1.1. This instrument commences on 15 October 2026 the date of the Standards being published in the government gazette. This is the seventh version of these Standards. The Service Victoria Identity Verification Standards Version six, issued on 14 May, published in the Government Gazette S 278 on Wednesday 29 May 2024, are revoked.

2.1. The Standards are a legislative instrument made under section 41(1) of the Act.

2.2. Consistent with section 41 of the Act, these Standards deal with issues including, but not limited to:

1. digital and non-digital processes for verifying identity;
2. determination of the level of assurance (LOA) of an identity verification function required for a transaction;
3. identity information required for each LOA;
4. the process for any exceptions to be applied if an individual’s identity cannot be readily verified;
5. the process for the application for an electronic identity credential (EIC);
6. the process for issuing and refusing to issue EICs;
7. the process for the renewal, suspension and cancellation of EICs; and
8. any terms and conditions that apply to the issue, use, reuse, or increase in LOA of an EIC and renewal of an EIC.

2.3. These Standards must be read together with the Act and any other regulations or standards made under the Act. These Standards are not intended to limit or restrict the operation of the Act.

2.4. The Minister may update these Standards at any time.

3.1. These Standards establish a consistent and secure identity verification framework for transactions where individuals are seeking to verify their identity through Service Victoria. The guiding principles for making and using these Standards are set out in section 42 of the Act as follows:

1. User choice – individuals are able to choose whether to store a record of an electronic identity credential for future use;
2. Minimal data is to be requested and stored – individuals must not be asked to provide more information than necessary in order for Service Victoria to verify the individual's identity and personal information can only be stored with the individual's consent, unless required by law;
3. Risk-based approach to identity verification – a consistent and evidence-based approach is employed to determine the LOA of identity required for transactions;
4. Security, transparency and accountability – Service Victoria, and any external service providers engaged to provide identity verification services, are to be regularly audited by an independent entity to ensure compliance with privacy and data security requirements;
5. Flexibility – the Standards must, to the extent practicable, be able to adapt to new technologies or methods of identity verification;
6. National consistency – the Standards must, to the extent practicable, align to national requirements, as set out in any relevant national framework or guidelines as in force from time to time.

4.1. These Standards use the following terms:

1. MUST indicates something that is required in order to meet these Standards;
2. SHOULD indicates something that is recommended but not required in order to meet these Standards (that is, these recommendations should be implemented unless it is unreasonable to do so, or an alternative process which provides an equivalent LOA is used);
3. MAY indicates something is permitted but is not required under these Standards;
4. SHOULD NOT indicates something that is not recommended under these Standards, unless circumstances make other approaches unfeasible;
5. MUST NOT indicates something that is not permitted under these Standards.

4.2. Except where otherwise specified, these Standards adopt the definitions contained in section 3 of the Act.

5.1. LOA is defined in the Act. It is the way of describing the degree of confidence that an individual is who they say they are:

1. in relation to an EIC, the LOA is the degree of confidence in an individual’s identity that the EIC is taken to provide;
2. in relation to an identity verification function for a transaction, the LOA is the level of assurance in an individual’s identity that is required for the purposes of that function.

5.2. Under the Service Victoria (General) Regulations 2018, there are four LOAs:

1. LOA1 — basic level of assurance;
2. LOA2 — medium level of assurance;
3. LOA3 — high level of assurance;
4. LOA4 — very high level of assurance.

5.3. Before a transaction involving an identity verification function is conferred on the Service Victoria CEO, a risk-based LOA assessment of the identity verification function required for that transaction must be undertaken, and an LOA agreed by Service Victoria and the service agency, non-government entity, or non-Victorian government agency for whom the Service Victoria CEO will perform identity verification functions.

5.4. To use an EIC to satisfy an identity verification function in a transaction, the LOA of the EIC must:

1. be the same as, or higher, than the LOA required for the identity verification function for the transaction; and
2. comply with all relevant re-use requirements under Standard 14.

