Providers of Verified Identity

KuppingerCole’s Buyer’s Compass for Providers of Verified Identity is a practical starting point for narrowing and evaluating vendors during RFI/RFP cycles. It structures selection around primary use cases, weighted functional and non-functional criteria, and the technical and organizational prerequisites required for a successful rollout. The intended outcome is an efficient shortlisting process that leads into deeper RFIs and proofs of concept, rather than a complete end-to-end procurement playbook.

Providers of Verified Identity are defined as solutions that verify a digital identity corresponds to a real-world identity and enable that verified identity to be used across platforms, services, or companies. The market is future-oriented, anticipating greater reliance on verified identities to improve privacy, meet KYC/AML compliance needs, and streamline onboarding and ongoing relationships. Technologies vary widely—passwords, certificates, biometrics, eTokens, federated trusted sources, decentralized identifiers (DIDs), and AI-supported approaches—yet all aim to underpin IAM and CIAM security while enabling remote verification at higher assurance levels. A reusable verified identity is positioned as potentially disruptive, changing how trust, data storage, compliance effort, and fraud prevention work, though no dominant approach has yet emerged.

The document highlights five key use cases: customer onboarding, employee/partner onboarding, transaction-grade KYC/AML verification, authentication based on verified identity (often via biometrics as a second factor), and sharing verified identity attributes far beyond basic demographics. Selection is guided by 20 functional criteria (document processing, biometrics, liveness, fraud detection, risk scoring, privacy, ZKPs, AI governance, APIs/SDKs, storage, user control, and more) and 10 non-functional criteria (deployment models, time-to-value, vendor viability, partner ecosystems, roadmap, and pricing). A matrix maps use cases to criteria priorities, complemented by technical prerequisites (Identity Fabric, monitoring, extensibility) and organizational requirements (ownership, training, incident response, budget, and authority).

• Providers of Verified Identity verify that a digital identity corresponds to a real-world identity.
• Verified identities may be issued to employees, end-users, devices, or legal entities for use across multiple platforms or companies.
• The market anticipates increasing reliance on verified identities for privacy, KYC/AML compliance, and ease of use.
• Technologies used can include passwords, certificates, biometrics, eTokens, federated trusted sources, DIDs, and AI.
• Five top use cases are customer onboarding, employee/partner onboarding, KYC/AML verification, verified identity for authentication, and sharing verified identity attributes.
• Physical identity document processing can triangulate OCR, smartphone NFC chip reads, and MRZ data to increase confidence in authenticity.
• Liveness checks can analyze selfie video with prompted movements to counter spoofing attacks.
• The non-functional criteria list includes deployment models, time-to-value, vendor size, number of customers, partner ecosystem, strategic focus, breadth of capabilities, support, roadmap, and pricing.
• Technical prerequisites include an Identity Fabric, iterative cybersecurity processes, monitoring and evaluation metrics, extensibility, and a defined deployment roadmap.
• Organizational prerequisites include defined system ownership, project ownership, business value quantification, training, risk ratings, policies, defined processes, an incident response team, budget, and sufficient organizational power to achieve goals.

• “This document is not a complete guideline for selecting vendors but should provide an excellent starting point to streamline the decision-making process.”
• “A reusable verified identity has the potential to change the trust afforded to credentials from other systems, the storage of user data, the effort needed to adhere to privacy and compliance regulations, and ability to prevent fraud.”
• “These are disruptive proposals, and the many vendors who are active in delivering such solutions take varying technological paths to achieve them.”
• “The dominant technological approach is not yet clear – many products are newly launched, and others are adapting their established and familiar approaches to adjust to the changing trends.”
• “Fraud detection often is complimentary to other cybersecurity tools for organizations that face high numbers of fraud attempts, not just at the point of onboarding or authentication.”
• “Not every aspect is of the same importance for every use case.”
• “Verified identity solutions will be integrated alongside existing IAM processes.”
• “A multispeed approach to IAM that addresses both predictable processes and unforeseen adaptations is required.”
• “Adequate metrics must be defined for measuring the effectiveness of the project.”
• “Some companies may struggle with these criteria, not because of technical weaknesses and wrong products, but because of a lack of organizational maturity.”