Broker guide
Is GBG Identity Verification Safe in 2026?
Check which GBG identity service handles the client’s documents, what it verifies and how access, retention and provider responsibilities are controlled.
- Published
- Updated
It depends on the service and your brokerage’s controls: GBG’s greenID documents encryption and access safeguards, while retention and authorised users need workflow-specific decisions. Confirm who requested the check before your client supplies identity documents.
This assessment covers Australian greenID identity verification, including document capture and face matching where those options are enabled. Other GBG services have different processing and retention arrangements.
Identify the GBG Service
Identify greenID in the request and name the business asking the client to verify their identity. The requesting brokerage, lender or other business uses the verification result. GBG provides the technology and processes information for that verification.
A GBG logo alone doesn’t establish who requested a check. Match the invitation to an application or other interaction your client recognises. If an unexpected message arrives, confirm it through the requesting business’s established contact channel before opening its upload journey.
Record the product and enabled checks in your brokerage’s workflow. GBG’s greenID product terms define the service around comparing claimed identity information with database sources, including the Australian Government’s Document Verification Service (DVS). The order form and selected datasets determine the contracted service.
Keep the requesting business’s collection notice beside the provider’s privacy information. Those documents answer different questions: why the business needs the check and how the provider handles the information it processes.
Documents, Checks and Result
greenID checks the identity information supplied against the sources and verification methods enabled for the customer. A document-and-biometric journey can capture an identity document, extract its details and compare a selfie with its photograph.
GBG’s documented process includes document checks, facial matching and liveness checks before the customer reviews extracted details. The process can also check those details against data sources. Optional supporting-document uploads and manual review are separate parts of the published workflow.
The DVS has a narrower function. The Office of the Australian Information Commissioner (OAIC) explains that it checks whether document biographical details match the original record and returns a yes-or-no response. That match alone doesn’t assess the borrower’s income, borrowing capacity or loan suitability.
Read the recorded result and any outstanding checks before treating the identity step as complete. A successful identity check is one input to the business’s decision. GBG’s products and services privacy policy states that the customer decides whether to accept or decline an individual.
For a mismatch, compare the entered details with the identity document and use the workflow’s review route. For poor image capture, GBG’s guidance calls for a live colour image with clear edges and no blur or glare. Escalate a continuing discrepancy instead of recording it as a successful verification.
Privacy and Access Controls
greenID shares information with the requesting business and with providers needed to complete its checks. GBG’s Australia and New Zealand privacy policy describes recipients such as data partners, government agencies and external storage providers. It also covers disclosures to related companies and disclosures permitted or required by law.
The same notice says Australian greenID customer information is collected and stored in Australia. It directs readers to IDScan’s arrangements for document images and biometric capture. Australian storage for a greenID record therefore doesn’t establish that every connected processing or support activity stays in Australia.
GBG’s products and services privacy policy distinguishes the records. It lists greenID identity-data de-identification after 12 months unless the customer defines another period, and IDScan document-verification retention of up to 31 days. Read the applicable product rows together before telling clients when their images or details disappear.
The greenID security policy documents encryption of stored data using AES-256 and encrypted transmission over HTTPS. It also describes restricted staff access and at least annual third-party penetration testing. Its plan table includes second-factor authentication on both listed plans, while IP allowlisting appears on Enhanced only.
These are published provider controls. The customer’s administrator still controls the brokerage’s users and configuration under the greenID product terms. Record who has access, remove access when staff leave and confirm which controls your subscription enables.
The OAIC’s assessment of DVS gateway providers found that GBG’s privacy policy mostly met the assessed transparency requirements. It also identified low privacy risks concerning readability and biometric retention. GBG did not accept the suggestion to reduce the default photo-retention period from 31 days to zero.
The assessment examined privacy transparency and explicitly excluded evaluating how the providers’ systems operated. Treat it as evidence about that assessed scope when weighing the service’s safety.
Use It in a Broker File
Approve greenID for a defined verification workflow. Assign responsibility for consent and access, with a named person to resolve incomplete checks. Before sending the first request, settle these points with your administrator and compliance lead.
- Identify the requesting business and its greenID modules and data sources.
- Review what the client sees about collection, recipients and any face matching before agreeing to proceed.
- Name who can access the result and documents, including staff in connected systems.
- Set the retention period for each record and the process for deletion or correction requests.
- Define the alternative or escalation route for an incomplete or disputed digital check.
Use an approved client notice that reflects the actual data flow. Retain the verification reference and result beside evidence of the notice and consent presented. Record who resolves any exception.
Keep only the documents your approved recordkeeping process requires.
For a hypothetical file, a client passes the database check but has an unresolved selfie comparison. Record the incomplete face check and send it through the approved review route. The database match doesn’t settle the separate discrepancy.
greenID’s product terms place verification-record governance on the customer and state that greenID isn’t a records management system. Keep the evidence your brokerage requires in its controlled file system. Complete the identity step only after the required checks pass or the authorised reviewer records an accepted alternative and its reasons.