6.1. Identity information (which includes identity documents) collected by Service Victoria when verifying identity under these Standards must:

1. be obtained with the consent of the individual;
2. be provided in the form and manner determined by the Service Victoria CEO;
3. be consistent with the LOA of the identity verification function for which it is collected;
4. achieve identity verification purposes using no more than the information that is required, recommended or permitted under these Standards;
5. be validated by a document verification service, at document source or through other service providers, to check that the information provided by the individual is legitimate.

6.2. Identity documents serve three purposes:

1. Commencement of identity: to confirm the individual’s identity has been legitimately created in Australia;
2. Use in the community: to confirm that an individual’s identity has been active in the community over time, to safeguard against the creation of fictitious identities; and
3. Photo bind: to confirm that the person presenting the documents is the legitimate owner by checking that the photo on the identity document matches the individual’s face.

6.3. Identity documents must come from high-integrity and known sources, and robust, risk-assessed identity verification practices must precede the issuing or provision of the identity document.

Commencement of Identity

6.4. Subject to these Standards, the following identity documents are satisfactory Commencement of Identity documents:

1. A full Australian birth certificate (not a birth extract or birth card) in the individual’s name or former name issued under the Births, Deaths, and Marriages Registration Act 1996, or issued in another Australian State or Territory under a comparable law (does not include a photo);
2. A full Australian passport in the individual’s name or former name which is current or has expired within the last three years (includes a photo);
3. A foreign passport with a valid Australian visa in the individual’s name or former name (includes a photo);

Use in the Community

6.5. Subject to these Standards, the following identity documents are satisfactory Use in the Community documents:

1. An Australian driver licence or learner permit issued under the Road Safety Act 1986 or a comparable law of an Australian State or Territory), or a comparable authority (includes a photo);
2. A Medicare card (does not include a photo);
3. A full Australian passport in the individual’s name or former name which is current or has expired within the last three years, where not already used as a Commencement of Identity Document (includes a photo).

Difference in Name

6.6. Subject to these Standards, the following identity documents are satisfactory Difference in Name documents:

1. A change of name certificate issued by a State or Territory registry of Births, Deaths and Marriages; and
2. A marriage certificate issued by a State or Territory registry of Births, Deaths and Marriages.

7.1 The individual must provide attributes from one satisfactory identity document. The document must be either a satisfactory Commencement of Identity document or a satisfactory Use in the Community document.

8.1. The individual must provide attributes from two satisfactory identity documents. Each document must be either a satisfactory Commencement of Identity document or a satisfactory Use in the Community document.

8.2. There must not be a material difference in the customer’s name as it appears on both forms of identity documents, as defined in Standard 12.4.

9.1. The individual must demonstrate the claimed identity:

1. is legitimate;
2. has been active in the community over time; and
3. there is a link between the claimed identity and the individual claiming that identity.

9.2. The individual must provide:

1. a satisfactory Commencement of Identity document; and
2. a satisfactory Use in the Community document, where at least one of the above identity documents must contain a suitable photo that can be used to complete a photo bind to the individual.

9.3. Where an individual seeks to undertake a transaction for which a nationally coordinated criminal history check is required, the Service Victoria CEO may require the individual to provide specific or additional identity information for the purpose of processing such checks as specified from time to time by the relevant agency of the Commonwealth.

9.4. The individual must provide a satisfactory Difference in Name document in relation to any material differences in the individual’s name as it appears on the Commencement of Identity document and the Use in the Community document provided to Service Victoria (see below).

9.5. The individual must pass a photo bind. This could involve a visual or digital liveness and likeness check, matching an image or a live video of the individual to a suitable photo on an identity document.

10.1. To verify an identity for LOA4, an individual must satisfy the requirements of LOA 3 that are set out in Section 9 of these Standards and must also complete an in-person biometric check.

10.2. Service Victoria does not offer these transactions.

11.1. Where considered reasonable and practicable in the circumstances, Service Victoria may use non-digital methods for identity verification.

11.2. Non-digital methods must provide a reasonably equivalent degree of assurance at each LOA as set out in these Standards, as determined by the Service Victoria CEO.

