News and Guides

OneID Expands Its Digital Verification Access Network with Google Wallet Credentials

The OneID Team® — Mon, 12 Oct 2026 15:38:18 GMT

OneID, the Digital Verification Access Network, today announced that it will support identity verification using eligible digital credentials presented through Google Wallet.

The addition of Google Wallet strengthens OneID's position as a single access point for organisations seeking to verify trusted digital identity information from multiple sources worldwide. Through a single integration, businesses can access verification services from banks, digital wallets, government credentials, mobile network operators, electronic identity schemes and other trusted identity providers. This provides maximum choice for consumers allowing them to use their preferred digital credential to verify their identity.

As governments, technology platforms and regulated industries accelerate the adoption of digital credentials, organisations face the challenge of supporting a growing number of identity ecosystems. OneID addresses this complexity by providing a unified verification network that allows businesses to consume trusted identity signals without needing separate integrations for each credential issuer, wallet provider or verification technology.

Karl MacGregor, CEO of OneID, said:

"The future of digital identity will not be built around a single wallet, provider or technology. Consumers will increasingly hold trusted credentials issued by banks, governments, mobile operators and other organisations, stored across multiple wallets and platforms.

Our vision is simple: organisations should be able to access trusted digital verification through a single connection, regardless of where that credential originates. Supporting Google Wallet is another important step in building that global Digital Verification Access Network. These services are important to underpin the new wave of agentic commerce where identity and trust is at the core of securing payments"

The integration enables organizations to offer their users, as part of customer onboarding, age assurance, account access, fraud prevention and other trust-critical digital journeys, the ability to verify their identity via digital credentials users have stored in Google Wallet.

OneID's network approach is designed to help organisations adapt as digital identity ecosystems continue to evolve. Rather than committing to a single identity provider, wallet or national scheme, organisations can access a broad range of trusted verification methods through a common verification framework and evidence model.

Originally established in the United Kingdom, OneID has become recognised for delivering high-assurance digital verification using regulated and trusted data sources worldwide. The company is certified against the UK Government's Digital Identity and Attributes Trust Framework and GPG45 standards, providing organisations with confidence that identity evidence is collected, verified and governed to rigorous standards.

The expansion of the Digital Verification Access Network reflects a wider shift towards reusable digital credentials and user-controlled identity. Consumers increasingly expect to prove identity, age, eligibility and authority using trusted credentials they already possess, while organisations require reliable evidence, auditability and stronger fraud protection.

By bringing together verification from banks, digital wallets, governments, mobile networks and electronic identity schemes, OneID helps organisations navigate a rapidly changing identity landscape through a single trusted integration.

The trillion pound question: who verifies the agent?

The OneID Team® — Wed, 30 Sep 2026 09:22:24 GMT

OneID and the trust layer for agentic commerce

AI agents are moving from recommending purchases to making them. They'll handle the weekly shop, renew insurance, book travel and run B2B procurement. McKinsey estimates the agentic commerce opportunity at $3–5 trillion by 2030.

Card networks, wallet platforms and AI providers are building the rails that let agents pay, and they're moving fast. What remains unsolved is trust, and that is what will decide how quickly this market grows.

The trust gap merchants can't absorb

Payment infrastructure assumes a human is present when a purchase is authorised. A card authorisation proves the card is valid and funds are available. It doesn't prove that an agent acted for a verified person, that the person approved this specific purchase, or that the agent stayed within its limits.

That leaves merchants exposed. Compromised or rogue agents can transact at machine speed, and customers can plausibly dispute purchases their agents made. If the merchant can't prove authority, the merchant takes the loss. The question isn't whether agents can buy. It's whether merchants can safely sell to them.

What OneID is building

OneID is extending its identity platform to become the independent trust layer for agentic commerce, binding a verified human, their approved intent and the limits of their authority to every agent-led transaction.

Before an agent acts, the proposed transaction is shown to the user through OneID's own trusted interface rather than the agent's, so an agent can't present one thing and do another. The user approves it in a single action, and OneID cryptographically signs the mandate against their verified identity. Users set limits on spend, merchant categories, frequency and data sharing, and the platform enforces them. Every action produces audit-grade evidence that holds up in a dispute. A real-time risk engine can pause or revoke authority when an agent's behaviour looks wrong.

Why OneID is positioned to lead

This builds on assets OneID already has. Our Digital Verification Service is certified under the UK Digital Identity and Attributes Trust Framework, which is a meaningful barrier to entry. Our orchestration layer already connects bank identity, government credentials, digital wallets and document verification, and agentic commerce needs that global reach from day one.

Neutrality matters just as much. Payment networks and wallet platforms are incentivised to enable transactions, not to protect merchants from liability, and none of them is a cross-platform identity authority. OneID can serve every participant. As transaction volume grows, our reputation data, which links verified identity, agent behaviour and merchant outcomes, becomes a compounding advantage that is hard to replicate.

