Identity Assurance Level 2 (IAL2), as defined in the National Institute of Standards and Technology (NIST) Digital Identity Guidelines, establishes requirements for identity proofing that provide a high degree of confidence that an applicant is who they claim to be.

Achieving IAL2 involves more than validating personal information or authenticating a government-issued identification document. Organizations must collect and validate acceptable identity evidence, verify that the applicant is associated with the claimed identity, and meet applicable identity proofing and fraud mitigation requirements.

An effective IAL2 identity proofing workflow brings these checks together into a consistent, auditable process. It also needs to accommodate legitimate applicants who cannot complete the initial proofing path without compromising the required assurance level.

For example, an applicant may be unable to complete a mobile carrier account match despite having a legitimate identity. Alternative evidence paths can help prevent unnecessary abandonment while maintaining the applicable identity proofing requirements.

How ID Dataweb’s IAL2-certified identity proofing workflow works

ID Dataweb’s preconfigured IAL2 workflow guides applicants through remote identity proofing while applying risk-based policies to determine the appropriate verification path.

The workflow combines session risk assessment, identity attribute validation, identity evidence checks, and applicant verification. Each step contributes to determining whether the applicant satisfies the configured identity proofing policy.

1. Assess session risk

The workflow begins by evaluating device, network, and session risk signals for indicators of suspicious activity. This initial assessment helps identify potentially fraudulent interactions before the applicant proceeds through additional identity proofing steps.

Sessions that exceed configured risk thresholds can be denied or directed to additional checks, depending on the organization’s policy.

2. Validate identity attributes and evaluate mobile carrier records

The applicant provides their name, contact information, and other required identifying attributes.

ID Dataweb evaluates the submitted personally identifiable information (PII) against authoritative or credible identity data sources to identify inconsistencies and assess whether the claimed identity can be substantiated.

The workflow also checks whether mobile carrier records associate the submitted phone number with the claimed identity.

A successful carrier match may contribute supporting evidence, depending on the applicable NIST requirements and the strength of the evidence established. However, a carrier match alone does not establish identity proofing at IAL2.

3. Verify phone control and government-issued identity evidence

When the carrier account can be associated with the claimed identity, the applicant completes a phone control check using a single-use text link or confirmation code.

The applicant then captures an accepted government-issued identification document and a live selfie.

ID Dataweb’s Government ID and Selfie Match capability evaluates the document’s authenticity, performs presentation attack detection, and compares the live facial image with the portrait on the identity document.

Together, these checks help establish that the applicant is associated with the identity represented by the submitted evidence.

4. Provide an alternative evidence path when necessary

If the carrier account cannot be confirmed, the workflow can direct the applicant to an alternative identity proofing path.

For example, the applicant may be asked to provide two qualifying government-issued identity documents. The workflow validates the submitted evidence and compares the applicant’s live facial image with the document portraits.

The alternative path must satisfy the applicable IAL2 evidence and verification requirements. This allows legitimate applicants to continue without automatically weakening the identity proofing policy.

5. Return the identity proofing decision

Once the required checks have been completed, the workflow evaluates the results against the configured policy.

An approved outcome indicates that the applicant has satisfied the requirements of the selected identity proofing path. The integrating application can then use that result to determine whether to proceed with enrollment or another permitted action.

An incomplete or pending result indicates that additional steps may be necessary. A denied or abandoned journey must not be treated as successful identity proofing.

By connecting these checks into a single workflow, ID Dataweb helps organizations apply consistent identity proofing policies while accommodating applicants with different types of available evidence.

Establishing the connection between an applicant and their claimed identity

Validating identity evidence is only part of establishing trust.

An applicant may submit accurate personal information or a genuine identity document that belongs to someone else. Consequently, organizations must also verify that the applicant is the individual associated with the claimed identity.

NIST distinguishes between validating identity evidence and verifying the applicant’s association with that evidence.

Evidence validation establishes whether submitted evidence is genuine, accurate, and valid.

Identity verification establishes that the applicant is associated with the claimed identity represented by the evidence.

These processes support identity resolution and the broader identity proofing objective of establishing confidence in the applicant’s claimed identity.

ID Dataweb’s workflow supports these objectives through several complementary checks:

  • Compare the applicant with government-issued identity evidence. The workflow evaluates the authenticity of the submitted identity document and compares a live facial image of the applicant with the document portrait. Presentation attack detection helps identify attempts to deceive the biometric capture process, including certain forms of image or video manipulation. This establishes an important connection between the individual presenting the evidence and the identity represented by the document.
  • Correlate mobile carrier records with the claimed identity. A mobile carrier account match helps determine whether the submitted phone number is associated with the applicant’s claimed identity. A separate phone control check establishes whether the applicant can receive a single-use link or confirmation code through the submitted number. These checks serve different purposes. A carrier account match provides supporting identity information, while a phone control check demonstrates access to the number at the time of verification. Neither check should be treated as definitive proof of identity on its own.
  • Verify the applicant through alternative identity evidence. When mobile carrier records cannot support the initial path, the workflow can request additional qualifying identity documents. Document authentication and facial comparison help establish the applicant’s association with the alternative evidence. This approach provides flexibility without relying exclusively on mobile carrier data.

