Despite the importance of verification and authentication in the work of a notary, notaries in England and Wales do not, as a general rule, attempt to verify identity documents beyond a physical examination by eye and have not adopted biometric identity verification. In certifying a copy of a passport a notary does not usually certify that it is valid. Some years ago some notaries did start using ultra violet lamps to examine passports, perhaps some still do, but it did not gain traction. Since then much has changed:
- identity theft related crime has mushroomed
- regulatory pressure to combat money laundering and to comply with international sanctions has increased. This is partly because of the war in Ukraine.
- there is new technology which is relatively cheap and easy to use. This is already being adopted outside the notarial profession for onboarding clients.
- there are new ways of working, particularly remote notarisation which mandate a different approach to identity verification.
This post examines these points in more detail to advance the argument that it is time notaries revisited this issue. It then the outlines some of the options for using online biometric identity verification in a notarial practice.
Table of Contents
- How Does Online Biometric Identity Verification Work?
- Remote Notarisation and Online Biometric Identity Verification
- Are There Regulatory Issues with Online Biometric Identity Verification?
- UK Government Initiatives
- An Overview of Some Available Solutions for Biometric Identity Verification
- Conclusions
How Does Online Biometric Identity Verification Work?
What has made online biometric identity verification a realistic option for notaries is the ubiquitous mobile device (tablet or phone) with its built in digital camera.
There are two aspects to checking identity:
- Does the identity exist? A synthetic identity is one which has been fabricated either wholly or in part.
- Is the person who they say they are? An identity may not be synthetic but the person claiming it may be an impostor.
Online biometric identity verification can address both these aspects using readily available technology with which most people are familiar; the mobile device in the form of the tablet or mobile phone.
The exact manner in which online biometric identification verification works depends on the provider, but the fundamentals are the same:
- The person presenting the identity document holds it up to the camera following the instructions on the screen. When it is properly positioned it is scanned and digital information about the document and the photograph is extracted.
- That information is compared with databases to verify that the document is genuine and has not been reported lost or stolen.
- The person presenting the document takes a selfie, again following the instructions on screen.
- The image captured with the photograph is then compared with the photograph on the identity document using biometric data. A visual comparison is hampered if the person has aged or changed their appearance since the photograph was taken. Using biometric data is designed to avoid these problems.
- The last step, is called “liveness testing”. It involves various tests to ensure that what the camera is looking at is not, for example, someone in a mask, a photograph or a pre-prepared video; or even a deep fake. These can range from very simple tests such as whether the person blinks from time to time or asking the person to move their head to follow a randomly moving arrow on screen, to much more sophisticated tests, some of which the companies involved are reluctant to discuss for obvious reasons.
Usually, as well as identity checking there is also an option for at least basic AML checks (whether the person is a PEP) and sanctions checks.
Remote Notarisation and Online Biometric Identity Verification
Before the Covid 19 pandemic it was almost impossible for a notary in England and Wales to notarise anything without a personal appearance. The rules were temporarily relaxed during lock-down and the latest Guidance on Remote Notarisation from the Faculty Office (published in January 2023) not only makes those changes permanent but extends them. It has this to say about verifying identity where there is no personal appearance:
If the notary does not already hold sufficient identity evidence, the remotely located individual should transmit electronically documents necessary to satisfy the notary as to the individual’s identity by means secure from fraud and misuse and capable of providing an appropriate level of assurance that the person claiming a particular identity is in fact the person with that identity and should be asked to present such documents to the notary during the real time interaction
But what in practice are means secure from fraud and misuse, and what would provide an appropriate level of assurance?
Not having the appearer physically present exacerbates the difficulty of both establishing that the identity exists and establishing that the person claiming it is entitled to it. For example:
- The latest UK passport, the blue version introduced in 2020, contains a number of easily visible security features besides the more sophisticated biometric ones; including laser engraving, animatic embossing and a decoding lens. None of these work properly, if at all, if the notary is looking at an image of the document on screen.
- What is the value of a scanned copy sent by email when .pdf files are readily editable and everyone with a camera (including a mobile phone) has access to some sort of image editing software?
- A notary meeting someone in person is far more likely to notice if they are using make up or prosthetics to alter their appearance.
- Tests suggest that people find it very difficult to distinguish on the screen between real people and deep fakes.
