Digital Identities & Data Compliance in Financial Services

Introduction

Identity verification is one area where data protection, financial crime and consumer protection rules meet and the ground has shifted considerably in the past year.

The Data (Use and Access) Act 2025 brought a new digital verification services regime into force on 1 December 2025, creating a statutory register of certified providers and a trust framework. In February 2026, HM Treasury and DSIT published guidance on using registered digital identity services to satisfy customer due diligence under the Money Laundering Regulations. Meanwhile, firms with EU customers face the eIDAS 2.0 timetable: Member states must offer an EU Digital Identity Wallet by 24 December 2026 and financial services firms must accept it for onboarding by 24 December 2027.

Facial matching and liveness checks involve biometric data, automated decision-making rules apply to many onboarding flows and firms remain controllers for the identity data they collect, even where a certified provider carries out the check. This means existing data protection rules matter more than ever and must be applied to new contexts.

This bitesize webinar gives you a practical map of the current landscape. It explains how the DVS regime, the MLRs and the UK GDPR fit together, what changes for firms using or providing digital identity services, how to approach lawful basis and automated decision-making for biometric onboarding and what to tell clients who are preparing for the EU wallet.

You will leave with a checklist that you can apply to your own onboarding and fraud prevention processes.

What You Will Learn

This short webinar will cover the following:

• How identity verification data is treated under the UK GDPR and when facial matching and liveness checks engage the ‘special category data’ rules
• What changes under the Data (Use and Access) Act 2025: The statutory DVS register, the trust framework, the trust mark and OfDIA’s role
• The impact of the February 2026 HM Treasury and DSIT guidance on the Money Laundering Regulations
• Automated decision-making and Article 22 UK GDPR in onboarding: when a rejected applicant has a right to human review and how the DUAA reforms affect the analysis
• Lawful basis, data sharing and retention for fraud prevention, including the ‘recognised legitimate interest’ provisions and what to keep after verification
• The EU dimension: eIDAS 2.0 and the EU Digital Identity Wallet deadlines of December 2026 and December 2027 for firms with EU customers
• A takeaway vendor due diligence checklist for biometric identity verification providers