Guide

What is identity verification in Australia?

Identity verification is checking, against sources you can trust, that a person exists and is who they say they are. In Australia that usually means matching an ID document to the issuer’s record, comparing a face to the ID photo, or accepting an accredited Digital ID. AML/CTF reporting entities must do it before they provide a service.

By Matt Collis·Updated 21 October 2026·Reviewed 21 October 2026·Version 7·5 min read

This guide is for businesses that must check who their clients are, including those regulated under anti-money laundering and counter-terrorism financing (AML/CTF) laws. From 1 July 2026 that includes accountants, lawyers, conveyancers and real estate agents.

What does identity verification mean?

Identity verification answers two questions: does this identity exist, and is the person in front of you the one it belongs to? A genuine licence in someone else’s hands passes the first test and fails the second.

The details you check are usually full name, date of birth and residential address. The Australian Transaction Reports and Analysis Centre (AUSTRAC) suggests verifying name and date of birth, because they rarely change over a person’s life.

Identity verification is one part of know your customer (KYC). Under AML/CTF laws, KYC also covers the customer’s risk, whether they are a politically exposed person (PEP) or sanctioned, and why they want the service. See what KYC compliance involves.

What methods are used in Australia?

Four ways to verify identity in Australia

Method	What it checks	Shows the person is present?	Consent rule
Document check (DVS)	Name, date of birth and document details on an Australian-issued ID against the issuer’s record. 14 document types; usually a yes or no	No. The DVS does not check faces	Express consent, under the participation agreement the Identity Verification Services Act 2023 requires
Face match	The person’s face against the photo on their ID: in person, by video call or with biometric technology. The government FVS covers passports and WA licences	Yes	Consent to collect biometric information (Privacy Act, APP 3); express consent for the FVS
Electronic data check	Name, address and date of birth against a credit reporting body’s records, as one overall match result	No	Express agreement first, and another way to verify must be offered (AML/CTF Act s 35A)
Digital ID	An accredited provider, such as myID, verifies the person once; they reuse it and share details with you	Depends on the provider’s identity proofing level	The person agrees each time details are shared; Digital ID Act 2024 safeguards apply to the provider

Sources: IDMatch, About our services; AUSTRAC, Initial CDD for individuals; Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (s 35A); Digital ID System, Digital ID Act 2024; Identity Verification Services Act 2023; Privacy Act 1988 (s 6, Schedule 1, APP 3) Reviewed 21 Oct 2026

No single method answers both questions. A document or data check shows the identity exists; a face match shows the person in front of you owns it.

There are four main methods. A full check usually pairs a document or data check with a face match, because each answers a different part of the question.

A document check through the Document Verification Service (DVS) confirms that the details on an Australian-issued ID match the issuer’s record. It covers 14 document types, including driver licences, passports, Medicare cards and visas. The result is usually a simple yes or no.

The DVS does not check faces. To show the person is present, you compare their face with the ID photo: in person, on a video call or with biometric technology. The government’s Face Verification Service (FVS) matches faces against passport and Western Australian licence photos.

An electronic data check matches name, address and date of birth against a credit reporting body’s records. Under section 35A of the AML/CTF Act, the person must expressly agree first and be offered another way to verify.

A Digital ID, such as myID, lets a person prove who they are once with an accredited provider, then reuse it. The Digital ID Act 2024 runs the voluntary accreditation scheme. Our guide to the identity verification service explains how the DVS and Digital ID work for organisations.

How does an online identity check work?

How an online identity check runs

For an individual, before you provide the service

Start
Consent and details

Explain the check, get consent, and collect full name, date of birth and address.
Document
Capture the ID

A photo of a licence, passport or other ID. Details can be read from it.
Issuer record
Check the document

Australian-issued ID details are matched against the issuer’s record through the DVS.
Person
Match the face

The person’s face is compared with the ID photo.
Result
Record or resolve

Record how identity was established. If details do not match, resolve it first; if you cannot, do not provide the service.

