How to implement digital identity verification methods in a notary practice

Implementing digital identity verification methods in a notary practice means layering automated credential analysis, biometric liveness checks, and knowledge-based authentication into your client intake, then recording the outcome in a tamper-evident electronic journal. The exact steps depend on your jurisdiction. In the United States, remote online notarization is only permitted where state law authorises it and the notary holds a current online commission. In the EU, the notarial act stays in the notary's physical office and digital tools handle intake and preparation only. The UK follows Faculty Office rules, and jurisdictions like Hong Kong and the UAE permit front-office digital onboarding.

This guide covers designing the notary identity verification workflow, selecting evidence types, integrating with intake, handling failures, and maintaining compliant records. If you want to get started with a system that supports these steps, the sections below map directly to what you need to configure.

Designing a compliant identity verification workflow

A compliant workflow moves the client through four sequential gates: identity evidence capture, automated credential analysis, biometric liveness verification, and journal recording of the outcome. Each gate must produce a pass or fail result before the client advances to the notarial act. The workflow must be designed so that a failure at any gate triggers a defined exception path rather than an ad hoc workaround.

The process begins when the client submits identity evidence through an automated ID capture interface, which reads the machine-readable zone and any embedded chip data. The system then compares the credential image against issuing authority templates and runs a biometric matching engine that checks a live selfie against the credential photo using presentation attack detection. If the jurisdiction requires knowledge-based authentication, the client answers dynamic questions generated from credit bureau and public records data. Every result is logged with a timestamp, the credential type, and the verification method used.

For a detailed walkthrough of how this fits into the broader practice build, see our remote online notarization setup guide.

Selecting multiple identity evidence types for layered checks

No single evidence type is sufficient. A layered approach combines document scanning, biometric matching, and knowledge-based authentication to create defence in depth against spoofing and forgery. The NIST identity proofing guidelines establish the framework most US states reference for acceptable evidence combinations.

Document scanning and credential analysis

Automated credential analysis examines the security features of a government-issued ID: holographic overlays, microprinting, ultraviolet elements, and machine-readable zones. The system reads the optical character recognition data and, where the credential supports it, validates the embedded NFC chip. The UK Faculty Office has been explicit that flat scanned images are inadequate. In its Standard for Verifying Identity Using Digital Checks, the regulator states:

A scanned copy of a passport, for example, is not a secure way of verifying identity as the document could easily have been forged. Using the biometric and machine readable parts of a passport on the other hand amount to a high level of security, if not absolute.

The Faculty Office of the Archbishop of Canterbury

Credential analysis must therefore read and validate the chip and machine-readable data, not accept a photograph of the document.

Biometric liveness detection

Biometric matching engines compare a live selfie against the photo on the credential. The critical component is presentation attack detection, which distinguishes a live person from a printed photo, a 3D mask, a video replay, or a digital camera injection. ISO/IEC 30107-3 defines the testing metrics: the Attack Presentation Classification Error Rate (APCER) measures how often an attack fools the system, and the Bona Fide Presentation Classification Error Rate (BPCER) measures how often a legitimate user is rejected. For notarial work, the liveness engine should be evaluated at Level 2 or Level 3 by an accredited independent testing laboratory.

Knowledge-based authentication and its limits

Knowledge-based authentication (KBA) generates dynamic questions from credit bureau and public records data. The client must answer within a time limit, and the questions are designed to be answerable only by the true identity holder. KBA has documented weaknesses. According to NIST Special Publication 800-63-3, KBA does not constitute an acceptable secret for digital identity proofing because the answers can be discovered through data breaches or public records.

KBA also fails at high rates. Initial sessions produce failure rates between 15% and 30% for legitimate applicants, disproportionately affecting older adults, recent immigrants, and individuals with thin credit files. NIST has formally deprecated KBA in favour of alternative proofing pathways. Your workflow must support fallback methods when KBA fails.

Integrating verification with client intake and booking

Secure client onboarding for notaries depends on embedding identity verification directly into the scheduling and data collection phase, so that a client cannot book a notarial appointment without completing the ID check. This prevents incomplete appointments and gives you time to resolve exceptions before the session. The intake form should request the credential type, trigger automated capture at the point of booking, and gate the calendar so that only verified clients can select a time slot.

The integration works as follows: the client completes the intake form, uploads or scans their credential, completes the biometric check, and receives a booking confirmation only if all checks pass. If any check fails, the system routes the client to an exception path rather than confirming the appointment. This reduces no-shows from clients who would have failed verification at the signing table. If your current setup does not support pre-booking ID checks, you can compare plans that do.

For more on how intake automation fits the broader workflow, see our guide on automating client intake with ID pre-check, scheduling, and payments.

Handling failed verifications and edge cases

Define clear failure paths before you go live. A client who fails automated checks needs a defined route that does not default to manual override. The goal is to know exactly when to intervene manually and when to reject the session.

