Proof of Identity: All UK Acceptable Documents

Overview

Identity verification in the UK uses a combination of photo identification documents and supporting documents. The Joint Money Laundering Steering Group (JMLSG) guidance sets the framework for FCA-regulated firms; other sectors follow similar principles. The standard requirement is one photo ID document plus, in most cases, one or two supporting documents that confirm address. Acceptable documents are listed here.

Photo identification documents

Top-tier photo IDs: valid passport (any country); UK photocard driving licence (full or provisional); UK biometric residence permit / eVisa share code; HM Armed Forces ID card; Northern Ireland electoral identity card. Each is accepted by most UK financial institutions as the primary identity document. Foreign driving licences are accepted by some but not all.

Non-photo identification documents

Where photo ID is unavailable, supporting documents include: birth certificate (UK long-form), marriage or civil partnership certificate, HMRC tax notice in the applicant's name, DWP benefits letter, NHS medical card. These do not on their own verify identity at the same standard as photo ID but are accepted when combined.

Electronic identity verification

FCA-authorised firms can use electronic identity verification (eIDV) providers that combine official records, electoral roll data and other public data to verify identity online without paper documents. Many newcomer-friendly digital banks use this approach. The Digital Identity and Attributes Trust Framework (DIATF) is the certification standard for UK eIDV providers.

Identity verification for newcomers

Newcomers with limited UK history can verify identity with passport plus a tenancy agreement, or passport plus right-to-rent/right-to-work share code. Specialist newcomer banking products are designed to onboard with just the passport plus selfie. The harder verification (electoral roll, utility bills) builds up over the first few months and then unlocks mainstream financial products.

Standards bodies and the regulatory framework

Identity verification in the UK is shaped by overlapping rules. The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 set the statutory baseline for FCA-authorised firms, payment institutions, accountants, solicitors and estate agents. The Joint Money Laundering Steering Group (JMLSG) issues practical guidance applied across the regulated sector; FCA-authorised firms in particular treat JMLSG guidance as the working standard.

The Home Office sets the document lists for right-to-rent and right-to-work checks, published in its codes of practice. The Department for Science, Innovation and Technology runs the Digital Identity and Attributes Trust Framework (DIATF) which certifies digital identity service providers. The Information Commissioner's Office (ICO) regulates the data-protection aspects of identity verification under UK GDPR and the Data Protection Act 2018.

Outside the regulated sector (e.g., retailers selling age-restricted goods, employers in some non-regulated industries, sports clubs), the rules are less formal. Most defer to PASS-accredited proof-of-age cards or photo ID such as passport or driving licence. The Challenge 25 industry-led standard in licensed retail goes beyond the legal minimum (age 18) by asking for ID from anyone who could be under 25.

Documents accepted under right-to-rent and right-to-work checks

Right-to-work checks performed by employers in the UK follow the Home Office Code of Practice on Preventing Illegal Working. The document list is split into List A (documents giving an indefinite right to work) and List B (documents giving a time-limited right to work). British and Irish passports, EEA documents for those with status under the Withdrawal Agreement, biometric residence permits and eVisa share codes are the most common. Online checks via the Home Office check service provide a statutory excuse for the employer.

Right-to-rent checks in England under the Immigration Act 2014 use a closely related but distinct document list. British and Irish citizens prove the right through passport or birth certificate plus a secondary document. Non-British nationals with UK status use the share-code service via gov.uk/view-prove-immigration-status. Landlords retain copies for the duration of the tenancy plus one year.

Both checks have time limits when status is time-limited. Employers must conduct a follow-up check when the original time-limited document expires; landlords must conduct a follow-up before the original status ends. Failure to perform the follow-up loses the statutory excuse. Identity Document Validation Technology (IDVT) providers certified under DIATF can perform the document check digitally on the employer's behalf.

Electronic identity verification (eIDV) in practice

The shift from paper documents to electronic identity verification has accelerated since 2022. Certified IDVT providers under DIATF can verify a person's identity once and that verification can be reused across multiple services. The provider checks the physical document for authenticity (security features, NFC chip on biometric passports, holograms), confirms the document matches the person via a live selfie, and runs the data against public records.

For right-to-work checks of British and Irish citizens, employers can either physically inspect documents or use a certified IDVT provider. For non-British nationals, the online share-code service through the UKVI account is mandatory; no physical document inspection is needed because the share-code system returns the relevant immigration status. Many UK fintechs and digital banks rely on eIDV for KYC at onboarding, often completing the process within minutes of the customer downloading the app.

