Back to Insights
Identity & Regulation3 min read

IDLock and DVS checks: what Australian businesses need to know before 2027

Australia's upcoming IDLock service will let individuals protect their identity documents from DVS checks. What it could mean for customer verification, onboarding and AML/CTF compliance.

SA
Brisbane, Australia
October 2026

On 31 August 2026, the Attorney-General announced IDLock, a new service accessible through myGov that will let Australians block and unblock verification of eligible identity documents through the Document Verification Service (DVS).[2] It is not available yet. A small early-access group comes first, with a national rollout planned for 2027.[1, 2]

What exists today

IDLock builds on something already in place: the Credential Protection Register. The government set it up in 2022, after the large data breaches of that year. When an agency knows a document has been compromised, it can add that document to the register. From then on, the document can't be verified through the DVS, but it still works for its main purpose; a passport on the register can still be used to travel.[1]

As reported in August 2026, the register had blocked more than 830,000 fraudulent verification attempts since late 2022, averaging around 18,000 per month.[2]

Today, document issuers can add compromised documents to the register. Individuals cannot directly lock or unlock their documents themselves.[1]

What IDLock adds

IDLock gives that control to the individual. Through myGov, people will be able to:[1]

  • lock an eligible document so it can't be verified through the DVS;
  • unlock it when they need to use it;
  • receive notifications about DVS verification checks involving their enrolled documents;
  • see whether their documents are protected.
The Credential Protection Register blocks DVS verification of protected documents.

What it could mean for businesses that check ID

The Credential Protection Register already prevents protected documents from being verified through the DVS.[1] What IDLock changes is who can initiate that protection. Once individuals can lock their own documents, businesses may encounter more verification attempts that cannot be completed even when customers are genuine.

An unsuccessful DVS check does not, by itself, establish fraud. Businesses will need procedures for handling unsuccessful checks, explaining the outcome to customers and deciding whether another verification method is appropriate. How IDLock-related restrictions will appear in DVS responses is yet to be confirmed.

The timing also lines up with two other changes:

  • AML/CTF Tranche 2. From 1 July 2026, businesses that provide certain designated services must carry out customer due diligence. This now includes some services offered by lawyers, accountants, conveyancers, real estate professionals, and trust and company service providers. Not every professional activity is regulated.[4]
  • The Privacy Act. From 10 December 2026, organisations covered by the Australian Privacy Principles must include information in their privacy policies about certain computer-assisted decisions that use personal information and could significantly affect an individual's rights or interests.[7, 8]

How a business handles an unsuccessful identity check can touch both.

What businesses can prepare for now

Businesses using the DVS for customer onboarding or identity verification can start by reviewing how unsuccessful checks are handled.

Staff should know when to ask a customer to check their document details, when another verification method may be appropriate, and when an unresolved result needs further investigation.

For businesses with AML/CTF obligations, any alternative verification process must still satisfy the applicable customer due diligence requirements. Keeping a record of the method used and the reason for changing it helps show how the customer's identity was established.[5, 6]

Where we sit

In April 2026, GetPost Labs entered into a DVS Identity Service Provider Participation Agreement with the Attorney-General's Department.[3, 9] We also build Lex-AML for firms with AML/CTF obligations. We're following IDLock as it moves through early access and will update this page as the details firm up.

If you verify identity through the DVS and are thinking through the same questions, we're .

References

  1. Attorney-General's Department, Recovering your identity — Credential Protection Register and IDLock.
  2. The Hon Michelle Rowland MP, Attorney-General, New identity protection service ‘IDLock’ to give Australians greater control over identity documents. Media release, 31 August 2026.
  3. IDMatch, Australian Government, Document Verification Service Identity Service Provider Participation Agreement.
  4. AUSTRAC, About the AML/CTF reforms.
  5. AUSTRAC, Overview of initial customer due diligence.
  6. AUSTRAC, Identifying individuals who don't have standard ID.
  7. Office of the Australian Information Commissioner, New resources on transparency for use of AI and automated decision-making.
  8. Federal Register of Legislation, Privacy and Other Legislation Amendment Act 2024.
  9. Federal Register of Legislation, Identity Verification Services Act 2023.