Clients without standard government-issued IDs

Some clients lack a standard government-issued ID, including recent immigrants, individuals whose credentials have been lost or stolen, or clients in transitional circumstances. If your jurisdiction's statute permits credible witness verification, the workflow must support it. Under Florida Statutes § 117.209 and similar provisions in other states, a credible witness who personally knows the principal and holds valid identification can attest to the principal's identity under oath during the audio-video session. The journal must record the credible witness's name, address, and sworn affirmation.

Configure your system so that the credible witness path is a deliberate, logged exception rather than a silent fallback. The witness must complete their own identity verification before the session proceeds.

Maintaining tamper-evident identity records for audit compliance

The electronic journal must store the outcome of every identity check in a tamper-evident format. This is a statutory requirement. Under 19 NYCRR § 182.9, Florida Statutes § 117.245, and Texas Government Code § 406.108, the journal must record specific compliance metadata for each notarial act.

Do not store prohibited data. Raw biometric recordings and social security numbers are restricted from journal entries under state statutes. The journal records the outcome of verification, not the underlying biometric data.

Retention periods are long. Florida, New York, and California each mandate a 10-year retention period for electronic journals and audio-video recordings. The UK Faculty Office requires 12 years. Texas historically set a 5-year minimum for online notary recordings, though recent legislative reforms are expanding the schedule toward 10-year alignment. Florida's statute requires that the recording be uninterrupted and unedited:

The RON service provider shall retain an uninterrupted and unedited copy of the recording of the audio-video communication in which an online notarization is performed.

The Florida Legislature

For a deeper treatment of record integrity, see our guide on maintaining e-journal integrity with tamper-evident features.

Jurisdictional rules for digital identity verification

The line between what a client can do remotely and what requires the notary's physical presence shifts by jurisdiction. Treat remote notarization as jurisdiction-specific rather than universal.

• 2020-01-01Florida's permanent RON law takes effect, establishing 10-year retention and multi-layer credential analysis rules
• 2023-01-25New York implements 19 NYCRR Part 182, mandating electronic journals and 10-year retention
• 2023-09-30California enacts SB 696, creating a statutory framework and 10-year retention mandate in phased milestones
• 2026-06-26UK Faculty Office issues the Standard for Verifying Identity Using Digital Checks, requiring chip and machine-readable validation

United States: RON where authorized

In the US, remote online notarization is restricted to states with enacted RON legislation where the notary holds an active, confirmed online commission. The California Secretary of State has issued customer alerts clarifying that remote notarization is not available until the state's technological certification process is complete, even though the statutory framework exists. Notaries must confirm their own authorization before offering remote services. The Florida Department of State publishes equivalent guidance for Florida online notaries.

EU: preparation versus execution

In continental European civil law systems, the core notarial deed must remain grounded in the physical office of the civil-law notary. Digital tools can handle pre-closing identity collection, digital intake, and document preparation, but the notarial act itself requires the principal's physical presence. This distinction between preparation and execution is fundamental. A digital identity check performed remotely supports preparation; it does not satisfy the execution requirement.

UK: Faculty Office rules

In England and Wales, notaries operate under Faculty Office directions and guidance. The 2026 Standard for Verifying Identity Using Digital Checks permits digital pre-checks that read biometric chips and machine-readable data, but flat scans are rejected. In-person verification with original tangible credentials remains acceptable practice.

Hong Kong and UAE: front-office intake only

In Hong Kong and the UAE, digital verification can facilitate front-office client onboarding and intake, but it does not replace required statutory execution formalities. The digital workflow supports preparation; the notarial act follows local statutory procedure.

For a jurisdiction-by-jurisdiction breakdown of what each system requires, see our guide on digital identity verification methods for notaries by jurisdiction.

FAQ

What are compliant digital notarization steps for client onboarding?

Compliant onboarding requires four sequential gates: identity evidence capture, automated credential analysis, biometric liveness verification, and journal recording of the outcome. Each gate must produce a pass or fail result before the client advances to the notarial act.

What are RON identity proofing standards?

RON identity proofing standards, referenced by most US states, follow the NIST identity proofing guidelines. They require layered evidence combining document scanning, biometric matching, and knowledge-based authentication. NIST has deprecated KBA as a standalone proofing method.

How should a notary handle a failed identity verification?

Escalate to manual review when the credential is genuine but the biometric match score sits below the pass threshold due to lighting or camera quality, or when a name mismatch stems from a hyphenation or transliteration difference. Reject the session when the credential fails security feature validation or the biometric check detects a presentation attack.

How long must a notary retain identity verification records?

Florida, New York, and California each mandate a 10-year retention period for electronic journals and audio-video recordings. The UK Faculty Office requires 12 years. Texas historically set a 5-year minimum, though recent legislative reforms are expanding the schedule toward 10-year alignment.

For the full digital identity verification methods implementation walkthrough, return to the signup page, which lets you configure each verification gate described above.