What are Identity Proofing Levels?

IP 1

Proofing Level

IP 1

Requirements

“I am who I say I am” No document or verification required.

What you can do

Low level risk activities such as paying a fine.

IP 1+

Proofing Level

IP 1+

Requirements

Provide one identity document with a date of birth to RatifyID which will be verified.

What you can do

Low-level risk where the consequences are minor such as signing up to loyalty cards.

IP 2

Proofing Level

IP 2

Requirements

Provide two or more identity documents one of which is a PhotoID, Passport, or Australian Birth Certificate to RatifyID which will be verified.

What you can do

Moderate risk activities such as signing up for services that may be paid for, eg: Subscriptions.

IP 2+

Proofing Level

IP2+

Requirements

Meet the requirements for IP2 and complete biometric verification.

This includes

  • One Commencement of Identity (CoI) credential and one Use in the Community (UitC) credential; or
  • One Photo ID and one Use in the Community (UitC) credential.
  • Biometric capture.
  • Liveness detection.
  • Biometric face matching.
  • Identity uniqueness checks.
  • Fraud checks.
  • Evidence verification activities appropriate to IP2+.

What you can do

Higher-risk activities where stronger identity assurance is required, such as accessing regulated services, higher-value transactions, or sensitive personal information.

IP 3

Proofing Level

IP3

Requirements

Meet the requirements for IP2+ and complete additional verification activities.

This includes

  • One Commencement of Identity (CoI) credential and one Use in the Community (UitC) credential; or
  • One Photo ID and one Use in the Community (UitC) credential.
  • Biometric capture.
  • Liveness detection.
  • Biometric face matching.
  • Identity uniqueness checks.
  • Fraud checks.
  • Deceased person checks.
  • Evidence verification activities appropriate to IP3.

What you can do

High-risk activities where the highest level of confidence in an individual's identity is required, such as accessing highly sensitive government services, regulated financial services, or critical infrastructure services.