The opportunity reaches well beyond retail, into marketplaces, subscriptions, travel, financial services, procurement and regulated sectors where eligibility has to be proven.

Execution is being solved. Trust is the opportunity, and OneID is building the infrastructure to capture it.

The Compliance Challenges of Agentic Commerce

The OneID Team® — Fri, 25 Sep 2026 13:41:40 GMT

The Identity Problem

In traditional commerce, the identity question is straightforward. A person visits a website, identifies themselves through a login or a payment credential, and completes a transaction. The merchant knows who the buyer is.

In agentic commerce, an AI agent sits between the buyer and the merchant. The merchant receives a transaction request from software, not a person. The fundamental question becomes: who authorised this action, and how can the merchant verify that?

This is not a theoretical concern. Payment networks are already publishing frameworks that emphasise mandates, scoped permissions, and cryptographic proof of intent. Visa has introduced its Trusted Agent Protocol, a standards-based framework for verifying agent identity and intent in real time. Mastercard has launched Agent Pay with Agentic Tokens that tie AI agents to individual users through tokenisation technology.

The challenge is that most digital commerce systems are still designed around behavioural inference: click patterns, device signals, session flows, and historical activity. These signals weaken significantly when agents act asynchronously, operate across multiple platforms, and transact without direct human interaction.

Delegation and Authority

When a person delegates purchasing authority to an AI agent, that delegation needs to be explicit, scoped, revocable, and auditable.

Explicit means the person consciously granted the agent permission to act. Scoped means the agent can only operate within defined limits, whether spending caps, merchant restrictions, product categories, or time windows. Revocable means the person can withdraw authority at any time. Auditable means there is a complete record of what was authorised, what was executed, and what the outcome was.

Current agentic commerce protocols handle some of this at the transaction level. ACP uses Shared Payment Tokens scoped to specific merchants and amounts. UCP supports modular capabilities that merchants can choose to adopt. But the broader question of ongoing delegation governance, where a person grants standing authority to an agent across multiple contexts over time, requires identity infrastructure that sits beneath the commerce layer.

The Liability Question

When an AI agent makes a purchase that is later disputed, who is responsible?

If the agent ordered the wrong product because it misinterpreted the buyer's instructions, is that the fault of the buyer, the AI provider, or the merchant? If an agent was manipulated by a fraudulent listing, who bears the loss? If an agent exceeded its spending authority, can the buyer reverse the transaction?

Existing consumer protection regulations were built on the assumption that a human initiated the transaction. Error resolution and liability protections under regulations such as the UK Consumer Rights Act and payment standards like those from the Payment Systems Regulator assume a person made the purchasing decision. An AI agent does not fit neatly into these frameworks.

Legal analysis from firms including Crowe and Torys has noted that this accountability gap could result in liability shifting unpredictably between the user, the merchant, the platform, and the AI provider. Businesses entering agentic commerce need to define these boundaries explicitly in their terms, contracts, and operational procedures.

Regulatory Gaps

No comprehensive regulatory framework for agentic commerce exists anywhere in the world as of early 2026.

The EU AI Act, the most ambitious AI regulation to date, predates agentic commerce and contains no specific provisions for autonomous purchasing agents. Data protection laws like UK GDPR address how personal data is processed but do not contemplate scenarios where AI agents process data across multiple merchants in a single automated workflow.

Financial services regulation presents particular challenges. Anti-money laundering programmes and Know Your Customer requirements were designed around human identity. When an agent initiates a financial transaction, questions arise around beneficial ownership, transaction monitoring, and sanctions screening that existing frameworks do not cleanly resolve.

The industry is not waiting for regulators to catch up. The Linux Foundation established the Agentic AI Foundation in late 2025, backed by Anthropic, Google, Microsoft, OpenAI, and others, focused specifically on interoperability, identity, and payments infrastructure for autonomous commerce.

The Fraud Problem

Agentic commerce creates new opportunities for fraud. Visa reported a 450% increase in dark web posts mentioning "AI Agent" in the six months to early 2026 compared to the prior period.

The risks include agent impersonation, where bad actors create agents that mimic legitimate purchasing behaviour; credential harvesting through agent interactions; and the creation of fraudulent merchant networks designed to exploit autonomous purchasing flows. Traditional fraud detection systems were built to flag anomalies for human review, but agents can spin up thousands of targeted operations rapidly, adapting in real time to detection measures.

This is why compliance infrastructure, rather than behavioural monitoring alone, is critical to the agentic commerce ecosystem. Proving agent authority through verifiable credentials, binding identity to transactions cryptographically, and generating immutable audit trails provides a fundamentally stronger foundation than inferring legitimacy from behavioural patterns.

Frequently Asked Questions

What are the compliance challenges for agentic commerce?

The main compliance challenges are: proving who authorised an AI agent to act (identity), defining what the agent is permitted to do (delegation), determining who is liable when transactions are disputed (liability), navigating regulations designed for humans rather than agents (regulatory gaps), and preventing new forms of fraud targeting autonomous purchasing flows.

