Dealing with the UK’s identity crisis

It is not an unfair statement to say that, at this moment, the United Kingdom is a nation in a state of flux. 2022 will go down in history as the year when the world saw three prime ministers and two monarchs while instability seeped into many areas of public life.

Digital identity is one area where the country is looking to get on track. The UK does not currently require a compulsory form of identification for citizens, but there have been several aborted attempts to introduce and maintain them in the past. The Digital Identity and Attributes Trust Framework is the latest as it looks to take the country into a future where its population expects nothing less than digital identity verification solutions – done the UK’s way, of course.

Establishing trust

The rules and standards within the framework are aimed at establishing trust in digital identity products. Organisations which participate in the initiative must show that they can manage personal data safely – which, in the age of the smartphone, is unquestionably vital. The data breaches over the last six months in Australia’s telecom and tech sectors which may have exposed personal data of almost half of their population, for example, does nothing to reduce concern.

There will be a considerable number of use cases for the framework, but matters are currently being lined up with a specific focus on Right To Work, Right To Rent, and Disclosure and Barring Service (DBS) checks. With an estimated £149bn at stake to boost the economy through the removal of friction points while verifying identities via digital means during transactions, it is not hard to see the appeal.

The ultimate question, though, is whether the UK will embrace the framework.

Embracing the framework

There is no strict requirement for UK businesses to digitally verify identities unless the case involves high-risk assurance. In most other low-risk cases, simple documentation like a National Insurance number is required that is then cross-referenced. This leaves the door to fraud wide open.

Identity checks are a key part of due diligence in the onboarding process of customers as businesses seek to understand the risks that these new customers may pose. This requirement took on a new level of importance since the pandemic, with Office for National Statistics (ONS) data showing that there were 5.1m offences reported from January 2021 to September 2021, a 36 per cent increase from the same period in 2019. The same figures also highlighted that online fraud was ten times more likely in the UK than in other European countries.

With current verification processes being cumbersome and slow, the UK’s population certainly seeks simpler solutions. However, they also don’t want to rely too heavily on their passports as a ‘catch-all’ form of identity proofing. If the process to identify oneself is deemed too slow, there is a risk of the customer abandoning the onboarding process. This would be an universally unacceptable result,  so a customer-centric and business-focused solutions must be an industry tenet.

What could be coming

The government is proposing a five-step identity check:

• The gathering of evidence of the claimed identity
• Checking that such evidence is genuine and valid
• Checking that the identity has existed over time and is not simply newly-created (fabricated)
• Checking whether the identification carries with it a high risk of identity fraud being carried out on it
• Checking that the identification is that of the claimant, using biometric-based cross-referencing with digital solutions including liveness detection

Barriers to implementation

Although the benefits to business have been made clear, there is still hesitancy about implementing solutions. Cost is the principal barrier, as well as the lack of clarity of a return on investment – or to use the British term “value for money”; confusion remains over appropriate solutions and concerns over training levels for staff to make the best use of the technology.

It all adds up to an incoherent, confused approach in which there can be a mixture of documentary, in-person review, and data verification. It is the absence of a UK-specific form of identity which also muddies the waters. It begs the question; is it realistic to use biometric authorisation in a country where this data is not harnessed at an early age?

Benefits of digitalisation

Catching up and the introduction of digital verification would give millions of people instant access to government services as ‘verification for all’ becomes the standard. With an eye on net zero, there are also the environmental benefits of a paper-free system.

Generating trust in digitalisation processes could, according to McKinsey, boost the UK’s GDP by up to 30 per cent by 2030. That’s an eye-widening statistic in itself, without even thinking of the immense societal inclusion it would create.

Digital wallets

Electronic IDentification, Authentication and Trust Services (eIDAS 2.0) is the proposed European Union legislation which will allow a person to store their digital identity in a smartphone wallet and use and reuse them as and when they are needed. The UK government is watching the development of this framework closely because, although it could be used by citizens of EU member states in this country, there is currently no reciprocal agreement that would allow the use of the British framework on the continent. This is why aspects of technology policy and standards need to be prepared for this new EU law, so that UK policymakers are in a position to create a complimentary, yet distinct, system.

What needs to happen?

While there is a general need for the public and private sectors to work together on digital identity proofing, more than anything there must be an appetite amongst the wider population to use it.

As previously noted, prior attempts to integrate identity products in the UK have met with resistance. The Digital ID and Attributes Trust Framework needs to be different – and it also needs strict regulatory guidelines, on which the Financial Conduct Authority (FCA), in particular, is keeping a close eye.

The tide is gradually turning, as the benefits and convenience become more and more tangible to people far and wide in the UK. They can see how identity proofing technology can step up to the plate when they are starting a new job, opening a new bank account, renewing their car insurance or booking a flight online.

The government’s soft touch recommendation rather than hard force for landlords in Right to Work, Right to Rent, and DBS check cases that are required to be done by accredited identity service providers will undoubtedly help. If there are other, multi-use cases for a whole host of organisations and services, so much the better.

Trust and liability will be vital for the framework if it is to be accepted into the British economy. And obtaining its certification will be a huge step in the right direction for any identity proofing provider.

Rayissa Armata is senior head of regulatory affairs at IDnow.