Where it stands
Since 15 September 2026, pubs, shops and other licensed premises in England and Wales can accept a digital proof of age for alcohol, alongside physical ID. That is a new market for digital verification services (DVS). Nobody has to use it: venues decide whether to offer the digital route, and customers can still show the physical ID a venue accepts.
The draft order was approved by Parliament on 8 September 2026. The made order, SI 2026/1022, was made on 14 September and came into force on 15 September 2026. It amends the mandatory licensing conditions on age verification policies.
What certification covers
Every service in the chain has to be certified against the DVS trust framework and on the statutory register, under either framework 0.4 or 1.0. Beyond that, there is nothing extra to get: no alcohol certification, no further approval and no alcohol-specific code. OfDIA has started exploring a wider age verification code, but it is not a current requirement.
An identity service provider (IDSP) must establish the underlying identity at medium, high or very high confidence, and be certified and registered for those identity profiles. An attribute service provider (ASP) can derive an age attribute from that identity, and a holder service provider (HSP) can store it and disclose only the proof of age. One provider or several partners may fill these roles, as OfDIA's certification explainer sets out. Review the actual service and its registered scope: a company's certification does not automatically cover every product it sells.
The order does not change what a certificate of conformity shows by default, so discuss with your CAB how to describe the use case. Give retail customers a short description of who verifies identity, who derives the age information and who delivers the proof, so they know which registered services they rely on.
Make the check work at the counter
Glancing at an app or a screenshot doesn't count. A registered DVS has to check the proof electronically, and the service has to show that it belongs to the person presenting it, which is usually called binding.
How you bind is up to you. A face match against the photo taken at setup is one option; a PIN, plus a photo sent to the till for staff to compare, is another. A photo on the till helps staff match the holder, but it is not a substitute for checking the proof electronically. OfDIA's guidance on confidence and binding explains the difference. Expect to be asked how your design copes with a borrowed phone or a shared login.
Help retailers use it properly
A register entry alone does not show licensing compliance. A venue that adopts the route updates its age verification policy and needs an agreement with a registered DVS provider, under which the provider confirms whether the customer has reached the relevant age and delivers identification at medium confidence or above. Local licensing conditions still apply, and so do Challenge 25, preventing proxy purchases and refusing sales to intoxicated customers. Self-service checkouts must not be left completely unsupervised.
Share only the personal information needed to confirm the age threshold and the rightful holder; a full identity record or date of birth will often be unnecessary. Age estimation cannot be used for alcohol sales under this route. See OfDIA's practical alcohol guidance.
Early work on an age verification code
OfDIA has started exploring a supplementary code for digital age verification that could apply across different use cases, rather than one for alcohol alone. Its 2026 annual report describes this as considering whether to publish new rules on trustworthy digital age verification checks. The report's roadmap is not an official commitment, and no timetable has been set.
The report puts the code alongside wider work on age: supporting registered services for age-restricted products and services, exploring the role trusted providers could play in highly effective age assurance for the government's plans to stop social media platforms offering services to under-16s, and exploring how children could prove their age online safely and privately. It also records that the share of providers offering age assurance rose from 23% to 31%.
Any code would be consulted on first, as the Data (Use and Access) Act 2025 requires before new supplementary code requirements are introduced, and certification against it would only become mandatory through further regulation. OfDIA also intends to publish service patterns showing good practice for age verification journeys later in 2026.
For providers now: document how you derive and share an age result and match it to the holder under your current certification, so a future code is an uplift rather than a redesign, and take part when OfDIA consults.
Four steps for providers
- Check scope and registration. Map each participating service to its certified roles and current register entry, including any partners.
- Evidence assurance and holder matching. Document the identity confidence achieved, the electronic checks and your controls against impersonation.
- Prepare retailer integration information. Explain staff interactions, failed checks, physical ID alternatives and the data the retailer receives.
- Review certification claims. Describe the certified service accurately, and agree any proposed scope changes with your conformity assessment body (CAB).
Official sources
- SI 2026/1022, the made order
- In force from 15 September 2026, on legislation.gov.uk
- Parliamentary approval
- Approved by both Houses on 8 September 2026
- How DVS can support alcohol purchases
- OfDIA, 17 August 2026
- Confidence and holder matching
- OfDIA, 18 August 2026
- Certification requirements for alcohol purchases
- OfDIA, 19 August 2026
- OfDIA 2026 annual report
- Published 14 July 2026, including its work on age verification