1.1. This instrument commences on 29 May 2024, or the date of the Standards being gazetted, whichever is later. This is the sixth version of these Standards, and replaces the Standards issued on 27 April 2023.

2.1. The Standards are a legislative instrument made by the Minister administering section 41 of the Service Victoria Act 2018 (the Act).

2.2. Under section 41 of the Act, these Standards deal with issues including, but not limited to:

• a) digital and non-digital methods for verifying identity;
• b) determination of the level of assurance of an identity verification function required for a transaction;
• c) identity information required for each level of assurance;
• d) the process for applying any exceptions if an individual’s identity cannot be readily verified;
• e) the process for the application for an electronic identity credential (EIC);
• f) the process for issuing and refusing to issue EICs;
• g) the process for the renewal, suspension and cancellation of EICs; and
• h) any terms and conditions that apply to the issue, use, reuse, or increase in level of assurance of an electronic identity credential EIC and renewal of an EIC.

2.3. These Standards must be read together with the Act and any other regulations or standards made under the Act. These Standards are not intended to limit or restrict the operation of the Act.

2.4. The Minister may update these Standards at any time.

3.1. These Standards establish a consistent and secure identity verification framework for individuals transacting with the Victorian government through Service Victoria. The guiding principles for making and using these Standards are set out in section 42 of the Act as follows:

• a) User choice – individuals are able to choose whether to store a record of an electronic identity credential for future use;
• b) Minimal data is to be requested and stored – individuals must not be asked to provide more information than necessary in order for Service Victoria to verify the individual's identity and personal information can only be stored with the individual's consent, unless required by law;
• c) Risk-based approach to identity verification – a consistent and evidence-based approach is employed to determine the level of assurance of identity required for transactions;
• d) Security, transparency and accountability – Service Victoria, and any external service providers engaged to provide identity verification services, are to be regularly audited by an independent entity to ensure compliance with privacy and data security requirements;
• e) Flexibility – the Standards must, to the extent practicable, be able to adapt to new technologies or methods of identity verification;
• f) National consistency – the Standards must, to the extent practicable, align to national requirements, as set out in any relevant national framework or guidelines as in force from time to time.

4.1. These Standards use the following terms:

• a) MUST indicates something that is required in order to meet these Standards;
• b) SHOULD indicates something that is recommended but not required in order to meet these Standards (that is, these recommendations should be implemented unless it is unreasonable to do so, or an alternative process which provides an equivalent LOA is used);
• c) MAY indicates something is permitted but is not required under these Standards;
• d) SHOULD NOT indicates something that is not recommended under these Standards, unless circumstances make other approaches unfeasible;
• e) MUST NOT indicates something that is not permitted in order to meet these Standards.

4.2. Except where otherwise specified, these Standards adopt the definitions contained in section 3 of the Act.

5.1. Level of assurance (LOA) is a way of describing the degree of confidence that an individual is who they say they are:

• a) in relation to an EIC, the LOA is the degree of confidence in an individual’s identity that the EIC is taken to provide;
• b) in relation to an identity verification function for a transaction, the LOA is the degree of confidence in an individual’s identity that is required for the purposes of that transaction.

5.2. Under the Service Victoria (General) Regulations 2018, there are four LOAs:

• a) LOA1 — basic level of assurance;
• b) LOA2 — medium level of assurance;
• c) LOA3 — high level of assurance;
• d) LOA4 — very high level of assurance.

5.3. Before a transaction involving an identity verification function is conferred on Service Victoria, a risk-based LOA assessment of the identity verification function required for that transaction must be undertaken, and an LOA assigned. The assessment must be jointly completed by the service agency and Service Victoria.

5.4. To use an EIC to satisfy an identity verification function in a transaction, the LOA of the EIC must:

• a) be the same as, or higher, than the LOA required for the identity verification function for the transaction; and
• b) comply with all relevant re-use requirements under Standard 14.

