Setting the standards for identity

The impact of the public health guidelines and subsequent rise of remote working during the last year highlighted the need for a more secure, efficient and convenient means of identifying the parties to a property transaction.

After a series of events with conveyancers and identity service providers last year, we shared a set of draft identity check requirements. We then invited feedback from identity service providers and members of our Industry Forum. On top of this, we received 40 responses from a range of interested parties in response to our blog. Thank you to everyone who responded.

After reviewing all this feedback, we have now published our standard.

Before exploring the feedback, we want to stress that the published requirements are not mandatory. Other existing means of verifying identity will always be available. However, those who have met the requirements will be protected, as HM Land Registry would not seek recourse against a conveyancer in the event their client was not who they claimed to be.

Nor do we expect an immediate take-up of digital identity verification tools. The technology market needs time to develop solutions and conveyancers need time to see what is available and incorporate these methods into their processes. We hope the standard, which incorporates digital solutions in place of manual processes, will act as a catalyst for technology providers and conveyancers to collaborate on developing and adopting convenient, modestly priced and more secure methods of digital identity verification.

Feedback

Many of the respondents welcomed the introduction of a more robust standard for identity checks in the conveyancing process and commended the clarity provided by the requirements.

The proposals have been endorsed by the legal regulators, who have engaged with us since the early stages of our policy development. Similarly, conversations with market-leading lawyer insurers have been very supportive.

Corporate transactions

We received feedback from a number of conveyancers who deal with corporate transactions, who quickly saw the value and purpose of the requirements and called for a version which could be utilised by their corporate clients. As a result, we have expanded our requirements to include checks tailored to corporate transactions involving UK registered companies.

Addressing additional concerns

Cryptographic biometric requirements

Cryptographic and biometric checks are multi-layered with detailed technical specifications, so it was unsurprising that the feedback we received from the identity check providers focused on the detail of the technical specifications we had selected for our requirements. We have made some additions to the requirements following this technical feedback that we hope increase clarity and assurance without altering their practicality.

The requirements were praised for establishing a robust process with a high level of confidence.

Apart from some suggestions to aid clarity, the main issue raised by some suppliers was that the requirements precluded them from checking identity without reading the chip within the identity document or using alternative methods of achieving the same level of assurance. For example, they could still achieve the same level of assurance as set out in Cabinet Office Good Practice Guide 45 (GPG45) through a process which uses pictures of multiple forms of evidence (such as a driver’s licence) to compare with a self-portrait photograph taken at the time of verification, supported by additional validation checks.

There was widespread endorsement of using GPG45 as the foundation of the requirements, recognising the benefits of this Cabinet Office guidance which is already familiar to the market and used by the identity providers to match their offerings to different assurance levels.

Our requirements do go a step further than those that rely on matching a photo printed on the document with the self-taken photograph. We require that the self-taken photograph, or a live video, is also biometrically matched to the photograph extracted from the encrypted chip. It is especially difficult to tamper with the photograph held on the encrypted chip, so insisting on this level of check gives us a higher level of assurance of the validity of the document.

We acknowledge that this requirement prevents conveyancers’ clients who do not own smartphones or UK passports from verifying themselves in this way. However, given the nature, significance and value of most property transactions, we believe the suitable level of assurance can best be achieved in an accessible and usable solution by checks which are enabled by chip technology. It is also important to remember the standard is optional. Other methods for verifying identity will remain valid.

Anti-money laundering/Know your customer

Some respondents felt that the requirements are an appropriate blend of existing anti-money laundering/know your customer (KYC) standards and the identity assurance level that is achieved by alignment of the requirements to GPG45, which itself is acknowledged as meeting KYC requirements.

However, others felt that the requirements are more restrictive than the standards currently required by anti-money laundering legislation and enforced by the legal regulators and the standards commonly adopted in regulated financial services and banking.

However, we have set the requirements at an assurance level we consider necessary to deliver our primary role: to protect the integrity of the register. The ‘no recourse’ promise needs to be underpinned by requirements which are sufficiently robust.

On 20 January the Legal Services Affinity Group updated its anti-money laundering guidance to provide further guidance on the use of electronic identification and verification tools, including the role of the tools, the data sources available and general guidance on when to use these tools – acknowledging that the market is diverse and growing.

Linking the client with the particular property

We received feedback that the requirement to obtain evidence that establishes a connection between the client and the property could not be met using current digital solutions.

We acknowledge that currently this requirement introduces an element of paper-based  evidence into the process. However, we see this as temporary, until such time as digital checks against secure, comprehensive and current data sources become more widely available.  We believe this will evolve, particularly as more data becomes available for validation through other channels, such as Open Banking.

A number of respondents asked if this requirement was simply an ‘address check’. This is not the case; we are seeking some form of evidence in the property owner’s possession that links them to the particular property. This is a wider check than an address check as it requires sight of a document which you would only have if you are the true owner of the property.

Certified providers

There have been calls for HM Land Registry to provide a list of certified identity check providers to give certainty as to who in the marketplace meets the requirements.

We recognise this issue and we are currently exploring the most appropriate way of achieving this in a fair and practical manner. We would encourage technology providers to consider how they can show that they are able to meet the requirements.

Cross-government digital identity agenda

The Department for Digital, Culture, Media & Sport (DCMS) is currently developing an overarching ‘trust framework’ for digital identity use across the economy. The ‘alpha’ draft of this document was published on 11 February. DCMS is also supportive of the Home Buying and Selling Digital Identity Working Group’s initiative to create a certified digital identity scheme for homebuying and selling to sit under the trust framework.

We will continue to work closely with DCMS over the coming months to ensure our work is aligned.

Next steps

We will continue to engage with identity check providers as they develop their processes to incorporate the new requirements.  Many have assured us they are already in a position to do this.

We will also develop our requirements by widening the scope to incorporate different legal entities (for example, overseas companies and local authorities) and to explore the availability of more enhanced digital means of obtaining evidence to link the property owner to the property.

This will remain an optional standard. However we do hope most conveyancers will look to meet the requirements set out in the standard and benefit from the protection it offers.

Thank you to everyone who was involved in the workshops, the consultation and the Industry Forum. We will continue to collaborate as our thinking and the technological solutions develop further.