What is NIST IAL2 identity verification?

Updated September 15, 2026

Identity fraud is scaling faster than most organizations' defenses. Synthetic identities, AI-generated fake IDs, and stolen credentials have made it trivially easy to impersonate a real person online. IAL2 identity verification is the federal standard designed to close that gap, and understanding what it actually requires is the first step toward building a defensible identity layer for your business.

Identity Assurance Level 2 (IAL2) is one of three levels of identity proofing defined by the National Institute of Standards and Technology (NIST) in Special Publication 800-63. At its core, IAL2 is a standard for establishing, with a high degree of confidence, that a person is who they claim to be. It requires verified identity evidence and biometric binding, and it can be completed remotely, without an in-person visit.

Federal agencies are increasingly mandating IAL2 across regulated workflows. The National Highway Traffic Safety Administration (NHTSA) requires it for executing odometer disclosures. The Small Business Administration (SBA) requires it for loan documents. The IRS requires it when accessing tax records. Beyond federal mandates, IAL2 has become the de facto gold standard for identity verification and has been voluntarily adopted by private industry, state governments, and local agencies.

Key takeaways

• IAL2 is a NIST standard defined in SP 800-63A that requires verified identity evidence, document validation against authoritative sources, and biometric binding between the applicant and their strongest piece of evidence.
• IAL2 can be completed remotely without in-person supervision, making it practical for digital onboarding, e-signature workflows, loan applications, and account access.
• Federal agencies including the SBA, NHTSA, and IRS mandate IAL2 for specific regulated transactions, and private industry has adopted it as the baseline for high-confidence identity verification.
• Knowledge-based authentication (KBA) alone cannot satisfy IAL2 verification requirements; biometric or physical comparison is always required.
• Organizations rarely build IAL2 verification in-house. Most rely on a certified credential service provider (CSP) like Proof, which holds Kantara IAL2 certification independently audited by a third party.
• An immutable audit trail documenting each step of the identity-proofing process is a required component of IAL2 compliance, not an optional enhancement.

How IAL2 compares to IAL1 and IAL3

NIST SP 800-63 defines three identity assurance levels, each representing a different degree of confidence in the verification process:

• IAL1: Identity claims are self-asserted and not linked to a specific real-world individual. Anyone can claim to be anyone else.
• IAL2: Evidence supports the real-world existence of the claimed identity and establishes the applicant as the true owner of that identity. Remote proofing is permitted.
• IAL3: Identity proofing is supervised by an authorized representative with specialized hardware if conducted remotely. Maximum assurance, but impractical for most digital interactions.

IAL2 occupies the critical middle ground. It provides strong identity assurance while remaining accessible for remote, digital transactions. IAL3's supervised hardware requirements make it cost-prohibitive for most commercial use cases. IAL1's self-assertion offers no real protection against fraud. IAL2 is where the practical security lives.

What IAL2 identity verification requires

IAL2 is a framework for confirming that a person owns a genuine identity. The process runs through three sequential stages: evidence collection, evidence validation, and biometric binding.

Evidence collection

To initiate IAL2 proofing, the applicant must provide qualifying identity documents. NIST defines evidence quality on a scale from unacceptable to superior, and IAL2 requires one of the following combinations:

• One piece of superior or strong evidence, where the issuing source confirmed the identity using two pieces of superior or strong evidence and the credential service provider validates directly with the issuer
• Two pieces of strong evidence
• One piece of strong evidence plus two pieces of fair evidence

A government-issued driver's license or passport typically qualifies as strong evidence. Supporting documents such as utility bills or bank statements may qualify as fair evidence. The specific combination determines which validation pathway applies.

Evidence validation

Validation confirms that the identity document is authentic, current, and belongs to a real individual. This involves two steps:

First, the document itself is examined for authenticity, including completeness and format for the document type, detection of tampering or counterfeit features, and confirmation of security features such as holograms or color-shifting inks.