6.1. Identity information collected by Service Victoria when verifying identity under these Standards must:

• a) be obtained with the consent of the individual;
• b) be provided in the form and manner determined by the Service Victoria CEO;
• c) be consistent with the LOA of the identity verification function for which it is collected;
• d) achieve identity verification purposes using no more than the information that is required, recommended or permitted under these Standards; and
• e) be validated by a document verification service, at document source or through other service providers, to check that the information provided by the individual is legitimate.

6.2. Identity documents serve three purposes:

• a) Commencement of identity: to confirm the individual’s identity has been legitimately created in Australia;
• b) Use in the community: to confirm that an individual’s identity has been active in the community over time, to safeguard against the creation of fictitious identities; and
• c) Photo bind: to confirm that the person presenting the documents is the legitimate owner by checking that the photo on the identity document matches the individual’s face.

6.3. Identity documents must come from high-integrity and known sources, and have robust, risk-assessed identity verification practices attached to the issuing of the document.

Commencement of Identity

6.4. Subject to these Standards, the following identity documents are satisfactory Commencement of Identity documents:

• a) A full Australian birth certificate (not a birth extract or birth card) in the individual’s name or former name issued by a State or Territory registry of Births, Deaths and Marriages (does not include a photo);
• b) A full Australian passport in the individual’s name or former name which is current or has expired within the last three years (includes a photo);
• c) A foreign passport with a valid Australian visa in the individual’s name or former name (includes a photo);
• d) An ImmiCard issued in the individual’s name (includes a photo); and
• e) An Australian citizenship certificate issued in the individual’s name or former name (does not include a photo).

Use in the Community

6.5. Subject to these Standards, the following identity documents are satisfactory Use in the Community documents:

• a) An Australian driver licence or learner permit issued under the Road Safety Act 1986 or a comparable law of an Australian State or Territory), or a comparable authority (includes a photo); and
• b) A Medicare card (does not include a photo);
• c) A full Australian passport in the individual’s name or former name which is current or has expired within the last three years, where not already used as a Commencement of Identity Document (includes a photo).

Difference in Name

6.6. Subject to these Standards, the following identity documents are satisfactory Difference in Name documents:

• a) A change of name certificate issued by a State or Territory registry of Births, Deaths and Marriages; and
• b) A marriage certificate issued by a State or Territory registry of Births, Deaths and Marriages.

7.1. The individual must provide attributes from one satisfactory identity document. The document must be either a satisfactory Commencement of Identity document or a satisfactory Use in the Community document.

8.1. The individual must provide attributes from two satisfactory identity documents. Each document must be either a satisfactory Commencement of Identity document or a satisfactory Use in the Community document.

8.2. There must not be a material difference in the customer’s name as it appears on both documents, as defined in Standard 12.4.

9.1. The individual must demonstrate the claimed identity:

• a) is legitimate;
• b) has been active in the community over time; and
• c) there is a link between the claimed identity and the individual claiming that identity.

9.2. The individual must provide:

• a) a satisfactory Commencement of Identity document; and
• a satisfactory Use in the Community document, including at least one document containing a suitable photo that can be used to complete a photo bind to the individual.

9.3. Where an individual seeks to undertake a transaction for which a nationally coordinated criminal history check is required, the Service Victoria CEO may require the individual to provide additional identity information for the purpose of processing such checks as specified from time to time by the relevant agency of the Commonwealth.

9.4. The individual must provide a satisfactory Difference in Name document in relation to any material differences in the individual’s name as it appears on the Commencement of Identity document and the Use in the Community document provided to Service Victoria (see below).

9.5. The individual must pass a photo bind. This could involve a visual or digital liveness and likeness check, matching an image or a live video of the individual to a suitable photo on an identity document.

10.1. To verify an identity for LOA4, an individual must satisfy the requirements of LOA 3 that are set out in Section 9 of these Standards and must also complete an in-person biometric check.

10.2. Service Victoria does not offer these transactions.

11.1. Where considered reasonable and practicable in the circumstances, Service Victoria may use non-digital methods for identity verification.

11.2. Non-digital methods must provide a reasonably equivalent degree of assurance at each LOA as set out in these Standards, as determined by the Service Victoria CEO.

11.3. Without limiting section 11.2, when using a non-digital methods, the Service Victoria CEO may determine, for a given LOA:

• a) that individuals must provide certified copies of non-digital identity documents; and/or
• b) that non-digital identity documents received, and identities claimed, must be able to be validated through the Service Victoria digital platform; and/or
• c) individuals submitting a non-digital application must utilise a referee meeting the requirements determined by the Service Victoria CEO and provide information verifying the referee’s identity as required.

11.4. Service Victoria may require individuals submitting a non-digital application to provide further information, or to re-submit their application (as required), if the individual did not complete any required part of the application pack for the transaction to be performed for the individual.

12.1. A difference in name occurs where an individual’s first, middle and/or last names are not identical on their Commencement of Identity document(s) and/or Use in the Community document(s).

12.2. A difference in name is either:

• a) a minor difference; or
• b) a material difference.

12.3. A minor difference occurs where:

• a) the first and last names are an exact match, and the middle name (if available) is represented by an initial that is consistent with the correct full name; and/or
• b) the first and last names (and middle, if available) feature inconsistently applied or missing punctuation that is minor (e.g. hyphens or apostrophes) and the names are otherwise an exact match.

12.4. A material difference occurs where the names on the provided documents are not an exact match and cannot be explained as a minor difference.

13.1. There are options available to individuals who cannot provide the documents required to verify their identity in accordance with these Standards.

13.2. Service Victoria may use an exceptions process for individuals who otherwise have difficulty having their identity verified under these Standards.

13.3. When using an exceptions process, the Service Victoria CEO must be satisfied that it is reasonable in the circumstances and does not substantially reduce the reliability of the identity verification process.

13.4. The exceptions process may involve the use of alternative methods to gather necessary information to verify an individual’s identity, including:

• a) interviews;
• b) information provided by verified referees or other responsible persons; and/or
• c) other information provided by the individual.

13.5. Where possible, information provided by individuals or referees should be checked with a record checking agency or with other appropriate people or organisations.

13.6. Service Victoria may require the individual using an exceptions process to utilise a referee meeting the requirements determined by the Service Victoria CEO and provide information verifying the referee’s identity as required.

13.7. Where an individual cannot provide one of the satisfactory identity documents, Service Victoria may request the individual to provide an alternate reasonably equivalent identity document that has come from high-integrity and known sources, and have robust, risk-assessed identity verification practices attached to the issuing of the document.

13.8. Where an individual cannot provide one of the required identity documents, Service Victoria may direct the individual to the relevant issuing authority to obtain one.

13.9. Individuals may also be given the option to complete transactions through existing digital and/or non-digital service delivery methods with service agencies including Service Victoria.

Applications for an EIC

14.1. Individuals may apply for an EIC using a digital service or offline channel provided by the Service Victoria CEO for the purpose of identity verification.

Issuing an EIC

14.2. The Service Victoria CEO may issue an EIC to an individual at a specified LOA where:

• a) the individual has made a valid application under Standard 14.1;
• b) the individual has provided satisfactory evidence of identity for that LOA as specified in these Standards, including any Difference in Name document (where applicable);
• c) in the case of an EIC to be stored as an ongoing EIC, the individual meets any additional requirements outlined below.

14.3. Where an EIC is issued to an individual, Service Victoria must record on the EIC:

• a) the LOA; and
• b) any other information as needed to facilitate the use of the EIC at the relevant LOA.

Choosing an ongoing EIC

14.4. An individual may choose to store an EIC for future use (an ongoing EIC).

14.5. An individual who chooses to store an ongoing EIC must establish and maintain a Service Victoria account.

14.6. Service Victoria may set up a Service Victoria account for customers transacting non-digitally with Service Victoria. Service Victoria may delete an account set up in this way if the relevant individual does not take required steps to make the account active within 90 days of the account being set up.

14.7. If an individual to whom an ongoing EIC is issued deletes their Service Victoria account, or the account is deleted by Service Victoria under Standard 14.6, their ongoing EIC expires upon deletion of the account.

Issuing an ongoing LOA3 EIC

14.8. If an individual chooses to establish an ongoing EIC of LOA3, then in addition to being satisfied that the individual has complied with Standard 14.5, Service Victoria must be satisfied that the following conditions are met before issuing an ongoing EIC of LOA3 to the individual:

• a) the individual must provide a photo that is suitable for reuse in accordance with paragraph (c) below (the Photo);
• the Photo must match the photo bind performed under paragraph 9.5 and be suitable for future digital identity verification; and
• the individual must consent to the Photo being retained as an attribute of the ongoing EIC at LOA3.

14.9. Saving a photo to an ongoing EIC as outlined in Standard 14.8 enables the individual to reuse a verified photograph linked with their EIC, and may be used to verify the individual is the true owner of an EIC.

Maintaining and using an Ongoing EIC

14.10. Service Victoria must take reasonable steps to ensure each ongoing EIC issued to an individual continues to satisfy all requirements and conditions that apply to the issue of an ongoing EIC of the same LOA, as set out in the latest version of these Standards.

14.11. If an individual’s ongoing EIC no longer meets the latest requirements and conditions, then Service Victoria must decrease the LOA recorded on that EIC to the appropriate LOA, and notify the individual at the appropriate time.

14.12. Service Victoria should check with an individual that their name as recorded on their EIC has not changed before permitting the individual to re-use that EIC.

14.13. If the individual’s ongoing EIC has a lower LOA than is needed for the transaction, the individual may apply to Service Victoria to verify their identity at the higher LOA needed in accordance with the Standards and if successfully verified at the higher LOA, choose to either:

• a) obtain a temporary EIC at the higher LOA; or
• b) increase the LOA of the individual’s existing ongoing EIC to the higher LOA.

14.14.To be valid, an application for the renewal of an ongoing EIC must be made in the form and manner determined by the Service Victoria CEO.

14.15. Service Victoria may renew an ongoing EIC in relation to an individual if, having received an application for renewal in the form and manner determined by the Service Victoria CEO, the individual has provided sufficient satisfactory identity information such that the requirements for issuing a new EIC to the individual at the same LOA would be satisfied.

14.16. Use of an ongoing EIC for the purposes of a nationally coordinated criminal history check is subject both to the EIC satisfying ordinary LOA3 requirements and to the individual providing any further information as required in accordance with Standard 9.3.

14.17. Service Victoria should check issued ongoing EICs from time to time and may cancel any EIC issued to an individual who has died subsequent to the issue of the EIC.

Suspension

14.18. Service Victoria must suspend the operation of an EIC if the Service Victoria CEO is satisfied on reasonable grounds that the individual to whom the credential is issued is not the individual to whom the credential relates.

Expiry and cancellation

14.19. An EIC expires as follows:

• a) in the case of a temporary EIC, 10 days after the day it was issued or such later period as is reasonable to complete a transaction for which the temporary EIC was issued; and
• b) in the case of an ongoing EIC, 10 years after the day it was issued.

14.20. An individual may request to cancel an ongoing EIC at any time before its expiry.

14.21. The Service Victoria CEO must cancel an EIC that has been suspended under Standard 14.18 if, having considered any comments from the individual to whom it was issued, the Service Victoria CEO is satisfied on reasonable grounds that the individual to whom the EIC is issued is not the individual to whom it relates.

14.22. The Service Victoria CEO must cancel an EIC if the Service Victoria CEO is satisfied on reasonable grounds that the EIC has been issued or renewed in error.