Digital ID checks for AML: what UK firms need to know in 2026

Can you verify a client’s identity online for AML?

Yes. Regulation 28 of the MLRs requires you to identify your client and verify their identity “on the basis of documents or information in either case obtained from a reliable source which is independent of the person whose identity is being verified”.

Regulation 28(19), added in January 2020, says information obtained through “an electronic identification process” can count as that reliable, independent source. The condition is that the process is secure from fraud and misuse and can give you enough assurance that the person is who they claim to be, to the degree your money laundering risk calls for.

So the law does not prefer a passport seen across a desk to a check done on a phone. It cares whether the method is reliable. The 2026 amendments to the MLRs (SI 2026/621, in force 30 June 2026) did not change regulation 28 and contain nothing about digital identity. For what they did change, see our guide to the Money Laundering Regulations 2026 changes.

What changed in 2026

The change came through guidance that supervisors now expect you to follow.

Note the wording. HM Treasury and HMRC do not say non-registered services are banned. They say you cannot reliably treat them as suitable, which in practice means you would struggle to defend that choice at an inspection. The accountancy guidance is stricter and tells firms to fall back to paper documents.

eIDV vs certified digital identity: what’s the difference?

“Electronic identity verification” (eIDV) has meant different things over the years. The table compares the main methods.

HMRC’s internal supervision handbook (ECSH33357) still describes the older test: an electronic check alone is enough if it uses data “from multiple sources, and across time”, or includes qualitative checks. It does not mention the DVS register. For HMRC-supervised firms, the guidance written for businesses, AMLG11400 section 14.5, is the current reference. The legal sector guidance makes the same point about database checks: they must establish “your customer’s identity, rather than just establishing that the identity exists”. For definitions, see electronic identity verification, which also covers eKYC.

The DVS register and the trust framework

The DVS register is a statutory list kept by OfDIA under Part 2 of the Data (Use and Access) Act 2025, in force since 1 December 2025. A service gets on it by being certified by an independent conformity assessment body, accredited by UKAS, against the UK trust framework. The current framework versions are 0.4 (gamma) and 1.0, now called the “UK digital verification services trust framework”.

Three things are worth knowing:

• There is no “AML” certification. The register has supplementary codes for right to work, right to rent and DBS checks, but none for the MLRs. A service cannot be certified against a piece of legislation, so a provider claiming to be “certified for AML” is using wording the government says “must not be used”.
• Being listed is not government approval. The trust mark guidelines say being on the register “does not mean government has approved or endorsed a service”. The UK CertifID trust mark shows a service is certified against version 1.0 and listed.
• The register changes. On 29 October 2026 it listed 66 services. Services are removed automatically at 11:59pm on the day their certificate expires unless recertified, so check more than once.

How to check your ID provider in five steps

This takes a few minutes and gives you evidence for your file.

1. Ask which service performs the check. The brand you buy from may not be the service on the register. The accountancy guidance warns that the provider’s “brand” may not be listed while the underlying software is. Ask for the registered service name in writing, ideally in the contract.
2. Search the register. Go to the DVS register and search by provider, service or trust mark number. Check the “underpinning or white-labelled service” field if the names differ.
3. Check the role and the dates. The service should hold the identity role. Note the certificate issue and expiry dates.
4. Check the identity profiles fit your risk. Entries list identity profiles from low to very high confidence (for example M1A or H2B). Your firm-wide risk assessment should say what level you need, and when you need more.
5. Record it. Save a screenshot or PDF of the register entry with the date, and set a reminder to re-check before the expiry date.

If a provider is not listed, the SRA suggests asking whether it is listed under another name, uses a listed back-office service or has applied for registration. If the answer is unclear, use documents until it is resolved.

What a digital ID check does not do for you

HM Treasury is clear that firms “should not assume that digital identities fulfil all aspects of customer due diligence”. A digital ID check confirms who your client is. You still need to:

• assess the purpose and intended nature of the work (regulation 28(2)(c));
• identify and verify beneficial owners where the client is a company or trust;
• screen for sanctions, PEPs and adverse media (see PEPs, sanctions and adverse media);
• check source of funds or wealth where the risk calls for it, and apply enhanced due diligence where required;
• keep the relationship under ongoing monitoring.

Liability stays with you. Regulation 39(7) allows CDD through an outsourcing provider only if your firm remains liable, and HMRC’s supervision handbook states that using electronic verification “is also not a reliance arrangement”. For the full picture, read our guide to customer due diligence.

What it means for your sector

What to keep on file

Regulation 40 requires you to keep CDD documents and information for five years after the relationship ends or the transaction completes, then delete personal data unless an exception applies. HM Treasury says you should make sure your provider can meet these requirements.

For each client, your file should show:

• the method used (digital ID, documents, or both) and the date;
• the provider and the registered service name;
• the result (pass, fail or refer) and who reviewed it;
• the confidence level or identity profile achieved;
• your screening results and risk rating.

HMRC’s supervision handbook tells its officers to ask what happens to stored results “if the business switches providers”, so keep your own copy rather than relying on the provider’s portal. Our guide to preparing for an HMRC AML inspection covers what inspectors look at, and our templates help you record it.

When to fall back to documents or an in-person check

Digital checks do not suit every client. Common cases:

• the client has no passport or photocard driving licence, or no smartphone;
• the liveness or document check fails or keeps returning “refer”;
• the client is vulnerable or not confident with technology;
• the provider’s register status is unclear.

In these cases use original documents seen in person or suitably certified copies, following your supervisor’s document list, with at least one photo document. Record why you used the alternative and what you saw. A failed digital check is not proof of wrongdoing, but treat an unexplained failure as a risk factor.

How AML Buddy fits

AML Buddy’s identity checks run through GBG (GB Group plc). GBG’s services are certified against version 1.0 of the UK digital verification services trust framework and listed on the DVS register under GB Group PLC. GBG runs the document check with face match and liveness, and its ID3global service (trust mark 020401) runs the electronic identity and address checks. AML Buddy itself is not a separate entry on the register: it delivers the checks through GBG’s certified services.

Your client completes the check through one secure link: they photograph an ID document and take a selfie, and the check also covers an address match, sanctions and PEP screening and adverse media. You get a timestamped PDF report for your file.

Each register entry shows the identity profiles a service is certified to, so record in your risk assessment which checks you rely on and why. Where your supervisor’s guidance asks you to confirm that the software behind a provider is listed, as the accountancy guidance does, keep a note that AML Buddy’s identity checks run through GBG. Your firm stays responsible for its CDD decisions. See pricing for how pay per check works.