New Zealand sets thresholds for liveness detection in rules defining trusted assurance

New Zealand recently enacted the Digital Identity Services Trust Framework Amendment Regulations 2026, which amend the Regulations 2024 by formally defining levels of assurance and streamlining accreditation renewals for partners. Digital identity providers who wish to be accredited under the Trust Framework Authority must be able to show they are in compliance with the attendant rules and regulations.

The framework’s amended section on levels of assurance, Schedule 4, defines biometric information for the purposes of the framework, sets out four levels (basic, standard, strong and very strong) and explains how to determine which level is necessary. Standard assurance requires binding with a biometric, possession or knowledge factor, while strong requires two factors and very strong requires the combination of biometrics with one of the other two factors. There is also a “+” distinction for standard and strong assurance bound using a biometric factor.

The Digital Identity Services Trust Framework Rules 2024 states that biometric factor verification methods must “incorporate effective measures to detect spoofing, impersonation, or any other fraudulent attempt to replicate biometric characteristics, including but not limited to recordings, artificial intelligence, masks, makeup, prosthetics, or similar artefacts.”

New Zealand’s Trust Framework Amendment Rules 2026-1 has also come into force, with changes including additional support for online credential presentation standards and requirements relating to character encoding and international characters.

Standard assurance requires PAD with 95% resistance

But simply having fraud prevention tools in place is not sufficient. For standard level and up, liveness detection technology must “demonstrate at least 95 percent resistance to presentation attacks, measured using a documented testing methodology that uses defined presentation attack types, including artefact attacks, replay and injection attacks.”

Testing must be based on “recognized performance metrics (for example, attack presentation classification error rate or equivalent)” and “be supported by documented testing results or supplier assurance, including a description of the test conditions, attack types, and performance outcomes, that can be provided for audit.”

For strong and very strong binding assurance levels, the threshold for liveness detection rises to 99 percent resistance to presentation attacks.

Moreover, it must “minimize the risk of false positives in biometric comparison by using either manual comparison of the biometric characteristic by a trained operator, or systematic biometric comparison with a false‑positive rate of less than 0.01 percent, based on a one‑to‑one biometric comparison.”

In brief, companies that wish to be certified as providers of very strong binding assurance in New Zealand must boast biometric algorithms that are almost perfect – and they’ll need the testing results to prove it.

Article Topics

biometric binding  |  biometric liveness detection  |  biometrics  |  Digital Identity Services Trust Framework (DISTF)  |  identity assurance  |  New Zealand