Who is liable when an AI agent makes a wrong purchase?

Liability is currently unclear. Existing consumer protection laws assume a human initiated the transaction. The responsibility could fall on the buyer, the AI provider, the merchant, or the platform depending on the circumstances. Legal experts recommend that businesses define liability explicitly in their contracts and terms of service before entering agentic commerce.

Is there a regulation specifically for agentic commerce?

No. As of early 2026, no jurisdiction has enacted regulation specifically addressing agentic commerce. The EU AI Act predates the technology, and financial regulations do not contemplate autonomous AI agents. Industry-led standards from organisations including the Linux Foundation's Agentic AI Foundation are filling the gap while regulators develop frameworks.

What is Know Your Agent?

Know Your Agent is an emerging concept that extends traditional Know Your Customer (KYC) principles to AI agents. It involves verifying the identity of the agent, confirming the human or organisation that owns it, validating its authorisation to act, and maintaining an audit trail of its actions. Several compliance providers, including OneID, are developing infrastructure to support this requirement.

2026: The year agentic commerce meets identity reality

The OneID Team® — Fri, 25 Sep 2026 13:41:21 GMT

Agentic commerce is already operating inside live retail, payments, and platform environments. For Partnership Managers across e-commerce platforms and the Financial Services industry, the focus in 2026 is less about capability and more about control.

As AI agents take on delegated authority to research, select, and complete transactions, the underlying question becomes harder to ignore. When software initiates an action, how does a platform prove that the decision was authorised by a real person, within agreed limits, and with clear accountability?

The answer is identity.

When software acts, behavioural trust stops scaling

Most digital commerce systems are still designed around behavioural inference. Click patterns, device signals, session flows, and historical activity are used to determine whether an action appears legitimate.

That approach weakens when agents act asynchronously, operate across platforms, and transact without direct human interaction. An agent can behave consistently while still acting outside the authority originally granted to it. Familiar patterns no longer guarantee authorised outcomes.

In agent-led environments, platforms need stronger proof. They need to know who authorised an action, what authority was granted, and whether the agent stayed within those boundaries when it acted.

Behaviour can signal risk. It cannot carry accountability.

The credentials agentic commerce depends on

Agentic commerce introduces a structural requirement that existing commerce systems were not built to handle. Authority has to be explicit, enforceable, and attributable at the moment an agent acts.

That requirement separates three credentials that agent-led transactions rely on.

Payment credentials authorise the movement of funds. These already exist in tokenised form across cards, accounts, and wallets. In agentic commerce, they need to be enforced against delegated limits, not just ownership.

Identity credentials prove who the human principal behind an agent is. Agents can be instantiated, replaced, or delegated tasks. Identity has to persist independently of the software executing the action.

Intention credentials define what an agent is allowed to do on someone’s behalf. Spending caps, merchant restrictions, time limits, and delegation scopes set the enforceable boundaries within which an agent can act.

Together, these credentials replace inference with proof and assumption with accountability.

Where OneID® fits in agent-led commerce

OneID® can issue certified identity credentials that bind an agent’s actions back to a verified individual. Our role will be to prove who is behind a decision and whether that person authorised the action within defined limits, rather than directing or interpreting the agent’s behaviour.

In large-scale platform and financial services environments, identity credentials can provide a consistent way to establish accountability when agents initiate transactions, regardless of which agent software or interface is involved.

“Agentic commerce only works when trust between parties is proven. At OneID, we don’t just verify who an agent is acting for - we bind identity, authority, and intent into a single, provable transaction. That means liability doesn’t sit with the retailer, the platform, or the AI agent. It sits exactly where it should: with the verified individual or organisation that authorised the action. This is what allows agent-led transactions to scale safely, legally, and with confidence.”

Karl MacGregor, CEO at OneID®

Delegation, permissions, and auditability in live environments

Agentic commerce makes delegation unavoidable. People act in different roles and grant authority accordingly. A parent, a manager, or a partner may delegate limited powers to an agent or another person for specific purposes.

That delegation must be explicit, scoped, revocable, and auditable.

OneID®'s approach centres on verified identities which have delegations and permissions. Agents operate within defined autonomy limits. If those limits are exceeded, control returns to the human. Each action can be traced back to who authorised it, under what conditions, and for how long.

For platforms, this creates clearer boundaries around who authorised an action and within what limits, reducing ambiguity when agents operate across services and partners. For financial services, it supports auditability, clearer liability attribution, and regulatory confidence as agent-led transactions become routine.

Why this matters for partnerships in 2026

For Partnership Managers, agentic commerce changes the shape of platform risk.

Unauthorised agent actions create exposure across merchants, platforms, and payment providers. Behavioural controls alone struggle to demonstrate that a transaction was properly authorised. Payment networks and major platforms are already publishing frameworks that emphasise mandates, scoped permissions, and cryptographic proof of intent.

