- 18 Nov 2026 UK Have your directors and PSCs verified with Companies House?
- 1 Dec 2026 AU Will your onboarding accept private-sector Digital IDs?
- 10 Dec 2026 AU Does your privacy policy explain your automated KYC decisions?
- End 2026 EU Is your ID verification ready for EUDI Wallets?
- 1 Jan 2027 US Can your age checks keep up state by state?
- 1 Apr 2027 JP Is your eKYC ready for the IC-chip mandate?
- 10 Jul 2027 EU Is your CDD flow ready for the AMLR?
- 1 Jan 2028 US Are your adviser clients ready for FinCEN’s AML rule?
- 31 Mar 2029 AU Is your initial CDD on the new AUSTRAC model?
- Now AU Tranche 2 is live. Is your AML/CTF program running?
Data Use and Access Act 2025: digital verification services and data protection changes
The Data (Use and Access) Act 2025 put the UK's digital identity trust framework and register on a statutory footing from 1 December 2025, and changed UK GDPR from 5 February 2026. Both matter to firms that verify identity for AML.
- Most of Part 2 of the Data (Use and Access) Act 2025 came into force on 1 December 2025, creating a statutory register of certified digital verification services (DVS).
- Certification against the UK digital verification services trust framework is optional, but only certified services can join the register.
- HM Treasury and DSIT guidance from 26 February 2026 says firms can verify individuals for the Money Laundering Regulations using a certified and registered DVS, and that unregistered services cannot reliably be deemed suitable.
- The Act amends UK GDPR, the DPA 2018 and PECR; most changes started on 5 February 2026 and a complaints duty on 19 June 2026.
What it is
The Data (Use and Access) Act 2025 (DUAA) received Royal Assent on 19 June 2025. Its eight Parts cover smart data, digital verification services, the National Underground Asset Register, births and deaths registers, data protection and the new Information Commission.
For identity checks, Part 2 is the key change. Since 2020 the government ran a pilot trust framework and a non-statutory list of certified providers. SI 2025/1213 brought most of Part 2 into force on 1 December 2025, when the statutory DVS register replaced the old list. Sections 45 to 48, an information gateway for public authorities to share data with registered providers, are not yet in force.
For data protection, SI 2026/82 brought most changes into force on 5 February 2026, and the complaints duty on 19 June 2026. See the UK GDPR hub for how they apply to KYC data.
Who it applies to
Part 2 regulates digital identity providers that choose to be certified. It places no direct duty on accountants, lawyers or estate agents, but government AML guidance now points to the register when firms use digital identity for customer due diligence.
- DVS providers that want to appear on the register, and the conformity assessment bodies that certify them
- Firms regulated under the Money Laundering Regulations that use digital identity for identity verification
- Every UK controller, for the data protection changes
What you have to do
Duties differ for providers and for the firms that rely on them. Using digital identity is a choice under each firm's own risk-based program.
- Providers: certify and register each service
A provider gets each service certified by an approved conformity assessment body, then applies to the register. A service drops off the register when its certificate expires unless it is recertified.
Provider duty - Firms: check a provider is on the register before relying on it for MLR identity checks
The joint HM Treasury and DSIT guidance says certified and registered DVS can be treated as a reliable and independent source for verifying individuals under regulation 28 of the Money Laundering Regulations.
- Firms: keep doing the rest of customer due diligence
The same guidance says digital identity does not cover all of CDD. Firms still assess risk, apply enhanced due diligence where needed, understand the purpose of the relationship and meet record keeping under regulation 40. They stay liable when using third parties.
- All controllers: have a data protection complaints process
From 19 June 2026, controllers must help people make complaints, for example with an electronic form, acknowledge complaints within 30 days and respond without undue delay.
Process - All controllers: review privacy and lawful basis documents
The Act adds recognised legitimate interests, including detecting, investigating or preventing crime, and changes the rules on automated decision-making and subject access. Firms decide whether to change their approach.