Second, the data on the document is validated against the issuing source or an authoritative source with linkage to the issuer. For a driver's license, this means verifying the license number and personal details against the state motor vehicle database. Not every field can always be validated, but all information that can be validated must be.

Automated document validation products are the most practical approach for remote IAL2 proofing. These tools test evidence against document type libraries, perform tamper detection, and confirm security features from images captured via webcam or mobile camera.

Biometric binding and liveness detection

Verification confirms that the validated identity evidence actually belongs to the person presenting it. This is the step that separates IAL2 from weaker verification methods.

The applicant's binding to the evidence is confirmed through one of two methods:

• Physical comparison: A trained operator compares a live capture of the applicant's face to the photograph on the strongest piece of validated evidence.
• Biometric comparison: An automated system compares a live facial image to the photo on the identity document.

For remote IAL2 proofing, liveness detection is mandatory regardless of which comparison method is used. Liveness detection confirms that the facial image being submitted is a live capture and not a static photo, a video replay, or a synthetic deepfake. This is the control that defeats presentation attacks.

Knowledge-based authentication (KBA) alone cannot satisfy IAL2 verification. KBA may be used in limited circumstances for identity resolution or as supplemental assurance for fair-level evidence, but it can never serve as the primary or sole verification method. The wide availability of personal data makes KBA answers accessible to impostors, which is why biometric or physical comparison is always required.

Address confirmation for remote proofing

Remote IAL2 proofing adds one requirement that in-person proofing does not: enrollment code confirmation. An enrollment code must be sent to a validated address for the applicant, which may be a postal address, SMS number, or email address.

Enrollment code validity periods are specific:

• 10 days when sent to a postal address within the contiguous United States
• 30 days when sent to a postal address outside the contiguous United States
• 10 minutes when sent via SMS or voice call
• 24 hours when sent to an email address

Enrollment is not complete until the applicant provides the correct code within the specified window.

Remote vs. in-person IAL2 proofing

IAL2 can be completed both remotely and in person. This distinction matters for organizations designing digital workflows.

Remote unsupervised proofing is the most common approach for commercial applications. The applicant uses their own device, submits document images via camera, and completes biometric comparison through automated liveness detection. No human operator is required in real time, though many platforms include fallback to a live agent when automated checks cannot reach a determination.

Remote supervised proofing involves a trained operator who monitors the session in real time, directs the applicant to adjust document presentation, and performs physical comparison of the live video feed to the document photo. This approach provides IAL3-comparable confidence without requiring specialized hardware at the applicant's location.

In-person proofing involves a trained operator examining documents and the applicant directly. Address confirmation is optional for in-person IAL2 proofing.

For most businesses operating digital workflows, remote unsupervised proofing is the practical path. It scales, it works on any device, and when implemented correctly with liveness detection and automated document validation, it meets the full IAL2 standard.

How IAL2 verification works in practice

IAL2 verification follows a structured sequence that most applicants complete in a few minutes. Here is how it works in a typical business workflow, using an electronic signature as the example:

1. The business sends the applicant an identity verification request, typically via a link or QR code.
2. The applicant captures images of their identity document using their device camera.
3. The system validates the document against authoritative sources and checks for tampering or forgery.
4. The applicant takes a live selfie or completes a short video capture.
5. Liveness detection confirms the capture is live, and biometric comparison matches the face to the document photo.
6. If automated checks succeed, the applicant proceeds to sign the document.
7. If automated checks cannot reach a determination, the session escalates to a live identity agent for real-time review.
8. A detailed audit trail is generated, documenting each step of the proofing process and binding it to the signed document.

The audit trail is not optional. A robust, immutable record documenting each step of the identity-proofing process is a core requirement of IAL2 compliance. When that audit trail is cryptographically coupled with the digital signature, it creates a defensible record that can withstand scrutiny in disputes or regulatory review.

To see an IAL2-compliant signing process in action, click through our demo.

Industries and regulations that require IAL2 identity verification

IAL2 is mandated or strongly recommended across a wide range of regulated industries and federal programs.

