Expand ↗
Page list (29)
zetl

Opportunity Overview

ATM: RFI-15434 — Biometric Verification Capability Agency: Australian Taxation Office (ATO) Type: Request for Information (non-binding) Closes: 4-Jun-2026 14:00 ACT (4 calendar days from 2026-05-31) Contact: Alison Buchanan — RFI15434@ato.gov.au

Why the ATO is asking

The ATO operates myid, Australia’s national Digital ID provider under the Digital ID Act 2024 (commenced 1-Dec-2024). myID has 14 M+ users, 6 M+ at IP3 (Strong) identity proofing, used 95 M+ times in the last 12 months across 240+ government online services.

myID’s current liveness-detection stack was procured in 2021. Since then biometric tech has moved on (anti-spoofing, deepfake defence, NFC-document binding). The ATO is now scoping a refresh and an expansion into offshore identity verification via NFC ePassports — neither covered by the existing stack.

What the ATO is asking for

Three streams of capability:

  1. Liveness detection & facial image capture — detect spoofing, deepfakes, presentation attacks; capture biometric images of adequate quality for matching.
  2. Biometric matching — authentication during service access and account recovery without manual re-proofing.
  3. Technical verification of credentials — NFC-enabled verification of electronically readable identity documents (ePassports) for offshore users.

Solution must be SaaS, AWS-hosted, MAUI-compatible, Australian-data-resident, ISM-PROTECTED-certifiable, WCAG 2.1 AA, with 99.95 % availability and ≥10 000 verifications/hour @ p95 ≤ 1000 ms. See evaluation-criteria.

Where this could go

“As a direct result of this RFI, the ATO may proceed with a second stage that includes any of the following … Shortlist, RFT, RFQ, Limited Tender, Proof of Concept, Product demonstration/trial, or RFI closure.”

So this is market intelligence, with a strong shortlisting bias — RFI respondents who answer technically and demonstrate fit are the natural pool for the next stage.

Why SABLE is a strong fit

See sable-fit for the requirement-by-requirement mapping. The four distinctive pillars:

  1. Privacy by construction — biometric data never leaves the device; cryptographic guarantee via Halo2 ZK rather than a policy promise. Exceeds APP minimum and structurally fits the Digital ID Act 2024’s data-minimisation provisions.
  2. Selective disclosure via BBS+ — Verifiable Credential predicates (“over 18”, “Australian citizen”) provable without exposing underlying fields.
  3. Offline P2P operation — the capture / liveness / proof pipeline runs entirely on-device, no internet dependency for capture; addresses inclusivity for low-connectivity / offshore users.
  4. Open-source public good — Apache 2.0; any maturation work the ATO funds becomes freely available to any other government adopter. Candidate future deployment contexts include Anuna’s existing BARMM (Philippines) eGov engagement (natural extension; SABLE not yet deployed there), European public-sector identity stakeholders (early dialogue with Germany’s BSI), other Pacific / SEA governments, and adjacent use cases (age verification, healthcare, building access).

To our knowledge SABLE is the first open-source library to combine all four properties together with transparent ZK setup (no trusted ceremony) and no special hardware requirement.

Additional credibility signals:

  • Spatial-flash liveness (Tang et al., NDSS 2018) — strong defence against photo / screen replay attacks without depth sensors
  • Anuna track record — currently delivering eGov services (digital identity + citizen services + advisory) for BARMM (Bangsamoro Autonomous Region in Muslim Mindanao) — production go-live July 2026 — same practitioner team that would deliver any ATO engagement (BARMM does not currently deploy SABLE). Adjacent: GovUK, CSIRO Data61, Microsoft, Autodesk, Suncorp, IAG, Telus, Telefónica. Early international dialogue on the SABLE approach with Germany’s BSI.

Open gaps that the response must acknowledge: third-party ISO/IEC 30107-3 EAL-2 (Level B) PAD test report, ASD PROTECTED certification, NV1-cleared Australian support staff. All addressable through a follow-on procurement stage. See gaps-and-risks.

Linked notes

Backlinks