Review
What firms get wrong
The Act's identity and data protection parts are often confused.
Certification is optional for providers, and nothing in Part 2 requires a firm to use digital identity. Firms can still verify identity in other ways their AML program allows. The register matters when a firm chooses to rely on a digital identity service for MLR checks.
The ICO says the Act amends, and does not replace, UK GDPR, the DPA 2018 and PECR.
The register lists providers certified against the trust framework. The national digital ID is a separate government proposal that has not been legislated. The consultation expects most checks of it outside government to run through registered DVS providers.
What happens when
- In force
Data (Use and Access) Act 2025 receives Royal Assent Source
- In force
Part 2 (digital verification services), except sections 45 to 48, comes into force; statutory DVS register goes live Source
- In force
Main data protection changes come into force, including recognised legitimate interests, automated decision-making and PECR enforcement Source
- In force
HM Treasury and DSIT publish guidance on using digital identities with the Money Laundering Regulations Source
- In force
Version 1.0 of the UK digital verification services trust framework published Source
- In force
Data protection complaints duty applies to complaints received from this date Source
- Not yet setProposed
Information gateway (sections 45 to 48) letting public authorities share data with registered DVS providers Source
Not yet confirmed. We will update this when the date is set.
Related guides
Questions people ask
What is the Data Use and Access Act 2025?
A UK Act that received Royal Assent on 19 June 2025. It sets up a statutory framework for digital verification services, amends UK GDPR, the Data Protection Act 2018 and PECR, creates smart data schemes and restructures the ICO as the Information Commission.
When does the Data Use and Access Act come into force?
In stages. Part 2 on digital verification services mostly started on 1 December 2025. Most data protection changes started on 5 February 2026, and the complaints duty on 19 June 2026. The DVS information gateway has no commencement date yet.
What is the UK digital identity and attributes trust framework?
The government's rules and standards for digital identity services, now called the UK digital verification services trust framework. Version 1.0 was published on 9 June 2026. Services certified against it can join the DVS register.
Can I use digital identity for AML checks in the UK?
Government guidance says firms can verify individuals under the Money Laundering Regulations using a certified and registered DVS, and keep responsibility for the rest of CDD. See Money Laundering Regulations.
Primary sources
Checked 5 Nov 2026. We review this page every 90 days and when the rules change.
- legislation.gov.uk, SI 2025/1213 (DUAA Commencement No. 4)
- GOV.UK, Join the digital verification services register
- legislation.gov.uk, Data (Use and Access) Act 2025
- legislation.gov.uk, SI 2026/82 (DUAA Commencement No. 6)
- ICO, The DUAA: what does it mean for organisations?
- GOV.UK, UK digital verification services trust framework
- HM Treasury and DSIT, Using digital identities with the Money Laundering Regulations
- OfDIA blog, DVS measures in the Data Act have come into force
- OfDIA blog, How digital identity can support compliance with the UK's Money Laundering Regulations
Where StackGo fits
IdentityCheck is not certified under the UK digital verification services trust framework and is not on the DVS register. The HM Treasury and DSIT guidance says services not on the register cannot reliably be deemed suitable for MLR identity verification, and UK firms should weigh that when choosing how to verify. IdentityCheck can support the rest of customer due diligence, which the guidance says firms keep responsibility for.
- Onboarding forms, including multi-entity forms that collect each person and entity on a structure
- Risk assessment forms with scoring and enhanced due diligence steps
- PEP, sanctions and adverse media screening, with ongoing monitoring of screened clients
- Biometric identity checks (photo ID plus live selfie with liveness), which a firm may use where its own risk-based program allows
- It is not certified under the UK digital verification services trust framework or listed on the DVS register
- It does not accept UK digital identity credentials or the proposed national digital ID
- It does not run a firm's data protection complaints process
Ready to make onboarding minutes, not hours?
Start free and run your first check today, or book a demo and we will walk you through it.