All uses

Trust framework

Find out more about the new digital identity standards for the UK.

Person using a laptop.

Overview

What is the UK digital identity & attributes trust framework (UKDIATF)?

The trust framework is a new set of standards, rules and best practice guidelines for the digital identity market. This new framework provides an opportunity for digital identity providers to meet specific and externally certified standards in relation to security, data governance and privacy.

What does this mean for consumers and businesses?

This is good news for consumers looking to prove their identity online, access regulated products or services and reuse their identity credentials securely.

For businesses, the new framework provides a clear set of standards and a marketplace to select certified identity providers. This means businesses can rely on information and attributes from verified digital identities, reduce risk of fraud and simplify their business processes by going digital.

How will this work in practical terms?

The trust framework encourages digital identity service providers to work together under a common set of government designed principles, to describe what ‘good’ digital identity is and what a person can do with it.

The national framework will govern digital identity across the entire economy, sector-specific trust schemes are being developed underneath it to help ensure consistency and allow for the best practices within those sectors to be incorporated.

You can find the full UKDIATF statement here.

Trust framework

FAQs

What is the trust framework?

The trust framework creates a new standards based, government accredited online marketplace for digital identity. Participants will be certified against this government drafted framework by an external UKAS accredited certification provider and be regularly audited to ensure compliance – similar to how they are currently certified against standards for information management or cyber security, but tailored towards the digital identity market. One of the key advantages is that it enables trust between organisations that the information shared with them is accurate and reliable.

What does this mean for DBS checks?

From April 2022, digitally processed DBS checks have been able to be completed using a certified identity service provider. However the current temporary guidance for digital checks will still be valid until September of this year.

A number of identity service providers are currently going through the process of certification. By using a certified provider, DBS will know that your business is meeting the required standards for governance and verification of a candidate's identity.

What does it mean for Right to Work checks?

From September 2022, the option for your business will be to either go back to meeting candidates face-to-face to check documents manually or use a certified digital identity provider.

The Home Office has advised that organisations should start to consider this now to ensure they are not left short, and strongly urge you to use a certified provider.

The temporary Covid adjusted right to work checks, which were set to end in April have now been deferred to end in September 2022 with the aim to give employers enough time to create relationships with identity service providers.

Why are DBS adopting the new digital standards?

Mark Sugden, Head of Identity at DBS, explained:

There’s friction in the current process - it takes time for the candidate to pull documents together and they then have to go back to their new employer to get this identity check done. And employers aren't typically experts at looking at a passport or establishing whether that proof of address document is real. We’re relying on untrained identity checkers.
–Mark Sugden

Fraud is on the rise, it's becoming easier to falsify documents and information and you can be fined up to £20,000 per candidate for employing people illegally. Having a robust system of checking identity is critical to protect your business

Digital checks and technology such as facial recognition and video liveness give a secure verified assurance that the information provided matches the person being checked. Applying and using new technology ultimately requires standardisation and a lot of guidelines and rules. This is where the UKDIATF comes in.

What do professional regulatory bodies say about the adoption of digital identity and use of identity verification technology?

DCMS have worked extensively with industry stakeholders including supervisory authorities during the creation of the UKDIATF. We fully expect the national framework as well as sectoral frameworks to gain the endorsement of relevant regulatory bodies.

The RRU (a cross sector group of regulators including FCA, SRA, Law Society of Scotland and many others) have released a statement in support of digital identity verification adoption, which you can find here. Amiqus were pleased to contribute to this work coordinated by Law Tech UK.

Will the trust framework make things simpler or more complicated?

The trust framework will introduce and govern the use of a new Trust Mark – a symbol that shows a provider is accredited and meets UK Government standards. The Trust Mark will enable you to quickly find providers that help you meet requirements of digital identity checking. As there will be clear government accepted digital processes and methodology in place. This will make this more streamlined and simpler for businesses and consumers alike.

Will the trust framework make things safer?

Amiqus already meets the prescribed requirements of the trust framework, like meeting industry standard cyber security practices, ISO/IEC 27001:2013 certification and being compliant with data protection legislation.

The trust framework will create a new digital identity marketplace where everyone will be bound by these same rules and standards in addition to introducing new requirements. Identity service providers will need to become externally accredited and regularly audited to these requirements, which will give you confidence when choosing one, knowing they meet the necessary safety standards, eliminating the guesswork.

How will it benefit my organisation?
  • Meeting required compliance standards will be simple and clear whilst the experience for clients and consumers will be simple and repeatable.
  • Your customer/candidate will know and recognise a safe and secure system by its trust mark logo. The Department of Digital, Culture, Media and Sport will take steps to educate people on what the trust mark means –just as consumers recognise the direct debit guarantee logo mark, the CE mark on electrical products or the red tractor logo for assured food standards.
  • There will be a standardised way of identity verification and proofing across industries. In time, consumers will be able to present and reuse their digital identity attributes or credentials across various sectors, scenarios and use cases.
  • There will be a wider range of ways to identify and verify clients depending on the types of documentation they have and their circumstances providing you flexibility in your approach whilst meeting required standards.
How will DBS adopting digital identity impact businesses?

For businesses who want to continue to run DBS checks digitally you will have to use an accredited provider to do so.

Eventually the trust framework is expected to sit over the identity checking landscape and multiple sector level schemes are already developed or will be developed under it - so it is likely your business will be impacted one way or another.

Does our business have to use an accredited provider or can we still do in person checks?