Financial services: Banks, credit unions, investment firms, and fintech companies use IAL2 to secure online account opening, loan applications, and high-value transaction authorization. The SBA requires IAL2 for loan document execution. Wire authorization workflows increasingly require IAL2 to prevent business email compromise fraud.

Healthcare: Healthcare providers require IAL2 for accessing electronic health records (EHRs), executing HIPAA authorizations, and completing treatment consent forms remotely. The sensitivity of protected health information (PHI) makes high-confidence identity proofing a compliance necessity.

Government services: Federal and state agencies use IAL2 to secure access to tax records, social security services, immigration services, and government benefit programs. The IRS mandates IAL2 for accessing tax records. Login.gov's enhanced identity verification service is independently certified at the IAL2 level by the Kantara Initiative.

Real estate and auto: NHTSA mandates IAL2 for electronic odometer disclosures under 49 CFR 580.3. Title transfers, eClosings, and power of attorney documents in real estate transactions increasingly require IAL2 to prevent deed fraud and impersonation. Proof has surpassed $640 billion in real estate transactions processed on its platform.

Telecommunications: Telecom companies use IAL2 to secure customer account changes, SIM swaps, and access to sensitive billing and call records, all common targets for social engineering attacks.

Education: Educational institutions implement IAL2 to secure access to student records, online learning platforms, and credentialing systems.

How to verify that a vendor is Kantara IAL2-certified

Claiming IAL2 compliance and holding independent certification are different things. The Kantara Initiative is the primary independent certification body for IAL2 compliance. Kantara-certified credential service providers (CSPs) have undergone a formal audit of their identity-proofing processes, technical controls, and documentation practices.

To verify a vendor's certification status, check the Kantara Initiative Trust Status List directly. A vendor that is Kantara-certified will appear on that list with their certification scope and status. Self-asserted IAL2 compliance without Kantara certification is not the same as independently audited compliance.

Proof holds Kantara IAL2 certification, independently audited by a third party. This certification covers Proof's Identify product and the identity-proofing workflows embedded across the Proof platform.

Why IAL2 compliance matters for fraud prevention

IAL2 addresses the specific fraud vectors that have become most prevalent in digital commerce. Stolen identities, synthetic identities, and AI-generated fake IDs are all designed to defeat weaker verification methods.

IAL2 creates a verified link between a digital identity and a real person. That link has four concrete business consequences:

• Regulatory compliance: Meet federal requirements across the SBA, NHTSA, IRS, and other agencies without building the verification infrastructure in-house.
• Fraud prevention: Document validation and biometric binding significantly reduce identity theft, synthetic identity fraud, and account takeover attacks.
• Legal defensibility: An immutable audit trail documenting each step of the proofing process creates a record that can withstand scrutiny in disputes, audits, and litigation.
• Customer trust: Demonstrating that your organization verifies who it does business with protects customers and signals operational seriousness to regulators and counterparties.

The scale of the threat justifies the investment. It has never been easier to purchase a stolen identity, construct a synthetic identity, or obtain a convincing fake ID. IAL2 is the standard that makes those attacks materially harder to execute at scale.

What IAL2 means for the agentic internet

As AI agents begin to transact on behalf of real people, including initiating payments, signing documents, and authorizing account changes, the question of who authorized the agent becomes as important as verifying the human identity itself.

Proof's position is that IAL2 is the foundation, not the ceiling. The Proof platform cryptographically binds verified human identity to agent actions, creating a verifiable record of who authorized what and when. This is the infrastructure that makes agentic commerce trustworthy. Proof joined the FIDO Alliance specifically to contribute to the standards defining how AI acts on behalf of verified humans.

About Proof

Proof is the platform businesses use to digitize their document collection processes. Proof offers out-of-the-box IAL2 compliance, eSign, and online notarization in a single platform, making it possible for businesses to move from paper to digital in as little as one day. With over 34 million customer days saved and counting, Proof serves organizations across financial services, real estate, auto, healthcare, and government that need to make it safer and faster to do business online.

See how Proof Identify delivers IAL2-certified identity verification for your workflows.