Most of the UK’s digital verification regime will switch on from Monday 1 December 2025. The government has signed the Commencement No. 4 Regulations, bringing Part 2 of the Data (Use and Access) Act 2025 into force while holding back sections 45 to 48 on public‑sector information sharing. The instrument was made on 19 November and signed by DSIT Minister of State Ian Murray, according to legislation.gov.uk.

For investors and operators, Part 2 is the rulebook that turns years of pilots into a statutory market. It mandates a DVS trust framework, a public register of providers, supplementary codes for specific use cases, and a government trust mark. The Act defines “digital verification services” as verifying a fact about an individual using third‑party data and confirming that fact to another party-think right‑to‑work checks, age assurance or fraud controls delivered online.

Not everything goes live on day one. Because sections 45–48 are excluded for now, registered providers will not yet be able to rely on the new legal gateway for public authorities to disclose data to support a verification request. Those gateway powers-covering HMRC, the Welsh Revenue Authority and Revenue Scotland-remain pending commencement.

Entry to the new register is conditional. Under section 33, a provider must hold a certificate from a conformity assessment body stating its service meets the DVS trust framework, submit an application that meets the Secretary of State’s determination, and pay any fee. National security and non‑compliance remain grounds to refuse registration under section 34. That mix of certification, application and oversight is designed to give buyers and regulators a consistent signal of quality.

Where certification stands today matters for timelines and budgets. DSIT’s Office for Digital Identities and Attributes (OfDIA) says the certification scheme is still running as an unaccredited pilot, with no UKAS‑accredited CABs yet listed. The live scheme version is 0.4.4 (“Gamma”) from 1 July 2025, with a 1.0 series planned. Providers working with OfDIA‑approved CABs should plan for a transition to UKAS‑accredited certification once available.

Process detail is now published for applicants. Updated GOV.UK guidance confirms the statutory register will replace the non‑statutory list once section 32 is commenced, and sets out how existing certified services can confirm they want to appear on the new register. OfDIA will publish and maintain the register on behalf of the Secretary of State, providing a single reference point for buyers across finance, employment and housing.

There is already a real market to serve. DSIT notes that more than 50 services are independently certified against the non‑statutory trust framework, delivering thousands of checks each month for right to work, right to rent and DBS. For fintech and regtech firms, the shift to a statutory footing should make procurement easier and help standardise assurance across KYC and onboarding journeys.

What to watch next: government commencement plans flagged DVS measures for this phase of the rollout, with other data protection changes following later. The immediate operational priority is registration and certification; the medium‑term watchpoint is when the public‑authority data gateway is switched on, which could lower friction for income, residency or tax‑status verifications.