Private-sector facial verification is coming to Australia. Here's what the IVS Act actually means for you.

For years, verifying a customer in Australia has meant checking their details against a government record and trusting that whoever supplied those details is who they say they are. That trust is exactly where the risk now sits. After the large-scale data breaches of recent years, a criminal can hold a real name, a real licence number, and a real date of birth that belong to someone else. The document checks out. The person behind it doesn't.

The Identity Verification Services Act 2023 reset the rules for how Australia closes that gap. Parliament passed it in December 2023, and it put the country's identity verification services on a proper legislative footing for the first time. The part that matters most to your team is only arriving now: private-sector access to the Face Verification Service (FVS), the government check that confirms a customer's face against the photo the government already holds.

We orchestrate identity and fraud checks for banks and regulated businesses, connecting the checks that matter into a single workflow. FVS is a new rail we can bring into that workflow, an Australian government service that sits alongside the document, sanctions, and fraud checks you already run. This piece covers what's changing, why it matters now, and what you can do before FVS goes live for the private sector.

What the IVS Act changed, and what's changing now

Australia's identity verification services aren't new. The Document Verification Service (DVS) has been in heavy use for years, and AUSTRAC points to it as a way for financial businesses to meet customer identification obligations under the AML/CTF regime. What the DVS does is narrow and useful: it checks whether the biographic details on an identity document, a name, a date of birth, a document number, match the original government record. The answer comes back as a yes or a no. The DVS never looks at a face.

The IVS Act 2023 gave these services a statutory framework, with privacy safeguards, oversight, and transparency arrangements written into law. It also drew a hard line worth understanding, because it shapes what FVS can and can't do. The Act deliberately limits identity matching to one-to-one checks. It does not permit one-to-many searching, the kind that would let a photo be run across a database to find a match. That distinction is the difference between confirming an identity and searching for one, and the Act comes down firmly on the side of confirmation.

Here's the change that affects you. Until now, FVS has been restricted to a small number of Commonwealth agencies. In the government's most recent reporting year, a single government agency used it. No private business has run a live FVS transaction. The Act opens a path for that to change: private-sector organisations will be able to use FVS once they enter a participation agreement in line with the IVS Act, with use that is reasonable, necessary, and proportionate to what the business actually does.

That access is arriving in stages rather than all at once, and the timing sits with the government's rollout. Which is exactly why the businesses thinking about it now are the ones who'll be ready when it lands.

Why this matters now

Ask a blunt question. If a fraudster walked in today holding a genuine passport number and a genuine date of birth belonging to a real customer, would your onboarding stop them?

For most Australian businesses, the honest answer is no. The document is real. The details match. A document check confirms the record exists and says nothing about who is sitting behind the screen. That isn't a flaw in the DVS. It's the boundary of what a document check was ever built to do.

The scale of the problem isn't abstract. Equifax's Fraud Index Report for 2025 found that Australian lenders prevented more than $1.5 billion in reported fraudulent applications over the year, and the nature of the fraud is shifting from simple theft toward manipulation. Money mule activity, where accounts are used to move illicit funds, rose 90.9% year on year, though Equifax is careful to note that part of that jump reflects better detection and the reclassification of cases once logged as identity takeover. The direction of travel is the point: fraud is moving toward methods a document check alone was never designed to catch.

Artificial intelligence is accelerating it. Entrust's 2026 Identity Fraud Report recorded a 58% rise in deepfake selfie attempts globally in a single year. That figure matters for a specific reason. Most identity checks compare a customer's selfie to the photo on their document, and if a fraudster can generate both, the check passes. The comparison is only as trustworthy as the two images being compared, and both are now forgeable at scale.

That is the gap FVS closes. It confirms the face in front of you against the photo the government already holds, a record the fraudster doesn't control and can't fabricate. A stolen licence number can't produce the rightful owner's face on demand. A synthetic identity has no government photo to match against. A deepfaked selfie has nothing genuine to match to. The fraud fails at the biometric step instead of passing the document step. For a compliance or risk leader, that isn't a marginal gain. It's a different question being answered: not "is this document real?" but "is this the person?"

What FVS is, and what it isn't

Because FVS is new to the private sector, and because it's easy to confuse with things it isn't, precision matters.

FVS is a one-to-one biometric check. A customer provides a selfie with liveness detection, and FVS confirms whether that face matches the photo held on the government record for the identity being claimed. Match, or no match. Nothing more.

It is not facial recognition in the sense people usually fear. It doesn't scan a crowd, it isn't surveillance, and it is not a one-to-many search that hunts for a person across a database, because the Act doesn't allow that. FVS answers one question about one identity: is this the rightful owner?

