Identity Verification Integration in the UK: Digital Verification Services, Right to Work Checks and UX
How UK businesses integrate identity verification: the DVS trust framework and OfDIA register, right to work checks, confidence levels, privacy and UX.
How should UK businesses integrate identity verification?
Decide what you need to establish (identity, age, right to work, address) and to what level of confidence; integrate a certified digital verification service through its API or SDK; store only the result, confidence level, evidence reference and date you need; provide a manual or in-person alternative; and treat biometric processing as special category data. For right to work checks, use a provider permitted for that purpose on the OfDIA register, and follow the Home Office's prescribed steps to keep a statutory excuse.
This guide is for product and engineering teams at UK employers, platforms, landlords and regulated businesses. It is general information as at October 2026, not legal advice. For Australia, see identity verification integration in Australia.
Key takeaways
- Define the attribute and confidence level before choosing a provider.
- Check the provider is certified and on the OfDIA register for your use.
- For right to work, follow the Home Office's prescribed checks exactly.
- Store outcomes and references, not more biometric data than needed.
- Always offer an alternative route.
The UK framework in brief
| Element | Status (October 2026) |
|---|---|
| Data (Use and Access) Act 2025, Part 2 | Most provisions in force since 1 December 2025: statutory register, trust framework, trust mark |
| DVS trust framework | Statutory gamma (0.4) from 1 December 2025; version 1.0 published June 2026, taking effect from 1 September 2026 subject to accreditation of certification bodies |
| OfDIA register | 46 providers offering 64 certified services as at July 2026, per OfDIA's annual report |
| Trust mark | UK CertifID, for registered services certified against version 1.0 |
| Information gateway | Powers for public authorities to share data with registered providers not yet commenced |
Worth noting
Figures and dates come from OfDIA's July 2026 annual report. The register changes; check it directly before choosing a provider.
Right to work checks
Employers establish a statutory excuse against civil penalties by completing a prescribed check correctly and keeping evidence. The routes are a manual document check, a Home Office online check using a share code (common for people with eVisas), or a digital check through a right to work digital verification service provider for valid British and Irish passports. Home Office guidance effective from 1 October 2026 directs employers to choose a provider permitted for right to work checks from the OfDIA register. Employers remain responsible for checking that the person matches the result and for retaining the output.
- Route candidates by nationality and document to the right check type.
- Record check type, date, outcome, who checked and the retained output.
- Schedule follow-up checks for time-limited permission.
- Keep evidence for the required period after employment ends, then delete.
- Do not discriminate: apply the same process to everyone.
Integration architecture
| Component | Responsibility |
|---|---|
| Policy engine | Which check and confidence level each journey needs |
| Provider adapter | SDK or redirect flow, webhooks, retries; one interface for several providers |
| Result store | Outcome, confidence, provider reference, timestamps, reviewer actions |
| Manual review queue | Referrals, mismatches and alternative-route checks |
| Retention and deletion | Schedules per check type, deletion of images when no longer needed |
| Audit | Who triggered, reviewed and accessed each check |
User experience and inclusion
Explain why you need the check, what the person will need (document, camera, time) and what happens to their data before they start. Support mobile hand-off from desktop, give clear guidance on photo capture, and show a route for people without suitable documents or devices. Test the flow with assistive technology. Government guidance on identity proofing and verification (GPG 45) explains how evidence and checks combine into levels of confidence.
Hypothetical example: a staffing agency
This example is hypothetical. A UK staffing agency onboarding hundreds of temporary workers a month routes British and Irish passport holders to a registered right to work digital verification service, sends others to provide a Home Office share code for an online check, and books in-person checks for the remainder. Results, check types and expiry dates feed its compliance dashboard, and follow-up checks are scheduled automatically.
Common mistakes
- Using an unregistered provider for right to work checks.
- Keeping face images indefinitely.
- No alternative for people who cannot verify digitally.
- Requiring higher confidence than the risk justifies.
- Not recording which check type was used.
Sources
OfDIA 2026 annual report (14 July 2026); Office for Digital Identities and Attributes; Right to work checks: employer guidance; View a job applicant's right to work details; GPG 45: identity proofing and verification.
Accessed 10 October 2026. Right to work guidance changes; use the current employer's guide. Nothing here is legal advice.
Conclusion
UK identity verification now sits on a statutory framework: certified services on the OfDIA register and, for right to work, Home Office prescribed checks. Integrate behind a policy engine and adapter, store minimal results, offer alternatives and handle biometrics carefully. For credential and expiry tracking, see workforce credential management software.
Adding identity or right to work checks to your platform?
ZSpace Labs is a remote-first technology studio that works with clients globally on onboarding flows and integrations and mobile capture experiences. We are not a digital verification service and have no UK office. If it would help to plan the integration, we are happy to talk it through.
Common questions.
A service that verifies identity or other attributes digitally, such as a document and face check. Under Part 2 of the Data (Use and Access) Act 2025, the Office for Digital Identities and Attributes keeps a register of services certified against the UK digital verification services trust framework.