Of course notaries must follow the guidance from their regulator, but in this case perhaps it should be seen as setting a minimum standard rather than defining best practice. Obtaining scanned copies of identity documents from the remotely located individual does not preclude the notary from using online biometric identification
Remote notarisation is inherently more risky than seeing people in person. Online biometric identity verification provides a relatively cheap, simple and quick way of significantly mitigating those risks, why not use it?
The use of e-signatures and e-apostilles does not mandate remote notarisation, but it is required to obtain the full benefit of those technological developments. It follows that, if digital identity verification is required to make remote notarisation work, it is also required to enable notaries to make e-signatures and e-apostilles work.
The issue of remote notarisation and anti-money laundering is considered further below in relation to the Legal Services Affinity Group AML Guidance.
Are There Regulatory Issues with Online Biometric Identity Verification?
Lawtech UK/Regulatory Response Unit Joint Statement
The Regulatory Response Unit was set up to facilitate innovation in the legal sector by bringing together relevant regulators into a single body to respond to the concerns of those developing the technology about regulatory barriers. Together with Lawtech UK, a government backed initiative, the RRU published a Joint Statement in Support of Digital Identity Technology in the Legal Sector in response to a perception that legal professionals were reluctant to use digital technology to verify the identity of their clients. This reluctance arose not just from ignorance of the available technology but also from misconceptions about regulation. The statement was unequivocal:
Legal services regulation does not prohibit the use of digital ID verification tools in any of the jurisdictions of the UK. Digital ID verification technology is established now, and the Government is working to encourage and unify ID verification across sectors, for the benefit of the public and professionals
Page 3
No regulator in the UK jurisdictions prevents the use or reliance on digital means of identity verification in legal services. Responsible selection, adoption and implementation of these tools can contribute to improved compliance practices across the legal sector, as well as improved client service
Page 9
The Regulatory Response Unit (RRU) encourages all legal practitioners to review their client onboarding and AML practices in light of the available technologies and use the resources and support available to evaluate and responsibly deploy them.
Page 10
Legal Services Affinity Group AML Guidance and Online Biometric Identity Verification
All notaries in England and Wales must be familiar with the current Legal Sector Affinity Group Anti-Money Laundering Guidance for the Legal Sector and no notary in England and Wales should adopt online biometric identity verification without being particularly familiar with section 6, Customer Due Diligence, and section 7, Technology. However, for the purposes of this post, it is possible to derive three general principles can be derived from the guidance
- Electronic identification and verification (EID&V) can be a reliable source of information for the purposes of verifying identity.
The use of EID&V is increasingly being viewed as being as robust as traditional verification methods (physical documentary evidence such as passports, driving licences etc.) Electronic verification methods are becoming more secure and sophisticated and may in fact be lower risk than traditional means in some circumstances. They can be used both at client on-boarding stage and as a tool for ongoing monitoring and the reapplication of CDD.
7.3
- However, the ultimate responsibility remains on the notary to ensure that the documents and information relied on are sufficient.
It is not acceptable to simply run a search on a prospective or current client and file it as having completed the identification and verification process, without consideration of the wider risks … . Practice units must bear in mind that identification and verification is one element of overall customer due diligence requirements necessary under the regulations
7.3
- Electronic verification is particularly relevant to remote notarisation
When you do not meet the client, you should consider the reason for this and whether this represents an additional risk which should be taken into account in your risk assessment of the client and the extent of the due diligence measures you apply. EID&V may be a particularly useful tool in these circumstances.
6.14.6
UK Government Initiatives
Technological change is not the only pressure on notaries to adopt digital identification verification. The UK Government has recently become increasingly interested in its benefits for two reasons:
- the cost of money laundering to the UK economy has been estimated at 100 billion pounds each year. Identity theft also costs billions of pounds and often affects the most vulnerable in society. The invasion of Ukraine has led to an increase in cybercrime and the imposition of sanctions has meant an additional need for accurate identification.
- On the other hand, compliance imposes a significant burden on British businesses, particularly where identity has to be verified several times in relation to the same transaction. Standardisation could reduce that burden by creating reusable identities. For example, in a typical conveyancing transaction a purchaser may need to prove their identity to a mortgage provider, estate agent and solicitor (and perhaps more). If the first identification was done to a certified and audited standard then all three could rely on it.
This post is not the place for a detailed examination, but three UK Government initiatives are worth mention as indicative of the direction of travel.
Cabinet Office GPG 45
How to Prove and Verify Someone’s Identity & Identity Profiles is a Good Practice Guide published by the Cabinet Office Government Digital Service and for brevity is known as GPG 45. The current version is 5.2.
