In November of last year, the HM Land Registry announced that they were pursuing a ‘safe harbour’ standard for digital ID within conveyancing. The HM Land Registry’s ‘Digital ID Standard’ will be a set of requirements that, if met by a provider, means their ID check will equal an ‘alternative higher standard of identity check’. When law firms carry out these checks to verify clients, they will reach a level of due diligence that gives them the key benefit of resource removal by HM Land Registry if fraud does occur during the transaction. In other words, a Digital ID Standard check will have ‘fulfilled [a firm’s] obligation to take reasonable steps in relation to the requirement to verify their client’s identity’.
So what will the Digital ID standard include, and what should law firms be asking of their current and prospective ID providers?
Obtaining evidence from the client
The basis of an ID check is to obtain enough evidence from a client to verify that they are who they say they are. This evidence can be a biometric passport, identity card or UK biometric residence permit. The Digital ID Standard takes this one step further in that within this evidence, a provider must also be verifying cryptographic security features. These features must include an electronic photo of the identity against which facial biometric checks can be carried out.
How can facial recognition technology be utilised by your clients? They will be able to take a selfie, which will use biometrics to compare your clients facial features in the selfie to that of the picture in their ID document.
Therefore, it will be key to ensure that your current or prospective provider uses facial biometric technology within their solution. This means that you can be sure that the person carrying out the ID check is the person in the ID document.
Thirdfort uses facial recognition technology in the ID checks that we carry out. We don’t stop there, though. We also ask clients to perform ‘liveness’ tests, to further eliminate the risk of spoofing (we’ll revisit this shortly).
Check that this evidence is a valid document
Conveyancers must be sure that the evidence they have obtained from the client is current and is not a fraudulent document. To do this, providers must be able check documentary and cryptographic security features within the evidence provided.
This means that an ID provider must be able to read a chip within the evidence using Near Field Communication (NFC) by providing any required cryptographic keys, to meet the Digital ID Standard.
How will this work?
Simply put, your client will hold their mobile device up to their ID document, which will contain an NFC chip. The technology will do the rest of the work!
NFC chip reading is a secure way of cryptographically verifying that a document is real. The process can match an electronic signature, as well as extract biometric information.
The key question to ask ID providers is what type of NFC chip reading they use. As with most things, there are different levels to these kinds of products and some will not meet the Digital ID Standard. The Land Registry will only accept government-grade NFC chip reading that can capture digital signatures to ensure the highest level of certainty.
A few current providers use NFC chip reading, but not the type that can capture signatures, so look out for this when scouting out a potential ID supplier.
Make sure the evidence matches the client
We mentioned liveness testing in our previous paragraph - this is an important element of the new Digital ID Standard. Naturally, conveyancers must be sure that the person providing them with the ID matches the photo on the document. Digital ID providers must be able to match the biometric data from the NFC chip reading to a ‘liveness test’.
How will this work?
A ‘liveness test’ is either a photo or a video that is captured in real time during the ID check. This verifies that the person carrying out the ID check is a real-life person. Your clients will simply have to take a selfie on their phones to do this. Easy!
Clearly, the three elements of the Digital ID Standard rest upon your client's ability to complete the check. Central questions to be asking are; how easy the provider’s solution is to use; what their completion rates look like; and whether or not they have adequate support in place.
Conveyancers should be asking their providers how they will ensure their clients are taking these ‘liveness tests’ in controlled conditions. The ID provider also must have a false match rate of below 0.01%, whilst also using a biometric algorithm that’s proven to be effective against a recognised benchmark.
Not many current providers use a liveness test when capturing digital ID, so this should be a question at the top of your list when speaking to your current or prospective providers.
The Digital ID Standard: a summary
In summary, the Land Registry’s new Digital ID Standard is set to revolutionise digital ID in property. Many solicitors have bemoaned the lack of transparency and guidance around digital ID. However recent outlines in the draft LSAG guidelines and the HMLR’s statement of intent put forward by the Digital ID Standard shows digital ID at the forefront of conveyancing for the future.
The opportunity for firms to use providers that meet the requirements for the Digital ID Standard will be something that many will bear in mind, considering the level of security involved and the promise of no perusal from the Land Registry.
Firms need to ask questions of their current or prospective ID providers that are in line with this latest announcement. Does your product use facial recognition technology? Do you use NFC chip reading in your solution, and does it capture digital signatures? Does your liveness test meet the false match rate requirements?
These are specific questions that relate to the Digital ID Standard itself, but it is also important to remember that the client is still central to this. Other important questions must focus on ease-of-use, support and pass/completion rates.
The Digital ID Standard will give conveyancers peace of mind when it comes to using digital ID, but it is important that firms settle on providers that satisfy their expectations.