Identity credentials that support ongoing verification, delegated authority, and audit trails are becoming foundational infrastructure.

OneID®'s focus on certified identity and permissions enables partners to support agent-initiated commerce while maintaining confidence in who is accountable when something goes wrong.

Looking ahead

Agentic commerce promises speed, convenience, and scale. Delivering on that promise depends on trust models that match the reality of delegated, automated action.

In 2026, identity becomes an active control layer inside agent-led transactions. Platforms that embed identity, permissions, and auditability into their agentic workflows will be better positioned to partner, comply, and scale as agentic commerce becomes part of everyday digital operations.

“As agent-led transactions become routine, trust can’t sit in the background. Identity has to be tightly bound to the payments and permissions, from the moment an action is taken.”

Keith Mabbitt, CCO at OneID®

If you’re exploring how agentic commerce will impact your platform or financial ecosystem, and how certified identity credentials can support it, speak to OneID®'s partnerships team to continue the conversation.

What Is the Agentic Commerce Protocol?

The OneID Team® — Fri, 25 Sep 2026 13:41:13 GMT

Why Protocols Matter

In traditional e-commerce, a human navigates to a website, browses products, and checks out through the merchant's own payment page. The entire transaction happens within systems designed for people.

Agentic commerce breaks that model. When an AI agent initiates a purchase, it needs a structured way to communicate with the merchant's systems: requesting product information, building a cart, handling payment credentials securely, and confirming the order. Without a shared standard, every AI platform would need a bespoke integration with every merchant, creating an unworkable complexity.

Protocols solve this. They create a common language so that a single integration allows a merchant to sell through any compatible AI agent.

How ACP Works

ACP defines a set of REST API endpoints that merchants implement to make their checkout accessible to AI agents. The flow follows a clear sequence.

The buyer expresses intent through an AI interface, such as ChatGPT. The agent sends a checkout request to the merchant. The merchant returns the current state of the cart, including available payment methods, shipping options, and totals. The agent renders this to the buyer. Once the buyer confirms, the agent provisions a Shared Payment Token, a new payment primitive from Stripe that allows the AI platform to initiate payment without exposing the buyer's actual payment credentials. The token is scoped to that specific merchant and cart total. The merchant processes the payment through their existing provider and confirms the order.

Throughout this process, the merchant remains the merchant of record. They retain control over what products are sold, how they are presented, and how orders are fulfilled. The AI agent acts as an intermediary, not a marketplace.

ACP and UCP: Two Standards, One Direction

In January 2026, Google released the Universal Commerce Protocol at the National Retail Federation conference. UCP takes a broader scope than ACP, covering the full commerce journey from product discovery through to post-purchase support including returns and order tracking.

UCP was co-developed with Shopify, Etsy, Wayfair, Target, and Walmart, and endorsed by over 20 partners including Visa, Mastercard, American Express, Adyen, and Stripe. It is designed to be interoperable with existing protocols including ACP, Agent2Agent (A2A), Agent Payments Protocol (AP2), and Model Context Protocol (MCP).

The two protocols are complementary rather than competing. ACP focuses on the checkout transaction. UCP standardises the full lifecycle. Both are open source and both aim to prevent the same problem: merchants having to build separate integrations for every AI agent that wants to sell their products.

The Compliance Gap

Both ACP and UCP address the mechanics of transactions, but the question of identity and compliance sits alongside them. When an agent acts on behalf of a person, someone needs to prove that the action was authorised. Both protocols include payment security through tokenisation and scoped permissions, but the broader questions of agent identity, delegation authority, and regulatory compliance require additional infrastructure.

This is the layer where compliance providers operate. Proving who authorised an agent action, what limits applied, and whether the transaction was permissible under applicable regulations requires identity verification, delegation credentials, and audit-grade evidence. As Visa, Mastercard, and others have noted, these capabilities will be foundational to agentic commerce scaling safely.

Frequently Asked Questions

What is the Agentic Commerce Protocol?

The Agentic Commerce Protocol (ACP) is an open standard created by OpenAI and Stripe that defines how AI agents and merchants communicate to complete purchases. It includes specifications for checkout, payment handling, and order confirmation, and is open-sourced under the Apache 2.0 licence.

What is the difference between ACP and UCP?

ACP, developed by OpenAI and Stripe, focuses on the checkout transaction between an AI agent and a merchant. UCP, developed by Google with partners including Shopify and Walmart, covers the full commerce journey from discovery to post-purchase support. Both are open source and designed to be interoperable.

Can merchants use both ACP and UCP?

Yes. The protocols are designed to work alongside each other. Stripe is an endorsed partner of both standards. A merchant implementing UCP can also support ACP-compatible agents, and vice versa. The aim is interoperability, not exclusivity.

Who is already using ACP?

As of early 2026, ACP powers Instant Checkout in ChatGPT. US-based Etsy sellers were the first merchants, with over one million Shopify merchants including Glossier, SKIMS, Spanx, and Vuori announced as coming soon. Salesforce has also announced ACP integration for its Agentforce Commerce platform.