In outline, it provides guidance on checking identity in a manner which is consistent with other organisations or services which also use it and which therefore permits comparison, audit and certification.
Identity checking is divided into five parts:
- getting evidence of the claimed identity
- checking the evidence is genuine or valid
- checking the claimed identity has existed over time
- checking if the claimed identity is at high risk of identity fraud
- checking that the identity belongs to the person claiming it
Each element is given a score and the scores are then used to establish an identity profile which in turn corresponds to one of four levels of confidence:
- low confidence
- medium confidence
- high confidence
- very high confidence
Which level of confidence should be met depends on the risk assessment.
UK Digital Identity & Attributes Trust Framework
The UK Digital Identity and Attributes Trust Framework (UK DIATF) is an initiative of the UK Government to facilitate individuals having reusable certified digital identities by setting rules, standards and governance oversight for companies involved in “the digital identity ecosystem”. Companies can currently be certified for the Right to Rent and Right to work schemes, or the Disclosure and Barring Service, or both.
It is a work in progress and the current version is the UK Digital Identity and Attributes Trust Framework beta version 0.3 (updated 20th July 2023). As the scheme develops it is likely that certification will increasingly become a requirement.
HM Land Registry Practice Guide 81
Practice Guide 81: Encouraging the Use of Digital Technology in Identity Verification explains the HM Land Registry Digital Identity Standard
Although not many notaries public in England and Wales do conveyancing through their notarial practices, Practice Guide 81 is important because it is expressly founded on the principles of GPG 45 and so the HM Land Registry Digital Identity Standard illustrates the way the government envisages digital identification being used in practice in the future .
An Overview of Some Available Solutions for Biometric Identity Verification
This is not a review of the five best digital identification and verification apps of 2023. If you want that you can google it. Neither is it a ranking. Each of the solutions below has a different emphasis and each may therefore be more appropriate depending on the circumstances. Finally, it is not an exclusive list. There are plenty of other good products and it is intended as a starting point for further research.
Thirdfort
Thirdfort is well known in the UK legal sector as a provider of KYC and AML solutions and is used by many firms of solicitors including some of the largest and best known in the country. It has partnered with the Law Society and dual qualified notaries may be entitled to an introductory offer through their membership of the Law Society. However, Thirdfort may not be ideal for small firms of notaries.
Docusign
Docusign is a large US tech company founded in 2003, with its headquarters in San Francisco and a market capitalisation of around 8.4 billion dollars. It claims to have more than a billion users of its products and is, of course, best known for its electronic signature platform. However, it also provides identity verification. Notaries already using Docusign as an electronic signature platform may find it convenient to have the same supplier for identity verification too. It may also make it easier to get the full benefits of integrating electronic signature and biometric identification but it is not essential as Docusign provide a wide range of API supported integrations as well as its native solutions.
Notaries using a different electronic signature platform or not wanting to integrate their electronic identity verification with electronic signatures, at least for the present, may find that there are better options for them.
APLYiD
AplyiD is towards the opposite end of the size spectrum to Docusign but it claims to be “the world’s fastest growing AML platform” and “.. the market leader in digital onboarding solutions across all of Australasia and the UK”.
IDnow
IDnow is based in the European Union, which may be important to some notaries, and is one of the leading providers of biometric identity verification in Europe.
Yoti
The name Yoti may be familiar to notaries with teenage children or grandchildren who are able to verify their ages and identities through an app on their mobile phones to obtain access to age restricted goods and services. But Yoti also provides online biometric identity verification As well as its online biometric identity verification product, it has partnered with the Post Office to provide an identity checking service and Yoti and the Post Office were the UK’s first Identity Service Provider (IDSP) certified under the UK Government’s Digital Identity and Attributes Trust Framework.
Conclusions
- The availability of relatively cheap and user-friendly technology makes biometric identity verification a realistic option for all notaries.
- This technology is already being adopted by solicitors and others operating in the UK legal sector (and in financial services too).
- There are no regulatory obstacles to notaries in England and Wales adopting this technology, provided they follow the rules and guidance provided by the regulators. Reluctance to adopt this technology on regulatory grounds is due to misunderstanding.
- The adoption of such technology is essential to the success of remote notarisation and therefore to realising the full potential of e-signatures and the e-apostille.
- Government policy initiatives place additional pressure on notaries to adopt the technology or be left behind.
