Is your digital ID provider certified?

Following announcements that digital ID checks are to be introduced from April, the Digital Identity Systems Certification (DISC) service has confirmed that “expressions of interest” in becoming certified under the Digital Identity Trust Framework and Right to Work/Right to Rent and CRB criteria are now being taken.

The service says it is having conversations with multiple ID service providers about the criteria and timetable for expressions of interest and that, by the end of next week, it will be able to accept formal applications for certification. For the service to be up and running by 6^th April, formal applications will need to be lodged by Friday 11^th February. After this date the certification process will commence, and is anticipated to take a total of 15 – 18 audit days (rather than the 25 – 35 previously indicated by DCMS).

Identity service providers (IDSP)s will be a certified provider and will be legally able to describe themselves as such, but they will not be authorised as a Right to Work/Rent/CRB IDSP provider until they appear on a list to be published by the Home Office on gov.uk. DISC says it is required to notify DCMS and the Home Office when a certification is issued and they will then carry out their own checks before listing them on gov.uk. It is thought that checks will cover national security, sanctions and political exposure.

Commenting on timeframes for the launch of the service, DISC said:

“The real challenge that this presents (quite understandably from your client’s point of view) is that the list of available, certified and authorised IDSPs for the Right to Work/Right to Rent/CRB process is not likely to emerge (at the very earliest) until the last week of March. That makes vendor selection, approval and implementation prior to 5^th April somewhat of a challenge.”

To manage this, the service says that it has suggested that the list of IDSPs that have registered an application with a certification body ought to be made available in some way. Although there is a risk that IDSPs don’t make it through certification or get approved, the suggested proposal is a “sensible way” of giving clients some information on which organisations should be approached, said DISC.