Age assurance records: what a regulator can ask for

The OneID Team® — Fri, 25 Sep 2026 13:39:11 GMT

Ofcom fined Fenix International, the operator of OnlyFans, £1.05 million for failing to provide accurate information about its age assurance measures. Ofcom lists that penalty in its guidance on responding to information requests, updated 11 April 2025.

Compliance plans tend to be built around keeping a log of every check. Age assurance records do a narrower job. They let a service give a regulator an accurate written description of the methods it uses, by the deadline the notice sets.

Do you have to keep records of every age check?

No. As at 17 August 2026, no regulator has imposed a per-user, per-check audit trail for age assurance. What UK law requires is a written record of the methods a service uses and how it uses them, its risk assessment, its children’s access assessment, and an accurate and timely answer to any information notice Ofcom serves.

What the Online Safety Act actually requires you to keep

Three record duties matter here, and they sit in different parts of the Act.

Section 36(7) requires a provider to make and keep a written record, in an easily understandable form, of every children’s access assessment. Those assessments are needed at intervals of no more than a year where a service is not treated as likely to be accessed by children, before any significant change to design or operation, and where evidence shows a significant increase in child users.

Section 23 carries the record-keeping and review duties for user-to-user services. A provider must keep a written record of all aspects of every risk assessment, and a record of any measures taken or in use to comply with a relevant duty described in a code of practice. Where a provider uses something other than a measure the code recommends, it must record which measure it did not take, what it did instead, how that achieves compliance, and how it satisfies the freedom of expression and privacy requirements. It must also review compliance regularly, and as soon as reasonably practicable after any significant change to the design or operation of the service.

Age assurance is not named in section 23. It arrives as a measure taken or in use, which means the record of your age assurance is part of your measures record rather than a document of its own. Our guide to the Online Safety Act age verification duties sets out the underlying duties those measures answer to.

Section 81 is the only place in the Online Safety Act where a record duty names age checks directly, and it applies to Part 5 services alone. For services publishing their own pornographic content, a provider must make and keep a written record of “the kinds of age verification or age estimation used, and how they are used”, and of how it had regard to protecting UK users from a breach of privacy law when deciding. It must also summarise that record in a publicly available statement.

What Ofcom can compel

Section 100 lets Ofcom require a person to provide any information it needs to exercise, or to decide whether to exercise, its online safety functions. It can require a person to obtain or generate information that does not already exist, to provide information about the use of a service by a named individual, and to permit remote viewing of systems, processes, functionalities and algorithms in real time, including information generated by a test or demonstration.

Section 102 turns that into an information notice, and section 102(8) sets the duty: a recipient must act in accordance with the requirements of the notice, and must ensure that the information provided is accurate in all material respects. Accuracy sits alongside timeliness as a separate limb, which is why a penalty can follow a full and punctual response that turns out to be wrong.

The maximum penalty Ofcom can impose is the greater of £18 million and 10 per cent of qualifying worldwide revenue. Section 109 creates criminal offences including providing information known to be false or with reckless disregard for whether it is false, and section 110 extends criminal liability to a named senior manager who failed to take reasonable steps to prevent such an offence.

Section 100(2) creates no standing duty to log anything. In practice a service can be told to produce something it never collected, to Ofcom’s timetable.

Which age assurance records are required, and where each duty sits

What	Where	What it covers
Children’s access assessment record	Online Safety Act 2023, s36(7), Part 3 services	Every assessment, in writing, in an easily understandable form
Risk assessment and measures record	s23, Part 3 user-to-user services	All aspects of every risk assessment, and any measures taken or in use, including alternatives to code measures and why they work
Age assurance record	s81, Part 5 services only	The kinds of age verification or estimation used and how they are used, plus a public summary
Accurate answer to an information notice	s102(8)	Complete, accurate in all material respects, by the deadline
Data protection impact assessment	UK GDPR, where age assurance is likely to be high-risk processing, read with ICO expectations	The age assurance process assessed against the data protection principles, and reassessed for continued fitness
Review cadence	s23	Regularly, and after any significant change to design or operation

No regulator requires a log of every check

As at 17 August 2026 there is no per-check audit duty in the Online Safety Act 2023, in Ofcom’s guidance, in the Australian Online Safety Act 2021, in eSafety’s guidance, in the Digital Services Act, or in ICO guidance. Where a vendor or a guide says otherwise, ask which provision it is relying on.

The Information Commissioner has been explicit in the other direction. Its opinion on age assurance for the Children’s code, published in January 2024 and under review following the Data (Use and Access) Act 2025, states that where a hard identifier is used to assess age, a service may only need to retain a yes or no output once the check is complete. The same opinion says that in many cases seeing an official document such as a passport or driving licence may be excessive, because a method processing less personal information can still be proportionate to the risk.