Sources: AUSTRAC, Overview of initial customer due diligence; AUSTRAC, Initial CDD for individuals; IDMatch, About our services Reviewed 21 Oct 2026

Consent comes first, then the document and face checks. If identity cannot be established, the service does not start.

An online check usually runs in five steps, from consent to a recorded result. Consent comes first, because the government services and credit reporting bodies need it before they match anyone’s details.

When details do not match, such as an old address on a licence, AUSTRAC suggests asking the customer to explain. You can then check another independent source, or confirm the document with the issuer through the DVS.

For the methods behind each step, see types of identity verification and biometric identity verification.

When does Australian law require identity verification?

AML/CTF reporting entities must verify customers before they provide a designated service. Since 1 July 2026 that includes tranche 2 businesses: accountants, lawyers, conveyancers, real estate agents and dealers in precious metals and stones.

Section 28 of the AML/CTF Act sets the test. You must establish the customer’s identity on reasonable grounds. For an individual, you must also take reasonable steps to confirm they are who they claim to be.

Key point

Under Australia’s AML/CTF Act, a reporting entity must verify customer KYC information using reliable and independent data, as appropriate to the customer’s risk.

The AML/CTF Rules 2025 set no fixed number of documents or data sources. AUSTRAC expects at least one verified piece of information for each matter, and more for higher-risk customers.

For a low-risk customer you may apply simplified customer due diligence (CDD), but you still verify enough to establish identity. If you cannot establish it, you must not provide the service. If you suspect the person is not who they claim to be, submit a suspicious matter report (SMR).

In Australia, section 175 of the AML/CTF Act allows civil penalties of up to 100,000 penalty units (A$36.4 million) per contravention for a company. For an individual the limit is 20,000 units (A$7.28 million), at A$364 per unit from 1 July 2026. See AML non-compliance penalties.

What privacy rules apply to identity checks?

Identity checks collect personal information, and face matching collects sensitive information. Three laws shape how you handle it.

Key point

Under Australia’s Privacy Act, an organisation needs consent to collect biometric information for automated verification, unless an Australian law requires or authorises it.

The Privacy Act treats biometric information used for verification, and biometric templates, as sensitive information. The Australian Privacy Principles also limit what you collect and require you to keep it secure.

The Identity Verification Services Act 2023 governs the DVS and FVS. Only parties to a participation agreement can make requests, and the agreement requires the person’s express consent.

The Digital ID Act 2024 adds safeguards for accredited providers, such as limits on collecting biometrics and a ban on disclosing information for marketing. A business that relies on a Digital ID is still bound by the Privacy Act.

Frequently asked questions

Do I need two forms of ID?

Not under the AML/CTF Rules 2025, which set no fixed count. AUSTRAC suggests one primary photo ID, such as a licence or passport. Or a primary non-photo ID, such as a birth certificate, plus a secondary document showing name and address.

Can a customer verify with a Digital ID?

Yes, if it meets your obligations. AUSTRAC says you can use a third-party digital identity service if its data is reliable and independent. Consider who maintains the data and whether the system is secure.

What if a customer has no standard ID?

AUSTRAC allows alternative identification when a person cannot obtain or access standard ID, such as a referee statement or recently expired ID. You must manage the extra risk. See AUSTRAC’s guidance on individuals without standard ID.

Is a DVS check enough on its own?

Not to show the person is present. The DVS confirms a document’s details match the issuer’s record, but it does not check faces. For an individual you also take reasonable steps to confirm they are who they claim to be, such as a face match.

Next steps

List which customers you verify, which method you use for each, and where the record is kept. Our customer due diligence checklist covers the checks around identity, and online identity verification methods compares more options.

StackGo’s IdentityCheck runs the check from the practice software your team already uses. The client photographs their ID and face, a passive liveness check confirms a real person is present, and the result is written back to the client record. See how Verify works.

Sources

The facts on this page come from these sources, checked on 21 October 2026.

The legislation, on the Federal Register of Legislation: