The DVS register: what it is, who must use it, and what it means for a dealer’s identity check
A compliance lawyer’s first question to a dealer choosing an identity check is now often “are they on the register?” This page says which register that is, who it was built for, what the Money Laundering Regulations ask of an identity check instead, what HMRC’s current guidance says, and, plainly, where ArtGuard stands.
In short
- The DVS register is kept by the Office for Digital Identities and Attributes (OfDIA) under section 32 of the Data (Use and Access) Act 2025, in force since 1 December 2025. It is not an HMRC register and not an anti-money-laundering instrument.
- It lists digital verification services certified by an accredited conformity assessment body against the UK digital verification services trust framework, with supplementary codes for right to work, right to rent and DBS checks.
- Employers must use a registered right to work provider when the identity part of a right to work check is done digitally or facial recognition is used (Home Office guide, 1 October 2026 edition, pages 21 and 30).
- For customer due diligence the law asks for verification from a reliable, independent source (regulation 28(18)). Guidance from HM Treasury and DSIT (26 February 2026), approved by the Treasury for the purposes of the Regulations and repeated in HMRC’s 2026 manual, says a certified and registered service meets that test and that a digital verification service not on the register cannot reliably be deemed suitable.
- ArtGuard is not on the register. On that guidance its check is not something a dealer should rely on as their regulation 28 verification; it is a dated record of the document, the photograph match and the screening that sits alongside your own verification or a registered provider’s check. Section 4 sets this out.
1. What the register is
The register is a creature of the Data (Use and Access) Act 2025, not of the Money Laundering Regulations. The duty sits with the Secretary of State.
The Secretary of State must establish and maintain a register of persons providing digital verification services.
The government’s own description of it is short.
The statutory digital verification services (DVS) register is a public list of government-registered organisations who provide digital identity services certified against the UK digital identity and attributes trust framework.
Getting on to it means holding a certificate first. The Act makes that the condition of registration.
the person holds a certificate from an accredited conformity assessment body certifying that digital verification services provided by the person are provided in accordance with the DVS trust framework,
OfDIA’s guidance to providers explains who does what: “The Secretary of State has a duty to establish and maintain the register under section 32 of the Data (Use and Access) Act 2025 (the Act). The Office for Digital Identities and Attributes (OfDIA) does this on their behalf.” The certificate comes from a conformity assessment body, and only an accredited one counts.
Only certificates issued by CABs accredited against the trust framework by UKAS are valid for the purposes of joining the digital verification services (DVS) register established under Section 32 of the Data (Use and Access) Act.
On top of the framework there are supplementary codes for three uses.
UK digital identity and attributes supplementary codes are also in place for the following use cases:
- right to work checks
- right to rent checks
- Disclosure and Barring Service digital identity checks
There is no supplementary code for anti-money-laundering customer due diligence. The register is a list of certified identity services; it does not say anything about sanctions screening, source of funds or the rest of a dealer’s due diligence. The Act also protects the trust mark: it “may not be used by a person in the course of providing, or offering to provide, digital verification services unless the person is registered in the DVS register in respect of those digital verification services” (section 50(3)).
2. Who must use a registered provider
The clearest duty is on employers. The Home Office employer’s guide, in its 1 October 2026 edition, requires a registered right to work digital verification service provider (RtW DVSP) for the digital identity part of a right to work check.
Whilst it is not mandatory to conduct right to work checks digitally in this way, if an employer chooses to do so, it is mandatory that the DVSP is registered on the Office for Digital Identities Attributes (OfDIA) register
Where facial recognition technology is used to complete this element of the check digitally, this must be carried out by a registered RtW DVSP.
The guide also rules on resellers: if an employer buys the service “through another organisation which is not itself certified (for example, a referencing or screening agency), that organisation must clearly state that it is working with a certified and registered RtW DVSP and identify the service carrying out the check” (page 31). A gallery that employs staff is an employer, so this duty applies to the gallery’s own hiring. It is a different question from how the gallery checks a buyer.
Which providers would an employer use? The register itself is the only answer. Its download, taken on 3 November 2026 with entries published up to 26 October 2026, lists 66 services; 43 carry the Right to Work code. Among them are Amiqus, Credas Connect, GBG’s Identify and GBG Go, ID-Pal, Mitek’s MiVIP, OneID, Onfido’s Entrust IDV, TrustID, Veriff, Yoti IDV and Post Office EasyID. Entries carry a certificate expiry date, so an employer checks the register on the day, not a provider’s brochure.
| Who | Must they use a registered service? | Source |
|---|---|---|
| An employer doing a digital right to work check, or using facial recognition for it | Yes, a registered RtW DVSP | Home Office guide, 1 Oct 2026 edition, pages 21 and 30 |
| A landlord doing a digital right to rent check | The register marks services certified for that use under the right to rent code; the duty itself is in the Home Office’s right to rent guidance, not quoted here | OfDIA, supplementary codes |
| A body using digital identity for a DBS check | As above, under the DBS code | OfDIA, supplementary codes |
| A dealer verifying a buyer for the Money Laundering Regulations | The regulation does not name the register; the guidance approved by the Treasury and HMRC’s manual say a service outside it cannot reliably be deemed suitable (section 3) | MLR 2017 reg 28(18), (19); HM Treasury and DSIT guidance, 26 Feb 2026; HMRC AMLG11400 14.5; AMLG3100 |
3. What the Regulations, and the guidance approved by the Treasury, ask of an identity check
Your duty as a dealer is customer due diligence under regulation 28. The first two steps are to identify the customer and to verify that identity.
verify the customer's identity unless the customer's identity has already been verified by the relevant person; and
What “verify” means is set by the regulation itself, and it says nothing about a register.
except in paragraph (10), “verify” means verify on the basis of documents or information in either case obtained from a reliable source which is independent of the person whose identity is being verified;
Two more sentences matter. First, a passport counts as independent even when the customer hands it to you: “documents issued or made available by an official body are to be regarded as being independent of a person even if they are provided or made available to the relevant person by or on behalf of that person” (regulation 28(18)(b)). Second, electronic verification is allowed on conditions: that it is an electronic identification process (28(19)(a)), and this.
that process is secure from fraud and misuse and capable of providing assurance that the person claiming a particular identity is in fact the person with that identity, to a degree that is necessary for effectively managing and mitigating any risks of money laundering and terrorist financing.
Since 26 February 2026 there has been guidance on exactly this question, published jointly by HM Treasury and the Department for Science, Innovation and Technology and approved by the Treasury for the purposes of the Regulations.
It is approved guidance for the purposes of compliance with the MLRs.
Digital identity services which are certified against the trust framework and on the DVS register are a reliable and independent source of information, with an appropriate level of anti-impersonation assurance, and can be used by regulated entities as part of their customer due diligence processes. Specifically, for individuals, entities are able to fulfil their obligations under Regulation 28 of the MLRs by verifying a customer’s identity using certified and registered digital identity services.
Digital verification services which are not certified and therefore not on the DVS register cannot reliably be deemed suitable for identity verification in compliance with the MLRs.
The guidance also says what a registered service does not do for you: regulated entities “should not assume that digital identities fulfil all aspects of customer due diligence”, they “will also remain ultimately liable for any failures to apply customer due diligence measures appropriately when using digital identity services”, and the records must meet regulation 40. OfDIA’s August 2026 note adds that for attributes such as sanctions and PEP results “There is no obligation to source attributes from certified and registered DVS but it is strongly recommended.”
Why guidance approved by the Treasury matters: the regulation that creates the offence of breaching a relevant requirement tells the court what to weigh.
In deciding whether a person has committed an offence under paragraph (1), the court must decide whether that person followed—
The words that follow are “any relevant guidance which was at the time” issued by the FCA or “issued by any other supervisory authority or appropriate body and approved by the Treasury”. HMRC is your supervisor, and its new manual takes the same line. For an individual it starts with what you collect.
As a minimum, you should obtain all of the following details for a private individual:
- Full name.
- Date of birth; and,
- Residential address.
Then it gives two ways to verify them: identity evidence such as a valid passport or photocard driving licence, checked for spelling, expiry, that the photograph is the customer and that the document is genuine (14.2), or electronic verification (14.5), where it points at the register.
Any digital verification service provider which is not on the DVS register cannot reliably be deemed suitable for identity verification in compliance with the Regulations.
HMRC’s risk assessment for the art market, published in July 2026 and updated on 15 October 2026, says the same about remote sales, and adds what it expects when you have no registered digital service.
If you cannot meet the customer in person and inspect the original documents in their presence, and do not have relevant digital ID and screeningservice (see below), HMRC recommends that you conduct a video call to ensure the person you are dealing with is genuine and is the person in the identity documents.
So there are two texts to hold at once, and they differ in strictness. The regulation sets a test: a reliable, independent source, secure from fraud, giving enough assurance for the risk. The guidance approved by the Treasury and HMRC’s manual say a certified and registered service passes that test and a digital verification service outside the register cannot reliably be assumed to. A court must weigh whether you followed the guidance, and HMRC inspects you against its manual, so a dealer should plan on both being read as written.
4. Where ArtGuard stands, plainly
ArtGuard is not on the DVS register. It holds no certificate against the trust framework, it does not use the trust mark, and this page will say so until that changes. On the guidance quoted above, that means an ArtGuard check is not something a dealer should rely on as their regulation 28 verification of a buyer’s identity. What it is: a dated record of the buyer’s document, read on the buyer’s own phone, of the live selfie matched to the photograph, of the address document, and of the sanctions and PEP screening with the list versions, which sits alongside your own verification of the buyer or a registered provider’s check. We would rather say that than let you think a check is stronger than the guidance allows.
In HMRC’s terms, ArtGuard is a third-party identity provider. HMRC’s risk assessment is direct about what that means.
It is important to note that you, as the AMP, are responsible ensuring you comply with all of your obligations under the regulations. Any service, product or report the third-party provides must be examined by you, and you need to decide what, if any, further action you need to take to ensure you meet your obligations under the regulations.
What that looks like for a gallery using ArtGuard on a remote sale at or above the threshold:
| Step | What ArtGuard gives you | What you do | Source |
|---|---|---|---|
| Identify | Full name, date of birth and nationality read from the document; the address read from an address document | Check them against what you know of the buyer | AMLG11400 14.1 |
| Verify the identity | Images of the document, the machine-readable zone read and check-digit tested, a live selfie matched to the photograph; on iPhone, a chip read whose result is reported by the phone and shown for your review, not treated as a verified chip | Your own verification: the original seen in person, a video call as HMRC recommends for remote sales, or a check by a provider on the register; record which | MLR reg 28(18), (19); HM Treasury and DSIT guidance, section 4; AMLG11400 14.2, 14.5; AMLG3100 online sales |
| Screen | Sanctions and PEP results with the list versions and dates | Review anything flagged; apply your policy. Attributes need not come from a registered service, though OfDIA strongly recommends it | AMLG3100 sanctions section; OfDIA, 20 August 2026 |
| Assess | The facts your risk assessment needs: residence, nationality, issuing country | Decide the risk and whether enhanced due diligence applies; record why | MLR regs 18, 33(6) |
| Record | A dated evidence file with a hash | Keep it with your own note of the verification and the decision, for the period regulation 40 requires | HM Treasury and DSIT guidance, section 4 |
If your lawyer or your firm-wide risk assessment says the identity element must come from a certified and registered service, the register is the list to choose from, and ArtGuard is not on it today. That is the honest answer to the question, and the one we would rather you heard from us.
Questions people ask
Is the DVS register an HMRC register?
No. The Data (Use and Access) Act 2025 gives the duty to keep it to the Secretary of State (section 32), and the Office for Digital Identities and Attributes, part of the Department for Science, Innovation and Technology, runs it. HMRC keeps a different register: the register of businesses it supervises under the Money Laundering Regulations, which is where your gallery appears.
Is ArtGuard on the DVS register?
No. ArtGuard holds no certificate against the UK digital verification services trust framework and is not registered, and it does not use the trust mark. On the guidance approved by the Treasury that means an ArtGuard check is not something a dealer should rely on as their regulation 28 verification of the buyer’s identity. It is a dated record of the document, the photograph match and the screening that sits alongside your own verification or a registered provider’s check. The register at access-dvs-register.service.gov.uk is the only authority on who is registered; check it rather than any provider’s website.
