What is the Document Verification Service?

The DVS, operated by the Australian Government through IDMatch, checks whether details from an identity document such as a passport or driver licence match the issuer's records. Private-sector organisations access it under an approved arrangement, typically through a gateway service provider, and must obtain the person's express consent.

Can private businesses use the Australian Government Digital ID System?

The Digital ID Act 2024 provides for private-sector participation in the Australian Government Digital ID System in phases. Sources indicate private-sector entities can apply to participate from late 2026, with the ACCC as Digital ID Regulator. Check the official Digital ID and ACCC pages for current details.

Should we store copies of identity documents?

Only if you have a legal or genuine business need. Storing document images and numbers increases the harm from a breach. Many businesses record the verification outcome, method and reference instead, and delete or never keep the documents.

Are selfie and liveness checks available?

Commercial identity providers offer face matching and liveness checks. The government Face Verification Service is not currently open to private businesses. Biometric information is sensitive information under the Privacy Act, so consent, necessity and security need particular care.

Web Development4 min read

Identity Verification Integration in Australia: Designing Secure Customer Onboarding

Adding identity verification to Australian onboarding: when it is needed, DVS document checks, biometrics, Digital ID, consent, privacy and fraud controls.

How do you add identity verification to onboarding in Australia?

Decide whether verification is legally required or justified by risk, choose methods that fit (document checks through the Document Verification Service, commercial liveness and face matching, or a Digital ID as private-sector participation opens), integrate through an identity provider or gateway, collect express consent, keep only the verification outcome where possible, design for drop-off and fallbacks, and monitor fraud. Verification is a privacy-heavy process; minimise what you collect and keep.

This guide is for fintech, marketplace, property and HR product teams. It is general information, not legal advice; AML/CTF obligations in particular need specialist advice.

Key takeaways

Verify only when law or risk requires it.
Use DVS checks through an approved gateway with express consent.
Treat biometrics as sensitive information.
Store outcomes, not documents, where you can.
Offer fallbacks so legitimate customers are not shut out.
Track status of Digital ID private-sector participation.

Methods compared

Method	What it checks	Notes
Data checks (DVS)	Document details match issuer records	Private sector via gateway; express consent required
Document image checks	Document appears genuine	Provider-dependent; image handling risk
Face match and liveness	Person matches document photo and is present	Biometric = sensitive information
Digital ID	Identity asserted by an accredited provider	Private-sector participation opening from late 2026
Manual review	Staff check documents	Fallback for edge cases

Integration design

Use an identity provider or gateway with APIs and SDKs for web and mobile.
Show a clear consent screen explaining what is checked and why.
Record result, method, provider reference, timestamp and consent; avoid storing document images unless required.
Handle partial matches and failures with a fallback path and support.
Make flows accessible and test on low-end devices and poor connections.
Re-verify only when risk changes, not on every login.

Privacy and security

Identity data is a prime target for criminals. If the Privacy Act applies, collect only what you need (APP 3), tell people why (APP 5), protect it (APP 11) and destroy it when no longer needed. Sensitive information such as biometrics generally requires consent. Limit staff access, log every view and plan for breaches. See privacy by design and incident response planning.

Hypothetical example: a rental marketplace

This example is hypothetical. An equipment rental marketplace had fraud from fake renters. It added verification only for rentals above a value threshold: renters consented to a DVS driver licence check and a liveness check through an identity provider, and the platform stored the result, provider reference and timestamp, not the licence image. Failed checks went to manual review. Fraud reports and verification drop-off were tracked monthly, and the team planned to evaluate Digital ID once private-sector participation was available.

Common mistakes

Verifying everyone when only some transactions need it.
Keeping document images indefinitely.
No fallback for people whose checks fail.
Vague consent wording.
Treating verification as a one-off without fraud monitoring.

B2B customer onboarding automation for business accounts.
Secure account recovery for re-verifying users.
Consumer Data Right integration for consented financial data.
Marketplace development for trust and safety.

Conclusion

Good identity verification is proportionate, consented and minimal: verify when law or risk requires it, use established services such as the DVS through approved channels, keep outcomes rather than documents, provide fallbacks and monitor fraud. Watch for Digital ID options as private-sector participation opens. For the UK's digital verification services framework and right to work checks, see identity verification integration in the UK.

Adding identity checks to onboarding?

ZSpace Labs is an India-based, remote-first technology studio working with Australian and international businesses on secure onboarding and integrations and mobile apps. We are not legal advisers, but if it would help to plan the integration, we are happy to talk it through.

Start a Project

FAQ

Common questions.

When the law requires it, for example customer identification under anti-money laundering rules for reporting entities, or when the risk justifies it, such as high-value transactions, marketplaces with payouts, age-restricted products or account recovery. Collect identity information only when you have a clear reason.