Nor is it a replacement for the DVS. The two do different jobs. The DVS tells you whether the document details are valid and, when something doesn't line up, why. FVS tells you whether the person is who they claim to be. Whether you run one or both comes down to your use case and risk appetite. If you want a simple go or no-go on the person, FVS on its own does the job. If you want to know exactly which signal failed and why, run DVS and FVS together, in either order, so the DVS captures the reason for any mismatch while FVS confirms the rightful owner. Document is real, and person is real. We'll go deeper on how the two work together in a follow-up piece, because that pairing is where most of the practical value sits.

The privacy questions your team will ask

A compliance team's first reaction to "biometric check against a government database" is usually caution, and rightly so. The reassuring part is that the privacy guardrails are built into the framework rather than bolted on.

The one-to-one limit is itself a privacy protection. FVS confirms a claimed identity; it can't be turned into a tool that searches for someone. Consent is explicit and per-check: a business has to show the customer a clear consent step before each FVS check, not a buried clause in a terms-of-service page. Facial images are meant to be deleted once they're no longer needed, so this isn't a mandate to build a biometric database. And a Privacy Impact Assessment is required before go-live, which means the privacy work happens up front, on the record, before a single live check runs. For a regulated business, that sequence is familiar territory rather than a leap into the unknown.

How FVS fits into what you already run

The good news for anyone dreading another integration project: FVS doesn't have to be one. It slots into an orchestrated verification workflow as an additional step rather than a rebuild.

In a typical combined flow, a customer captures their document details and a selfie. The DVS validates the document. If that passes, FVS matches the selfie against the government record. The rest of your onboarding, sanctions screening, AML checks, fraud scoring, continues as it does today. If the biometric step returns a mismatch, or the customer isn't in the government database, the workflow falls back to a vendor identity check or manual review rather than dead-ending. Returning customers get a lighter path: a selfie against details already on file, useful for login, re-authentication, or stepping up a high-value transaction.

Access does come with obligations, and they belong on your radar early. A business will need its own participation arrangement with the Attorney-General's Department, a completed Privacy Impact Assessment before go-live, an express-consent step shown to the customer before each check, and a commitment to delete facial images once they're no longer needed. FrankieOne orchestrates the verification workflow and handles the connection into the government's identity services, so your team can focus on the compliance obligations that sit with you.

How to get ahead of it

Here's the honest position on timing. There's no confirmed date from the Attorney-General's Department for general production availability, and "coming soon" is the most anyone can responsibly promise. What you can do now is get in early, deliberately, so you're ready the moment it lands.

Start with a pilot. FrankieOne is working with a small group of partners to test FVS in a UAT environment ahead of production, without a production agreement in place. Setting up UAT and working through test results takes some lead time, which is part of why starting now matters. Be clear-eyed about it, though: because production timing sits with AGD, a pilot could run for a while before go-live. The businesses that treat that runway as preparation rather than waiting are the ones who benefit from it.

Build passport-first. AU passport coverage applies nationwide, so a passport-first design gives you national reach from the start, with other document types added as coverage expands over time.

Get familiar with the obligations that are coming. Access will require a participation arrangement with AGD and a Privacy Impact Assessment before go-live, alongside express consent and image-deletion commitments. You can't formally begin the participation process yet, it's pending AGD finalising the broader participant agreement, but understanding what these steps involve now means you can move the moment the door opens rather than starting cold.

The regulation has done the hard part, and the pathway is open. The real question isn't whether biometric verification reaches Australia's private sector. It's whether you're ready when it reaches yours.

Want to be among the first to test FVS? If that's you, let's talk.

Frequently asked questions about FVS

What is the Face Verification Service (FVS)?

FVS is Australia's government-operated biometric check. It confirms whether a person's live selfie matches the photo already held on the government record for the identity they are claiming. Operated under the Identity Verification Services Act 2023, it returns a one-to-one match or no match, nothing more.

Is FVS available to private businesses in Australia yet?

Not for production. Private-sector access is coming under the IVS Act 2023 through a participation agreement with the Attorney-General's Department, with no confirmed launch date. Selected partners can test FVS in a UAT environment now, ahead of general availability.

What is the difference between FVS and DVS?

The Document Verification Service (DVS) checks whether document details like name and date of birth match the government record, and explains any mismatch. FVS checks whether the person's face matches the record. DVS validates the document; FVS confirms the person behind it.

Is FVS facial recognition or surveillance?

No. FVS is a one-to-one biometric check: it confirms whether a person's face matches the photo the government already holds for the identity they are claiming. The Identity Verification Services Act 2023 prohibits one-to-many searching, so FVS cannot scan a crowd or search for a person across a database.

Is FVS the same as Digital ID?

No. Digital ID refers to reusable digital credentials a person holds and presents, such as a government digital identity. FVS is a biometric check that confirms a person's face against a government record. The two are often confused but solve different problems. 

Do you need DVS to use FVS?

No. You can run FVS on its own for a simple match or no-match decision. Running DVS alongside FVS, in either order, tells you exactly which detail failed when a check does not pass. Whether you use one or both depends on your use case and risk appetite.