Digital verification services: OfDIA confirms no new certification requirements for alcohol sales

The Office for Digital Identities and Attributes (OfDIA) has published guidance confirming that proposed changes to the Mandatory Licensing Conditions will not introduce any new certification requirements for digital verification services (DVS) providers. Once in force, the changes will allow DVS to be used to support the sale and supply of alcohol in England and Wales, a new use case that has prompted questions from providers about certification, registration and the UK digital verification services trust framework.

No new certification requirements. The new regulations do not introduce any additional approval process. Instead, they focus on the outcome that must be achieved: the identity used to create a digital proof of age must have been verified to at least a Medium level of confidence by a registered DVS provider, and the digital proof of age itself must be delivered to the licence holder by a registered DVS provider.

Different service models. Providers can meet this outcome in a number of ways. A holder service provider (HSP) could selectively disclose a proof of age from a digital identity created by an identity service provider (IDSP), or an attribute service provider (ASP) could derive a proof of age attribute from a digital identity so that only the proof of age is stored in the HSP. The HSP, IDSP and ASP roles could be performed by the same provider or by a combination of providers. Under the 0.4 and 1.0 trust frameworks, only IDSPs can be assessed against GPG 45, the guidance setting out the requirements for different levels of confidence, and IDSPs must be certified and registered as providing identity profiles at Medium, High or Very High levels of confidence.

No alcohol specific supplementary code, for now. OfDIA confirmed there are currently no plans to introduce an alcohol specific supplementary code, though the government will keep this position under review as adoption develops in the market. Separately, OfDIA is beginning work on an age verification supplementary code that could apply across different use cases, not just alcohol. That code does not yet exist and is not part of the current legislation. Under the Data (Use and Access) Act 2025, OfDIA must consult relevant parties before introducing any new supplementary code, and further regulatory change would be needed before certification against it could be made mandatory.

Certificates of conformity stay the same. The legislation does not change the information displayed by default on a provider’s certificate of conformity. Providers intending a service for a specific sector or use case can discuss with their conformity assessment body how this can be reflected on the certificate. OfDIA has published separate guidance on how DVS providers should describe their certification for specific use cases.

What happens next. OfDIA expects alcohol sales to be one of the first widespread use cases for DVS in the retail and hospitality sectors, and says it is alert to the need for consistency across other regulated use cases that require age checks. Later this year, OfDIA intends to publish service patterns demonstrating best practice for a range of age verification user journeys, to help providers and relying parties, including licensing authorities and premises licence holders, understand what good looks like. OfDIA describes the changes as a new opportunity for DVS market growth rather than a new set of requirements, and says it will continue to engage with providers as implementation of the Mandatory Licensing Conditions progresses.

Read the full blog post, published by Paul Donati and Aurora Olsen on the Office for Digital Identities and Attributes and Department for Digital, Culture, Media and Sport’s Enabling digital identity blog, on 19 August 2026. A related post looking at how a business can be confident that a digital proof of age belongs to the person presenting it was published on 18 August 2026, and further background is available in the UK digital verification services trust framework.