Using a digital solution, like Amiqus, allows for a quicker and more streamlined solution you can have full confidence in. It keeps client’s and your own data secure and saves you a lot of time and effort.

You can still meet your candidates face to face to verify their right to work, however it’s more challenging to verify a candidate’s document is legitimate by looking at it in person. There is a high risk of hefty fines if you make a mistake.

There are numerous advantages of digital identity checking with Amiqus, such as the removal of human error, improving the security of your process, automated recording of transactions, documents and data, better scalability and an improved client/candidate experience and their perception of your organisation.

How much is it going to cost?

There is a small cost to digitally verifying individuals data to the UK Government standards. However, you may save money due to low insurance premiums, save time with a faster and more efficient process, and be able to instead dedicate it to more billable work.

For more information about our pricing tailored to your use case, contact us at sales@amiqus.co

Will using a digital solution save us time or take longer?

Candidates will be able to complete pre-employment checks online and in minutes which will inherently save a lot of time. Your internal processes will become smoother and more efficient, paper based admin can be replaced by streamlined digital organisation and automatic tracking and storing of data. It will mean clients and candidates won’t need to travel into your offices, and it might give you greater ability to work from home, from any device.

All of this will make your team more efficient and save you time and money.

As an example NHS Business Services Authority implemented Amiqus to manage right to work checks when they supported the NHS Covid vaccine rollout. Tens of thousands of people were safely and quickly recruited or returned to the NHS with an estimated £1.3 million of cost saving efficiencies created for their organisation.

Any dates to be aware of in relation to digital identity checking for DBS?

The legislation that enables identity service providers to process checks digitally came into effect on the 6th of April 2022. You will still be able to conduct the Covid adjusted digital check process until the end of September 2022. The prolonged transition period between April and September will enable a smoother transition, and for IDSPs to go through the process of becoming  certified.

What do we have to action before September and when?

A transition period is in place to allow you to prepare for the changes to digital checks. From the 6th of April, DBS is accepting digitally processed checks using certified identity service providers. At the moment, all IDSPs are in the process of obtaining certification but it’s wise to start looking into making the change so your business is prepared when it becomes mandatory.

We’re proactively working across our client base to ensure a smooth transition and implementation of any new processes.

Typically, onboarding and implementation is viable within ten working days depending upon the scale, complexity and integration to your systems.

To talk to us about implementing a solution ahead of the right to work changes in September, contact sales@amiqus.co

Who exactly needs to become certified?

The Identity software providers are who need to become certified. You don’t need your own business to be certified. As long as you choose to work with an IDSP that is certified and carries a Trust Mark, there will be no certification requirements for your organisation.

Will Amiqus become an accredited identity service provider/attribute service provider?

We’ve been engaged with DCMS during its development of the UKDIATF since 2019. In early 2022 we were one of a handful of organisations to complete the alpha stage testing of the UKDIATF.

We are currently working with a globally recognised certification provider to meet the additional requirements of the UKDIATF and the DBS scheme and expect to complete this by summer 2022 ahead of the September changes to evidence digital ‘right to work’ checks.

How does Amiqus differ from other typically accredited IDSPs/ASPs?

Amiqus is the Uk’s most trusted compliance onboarding platform. We support the government, NHS and hundreds of regulated businesses to enable their staff and clients to access products and services digitally.

Amiqus provides a full end to end workflow solution for both employee or client onboarding journeys in addition to automated back office management tooling at scale. Through our other checks we enable organisations to run all aspects of their onboarding from one centralised system.

We are currently both a Responsible Organisation and Umbrella body with DBS and process basic, standard and enhanced level checks fully digitally. We also cover Disclosure Scotland and Access NI checks however currently they have a less specific approach to verifying digital identity which we also exceed.

What is the difference between identity service provider/attribute service provider?

Attribute Service providers are Individuals or organisations that collect, create, check or share attributes. Attributes are pieces of information that describe something about a person or an organisation.

Identity Service Providers prove and verify users' identities. They might not need to do all parts of the identity checking process.

How will we find a list of certified providers?

DCMS and relevant scheme owners will publish a list online of certified providers, and they will equally be recognisable by the use of the digital identity Trust Mark. Once certification has been completed, we’ll also provide access to this information.

Does Amiqus follow the Good Practice Guide (GPG) 45?

Yes. GPG45 is a government methodology for the collection, verification and confidence that can be placed in a digital identity created by a digital identity service provider like Amiqus.

To date, GPG45 has mainly been used by government bodies. The UKDIATF incorporates GPG45, and will ask all identity service providers to validate and provide evidence that the identities they create meet the requirements of GPG45. External verification of this will form part of the certification process.

Trust framework

Acronym guide

  • UKDIATF - UK Digital Identity and Attributes Trust Framework
  • DBS - Disclosure and Barring Service
  • DCMS - Department of Digital, Culture, Media and Sport
  • IDSP - Identity Service Providers
  • IDVT - Identity Verification Technology
  • REC - Recruitment and Employment Confederation
  • GPG45 - Good Practice Guide 45
  • ISO - International Standards Organisation
  • ISMS - Information Security Management System
  • ISO 27001 - The only auditable international standard that defines the requirements of an ISMS
  • NFC - Near Field Communication: NFC Chips are commonly used in e-passports, bank cards, etc. It is a chip that allows for two devices who have it embedded to communicate with each other when in near proximity to one another. Often they are used for the interchange of communication from one to the other.

Book a demo

By booking a demo you'll get a personalised product walkthrough, advice on your specific business needs and an overview of Amiqus pricing plans.