Do the Money Laundering Regulations require a registered digital service for customer due diligence?
The regulation itself does not name the register. Regulation 28(18) asks you to verify identity “on the basis of documents or information in either case obtained from a reliable source which is independent of the person whose identity is being verified”. The guidance HM Treasury and DSIT published on 26 February 2026, approved by the Treasury for the purposes of the Regulations, and HMRC’s manual for the businesses it supervises (July and October 2026), say a certified and registered digital service meets that test and that a digital verification service not on the register “cannot reliably be deemed suitable for identity verification in compliance with the MLRs”. The law is wider than the guidance; the guidance is what a court and your supervisor will measure you against. Section 3 explains, and section 4 says what that means for a check run through ArtGuard.
Which providers would an employer use for a right to work check?
Only one on the register whose entry carries the Right to Work supplementary code. The register’s download, taken on 3 November 2026 with entries published up to 26 October 2026, listed 66 services, 43 of them with that code, including Yoti, TrustID, Credas, GBG, Onfido, Mitek, Veriff and OneID. The register changes month to month, so check it on the day.
Does the register say anything about sanctions or PEP screening?
Not as a condition. Certification is against the trust framework, which is about proving identity and attributes. OfDIA says there is no obligation to take sanctions or PEP results from a registered service, though it strongly recommends it. Source of funds and the rest of customer due diligence sit outside the register altogether; a screening service is not made an identity service by being on it.
Sources
- Data (Use and Access) Act 2025, Part 2 (digital verification services)Text as in force; section 32 commenced 1 December 2025 · legislation.gov.uk
- Office for Digital Identities and Attributes, Find registered digital verification servicesUpdated 1 December 2025 · GOV.UK
- Office for Digital Identities and Attributes, Join the digital verification services registerUpdated 1 December 2025 · GOV.UK
- Office for Digital Identities and Attributes, Certification scheme for the UK digital verification services trust frameworkUpdated 21 September 2026 · GOV.UK
- The digital verification services register (CSV download)Register last updated 26 October 2026; downloaded 3 November 2026 · DVS register
- Home Office, Employer’s guide to right to work checks1 October 2026 edition · GOV.UK
- The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, regulation 28Revised text as at 30 June 2026 · legislation.gov.uk
- The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, regulation 86Text as in force · legislation.gov.uk
- HM Treasury and DSIT, Using digital identities with the Money Laundering Regulations (guidance approved by the Treasury)Published 26 February 2026 · GOV.UK
- HMRC, Anti-money laundering guidance for supervised businesses, AMLG11400: Identifying and verifying your customersUpdated 10 July 2026 · GOV.UK
- HMRC, Anti-money laundering guidance for supervised businesses, AMLG3100: Risk Assessment of Art Market ParticipantsUpdated 15 October 2026 · GOV.UK
- OfDIA blog, How digital verification services can help businesses meet their obligations under the Money Laundering Regulations20 August 2026 · GOV.UK blogs
ArtGuard supports your judgement; it never replaces it. This page describes what the Money Laundering Regulations 2017, HM Treasury’s notices and HMRC’s own published guidance say, with the source for each point, so you can read it yourself. It is not legal advice, and nothing here is advice about what HMRC will accept. ArtGuard is not affiliated with or endorsed by HMRC, HM Treasury, the Office for Digital Identities and Attributes or any AML supervisor. Check the current version of each document before you rely on it.
One link. One dated record for the file.
Send your buyer a link. They verify their identity on their phone. You receive the identity result, the sanctions and PEP screening with the list versions it ran against, and a dated evidence file. £39 + VAT a month for 15 checks, £2.50 + VAT for each one after, no minimum term, first month free.
Run one check with usNot a regulator, not a lawyer.
ArtGuard supports your judgement; it never replaces it. Your firm-wide risk assessment, your policies and the decision on each sale remain yours, and HMRC remains your supervisor.
Read the plain notes