UK digital identity framework is a compliance comfort, but not a safe harbour

The UK’s new digital identity framework could make customer verification faster and more secure for financial institutions. However, Spencer West partner James Clark warns that using a certified provider does not remove a regulated firm’s underlying anti-money laundering responsibilities.

Certification does not transfer liability

The framework gives statutory backing to certified digital verification services, allowing firms to rely on verified identity claims rather than collecting and storing copies of passports and utility bills. While certification and regulatory guidance can provide strong evidence that reasonable steps were taken, James says it is misleading to regard this as a complete safe harbour.

“The legal obligation to carry out customer due diligence still sits with the regulated firm, and where a firm relies on a third party it remains liable for any failure to apply appropriate measures,” he explains.

“If a bad actor gets through a certified provider, the firm will have certainly have a good defence in light of the guidance, but it would still want to be able to show that it undertook proper due diligence on the provider, used the tool responsibly and appropriately (in line with any instructions / limitations on appropriate use given by the provider), and that appropriate oversight and monitoring was in place to pick up red flags.”

Contracts and cross-border compliance remain critical

James also highlights the importance of contractual protection. If enforcement action follows a provider failure, recovery from the vendor would be a separate contractual matter. Firms should scrutinise liability caps, indemnities, exclusions, breach notification provisions and audit rights, as certification does not create a statutory claim against the provider.

The framework is also domestic rather than internationally portable.

“The UK framework is a domestic scheme without mutual recognition in the EU or US,” James says.

“Firms therefore need to meet the CDD standards of each regime they operate in.  Corporate groups generally need to apply the strictest applicable standard or otherwise document why a UK-verified customer meets local requirements in another jurisdiction.”

Read the full article on GRIP Global Relay: The hidden compliance risks of the UK’s new Digital Identity Framework