Digital verification services and Money Laundering Regulations duties

The Office for Digital Identities and Attributes (OfDIA) has published a blog post explaining how certified and registered digital verification services (DVS) can help businesses meet their customer due diligence duties under the Money Laundering Regulations (MLRs). The underlying guidance was published in early 2026 by DCMS, formerly DSIT, working with HM Treasury.

Identity checks must meet a GPG 45 level of confidence. Certified and registered DVS must provide identity checks that meet a level of confidence, low, medium, high or very high, as set out in Good Practice Guide 45 (GPG 45), a requirement of the UK DVS trust framework. Regulated businesses must carry out a risk assessment for each customer and select the level of assurance that matches the risk identified, so it is for the business to decide what level of confidence is appropriate case by case.

Identity checks and attribute checks are treated differently. A DVS check may also return additional information, such as address details or whether an individual is a Politically Exposed Person (PEP) or a sanctions target. OfDIA refers to this additional information as attributes. Only the identity verification outcome needs to meet GPG 45 requirements, attributes are not part of the identity check itself and are not covered by the MLR guidance. A DVS that shares attributes must also be certified as an attribute service provider (ASP), assessed separately against the attributes guidance, and must clearly communicate to businesses which attributes form part of its certified service. Failure to do so may result in loss of certification and registration.

Only certified and registered DVS count under the guidance. For customers who are individuals, businesses can meet their identity verification duty under Regulation 28 of the Money Laundering Regulations by using a certified and registered DVS. There is no obligation to source attributes, such as sanctions screening, from a certified DVS, though OfDIA strongly recommends doing so, and says being listed on the DVS register is the clearest signal that a provider is reliable and independently assured.

Relevant to casinos as well as other MLR-regulated businesses. The guidance applies to any business regulated under the MLRs. Casinos are listed as a relevant person under the Regulations, meaning casino operators, who already hold a Gambling Commission operating licence and must meet its anti-money laundering conditions, now have a clear route to using a certified DVS for the identity verification element of their customer due diligence duties.

What happens next. OfDIA says it will continue working with HM Treasury, sector guidance bodies and industry to keep the guidance clear and practical, and will use the Enabling digital identity blog to share further updates and respond to common questions.

The full blog post, and the underlying MLR guidance published by DCMS and HM Treasury, are available from GOV.UK.