The most widely-used eIDV providers include Onfido, Yoti, GBG, Jumio and Mitek. Each holds DIATF certification (or operates under FCA-regulated equivalence) and publishes its accuracy and accreditation status on its website. The Cabinet Office publishes the list of DIATF-certified providers; users should check that the chosen provider holds current certification.

Identity verification for newcomers without UK history

A common challenge for newcomers is that some institutions ask for documents the newcomer cannot produce in the first weeks: utility bills, council tax bills, electoral roll entries. The institutional response is to accept alternatives drawn from the JMLSG enhanced procedures. Tenancy agreements through regulated letting agents, employer letters confirming UK address, university enrolment confirmations and bank welcome letters all serve as documentary evidence.

Digital-first banks have built onboarding specifically around this profile: passport plus selfie verification through an IDVT provider, with UK address captured by self-declaration and verified later by mailing the debit card to the declared address. Specialist newcomer banking products at HSBC, NatWest and Barclays bridge the same gap for higher-net-worth clients by offering concierge document-collection services.

Universities and large employers often run their own identity-verification process for new students and staff using documents supplied at registration. The verification result is then accepted by other services within the same institution. For students this typically unlocks council tax exemption certification at the institutional level; for staff it forms the basis of the right-to-work check.

Lost or expired documents and replacement processes

Lost passports are reported to HM Passport Office through the gov.uk service; the lost passport is cancelled and cannot be reactivated even if found. A replacement application is made through the standard renewal process with the standard fee plus the cost of any lost-document fees. Reporting promptly reduces fraud risk; HMPO updates the issuing record within hours of report.

Lost driving licences are reported to the DVLA and replaced through gov.uk/apply-online-to-replace-a-driving-licence for a fee published at gov.uk. Driving on a licence that has been reported lost is permitted while waiting for the replacement. Lost biometric residence permits must be reported to the Home Office within three months; replacement is more expensive than passport replacement and takes longer.

Expired documents are generally not accepted as identity evidence even for newly arrived applicants. The exception in some sectors is recently-expired passports (within the last few months) which some banks accept under their own internal policies; check before applying. National ID cards from EU countries remain accepted for some non-immigration identity purposes in the UK; their acceptance varies by institution.

How institutions verify UK address

Address verification at UK institutions combines documentary evidence with database checks. Banks under FCA and JMLSG guidance typically require documents from a recognised list (utility bills, council tax, bank statements, government letters) plus an address validation against the Royal Mail Postcode Address File (PAF). Address-not-found in PAF can stall account opening even where the documents are genuine; new-build properties are a common case.

Credit reference agencies build address history from multiple sources: electoral roll (the strongest signal), credit account address records reported by lenders, public records including court judgments, and (increasingly) Open Banking data shared with the agency. Each address on file has a verification status; unverified addresses produce thin-file scoring and trigger manual review at lenders.

Updating address across the system is manual: HMRC, DVLA, GP, council, bank, electoral roll and utilities each need separate notification. The gov.uk Tell-Once service exists for births and deaths only; address changes use individual channels. Setting aside an afternoon when moving to do all the notifications systematically is the standard advice.

Key GOV.UK resources for new UK residents

The gov.uk website is the single front door for UK government services. Key services for newcomers include: gov.uk/apply-national-insurance-number for the NI number application; gov.uk/register-to-vote for the electoral roll; gov.uk/view-prove-immigration-status for the eVisa account and share codes; gov.uk/apply-renew-passport for British passport applications after citizenship; gov.uk/exchange-foreign-driving-licence for DVLA exchange.

Cross-cutting services include gov.uk/personal-tax-account for HMRC self-service (tax codes, employment history, NI record, state pension forecast), gov.uk/help-with-childcare-costs for the Tax-Free Childcare and free hours schemes, and gov.uk/sign-in-childcare-account for the parent-facing TFC portal. The NHS App at nhs.uk/nhs-app provides the parallel front door for health services.

For up-to-date practical guidance, the citizensadvice.org.uk and moneyhelper.org.uk websites cover the major newcomer scenarios. Citizens Advice operates free in-person and telephone advice across the UK; Money Helper is the consumer-facing site of the Money and Pensions Service offering free financial guidance.

Troubleshooting common identity and address verification failures

The most common verification failures involve: address not on PAF (new-build), name spelling variants (middle initial vs full middle name, accents in names), date-of-birth format mismatch (different conventions in different countries), and recent moves where the new address has not yet propagated to credit agencies.

Specific fixes by problem type. Address not on PAF: provide alternative documentary evidence including completion statement, mortgage offer, council tax registration letter and Royal Mail redirection confirmation. Wait for PAF update which typically takes four to twelve weeks for new-builds. Name spelling: provide alternative ID documents showing both spellings; bring deed poll if there has been a formal change.

