The proposed changes to the Mandatory Licensing Conditions enable an important new use case for digital verification services (DVS). Once in force, DVS can be used to support the sale and supply of alcohol in England and Wales.
Understandably, DVS providers have been asking what this means for certification, registration and the wider UK digital verification services trust framework.
There are no new certification requirements
The new regulations do not introduce any new certification requirements for DVS providers and do not introduce any additional approval process.
Whilst there are many different ways that services could be implemented to comply with the regulations, the regulations focus on the outcome that must be achieved. The identity that has been used to create the digital proof of age used for an alcohol age check must have been verified to at least a medium level of confidence by a registered DVS provider, and the digital proof of age presented to the licence holder must be delivered by a registered DVS provider.
Different service models may be used to deliver a digital proof of age. For example, a holder service provider (HSP) could selectively disclose the proof of age from a digital identity created by an identity service provider (IDSP), or an attribute service (ASP) could derive a proof-of-age attribute from a digital identity so that only a proof of age is stored in the HSP.
The HSP, IDSP and ASP services could all be provided by the same provider or by a combination of providers.
Under the 0.4 and 1.0 trust frameworks, only IDSPs can be assessed against GPG 45, the guidance which sets out the requirements that need to be met to reach different levels of confidence. IDSPs must be certified and registered as providing identity profiles at Medium, High or Very High levels of confidence in order to be compliant.
We are not developing a supplementary code for alcohol purchases
We have also been asked whether the changes will result in a new supplementary code.
At present, there are no plans to introduce an alcohol-specific supplementary code. As with other parts of the framework, the Government will continue to keep this position under review as adoption develops in the market.
The OfDIA team is, however, commencing work to explore an age verification supplementary code that could apply across different use cases. That supplementary code doesn’t exist yet, and so is not part of the current legislation. As required by the Data (Use and Access) Act 2025, we will consult with relevant parties before introducing any new supplementary code requirements, and it would require further regulatory changes to make certification against that supplementary code mandatory.
There will be no specific changes to certificates
Similarly, the new legislation does not change the information that will, by default, be displayed on providers' certificates of conformity. However, if a service is intended for use in a specific sector or use case, providers can explore with their conformity assessment body how that can be explained on their certificate of conformity.
We’ve written a separate blog post about how DVS providers should describe their certification for specific use cases.
We will be providing examples soon
This is expected to be one of the first, widespread use cases for DVS in the retail and hospitality sectors. We are conscious that it is not the only one. We are also alert to the need for consistency across regulated use cases where checking age is required.
OfDIA intends to publish, as appropriate, “service patterns” demonstrating best practice for a variety of age verification user journeys later this year, to help DVS providers and relying parties understand what good looks like.
A new opportunity for DVS market growth
These regulatory changes create a new opportunity for registered DVS providers, rather than a new set of certification requirements. The objective is to enable trusted digital proof of age within an existing framework that is already familiar to providers, conformity assessment bodies and relying parties.
As implementation of the Mandatory Licensing Conditions progresses, OfDIA will continue to engage with providers across the ecosystem and publish further information as appropriate.
Leave a comment