GPG45
GPG 45 is a guide for any organisation that needs to verify the identity of customers, employees, or other third parties. Issued by UK Government Digital Services, it outlines how to prove and verify identity against a range of confidence levels. The higher the confidence level, the more robust the checks will be.
How to check an identity under GPG 45
An identity is a unique combination of attributes that belong to an individual. You will need to check the claimed identity of an individual such as, their name, address, and date of birth. By confirming these attributes, you can identify if an individual is who they say they are. The process is made up of 5 parts:
- get evidence of the claimed identity
- check the evidence is genuine or valid
- check the claimed identity has existed over time
- check if the claimed identity is at high risk of identity fraud
- check that the identity belongs to the person who’s claiming it
Carrying out different parts of the identity checking process builds the necessary confidence that an identity is legitimate.
Levels of confidence in an identity
Each part of the identity checking process is scored from 1 to 4. These scores make up an identity profile which achieves one of the 4 levels of confidence. Each identity profile symbolises the level of confidence provided, the number of evidences required, and the profile assigned which identifies the scores required under each part of the identity checking process. For example, for the profile L1A, L means low level of confidence, 1 means that one piece of evidence is required, and A is the profile which sets out the required scores.
To meet the criteria of an identity profile, scores must be the same as, or higher than, the required scores for each part of the process.
There are 4 different levels of confidence:
- low confidence
- medium confidence
- high confidence
- very high confidence
Each confidence level tells you how well your organisation or service is protected against identity risks, as well as helping other organisations and services to understand your identity checking process.
🟠 Low level of confidence
Having low confidence in an individuals' identity will lower the risk of you accepting either, synthetic identities, or impersonators who are not the owner of the claimed identity.
🟡 Medium level of confidence
In addition, a medium level of confidence will also lower the risk of you accepting impersonators who have information about the claimed identity that’s not available in the public domain, for example information from business HR records.
🟢 High level of confidence
In addition, a high level of confidence will also lower the risk of you accepting impersonators who know the claimed identity (this includes their close friends or family), and/or do not match the claimed identity’s photo or biometric information.
🔵 Very high level of confidence
In addition, a very high level of confidence will also lower the risk of you accepting impersonators who change their appearance to look like the claimed identity, for example by wearing a mask or make up.