Guidance

How to create a vouch as evidence of someone’s identity (1. 0) pre-release

Published 3 March 2026

0. Version and certification validity notes

0.a. This 1.0 publication of ‘How to create a vouch as evidence of someone’s identity’ (‘the vouching guidance’) is valid from [date of final publication] to coincide with the date the 1.0 publication of the UK digital verification services trust framework (‘trust framework’) comes into force.

0.b. Services demonstrating compliance with the vouching guidance as part of certification against the 1.0 trust framework must comply with this version of the vouching guidance. You should refer to the version and certification validity notes in the trust framework to understand which version(s) of the trust framework you can undergo certification against.

0.c. This is the first version-controlled publication of the vouching guidance. The most recent non-numbered version of the vouching guidance (titled ‘How to accept a vouch as evidence of someone’s identity’) can be found on GOV.UK and is, from the date of this publication, is to be considered as the 0.4 version of the vouching guidance.

1. What is a vouch?

1.a. Someone vouches for a person by declaring they know that person as the claimed identity (i.e. who the person claims to be).

1.b. A vouch is a process that can be used to:

• provide evidence of an identity;
• help you check whether the identity has existed over time; and
• check a claimed identity belongs to the person claiming it.

1.c. When you check someone’s identity, you must get evidence about the claimed identity, check that evidence, and check the claimed identity belongs to the person claiming it.

1.d. A vouch is valuable as evidence of identity for people who do not have forms of identity evidence such as a passport or driving licence, or who are excluded from public or private sector digital records.

1.e. To provide evidence that a person (‘the vouchee’) is who they claim to be you can ask someone else (‘the voucher’) to confirm their identity.

1.f. The voucher will confirm details about the vouchee to help you confirm whether the vouchee is the claimed identity.

1.g. In this context, a vouch is not a guarantee of the vouchee’s character or financial status. Rather, it is a declaration that the voucher knows the vouchee and is willing to confirm their identity.

1.h. The outputs of a successful vouching process can be captured in different ways and stored in a physical or a digital format. To create a vouch as evidence which is scored for strength, validity or activity history according to the government guidance on how to check an identity – also known as Good Practice Guide (GPG) 45 – you must store it as a vouch outcome as described in section 5 of this guidance. 

1.i. How you store information about a vouch will affect how it can be used to check someone’s identity.

1.j. For instance, storing the outcome of a vouch digitally might make it easier to validate the vouch, share it with another organisation and enable someone to reuse the vouch.

Example     

Sarah wants to use an online service to order her prescription medication remotely and an identity check is required to open an account with the service. Sarah does not have access to any of the evidence required to open an account with this service.

However, Sarah has a friend, Casey, who is an accountant. Sarah asks Casey to vouch for her identity to open an account. The service is able to use this as evidence when checking her identity according to GPG 45, and can give Sarah access to the service.

1.1 What isn’t a vouch?

1 .1.a. Some processes are similar to a vouch. They are useful in some contexts but cannot be used as evidence of someone’s identity in the same way that a vouch can.

1.1.b. For example, a parent or guardian applying for something on behalf of a child is not a vouch. In this case, the identity of the child may be checked separately (e.g. using official documents) but is not checked using the parent’s assertion. 

1.1.c. Confirming an attribute can also sometimes be referred to as ‘vouching’. It’s not the same thing as vouching for someone’s identity and is out of the scope of this guidance.

Example

Leon has forgotten his pass to the gym, and he needs to prove that he has an active membership to be let in. The receptionist at the gym recognises Leon from a month ago, when he renewed his annual membership, so lets him in.

The receptionist has confirmed an attribute about Leon – that he has an active membership – but has not vouched for his identity.

1.2.  The scope of this guidance

1.2.a. This guidance helps you understand how you can use a vouch as part of the identity checking process to create a digital identity. Whilst it has been produced for this purpose, others may consider that its contents are instructive in a wider identity checking context.