Where verification fails repeatedly, request enhanced underwriting at the institution (most have a manual review path), or try a different institution that uses different verification systems. Open Banking sharing can sometimes work where standard document verification fails. Specialist identity-verification services including Onfido, Yoti and GBG offer a fallback that some institutions accept where their own verification is inconclusive.

Address change cascade: who to notify when you move

Moving home triggers a cascade of address updates. There is no single notification that updates all UK records. Priority notifications include: HMRC (via the personal tax account at gov.uk), the GP surgery (which transfers your registration to the new surgery or updates the existing one), the local council (for council tax registration), the DVLA (within fourteen days for the driving licence), and the electoral roll (re-register at the new address at gov.uk).

Financial updates include each bank, credit card and insurance provider, the pension provider, and Tax-Free Childcare or Universal Credit account where relevant. Utility updates include energy, water, broadband, mobile and TV licence. Subscriptions including streaming services, magazines and delivery services need separate updates. Royal Mail's address redirection service forwards post for a fee, buying time to update individually.

Setting aside an afternoon when moving to systematically work through the notifications is the standard advice. Most have online forms; many can be updated via the institution's mobile app. The gov.uk Tell-Once service is only for births and deaths; routine moves require individual notifications.

Identity fraud prevention and what to do if compromised

Identity fraud is one of the most common types of fraud in the UK. Action Fraud (actionfraud.police.uk) is the national reporting centre for cyber crime and fraud. Cases involving identity fraud are also reportable to the Cifas national fraud prevention service, which can flag the affected identity with multiple financial institutions to reduce subsequent harm.

Protective steps include: regularly checking credit files at each of the three agencies (free statutory reports under the Data Protection Act); enabling two-factor authentication on all financial accounts; using unique strong passwords (a password manager makes this manageable); being alert to phishing emails and SMS; never sharing OTP codes or full bank security details by phone.

If identity fraud is suspected: contact the bank and credit reference agencies immediately to flag the affected accounts; report to Action Fraud; obtain a Cifas protective registration (Cifas Protective Registration is paid; Cifas Member Protection is free for victims). The credit reference agencies can add a notice of correction or fraud marker to the file that lenders see at credit applications.

Specific routes for compromised passports (HMPO at gov.uk), driving licences (DVLA), eVisas (UKVI account) and NI numbers (HMRC) exist. Each replaces the compromised credential with a new one. The Information Commissioner's Office (ICO) is the regulator for data protection breaches; ICO complaints can support broader investigation where an organisation's data has been compromised.

Work, employment rights and the UK labour market

Once UK-resident with the right to work, employment in the UK is governed by the Employment Rights Act 1996, the Equality Act 2010 and a comprehensive framework of further legislation. Right-to-work checks are mandatory for employers; the share-code system through the UKVI account is the standard route for non-British nationals. The check provides the employer with a statutory excuse against illegal-working penalties.

Statutory employment rights include: the National Minimum Wage (different rates by age, set by HMRC); statutory holiday entitlement of 5.6 weeks per year (28 days for someone working a five-day week, including bank holidays at the employer's discretion); statutory sick pay; statutory maternity, paternity, adoption and shared parental leave; the right not to be unfairly dismissed (after two years' service in most cases); protections against discrimination on the nine protected characteristics under the Equality Act.

Workplace pensions are auto-enrolled for most employees aged twenty-two or over earning above the auto-enrolment threshold (currently around 10,000 pounds per year). The employee can opt out within the opt-out window. Auto-enrolment contributions are a minimum of eight percent of qualifying earnings (three percent employer, five percent employee). Many employers offer better than minimum.

HMRC personal tax account at gov.uk/personal-tax-account is the self-service portal for tax matters: viewing tax code, employment history, state pension forecast, marriage allowance claim and many other functions. The personal tax account works across employers and replaces previous paper-based interactions for most matters.

Data protection rights and how to exercise them

The UK GDPR and Data Protection Act 2018 give individuals strong rights over their personal data. Key rights include the right to be informed about data processing, the right of access (subject access request), the right to rectification of inaccurate data, the right to erasure in defined circumstances, the right to restrict processing, the right to data portability, the right to object, and rights related to automated decision-making.

To exercise rights with a specific organisation, send a written request to the data protection officer or to a general data-protection inquiry address. Most organisations have a privacy notice (often called Privacy Policy) on their website setting out the contact details. The organisation has one month to respond, extendable to three months for complex requests.