The record duties call for documents that describe a system. Ofcom’s information powers are wider, and they reach information about the use of a service by a named individual. The limit lies in what a service is obliged to have kept in advance, which does not include the evidence behind each check, and data protection law points away from holding it.

Australia asks for the evidence and requires the data destroyed

Australia pairs an active regulator with a statutory duty to destroy. Under the social media minimum age provisions of the Online Safety Act 2021, as set out in Australian Information Commissioner guidance dated 23 October 2025, platforms and age assurance providers must not use or disclose personal information collected for age assurance for any purpose other than determining whether the individual is age-restricted, and must ringfence and destroy it. The same provisions bar a platform from collecting government-issued identification for age assurance unless a reasonable alternative method is also offered.

At the same time, eSafety issued 23 legally enforceable information-gathering notices to 10 platforms in the first three months of its social media minimum age obligation, and five of those platforms became the subject of active investigations. Those figures come from its compliance update of March 2026, and no later update was published as at 17 August 2026.

A platform served with one of those notices has to describe its methods and its escalation behaviour while holding almost none of the underlying personal data. That leaves its method-level records and its documented process.

Australia’s bill and Ofcom’s October deadline

A bill before the Australian Parliament would roughly double the maximum penalty and let the Commissioner issue directions requiring platforms to produce evidence demonstrating the steps they have taken to prevent under-16s obtaining accounts. The power would extend to third parties, including age assurance providers and app stores. A Senate-referred inquiry is due to report by 25 August 2026. As at 17 August 2026 it remains a bill and not law, and it is the closest any jurisdiction has come to a produce-the-evidence power on age checks.

In the UK, Ofcom must deliver a rapid assessment to Parliament by the end of October 2026 on what highly effective age checks look like in practice for determining whether someone is over 16. Its July 2026 report already tells services to conduct vendor due diligence and to review their existing age assurance against identified areas for improvement as a matter of urgency.

Records worth keeping that no rule requires

None of the following is a legal duty as at 17 August 2026. Services that answer an information notice comfortably tend to hold most of it anyway.

Prudent practice	Why a service keeps it
Per-check metadata: method used, timestamp, outcome, escalation path	Answers a question about a specific period without generating the answer from scratch
Vendor due diligence files, including certification evidence for every provider in the chain	Ofcom’s July 2026 report asks services to conduct this due diligence
A retention schedule covering what is kept and for how long	Makes the data protection impact assessment checkable against actual behaviour
Completion and failure rates by method	The only way to know whether a check is refusing eligible users
A written record of how a threshold or challenge age was chosen	The reasoning is what a regulator asks about, and it is rarely written down at the time
A documented escalation policy for an inconclusive result	eSafety treated repeated identical attempts as insufficient in its March 2026 compliance update

Where OneID fits

As at 17 August 2026, OneID Limited is listed on the UK digital verification services register for the identity, attribute, orchestration and holder service provider roles, certified against the DVS trust framework. It covers five of the seven methods Ofcom names as at August 2026 as capable of being highly effective: open banking, photo ID matching, facial age estimation on-device through Regula, mobile network operator age checks, and digital identity services.

Because a check is routed across methods from one integration, a service describes one process to a regulator instead of one process for every method it has added separately. The platform receives an age result rather than a document, and the check runs without the platform collecting or retaining identity documents. Nothing in the written description a service produces depends on keeping personal data. Our piece on the Data (Use and Access) Act 2025 and age checks covers what certification against the framework does and does not tell a buyer.

For the person being checked, none of that is visible. Someone who has verified once confirms through their banking app or a credential they already hold, with no document to photograph and nothing to upload.

Work out which age assurance records you could produce today if an information notice arrived tomorrow. Our six criteria for choosing an age assurance method treats that as one of six things worth scoring, and our global briefing on age assurance records and requirements sets out what each of the jurisdictions it covers currently expects.

Frequently asked questions

How much notice does Ofcom have to give? Section 102(3) requires an information notice to specify the information sought, why Ofcom require it, and the form, manner and timing of the response. Where the notice requires remote viewing of systems under section 100(3), section 102(5) sets a minimum of seven days’ notice. Other deadlines are set in the notice itself.

What records does Ofcom require about age assurance? For user-to-user services, age assurance sits inside the section 23 record of measures taken or in use, alongside the written risk assessment. Section 36(7) requires a written record of every children’s access assessment. Only section 81, covering services publishing their own pornography, names age verification and estimation directly.

What is an Ofcom information notice? A notice under section 100 requiring a person to provide information Ofcom needs for its online safety functions. The information does not have to exist already: Ofcom can require it to be generated, and can require remote viewing of systems in real time. Section 102(8) obliges the recipient to comply, accurately in all material respects.

What happens if we get the information wrong rather than late? Accuracy is a separate limb of the duty, so a response that is inaccurate in a material respect breaches it even when it arrives on time. Ofcom has fined the operator of OnlyFans £1.05 million for failing to provide accurate information about its age assurance measures. Section 109 also creates criminal offences for knowingly false information.