11.3. Without limiting section 11.2, when using a non-digital method, the Service Victoria CEO may determine, for a given LOA:

1. that individuals must provide certified copies of non-digital identity information; and/or
2. that non-digital identity information received, and identities claimed, must be able to be validated through the Service Victoria digital platform; and/or
3. individuals submitting a non-digital application must utilise a referee meeting the requirements determined by the Service Victoria CEO and provide information verifying the referee’s identity as required.

11.4. Service Victoria may require individuals submitting a non-digital application to provide further information, or to re-submit their application (as required), if the individual did not complete any required part of the application pack for the transaction to be performed for the individual.

12.1. A difference in name occurs where an individual’s first, middle and/or last names are not identical on their Commencement of Identity document(s) and/or Use in the Community document(s).

12.2. A difference in name is either:

1. a minor difference; or
2. a material difference.

12.3. A minor difference occurs where:

1. the first and last names are an exact match, and the middle name (if available) is represented by an initial that is consistent with the correct full name; and/or
2. the first and last names (and middle, if available) feature inconsistently applied or missing punctuation that is minor (e.g. hyphens or apostrophes) and the names are otherwise an exact match.

12.4. A material difference occurs where the names on the provided documents are not an exact match and cannot be explained as a minor difference.

13.1. Service Victoria may apply exceptions to the standard requirements and processes under the Standards (Standard Framework) in relation to individuals whose identity cannot be readily verified using the Standard Framework. For example, for an individual unable to comply with identity information requirements set out at Standard 9.2, Service Victoria may apply an exception and accept alternative information or processes.

13.2. When applying an exception to the Standard Framework (Exception), the Service Victoria CEO:

1. must be satisfied that the alternative process or requirement is reasonable in the circumstances, informed by a risk assessment, and does not substantially reduce reliability or effectiveness; and
2. may impose alternative document requirements, verification processes, terms and conditions applicable to EICs, or processes for issuing and refusing to issue EICs as determined by the Service Victoria CEO.

13.3. The application of Exceptions may involve the use of alternative methods to gather necessary information to verify an individual’s identity, including:

1. interviews;
2. information provided by verified referees or other responsible persons; and/or
3. other information.

13.4. Where possible, information provided by individuals or referees should be checked with a record checking agency or with other appropriate people or organisations.

13.5. In applying an Exception, Service Victoria may require the individual to utilise a referee meeting the requirements determined by the Service Victoria CEO and provide information verifying the referee’s identity as required.

13.6. Where an individual cannot provide one of the required identity documents, Service Victoria may request the individual to provide an alternate reasonably equivalent document that has come from high-integrity and known sources, and have robust, risk-assessed identity verification practices attached to the issuing of the document.

13.7. Where an individual cannot provide one of the required identity documents, Service Victoria may direct the individual to the relevant issuing authority to obtain one.

13.8. Individuals may also be given the option to complete transactions through existing digital and/or non-digital service delivery methods with service agencies including Service Victoria.

13.9 Where an Exception is applied and an EIC is issued, the Service Victoria CEO must determine in accordance with Standard 14.5 whether the individual has the option to save their EIC for reuse as an ongoing EIC.

Applications for an EIC

14.1. Individuals may apply for an EIC using a digital service or offline channel provided by the Service Victoria CEO for the purpose of identity verification.

Issuing an EIC

14.2. The Service Victoria CEO may issue an EIC to an individual at a specified LOA where:

1. the individual has made a valid application under Standard 14.1;
2. the individual has provided satisfactory evidence of identity for that LOA as specified in these Standards, including any Difference in Name document (where applicable);
3. in the case of an EIC to be stored as an ongoing EIC, the additional requirements outlined below are met.

14.3. Where an EIC is issued to an individual, Service Victoria must record on the EIC:

1. the LOA; and
2. any other information as needed to facilitate the use of the EIC at the relevant LOA.

Ongoing EIC

14.4. Subject to the conditions at Standard 14.6, an individual may choose to store an EIC for future use (an ongoing EIC) unless Service Victoria has applied an Exception under Standard 13 in which case the Service Victoria CEO must determine whether the individual can choose to be issued an ongoing EIC.