The Information Commissioner's Office (ICO) regulates data protection in the UK. Complaints about an organisation's handling of personal data can be made to the ICO at ico.org.uk. The ICO investigates, can require remediation, and can issue fines for serious breaches (up to four percent of global turnover for the most serious GDPR breaches).

Identity verification organisations collect substantial personal data and are particularly tightly regulated. The Cifas national fraud database is a special-purpose data store with specific governance. Individuals can subject-access Cifas to see whether they appear on any fraud database and challenge incorrect entries.

Newcomer documentation checklist and next steps

A useful documentation checklist for newcomers covers: passport (current, valid); UK visa or eVisa share code; UK address evidence (tenancy or temporary address letter); NI number documentation (or application reference if pending); UK bank account confirmation; tax record (HMRC personal tax account at gov.uk/personal-tax-account); NHS number (issued at GP registration); driving licence (foreign or UK photocard).

Storage of these documents matters. Originals should be kept in a secure place (not all in one bag carried daily). Photocopies and digital copies (encrypted cloud storage) provide backup. Some institutions require originals for verification; others accept certified copies. Solicitors and notaries can certify copies for a fee.

Recovery of lost documents is straightforward through the relevant agency: HMPO for passport, DVLA for driving licence, HMRC for NI number documentation, UKVI for eVisa account. Each has online and phone routes. Identity fraud reports should go to Action Fraud immediately; Cifas protective registration adds an extra layer of protection.

Reviewing the document set every twelve to twenty-four months helps catch upcoming expiries: passports expiring within six months of an intended trip may not be accepted by some destination countries; driving licences need renewal every ten years; eVisas remain current as long as the underlying immigration status remains.

For sensitive documents (deed poll, marriage certificate, gender recognition certificate) keeping multiple certified copies avoids the need to use the original repeatedly. The General Register Office issues additional copies of birth, marriage and civil partnership certificates for a small fee.

Disclaimer

This article provides general information for UK residents and newcomers. It is not legal, tax, financial or medical advice. Rules, rates, eligibility criteria and processes change frequently; readers should verify details with the linked primary sources or consult an authorised professional before acting on anything described here. References to specific firms, products or services are illustrative and do not constitute endorsements.

Frequently asked questions

Do I need to bring documents in person?

Most UK banks and financial services now onboard fully online through IDVT providers. The applicant uploads photos of the document and takes a live selfie; the verification system matches the face to the document and checks document authenticity through holograms, NFC chip data on biometric passports and other security features. Some high-street banks still offer or require in-branch verification, particularly for premier accounts or for accounts with overseas connections that fall outside standard onboarding. The trend is clearly toward fully digital verification with in-branch as the exception.

Can I use a foreign passport as ID indefinitely?

Yes. A valid foreign passport remains a top-tier identity document throughout the holder's residency in the UK. The passport's expiry date matters; expired passports are generally not accepted even for newly arrived applicants. Where the foreign passport is used as identity and the applicant is on a UK visa, the visa or eVisa share code provides the necessary status evidence. Renewing a foreign passport while resident in the UK is done through the relevant country's UK embassy or high commission; some embassies offer expedited services for residents.

Will my expired driving licence be accepted?

Generally not. Identity documents are usually accepted only while valid. Expired passports and driving licences may be accepted in limited circumstances (e.g., banks sometimes accept a recently-expired passport within the past six months under their internal policy) but the safer assumption is that valid documents are required. Where a document has just expired and replacement is in progress, a letter from HMPO or DVLA confirming the application can sometimes serve as an interim evidence document. Each institution sets its own rules; checking the accepted-documents list before applying saves wasted visits.

How does digital ID work?

A certified digital identity provider under the Digital Identity and Attributes Trust Framework (DIATF) verifies the applicant once and issues a digital identity record. Institutions accepting that provider can then verify the person without seeing the underlying documents again. The model is gaining traction in right-to-rent, right-to-work and some financial services. The verification typically involves capturing the document image, taking a live selfie, and a series of automated checks including face-matching, document authenticity verification and (where supported) NFC chip read on biometric passports. The whole process usually takes a few minutes.

What if my name has changed?

Documentary evidence of the name change is required: deed poll for unilateral changes, marriage certificate or civil partnership certificate for marriage-related changes, gender recognition certificate where applicable, or court order for changes ordered by a court. The new-name documents are then verified against the original-name records held by the institution. Both versions of the name may be kept on record for a period (typically twelve to eighteen months) for fraud-prevention purposes. Some institutions require all current identity documents to reflect the new name before fully updating; others accept the deed poll plus an updated bank statement or utility bill as evidence the name change has been implemented in practice.