Should we store the documents used to verify a user’s age? The Information Commissioner’s position points the other way. Its 2024 opinion on age assurance, now under review, says that where a hard identifier is used, a service may only need to retain a yes or no output once the check is complete, and that seeing an official document may in many cases be excessive. Australia’s social media minimum age rules require such data to be destroyed.

Is a per-check record worth building if no regulator requires it? It is a commercial judgement, and no regulator requires it as at 17 August 2026. Both Australia and the UK are moving that way. An Australian bill would let the regulator direct platforms to produce evidence of the steps they have taken, and a Senate inquiry on it reports by 25 August 2026. Assembling that record under a notice costs considerably more than holding it.

Online Identity Verification in 2026: where regulation, risk and user experience are converging

The OneID Team® — Fri, 25 Sep 2026 13:38:28 GMT

Online identity verification entered a new phase in 2025. Across adult platforms, gambling, financial services, crypto and online safety, identity checks moved from being a back-office compliance task to something that directly shapes product design, conversion and trust.

As we enter 2026, businesses must ask themselves how they’re delivering identity checks at scale without damaging user experience, and how are they mitigating increased data risk and fragmenting platforms with point solutions.

Below, we dive into the state of online identity verification at the end of 2025, and how those requirements are expected to evolve in 2026.

Online Safety Act age verification and Ofcom-approved assurance

The most immediate regulatory shift in 2025 came from the UK Online Safety Act. From July 2025, services hosting pornographic content were required to implement “highly effective age assurance” to prevent children from accessing adult material.

Ofcom’s guidance made clear that self-declaration and simple tick-boxes do not meet this threshold. Instead, services must use age verification methods that are robust, privacy-preserving and resistant to circumvention.

In 2026, this is expected to evolve in scale. Ofcom has confirmed that enforcement will extend beyond adult platforms to user-generated content, live streaming, dating and social services where age risk is material. Platforms that implemented one-off solutions in 2025 are already reassessing whether those tools will hold up as volumes increase and scrutiny tightens.

Gambling, financial services and automated KYC checks

In parallel, regulated sectors continued to face pressure to modernise KYC and onboarding.

The UK Gambling Commission reinforced its expectations around age and identity verification as part of customer due diligence, particularly where operators rely on third-party suppliers. The Commission’s Remote gambling and software technical standards require operators to verify customer age and identity before permitting gambling activity.

In 2025, regulated sectors continued to face pressure to modernise onboarding and customer due diligence. Gambling operators, lenders, payments firms and marketplaces are all balancing the same tension: stronger assurance and lower tolerance for fraud, without adding steps that push genuine users away.

In the UK, financial services regulation also kept moving towards outcomes-based expectations. Under the FCA’s guidance on digital identity, firms can use digital identity systems to support customer due diligence where it is appropriate for the risk, and where the approach is reliable and auditable. That has accelerated interest in automated KYC checks that rely on authoritative sources, rather than repeated document uploads and manual review.

Crypto, synthetic identity fraud detection and ongoing assurance

Crypto platforms entered 2025 under increased international pressure to strengthen onboarding and monitoring. While UK crypto regulation remains transitional, firms registered under the Money Laundering Regulations are required to apply customer due diligence and ongoing monitoring. This is in part due to HM Treasury’s Cryptoasset regulation, where a phase one consultation in 2023 confirmed that moving forward, identity verification expectations will increasingly align with traditional financial services.

This has sharpened focus on synthetic identity fraud detection and the limits of document-only checks. Static identity evidence struggles to surface fabricated identities that pass basic validation but lack real-world footprint. As a result, 2026 is expected to see wider adoption of perpetual KYC solutions that can re-verify attributes against live data sources over time.

e-KYC frameworks and interoperability heading into 2026

By the end of 2025, identity verification across regulated sectors had begun to shift away from isolated, one-off checks. Instead, platforms are increasingly designing identity as reusable infrastructure, where verified attributes can support multiple interactions over time.

This change has been driven by practical pressure rather than new legislation. Repeating full identity checks at every touchpoint increases abandonment, raises data-handling risk, and creates operational overhead. In response, more organisations are separating the act of verification from the act of storage, relying on trusted third parties to confirm attributes when needed rather than holding sensitive data themselves.

Heading into 2026, this model is expected to become more common across onboarding, age-restricted access, account recovery and payments. Identity checks are still required, but they are increasingly embedded into user journeys in ways that are faster, more proportionate, and easier to reuse across services.

For partnership teams, the implication is clear. Platforms that treat identity as shared infrastructure are better positioned to scale across sectors and geographies, without layering additional friction or duplicating compliance effort for every new use case.

Where this leaves OneID in 2026

By the end of 2025, it became clear that identity verification works best when it is seamless, reusable and anchored in trusted sources. Solutions that rely heavily on document uploads or repeated checks are increasingly difficult to justify at scale, particularly in conversion-sensitive environments.

OneID’s role as an orchestration layer reflects this shift. By enabling organisations to verify identity and age through banks, mobile networks and other authoritative sources, without storing personal data, it aligns with the direction regulation is already moving.

As enforcement broadens in 2026, the platforms that succeed will be those that treat online identity verification as shared infrastructure rather than a bolt-on control.

Looking ahead

The next twelve months will be less about new laws and more about how existing ones are applied. Online Safety Act enforcement, tighter expectations around KYC, and growing awareness of synthetic identity risk are converging on the same conclusion.

Identity needs to be high-assurance, privacy-safe, and designed for reuse.

If you’re assessing how your platform, partners or customers will meet that bar in 2026, learn how OneID can get you set up in less than 24 hours.

What Is Agentic Commerce?

The OneID Team® — Fri, 25 Sep 2026 13:38:12 GMT

How Agentic Commerce Works

In traditional e-commerce, a person does everything: they search for a product, read reviews, compare prices across multiple tabs, add an item to a basket, enter their payment details, and confirm the order. Agentic commerce shifts part or all of that process to an AI agent.

A simple example: you tell an AI assistant to find running shoes under £80 with good arch support and next-day delivery. The agent searches multiple retailers, compares specifications, checks stock availability, and presents the best options. In more advanced implementations, the agent completes the purchase without you clicking anything at all.

The key distinction is autonomy. A chatbot that recommends a product but waits for you to press "buy" is conversational commerce. An agent that completes the entire purchase within agreed parameters is agentic commerce.

Why It Matters Now

Several things have converged in 2025 and early 2026 to move agentic commerce from concept to reality.

First, the AI models have become capable enough to handle multi-step tasks reliably. Modern agents can reason through a shopping decision, call external APIs, compare structured product data, and execute a checkout flow.

Second, the infrastructure now exists. In September 2025, OpenAI and Stripe launched the Agentic Commerce Protocol, an open standard that lets AI agents complete purchases inside ChatGPT. In January 2026, Google released the Universal Commerce Protocol at the National Retail Federation conference, co-developed with Shopify, Etsy, Wayfair, Target, and Walmart, with endorsement from over 20 global partners including Visa, Mastercard, and American Express.

Third, consumer behaviour is already shifting. An IBM Institute for Business Value study found that 45% of consumers already use AI for part of the buying journey. Half of all consumers now use AI when searching the internet, according to McKinsey.

Levels of Automation

Not all agentic commerce looks the same. McKinsey describes an "automation curve" with distinct levels.

At the lowest level, automation handles simple recurring purchases like subscription refills. This is what services like Amazon Subscribe and Save already do.

At the next level, agents assist with one-off purchases. You describe what you want, the agent finds options and presents them, but you still confirm the final purchase.

At higher levels, agents operate against standing goals rather than single transactions. For example, "keep household essentials under £250 per month" or "maintain my airline loyalty status at the lowest cost". The agent continuously monitors, anticipates needs, and acts accordingly.

Higher automation is not always better. The goal is not maximum autonomy but optimal delegation. People will happily automate the reorder of washing powder. They are far less likely to delegate the purchase of a holiday or a car.

What This Means for Businesses

For businesses, agentic commerce changes the fundamental question of who the customer is. Your next customer might not be a person browsing a website. It might be an AI agent evaluating your product data, checking your stock levels, and completing a purchase on someone's behalf.

This has implications for product data quality, API accessibility, and, critically, for identity and compliance. When an agent makes a purchase, the business still carries legal liability. Someone needs to prove that the person behind the agent authorised the transaction, that spending limits were respected, and that regulatory requirements were met. This is where compliance infrastructure becomes essential.

Frequently Asked Questions

What does agentic commerce mean?

Agentic commerce means AI agents acting autonomously to research, compare, and purchase products or services on behalf of a human or business. The word "agentic" comes from "agency", meaning the capacity to act independently within defined parameters.

How is agentic commerce different from conversational commerce?

In conversational commerce, you chat with an AI that suggests products, but you still make the final purchasing decision. In agentic commerce, the AI agent can execute the purchase autonomously within the limits you have set. The simplest test: if the human clicks the buy button, it is conversational commerce. If the AI does, it is agentic commerce.

Is agentic commerce already live?

Yes. As of early 2026, ChatGPT users in the US can purchase from Etsy sellers directly within the chat, with over a million Shopify merchants coming soon. Google has announced native checkout in AI Mode in Search and the Gemini app through the Universal Commerce Protocol. Mastercard has launched Agent Pay technology for AI agent transactions.

What are the risks of agentic commerce?

The primary risks are around identity, liability, and fraud. When software initiates a purchase rather than a person, businesses need to prove who authorised the transaction, what limits applied, and whether regulatory requirements were met. Existing legal frameworks were designed for human decision-makers, creating gaps around consent, contract formation, and dispute resolution that the industry is actively working to close.