IDVT checks: what they are and where they apply
Identity Document Validation Technology explained for UK firms: what an IDVT check actually tests, what a certified IDSP is, and the distinction that matters most for accountants and law firms.
By Mehmood Rajoka · Last updated 2026-08-12
TL;DR: Quick Summary
- •IDVT stands for Identity Document Validation Technology: software that checks a digital copy of a physical identity document is genuine and that the person presenting it is its rightful holder.
- •A provider offering identity verification using IDVT is called an Identity Service Provider, or IDSP.
- •IDSPs can be certified for right to work, right to rent, and DBS pre-employment checks, against the UK digital identity and attributes trust framework.
- •Certification is scheme-specific. An IDSP certified for right to work is not automatically appropriate for anti-money-laundering customer due diligence.
- •For accountants and law firms, IDVT is a way of evidencing identity within CDD. It is not a substitute for the wider MLR 2017 obligations around risk, source of funds, and ongoing monitoring.
Answer-first summary
What is IDVT?
IDVT stands for Identity Document Validation Technology. It describes technology used to verify a person's identity where a digital copy of a physical identity document is produced, the validity of that document is checked, and the person presenting it is confirmed to be its rightful holder. A provider offering identity verification using IDVT is called an Identity Service Provider, or IDSP.
- Identity Document Validation Technology
- Checks the document is genuine and the holder is right
- Providers using it are called IDSPs
- Certified for right to work, right to rent, and DBS
How an IDVT check works
Four stages. For a regulated firm the fourth matters as much as the first three:
Document capture
The individual photographs or scans an identity document, typically a passport. The image is captured through a controlled flow rather than accepted as an emailed file, because provenance of the image is part of what is being tested.
Document validation
The software checks whether the document is genuine: security features, data consistency across the machine-readable zone and the printed page, and, where the document has one, the chip.
Rightful holder check
A likeness check between the document image and a live capture of the person, usually with liveness detection to distinguish a present human from a photograph or a replay.
Result and evidence
The provider returns a result and, importantly, a record: what was checked, when, against which document, and with what outcome. For a regulated firm the record is the point, because it is what an inspector reviews.
Where IDVT is formally certified
Certification attaches to specific schemes, not to identity checking in general:
- Right to work checks, where an employer may use a certified IDSP for British and Irish citizens holding a valid passport or Irish passport card.
- Right to rent checks, on the same basis, for landlords and letting agents in England.
- DBS pre-employment checking, where a certified IDSP can carry out the identity stage of a criminal record check.
- Certification for these schemes is assessed against the UK digital identity and attributes trust framework, now published as the UK digital verification services trust framework.
IDVT and AML: the distinction that matters
This is where firms most often over-read what a check has given them:
IDVT evidences identity. CDD is broader.
Confirming a passport is genuine and belongs to the person in front of you satisfies part of Regulation 28: identifying the customer and verifying that identity from a reliable, independent source. It says nothing about the purpose of the relationship, the client's risk profile, the source of their funds, or whether they are a PEP.
Certification is scheme-specific.
A provider certified for right to work has been assessed against the requirements of that scheme. There is no general certification meaning 'suitable for all identity checks', so a firm relying on a certificate should look at what the certificate actually covers rather than at the fact one exists.
The regulations do not mandate technology.
MLR 2017 does not require electronic verification, and it does not prohibit it. Regulation 28 asks for a reliable, independent source. Electronic verification qualifies where the firm can explain why the source is reliable, which means understanding what the tool checks rather than trusting the output.
A failed or inconclusive check is evidence too.
Firms often record only successful checks. A referred or failed result, and what the firm did next, is exactly the kind of decision an HMRC or professional-body inspector will want to see reasoned and retained.
FAQ
Answer-first summary
What is IDVT?
IDVT stands for Identity Document Validation Technology. It refers to technology used to verify a person's identity where a digital copy of a physical identity document is produced, the document's validity is checked, and the person presenting it is confirmed as its rightful holder. In UK guidance the term appears mainly in the context of right to work, right to rent, and DBS pre-employment checks.
Answer-first summary
What does an IDVT check involve?
Four stages: the individual captures an image of an identity document through a controlled flow; the software validates the document's security features and data consistency; a likeness and liveness check confirms the person presenting the document is its rightful holder; and the provider returns a result along with a record of what was checked, when, and with what outcome. For a regulated firm the record is as important as the result.
Answer-first summary
What is the difference between IDVT and an IDSP?
IDVT is the technology. An IDSP, or Identity Service Provider, is an organisation that offers identity verification services using that technology. When guidance refers to a certified IDSP it means the provider has been assessed against the requirements of a specific scheme, not that the technology itself carries a certificate.
Answer-first summary
Can I use IDVT for anti-money-laundering checks?
You can use electronic verification as part of customer due diligence, and many UK firms do. MLR 2017 Regulation 28 asks for identity to be verified from a reliable, independent source; it does not mandate or prohibit any particular technology. What matters is that the firm can explain why the source is reliable, and that identity verification is not mistaken for the whole of CDD, which also covers purpose of the relationship, risk assessment, source of funds where relevant, and ongoing monitoring.
Answer-first summary
Is an IDSP certified for right to work also certified for AML?
No. Certification is scheme-specific. An IDSP certified for right to work, right to rent, or DBS has been assessed against those schemes' requirements. There is no general certificate meaning a provider is suitable for every identity purpose, so a firm should check what a given certification actually covers rather than treating the existence of one as sufficient.
Answer-first summary
Does IDVT satisfy Companies House identity verification?
Companies House identity verification is its own regime under the Economic Crime and Corporate Transparency Act 2023. An individual verifies directly through GOV.UK One Login, or an Authorised Corporate Service Provider verifies on their behalf and confirms it to Companies House. Technology used in that process sits within the ACSP route rather than replacing it.
Answer-first summary
What records should we keep from an IDVT check?
Keep what was checked, when, by which provider, against which document, the outcome, and the reasoning where a result was referred or overridden. Under MLR 2017 Regulation 40 CDD records are kept for five years. Where the check was carried out for Companies House purposes as an ACSP, the retention period is seven years, so a firm doing both needs to be clear which period applies to which record.
Read this from the role you hold in the AML process
AML content is only useful if it helps the right person make the next decision: sign off, escalate, collect evidence, train the team, or change the workflow.
Partner / director
Use this guide to understand ownership, supervision exposure, and what must be signed off at firm level.
ContinueMLRO / MLCO
Use it to check evidence, escalation, review cadence, and whether the file would stand up in an inspection.
ContinueClient-facing team
Use it to explain the requirement to clients and capture clean notes before the work becomes harder to evidence.
ContinueQuality standard for this guide
- Maps the topic to the UK AML framework rather than treating it as a generic compliance concept.
- Separates what the regulation requires from what a practical firm workflow should evidence.
- Links the topic to adjacent decisions, so readers can move from learning into implementation.
Related guides
Authorised Corporate Service Provider (ACSP)
The Companies House identity-verification regime and the transition ending 18 November 2026.
Customer Due Diligence: UK guide
MLR 2017 Reg 28 in depth, and what identity verification is only one part of.
What is KYC?
How identity, verification, and ongoing monitoring fit together.
Enhanced due diligence
When identity evidence alone is not enough and EDD is triggered.
AML record keeping
What to retain from a verification check, and for how long.