Digital Identity Verification and the Money Laundering Regulations

Checking who a customer is used to mean photocopying a passport and a utility bill. Today many firms verify identity digitally, using apps that read a passport chip and match a face. In February 2026 HM Treasury published guidance on how those services fit with the Money Laundering Regulations, and in August 2026 the government's Office for Digital Identities and Attributes explained what it means in practice. This guide sets out what the guidance says, what it does not, and what accountants and other regulated firms should do before relying on a digital verification provider.

What the guidance is

The guidance is called "Using digital identities with the Money Laundering Regulations". It was published on GOV.UK by HM Treasury on 26 February 2026 and is described as approved guidance for compliance with the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017. It explains how the UK digital identity and attributes trust framework, first developed in 2020, interacts with the Regulations. The page shows a later update date of 2 September 2026, so always read the current version.

The key point: certified and registered providers

According to the guidance, digital identity services that are certified against the trust framework and listed on the Digital Verification Services register can be treated as a reliable and independent source of information for customer due diligence. The Office for Digital Identities and Attributes sets the requirements, independent conformity assessment bodies overseen by the UK Accreditation Service assess providers, and the register is maintained under the Data (Use and Access) Act 2025. Providers can be removed for breaches or for failing to correct minor non-conformities promptly.

The guidance says that using certified and registered services to verify an individual's identity can help a firm meet its obligations under regulation 28 of the Regulations, and that they may also be used to verify company directors. It also says that providers which are not certified and registered cannot reliably be treated as suitable for identity verification under the Regulations. In a blog post published on 20 August 2026, the Office for Digital Identities and Attributes put it plainly: being on the register is the clearest signal of a reliable, independently assured service, and it expects the gap between certified and non-certified providers to matter more to relying parties over time.

What "GPG 45" means for you

The trust framework draws on Good Practice Guide 45, the standard for proving and verifying identity. According to the August 2026 blog, certified and registered providers must express identity checks as GPG 45 levels, which are low, medium, high or very high. Regulated businesses must carry out a risk assessment for each customer and choose the assurance level that matches the risks they find. The practical consequence is that a one-size-fits-all setting is unlikely to be right: a low-risk individual and a politically exposed person do not warrant the same level of assurance.

Identity outcomes and attributes are not the same

Digital checks often return extra data, called attributes, such as address information or politically exposed person and sanctions status. The August 2026 blog explains that identity outcomes and attributes must be kept separate. Only the identity outcome has to meet GPG 45, and attributes sit outside the money laundering guidance. A provider that shares attributes has to be certified as an attribute service provider, and one certified only as an identity service provider covers just the attributes created inside a GPG 45-compliant identity check. Providers must tell customers clearly which attributes are part of their certified service. Businesses are under no obligation to take attributes from certified and registered providers, although the blog strongly recommends it.

What stays with your firm

The guidance is just as clear about what a digital identity does not do. Firms must still assess customer risk themselves and apply enhanced due diligence where appropriate. A digital identity does not necessarily cover every part of customer due diligence, such as understanding the purpose and intended nature of the business relationship. Firms remain ultimately liable for customer due diligence failures when they use a digital identity service, and the service must support the record keeping required by regulation 40. Our guide to reliance on third parties for customer due diligence explains why outsourcing a check never outsources the responsibility.

A practical checklist before you adopt a provider

• Check the register. Confirm the provider is certified and registered, and confirm that the specific service you will use is covered by the certification.
• Match the level to the risk. Decide in your risk assessment which GPG 45 level you will accept for each customer type and write it down.
• Separate identity from attributes. Know which outputs are certified identity outcomes and which are attributes, and do not treat attribute data as verified identity evidence.
• Keep doing the rest of customer due diligence. Record the purpose of the relationship, the beneficial ownership of corporate clients and any source of funds work that the risk calls for.
• Keep your records. Make sure you can retrieve the evidence of the check for as long as the Regulations require.
• Look for the sector guidance. HM Treasury's page points to HMRC, CCAB, JMLSG, the Legal Sector Affinity Group and the Gambling Commission guidance for each sector, so check yours.

Our client onboarding KYC checklist shows where identity verification sits in the wider process, and our guide to customer due diligence for accountancy practices covers the other steps.

Frequently asked questions

Can I rely on any digital identity app for anti-money laundering checks?

According to HM Treasury's guidance, certified and registered providers can be treated as a reliable and independent source, while providers that are not on the register cannot reliably be treated as suitable.

Does a digital identity check replace customer due diligence?

No. It can help with identity verification, but firms still need to assess risk, understand the purpose of the relationship and apply enhanced due diligence where appropriate.

Who is liable if the provider gets it wrong?

The guidance says firms remain ultimately liable for customer due diligence failures when they use digital identity services.

Where can I find AML training for my team?

See Learnsignal's CPD courses for finance professionals.