Together, these checks help organizations establish confidence that the individual completing the process is associated with the claimed identity. They also introduce barriers against impersonation, stolen identity evidence, and certain synthetic identity attacks.

Implementing and managing an IAL2 identity proofing workflow

Implementing an IAL2 identity proofing process requires more than integrating individual verification services.

Organizations must determine how evidence is collected, how verification results are evaluated, when additional checks are required, and which outcomes satisfy the applicable policy.

They also need operational visibility to investigate failed attempts, understand applicant abandonment, and maintain their workflows as requirements evolve.

ID Dataweb addresses these challenges through preconfigured workflow templates, no-code configuration, and transaction-level reporting.

Simplifying IAL2 identity proofing implementation

ID Dataweb provides a preconfigured identity proofing workflow template that combines verification steps and recommended policy rules into a coordinated process.

Without orchestration, application development teams must determine how individual verification services interact and how their results contribute to the final decision.

For example, successful document authentication does not automatically mean an applicant has satisfied IAL2 requirements. Additional evidence validation, applicant verification, and policy checks may still be necessary.

ID Dataweb’s workflow coordinates these dependencies, reducing the custom development required to connect individual verification services.

Organizations can use the prepared workflow as a starting point and configure it according to their applicable assurance requirements.

Adapting identity proofing to different applicant populations

A verification process that works well for one population may introduce unnecessary friction for another.

Applicants with limited credit histories, for example, may lack sufficient information in traditional data sources. Others may have limited mobile carrier records or be unable to complete a particular document verification step.

Relying on a single proofing path can therefore increase abandonment among legitimate applicants.

ID Dataweb’s no-code workflow builder allows organizations to configure multiple identity proofing paths and adapt the experience to different applicant populations.

Teams can reuse verification steps from existing templates, define acceptable document types, and configure policies that determine when additional evidence is required.

These adjustments can improve accessibility and completion rates while preserving the evidence validation and applicant verification requirements applicable to the selected assurance level.

Understanding failed, denied, and abandoned verification attempts

A high approval rate does not necessarily indicate an effective identity proofing experience.

If a significant percentage of applicants abandon verification before receiving a decision, organizations may be overlooking friction that affects legitimate users.

ID Dataweb’s workflow reporting capabilities distinguish between completed verification outcomes and the broader population of applicants who initiated the process.

This visibility helps teams differentiate applicants who failed a configured policy from those who never completed the required steps.

Application-level and country-level filters provide additional context for identifying patterns.

For individual transactions, detailed transaction reports show the applicant’s verification path, completed checks, and the policy rules that influenced the outcome.

For example, support teams can determine whether an applicant encountered a document classification problem, failed a required identity match, or stopped before completing an additional verification step.

This information provides a starting point for investigating individual cases and identifying recurring friction. By connecting verification decisions with the underlying applicant journey, ID Dataweb helps organizations improve the experience without automatically relaxing identity proofing requirements.

Maintaining workflows as requirements evolve

Identity proofing requirements, organizational risk policies, and applicant expectations can change over time.

Maintaining a verification process therefore requires the ability to update individual steps without unnecessarily rebuilding the entire workflow. ID Dataweb supports the reuse of configured verification steps through workflow export and import capabilities.

Teams can incorporate established verification components into new workflows and adjust the surrounding policies to meet different application requirements.

Operational support is also connected to workflow configuration.

From an individual transaction record, administrators can navigate to the relevant workflow step or initiate a support request associated with the transaction.

This connection between configuration, transaction results, and support simplifies troubleshooting and ongoing workflow maintenance.

A more flexible approach to IAL2 identity proofing

IAL2 identity proofing requires organizations to establish confidence in an applicant’s claimed identity through appropriate evidence validation, applicant verification, and supporting controls.

Meeting these requirements can become operationally complex when verification services operate independently or applicants cannot complete a single prescribed path.

ID Dataweb’s preconfigured identity proofing workflow brings these capabilities together through coordinated verification steps, configurable policies, and alternative evidence paths.

No-code configuration helps organizations adapt the process to different applicant populations, while transaction reporting provides visibility into decisions, failed checks, and abandonment.

The result is a more manageable approach to implementing and maintaining identity proofing workflows designed to support NIST IAL2 requirements, without sacrificing the flexibility needed to deliver secure and accessible digital services.