1.2.b. This guidance is maintained by the Office for Digital Identities and Attributes (OfDIA), which sits within the Department for Science, Innovation and Technology (DSIT) and is produced as an exercise of DSIT’s functions. If other government departments want to apply the guidance to their functions, they should ensure it does not cut across any applicable legislation or statutory guidance that may be relevant.

2. How a vouch can help you check someone’s identity

2.a. A vouch or a vouch outcome can be used as a piece of evidence to check a person’s identity in line with parts of GPG 45.

2.b. It is a piece of identity evidence that can be given an associated strength and validation score, can provide evidence of an identity’s existence over time, and can support verification of a person’s identity.

2.c. A vouch cannot be used to check if an identity is at high risk of identity fraud.

2.1. A vouch as evidence of someone’s identity: the strength check

2.1.a. A vouch can be used as a source of evidence for a claimed identity. This is known as the ‘strength check’ in GPG 45. This can only be done if you create and store the vouch in accordance with this guidance, or if you accept a vouch outcome in accordance with this guidance.

2.1.b. The vouch outcome may be stored in a physical format, such as a document, or a digital format. How the vouch is stored may determine what score it is able to achieve when it is validated.

2.1.c. If a vouch is being used as evidence of someone’s identity, the strength of the vouch outcome must be assessed according to the strength section of GPG 45.

2.1.d. The maximum strength score of the vouch will depend on how well you checked the voucher’s identity. If you have checked the voucher’s identity to a medium level of confidence, it will score at most 1 for strength. If you have checked the voucher’s identity to a high or very high level of confidence, it will score at most 2 for strength. The strength score for a vouch outcome cannot be higher than score 2.

2.1.e. If you have not checked the identity of the voucher, or have only checked it to a low level of confidence according to GPG 45, you cannot use the vouch for any part of the identity checking process.

2.2. Checking a vouch is genuine or valid: the validity check

2.2.a. When a vouch is used as evidence for the purposes of the GPG 45 strength check, you must check it is genuine or valid. This is known as the ‘validity check’ in GPG 45.

2.2.b. If you are accepting the vouch outcome as evidence under GPG 45, but not creating it, your validity check can be scored according to GPG 45 but must not be higher than 2.

2.2.c. If you are both creating a vouch outcome and validating it to create a digital identity, you must still score your validity check according to GPG 45. As the issuer of the outcome, you can treat yourself as an authoritative source to score no higher than 2.

2.2.d. The validity score must not be higher than 2.

2.3. A vouch as evidence an identity has existed over time: the activity history check  

2.3.a. You can use a vouch to check the claimed identity has existed over time. This is known as an ‘activity history check’ in GPG 45.

2.3.b. The activity history score for a vouch must be determined using the activity history scoring matrix provided in GPG 45. A vouch can only be used for an activity history check if you have created and stored the vouch as described in this guidance, or if you accept a vouch outcome in accordance with this guidance.

2.3.c. You can use a vouch for an activity history check when you are using the same vouch for the purposes of the strength and validity check.

2.3.d. You can also use a vouch for an activity history check and use other evidence to meet the strength, validity, and verification checks. In this case, the vouch is only evidence that the claimed identity has existed over time, and so will not be given a strength score and must not be used for the verification check.   

2.4. Checking the vouchee is who they claim to be: the verification check

2.4.a. You can use a vouch to check an identity belongs to the person who’s claiming it. This is known as a ‘verification check’ in GPG 45.

2.4.b. If you are checking someone’s identity using multiple pieces of evidence including a vouch, and another piece of evidence has a higher strength score than the vouch, your verification check must be against the higher strength evidence.

2.4.c. If you are creating a vouch according to this guidance and validating it to create a digital identity, you can rely on the process you used to create the vouch to provide the verification check. The verification score of the vouch, in this case, must be 1.

2.4.d. If you are accepting the vouch, but not creating it, you must score your verification process as usual according to GPG 45 but it must be, at most, 1. To do this, you must match the person to the details in the vouch outcome, for example, by matching them to the biometric information (such as a photograph) in the outcome, or by using knowledge-based verification to match them to the vouch outcome.

2.5. A vouch cannot be used for the identity fraud check in GPG 45

2.5.a. You cannot use a vouch to check if the claimed identity is at high risk of identity fraud. This is known as an ‘identity fraud check’ in GPG 45.

2.5.b. This means that you must separately perform this check if it is necessary for the identity profile you want to achieve. If you discover a vouch is for a synthetic or stolen identity, you cannot accept it. 

3. Creating a vouch

3.a. You can collect evidence of a vouchee’s identity from a voucher using one or more of these methods:

• in person;
• over a video link;
• over the phone;
• a written or printed document, like a letter, email or form; or
• a secure digital system.

3.b. You must assess the security of the process that is being used to collect the vouching evidence and assess whether it is appropriate for the risks associated with what you would like to use the vouch for, or, where applicable, for the risks of those you will share the vouch with.

3.c. For example, written vouches, such as letters, will usually be less reliable than secure digital vouches.

Example

Fairouz is opening a bank account, and she asks her social worker to vouch for her. Her social worker will need to complete a digital or paper form, in which they confirm Fairouz’s details. The social worker may also take a call from the bank on a landline phone, confirming they are a genuine social worker and that Fairouz’s details are correct.

3.d. The process being used to collect the vouching evidence must be secure enough to ensure you meet other requirements in this guidance, for example, regarding the level of confidence to which you check the voucher’s identity.

3.e. The process you choose to create the vouch will depend on user needs as well as security needs. This guidance sets no rules on designing your service to meet user needs beyond the trust framework.

3.f. You must make sure the voucher knows what can happen if they vouch for someone that they know is using a synthetic or stolen identity. For example, if the voucher gives a false vouch on purpose, it is possible that this could result in a criminal conviction.   

3.g. To provide confidence that they are who they say they are, the voucher must prove their identity to at least a medium level confidence according to GPG 45. If you check the voucher’s identity to a medium level of confidence, the vouching evidence can only score a maximum of 1 for the strength score. If you check the voucher’s identity to high or very high level of confidence, the strength score can be a maximum of 2.

3.h. You must ensure that the method that you have used to collect all the evidence has not been compromised, and that the information has not been intercepted or tampered with.

3.i. You must confirm that the vouchee understands that the vouch is taking place.

3.j. You must collect a photograph of the vouchee during the vouching process, as this must be stored in the vouch outcome as described in section 5. You must know that this photo has been captured at the time of the vouch and not, for example, uploaded by the user.

3.k. The voucher must declare that the vouchee is known to them as the claimed identity. For an in-person vouch, or over a video or phone link, both the voucher and the vouchee must be present.

3.1. Additional requirements for face-to-face and video call vouches

3.1.a. If you are conducting the vouch face to face or over a video call, you must be able to clearly see the vouchee’s face. This will lower the risk of accepting a vouch for someone who’s wearing a mask, makeup or prosthetics to pretend to look like the claimed identity. They must not:      

• wear a head covering (unless it’s for religious or medical reasons);
• have their eyes closed; or
• have anything covering their face or eyes (such as shadows or their hair).

3.1.b. If someone is wearing a face covering to help them avoid catching or spreading a respiratory infection like COVID-19, they must remove the mask in order to be identified. If they cannot remove the mask, you could choose to collect evidence of the vouch using another method (e.g. over a video link or using a secure digital system).

3.1.c. Over a video channel, the video of the vouchee must:

• be clear and in focus;
• be in colour; and
• show them in clear contrast to the background.

4. Who can vouch for someone’s identity

4.a. You must only create vouches when all the following conditions apply to the voucher:

• they already know the claimed identity;
• they are not in a position that makes them ineligible to vouch (see ‘Ineligibility to vouch’ below;
• they are in a position of authority in their community (see ‘Appendix: Positions of authority’); and
• they’ve proven their own identity to at least a medium level of confidence according to GPG 45.

4.b. The voucher may know the vouchee professionally or personally.

4.c. A vouch can only be performed by an individual, not an organisation. This is because the voucher must be able to recognise the vouchee, and some people working at an organisation may not be able to do so.

4.d. However, a voucher’s role in an organisation may mean they are in a position of authority which means they meet the conditions set out in 4.a., for example if they are a GP at a medical practice or a solicitor at a law firm.

4.e. A voucher can vouch for a vouchee if they know the vouchee only because of their role in an organisation, e.g. a GP can vouch for someone they know as a patient at their medical practice.

Example

A 16-year-old secondary school pupil wants to prove her identity to get a reusable digital identity with a trust framework-certified digital verification service. While she can’t ask her school to vouch for her identity, she can ask one of her teachers to do so, because their role as a teacher at the school means that they know her and that they are in a position of authority.

4.e. The level of confidence you have in the voucher’s identity affects the scoring of the vouch in GPG 45, as outlined above. You cannot accept a vouch if you do not have at least medium confidence in the voucher’s identity.

4.1. How long the voucher must have known the vouchee

4.1.a. A vouch will be more reliable if the voucher has known the vouchee over a period of time. This is because it becomes harder for someone to maintain a fraudulent identity over time without it being detected.

4.1.b. There is not a defined period over which the voucher must know the vouchee before they can vouch for them. However, they must know the claimed identity well enough to be comfortable vouching and this must satisfy the needs of the organisation accepting the vouch.

Example

A secondary school teacher (the voucher) can vouch that a pupil who’s applying for a proof of age card (the vouchee) is who they claim to be. They are likely to have consistently seen this same pupil in school over a period of a few years.

The teacher can be confident that the pupil is the claimed identity and that they have not been falsely claiming to be the claimed identity during their time at the school.

4.1.c. When you decide to accept vouches, you can set requirements for the relationship between the claimed identity and the voucher. This could include how long they’ve known each other for.

Example

To vouch for someone’s photo when they’re applying for a British passport, the person who’s vouching must have known them for at least 2 years.

4.2. Ineligibility to vouch 

4.2.a Some people cannot vouch for an individual’s identity. You must not accept a vouch from anyone who:

• is related to the claimed identity by birth, marriage or another family relationship (such as adoption);
• is in a relationship with the claimed identity;
• lives at the same address as the claimed identity; or
• you know has given a false vouch in the past 5 years.

5. Storing the outcome of a vouch

5.a. You must store a record of the vouch securely, according to industry best practice. To use this record as evidence which is scored for strength, validity or activity history according to GPG 45, you must make a record called a ‘vouch outcome’ which records certain details.

5.b. The vouch outcome must contain at least the following details:

• the vouchee’s given name(s) and family name(s);
• the voucher’s given name(s) and family name(s);
• which position of authority the voucher holds;
• a photograph of the vouchee captured during the vouching process (as described at 3.j;
• the vouchee’s date of birth;
• the vouchee’s address, where the vouchee has an address   ;
• the name of the organisation and, where relevant, the service generating the vouch outcome (for trust framework-certified services, this will be the service provider name and service name, and must be as they appear on the certificate of the service conducting the vouch);
• a unique reference number for the vouch outcome, which could be generated by the system that creates the vouch outcome;
• the date the vouch was conducted;
• how long the voucher has known the vouchee; and
• the level of confidence to which you have verified the voucher’s identity.

5.c.  As set out in GPG 45, the score for an activity history check depends, in part, on how confident you can be that identity was checked during the interactions for which you have evidence. It may be possible to get a higher activity history score with a vouch when the voucher knows the vouchee through their professional work, and the vouchee’s identity has been checked over time by the organisation for which the voucher works. To enable a higher score to be achieved for the activity history check in this way, you could record the capacity in which the voucher knows the vouchee in the vouch outcome.

5.d. The vouch outcome must include a signed and dated declaration by the voucher that, to the best of their knowledge, the details in the vouch outcome are accurate and represent the identity of the vouchee.

5.e. While a vouch outcome contains the address and date of birth of the vouchee, they are only stored as a way to match the record to the right person in future. The vouch outcome is not in itself evidence of these attributes and must not be provided as such unless these attributes are separately checked, for example by following the guidance on how to create, store and share attributes.

5.f. The vouch outcome must be retained in accordance with your retention policy, informed by data protection and any other relevant regulation.

5.g. If you plan to share the vouch outcome, you must secure it so that those you share it with can confirm whether the vouch outcome is genuine or valid to at least a GPG 45 validity score of 1. For example, if the vouch outcome is stored digitally, you could cryptographically secure it.    

6. Sharing a vouch outcome

6.a. If you have stored a vouch outcome, it is possible to share the vouch outcome, parts of it, or a simple confirmation of the vouchee’s identity with another organisation. This must be done in line with the relevant regulations and legal requirements, including data protection legislation.

6.b. If you are sharing the vouch outcome, you do not have to share all the data that you hold on the voucher or vouchee. In particular, you must ensure you do not share any more personal data than is necessary as required under the data protection legislation and consider the implications for the vouchee of sharing the identity or position of the voucher.

6.c. As described in section 7, a vouch outcome can only be accepted by those following this guidance for a maximum of 6 months after it has been created. You could specify an expiration date on the vouch outcome that you share.

6.d. You must not share a vouch outcome if you know that its creation did not meet the requirements of this guidance or if you learn that the voucher or vouchee provided details falsely.

7. Accepting a vouch outcome conducted by another organisation or service

7.a. If you do not do the vouching process yourself, you can also accept a vouch from another organisation or service in order to create a digital identity in accordance with GPG 45.

7.b. To create a digital identity using a vouch, the vouch must be stored as a vouch outcome, and you must know that the vouch outcome you accept has been created in line with this guidance, for example by accepting a vouch created by a certified service demonstrating compliance with this guidance as part of its trust framework certification.

7.c. You must know that the vouch outcome is genuine, for example, by checking it has been cryptographically signed.

7.d. You must only accept a vouch outcome for up to 6 months after it has been created.   

8. Appendix: Positions of authority

8.a. The voucher must be in a listed position of authority in their community.

8.b. People in positions of authority are less likely to vouch for synthetic or stolen identities. They could risk damaging their reputation or losing their position if they do.

8.c. You can accept a vouch from someone in a position of authority even if their relationship with the claimed identity is not professional.

Example

A solicitor can vouch for the identity of their neighbour. The solicitor knows this person is who they say they are because they’ve lived next door to them over a period of a few years, even though they’re not one of the solicitor’s clients.

8.d. You must be sure that the voucher is in one of the listed positions of authority or has retired from one.

8.e. You must not accept a vouch from anyone who is not included in the list.

8.f. The positions of authority who can vouch for people are:

• accountant
• administrator (permanent) at a GP or dentist’s surgery
• administrator (permanent) at a school, college or university
• airline pilot
• bank, building society or credit union official
• registered care home manager
• registered chiropodist (also known as ‘podiatrist’)
• civil servant
• commissioner for oaths
• councillor, for example a local or county councillor
• dentist
• registered dietitian
• director of a limited company
• doctor or surgeon
• engineer or technician (professionally registered with the Engineering Council)
• financial services intermediary, for example a stockbroker or insurance broker
• fire service official
• funeral director
• High Court enforcement officer
• insurance or assurance agent (chartered)
• Jobcentre Plus work coach
• Justice of the Peace
• lawyer, barrister or solicitor (including trainee solicitors and anyone on a Legal Practice Course or Bar Practice Course)
• legal secretary (fellow or associate member of the Institute of Legal Secretaries and PAs)
• licensee of a public house
• local government officer
• manager or personnel officer of a limited company
• member, associate or fellow of a professional body
• Member of Parliament
• Merchant Navy officer
• minister of a recognised religion
• notary
• registered nurse
• officer of the armed services
• registered optician
• paralegal (certified paralegal, qualified paralegal or associate member of the Institute of Paralegals)
• registered pharmacist
• registered physiotherapist
• police officer
• Post Office official
• president or secretary of a recognised organisation
• probation officer
• social worker
• surveyor
• teacher or lecturer
• trustee of a registered charity
• valuer or auctioneer (fellow or associate members of the incorporated society)
• Warrant Officers and Chief Petty Officers