14.5. In determining whether an individual who has a temporary EIC issued subject to an Exception may choose an ongoing EIC, the Service Victoria CEO may have regard to:

1. the consistency and security of Service Victoria’s identity verification and EIC framework, and transactions; and
2. a risk assessment taking into consideration the nature of the Exception and the degree of non-compliance with the Standard Framework.

14.6. Service Victoria must be satisfied that the following conditions are met before issuing an ongoing EIC to an individual:

1. the individual must have or establish, and maintain a Service Victoria account.
2. where the ongoing EIC is of LOA 3:
1. the individual must provide a photo that is suitable for reuse in accordance with paragraph (iii) below (the Photo);
2. the Photo must match the photo bind performed under Standard 9.5 and be suitable for future digital identity verification; and
3. the individual must consent to the Photo being retained as an attribute of the ongoing EIC at LOA3.

14.7. Service Victoria may set up a Service Victoria account for customers transacting non-digitally with Service Victoria. Service Victoria may delete an account set up in this way if the relevant individual does not take required steps to make the account active within 90 days of the account being set up.

14.8. If an individual to whom an ongoing EIC is issued deletes their Service Victoria account, or the account is deleted by Service Victoria, their ongoing EIC expires upon deletion of the account.

14.9. Saving a photo to an ongoing EIC as outlined in Standard 14.6(b) enables the individual to reuse a verified photograph linked with their EIC, and may be used to verify the individual is the true owner of an EIC.

Maintaining and using an Ongoing EIC

14.10. Service Victoria must take reasonable steps to ensure each ongoing EIC issued to an individual continues to satisfy all requirements and conditions that apply to the issue of an ongoing EIC of the same LOA, as set out in the latest version of these Standards.

14.11. If an individual’s ongoing EIC no longer meets the latest requirements and conditions, then Service Victoria must decrease the LOA recorded on that EIC to the appropriate LOA, and notify the individual at the appropriate time.

14.12. Service Victoria should check with an individual that their name as recorded on their EIC has not changed before permitting the individual to re-use that EIC.

14.13. If the individual’s ongoing EIC has a lower LOA than is needed for the transaction, the individual may apply to Service Victoria to verify their identity at the higher LOA needed in accordance with the Standards and if successfully verified at the higher LOA, subject to paragraphs 14.4-14.6 choose to either:

1. obtain a temporary EIC at the higher LOA; or
2. increase the LOA of the individual’s existing ongoing EIC to the higher LOA.

14.14.To be valid, an application for the renewal of an ongoing EIC must be made in the form and manner determined by the Service Victoria CEO.

14.15. Service Victoria may renew an ongoing EIC in relation to an individual if, having received an application for renewal in the form and manner determined by the Service Victoria CEO, the individual has provided sufficient satisfactory identity information such that the requirements for issuing a new EIC to the individual at the same LOA would be satisfied.

14.16. Use of an ongoing EIC for the purposes of a nationally coordinated criminal history check is subject both to the EIC satisfying ordinary LOA3 requirements and to the individual providing any further information as required in accordance with Standard 9.3.

14.17. Service Victoria should check issued ongoing EICs from time to time and may cancel any EIC issued to an individual who has died subsequent to the issue of the EIC.

Suspension

14.18. Service Victoria must suspend the operation of an EIC if the Service Victoria CEO is satisfied on reasonable grounds that the individual to whom the credential is issued is not the individual to whom the credential relates.

Expiry and cancellation

14.19. An EIC expires as follows:

1. in the case of a temporary EIC, 10 days after the day it was issued or such later period as is reasonable to complete a transaction for which the temporary EIC was issued; and
2. in the case of an ongoing EIC, 10 years after the day it was issued.

14.20. An individual may request to cancel an ongoing EIC at any time before its expiry.

14.21. The Service Victoria CEO must cancel an EIC that has been suspended under Standard 14.18 if, having considered any comments from the individual to whom it was issued, the Service Victoria CEO is satisfied on reasonable grounds that the individual to whom the EIC is issued is not the individual to whom it relates.

14.22. The Service Victoria CEO must cancel an EIC if the Service Victoria CEO is satisfied on reasonable grounds that the EIC has been issued or renewed in error.