steps, more drop-off and more manual review, often without any real governance gain.
Practitioner guidance
- Define the required confidence level first Map each regulated journey to the exact GPG45 level it must satisfy before evaluating providers or redesigning the workflow.
- Break the check into five control elements Review strength, validity, activity history, identity fraud and verification separately so one weak signal cannot be hidden by a stronger one elsewhere.
- Test completion at the required assurance level Measure how many users finish the journey at the target level without manual fallback, because a provider that shifts most cases to operations has not solved the problem.
Bottom line: GPG45 turns identity proofing into an assurance decision, with four levels that map to different service risks.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →