The Digital ID Act 2024 created a national accreditation scheme for digital identity providers and the Australian Government Digital ID System (AGDIS). As private sector participation opens from 1 December 2026 (Department of Finance, 2026), organisations can accept a verified digital ID as a relying party instead of collecting licences and passports. AI then handles the onboarding workflow around that verified identity, with people making the decisions.
This guide is for operations leads, compliance managers and heads of customer onboarding at mid-sized lenders, insurers, property groups, professional firms and other regulated organisations in Australia. It explains what the Act sets up, where your organisation is likely to sit, and how AI fits without crossing lines it should not.
Key takeaways
- Most organisations will participate as relying parties: they accept a verified identity from an accredited provider and do not verify documents themselves.
- AI does not replace accredited verification. It handles intake, screening, record-keeping and routing around it.
- Relying on verified identity shrinks the store of identity documents you hold, which reduces breach exposure under the Privacy Act 1988.
- A person stays accountable for consequential decisions such as declining a customer or flagging high risk.
- The most valuable preparation is mapping how you verify identity today, before any integration.
What does the Digital ID Act set up?
The Digital ID Act 2024 commenced on 1 December 2024. It created a voluntary, legislated Accreditation Scheme for digital identity providers, replacing the older Trusted Digital Identity Framework, and put AGDIS on a legislative footing. AGDIS has so far been used mainly for government services such as myGov. The Act provides for it to open to private sector participants in phases.
The scheme is co-regulated. The Australian Competition and Consumer Commission (ACCC) is the Digital ID Regulator, and the Office of the Australian Information Commissioner (OAIC) oversees privacy. The Accreditation Rules and Data Standards set consistent requirements for identity verification levels, privacy, security, accessibility and usability.
The Act recognises three kinds of accredited entity:
- Identity service providers verify and assert a person's identity.
- Attribute service providers verify specific attributes, such as age or a professional qualification.
- Identity exchange providers route interactions between parties without holding the underlying identity.
Is your organisation a relying party or a provider?
A relying party is any organisation that relies on a verified digital identity instead of doing the verification itself. This is where most organisations will sit. You do not need accreditation to benefit. You need to accept a verified identity, handle it correctly and fit it into your onboarding and compliance workflows.
What is your relationship to identity verification?
- You onboard customers and want to stop collecting raw ID documentsRelying party, the common path
- You want to offer identity verification as a service to othersAccredited identity or attribute service provider
- You verify specific facts like age, licence or qualificationAttribute verification, likely via an accredited provider
- You route identity interactions between partiesIdentity exchange provider, a specialised role
The distinction decides where effort goes. Accreditation means formal assessment against the Accreditation Rules and Data Standards. The relying-party path is lighter but still real work: integrating verification into your systems, handling the resulting data under privacy law and proving you did so correctly. For most organisations the work is integration and governance.
Why should organisations prepare for Digital ID now?
The rules are being tightened before the gate opens. The ACCC and the Department of Finance have continued to update the Accreditation Rules, Data Standards and incident obligations ahead of private sector participation. The standard of conduct expected of participants will be enforced.
Onboarding friction loses customers. When a competitor can onboard a new customer by accepting a reusable verified identity, an organisation still asking people to photograph a passport and wait will feel it. Matching them becomes a growth question as much as a compliance one.
Data minimisation reduces liability. Under the Privacy Act 1988, personal information you hold is information you are responsible for, and identity documents are among the most sensitive and targeted data an organisation keeps. Relying on a verified assertion, instead of storing licences and passports, shrinks that exposure. Our guides to Privacy Act compliance for AI and how the wrong AI tools leak business data cover the underlying obligations.
Where does AI fit in Digital ID onboarding, and where must it not?
AI does not replace accredited identity verification. The point of AGDIS is that the identity assertion comes from an accredited provider held to legislated standards. AI and automation handle the workflow around that assertion: the high-volume, repetitive steps that go wrong when done by hand.
Strip onboarding down and it looks like this. An applicant starts an application. Details are captured. An identity check is initiated and the result recorded. The result is matched against your risk rules, fraud screening and sector obligations. A record is written showing what you did and when. Anything ambiguous goes to a person. Only that last step genuinely needs human judgement.
- IntakeCapture applicant details cleanly and consistently
- VerifyInitiate the accredited identity check, receive the result
- ScreenMatch against risk, fraud and sector rules
- RecordWrite the audit trail as a by-product
Used this way, onboarding becomes a governed pipeline. Intake is validated on arrival, so bad data is caught early. The verification result is attached to the right record automatically. Screening runs the same way on every application, every day of the week. The reviewer sees only the cases that need a decision, with the relevant information already assembled.
A person stays accountable for consequential decisions. Declining a regulated service or flagging someone as high risk cannot be left to an opaque model. Our guides to AI agent governance and human override and automated decisions under the Privacy Act set out that discipline.
How does Digital ID change fraud and scam risk?
A stronger, standardised identity layer makes some kinds of impersonation fraud harder. It also moves pressure to the weakest link. If identity checks are strong but account recovery, document-upload fallbacks or staff override paths are weak, attackers go there.
AI-assisted fraud screening helps by watching for patterns people miss at volume: one device onboarding many identities, mismatches between stated and inferred attributes, or application behaviour that does not fit a genuine customer. Flags go to a reviewer, never straight to a refusal. This connects to the obligations covered in our guide to the Scams Prevention Framework for banks and telcos.
| Manual document handling | AI-assisted, relying on verified ID | Impact | |
|---|---|---|---|
| Sensitive documents stored | Large, growing store | Minimised | Lower breach risk |
| Onboarding consistency | Varies by staff and day | Uniform on every case | Higher |
| Fraud screening | Ad hoc, limited by staff time | Continuous, pattern-based, reviewed by a person | Stronger |
| Audit evidence | Reconstructed after the fact | Captured in the workflow | Reliable |
How does Digital ID fit with AML/CTF and other obligations?
Many organisations already carry identity duties under other regimes. AGDIS is best treated as infrastructure that can serve several of them. Organisations drawn into the expanded anti-money laundering and counter-terrorism financing regime face customer due diligence obligations that depend on reliable identity verification. We cover that for real estate agencies under AML Tranche 2 and accounting firms. A verified digital ID can be a strong building block within customer due diligence, though it does not replace the full process those regimes require.
Avoid building identity verification as disconnected point solutions (one for onboarding, one for AML, one for account recovery), each with its own document store and gaps. One governed identity workflow that draws on accredited verification and feeds every downstream obligation is cheaper to run and easier to defend. For regulated financial services, this sits within the expectations covered in financial services AI compliance under APRA and ASIC.
- Faster onboarding, fewer abandoned applicationsRevenue protected
- Smaller store of sensitive identity documentsLower liability
- Consistent screening on every applicationFewer costly misses
- Audit-ready records produced in the workflowCompliance by design
What is a realistic timeline for getting ready?
You do not need to be an early accredited provider. You need to be ready to rely on verified identity cleanly when it suits you, with an onboarding process worth connecting it to.
- NowMap your onboardingDocument how you verify identity today and where friction, cost and data-storage risk sit
- Next quarterDesign the target flowDecide where verified identity fits and where AI handles intake, screening and records
- As participation opensConnect as a relying partyAdopt verified identity and retire raw document collection where you can
- OngoingGovern and improveKeep people accountable for decisions, monitor fraud, tighten the audit trail
The most valuable work is the unglamorous first step. Most organisations do not have a clean picture of how they verify identity across branches, how many documents they hold or where the process breaks. That audit is worth doing regardless of AGDIS, and it turns "we should look at Digital ID" into a concrete list of fixes. Check current dates and requirements with the ACCC's Digital ID guidance before committing to a go-live.
What should you do now?
Treat the Digital ID Act as an operations question as much as a legal one. The legal reading is that you can choose to rely on accredited verified identity and, if you do, handle the data under the Privacy Act and the scheme's rules. The operations question creates the value: rebuild onboarding so it is faster for customers, cheaper to run and holds less risky data, with AI carrying the repetitive workflow and your people carrying the judgement.
The organisations that do this well will re-engineer onboarding into one governed pipeline and adopt verified identity as a relying party when it makes sense. The ones that do not will keep collecting passports into shared drives, verifying identity differently depending on who is on shift, and carrying a data liability that grows every month.
How Solve8 can help
Our team maps your current onboarding, designs the target workflow around verified identity and builds the intake, screening and record-keeping automation, running on your infrastructure in Australia with a person approving every consequential decision. See our process automation and financial services pages, or talk to us.
This article is general information, not legal or compliance advice. Confirm your obligations under the Digital ID Act 2024, the Privacy Act 1988 and any sector-specific regime against ACCC and OAIC guidance and qualified advice.
