[TABLE]

Statement of Requirements

[TABLE]

Table of Contents

[Background 4](#background)

[About myID 4](#about-myid)

[High-level system architecture diagram 5](#high-level-system-architecture-diagram)

[Request for Information 5](#request-for-information)

[Vision 6](#vision)

[Overview of Business Requirements 6](#overview-of-business-requirements)

[High Level Requirements & Prioritisation 7](#high-level-requirements-prioritisation)

[Technical requirements 8](#technical-requirements)

[Biometric Capture and liveness Detection 8](#biometric-capture-and-liveness-detection)

[Technical Verification and Biometric Binding 8](#technical-verification-and-biometric-binding)

[Scalability 9](#scalability)

[Performance 9](#performance)

[Availability 9](#availability)

[Hosting 10](#hosting)

[Integration 10](#integration)

[Compliance 10](#compliance)

[Security and Confidentiality 10](#security-and-confidentiality)

[Operations, Support and Maintenance 11](#operations-support-and-maintenance)

[Operations 11](#operations)

[Vendor Implementation, Support & Maintenance 12](#vendor-implementation-support-maintenance)

[Maintainability 12](#maintainability)

[Reporting and Monitoring 13](#reporting-and-monitoring)

[Usability & Accessibility 13](#usability-accessibility)

[User Experience and Accessibility 13](#user-experience-and-accessibility)

[Response Instructions 14](#response-instructions)

[Appendices 14](#appendices)

[Appendix 1 – Legislation, Guidelines and Standards 14](#appendix-1-legislation-guidelines-and-standards)

[ATO procedures and guidelines 14](#ato-procedures-and-guidelines)

[Specific Requirements IT Goods 14](#specific-requirements-it-goods)

[Indigenous Procurement Policy Reporting 15](#indigenous-procurement-policy-reporting)

Background

myID, managed by the Australian Taxation Office (ATO), is the Australian Government’s Digital ID Provider operating within the Australian Governments Digital ID System (AGDIS).

myID is an app installed on a smart device that enables a user to prove who they are and logon to online services. myID is accredited under the AGDIS legal framework, the Digital ID Act 2024.

The Digital ID Act 2024 and its associated Accreditation Rules establish a comprehensive framework for accrediting entities, such as identity providers, attribute service providers, and exchange providers within Australia’s Digital ID System.

> For more information visit - The Australian Government Digital ID System (AGDIS) | Digital ID System

About myID

myID currently supports three identity proofing (IP) levels:

• IP1 (Basic) - verified email address and self-asserted name and date of birth

• IP2 (Standard) - verified email address, verified name and date of birth through the verification of 2 Australian identity documents via the Document Verification Service (DVS)

• IP3 (Strong) - verified email address, verified name and date of birth through the verification of 2-3 Australian identity documents via DVS and face biometric verification against a source document (Australian Passport or Driver Licence) via the Face Verification Service (FVS)

In future myID will support additional IP level specified in the Digital Act including:

• IP1+ - verified email address, verified name and date of birth through the verification of 1 Australian identity document via DVS

• IP2 + - verified email address, verified name and date of birth through the verification of 2 Australian identity documents via DVS and face biometric verification against a source document (where an Australian Passport is not used) via FVS to achieve a Strong myID, users must complete a liveness test to confirm they are a real, live person. The image captured during this process is securely transmitted to the relevant document source agency (e.g. the Australian Passport Office) via the Facial Verification Service (FVS) for a 1:1 face match against the official document photo. The result of this verification either a pass or fail is then returned to myID and displayed to the user.

There are currently over 14 million myIDs with over 6 million who have verified their identity to IP3 (Strong). myID is currently used to access over 240 government online services with more services coming. In the last 12 months (August 2024 – August 2025) myID was used over 95 million times to login to government online services. Further growth in adoption is expected as myID becomes available to access more online services.

High-level system architecture diagram

The below diagram demonstrates the high-level system architecture for myID.

> More information visit - Home | myID

Request for Information

Since the launch of Strong myID in 2021, the technology landscape for identity verification has evolved significantly, particularly in areas such as liveness detection and facial biometric matching. To ensure myID continues to meet the highest standards of security, usability, and inclusivity, the Australian Taxation Office (ATO) is seeking information from technology providers on their capabilities to support future enhancements.

The ATO invites responses from suppliers with expertise in identity verification technologies, specifically in relation to:

• Liveness detection and facial image capture: Solutions that can reliably detect and verify the presence of a live individual during identity verification.

• Biometric matching: Capabilities that support use cases such as authentication during service access and account recovery.

• Technical verification of credentials: Technologies such as NFC-enabled verification that can support identity verification for individuals located offshore through the verification of electronically readable identity documents (e.g. ePassports) The ATO is seeking to explore emerging technologies and innovative solutions to address several key challenges associated with identity verification within the myID platform. Since the initial procurement of Strong myID in 2021, advancements in biometric technologies particularly liveness detection and facial matching have accelerated. This RFI aims to understand what new capabilities exist in the market that could enhance the security, scalability, and inclusivity of myID.

Specifically, the ATO is seeking to address the following challenges:

• Advancements in Liveness Detection

The current liveness detection solution was procured in 2021. Given the pace of innovation in this space, the ATO is interested in exploring the availability of solutions available in the market today.

• Scalable Biometric Authentication

With over 14 million myID users, the ATO is looking for biometric verification solutions that can support authentication at scale. This includes enabling users to verify their identity during login or account recovery without needing to re-prove their identity through manual processes which results in the need for call centre support.

• Verification of Offshore Individuals

myID currently supports verification only against Australian-issued identity documents. This presents a gap for offshore users who need to access services but cannot be verified through existing mechanisms. The ATO is seeking information on alternative biometric technical verification methods of document verification and biometric binding, such as NFC-enabled document reading that could support identity verification for individuals outside Australia.

Vision

The ATO’s vision is to evolve myID into a future-ready, secure, and inclusive digital identity solution that meets the needs of a diverse and growing user base. We aim to leverage cutting-edge biometric technologies to enhance identity verification, streamline authentication, and improve account recovery, while maintaining the highest standards of privacy and user experience.

Overview of Business Requirements

The Australian Taxation Office (ATO) is seeking information from the market on biometric liveness detection solutions that can support the strategic objectives of the myID app. The solution must support secure, seamless, and scalable identity verification for users accessing online services.

To meet these objectives, the ATO requires a biometric liveness solution that satisfies the following core business requirements:

• Secure – Must detect and prevent spoofing, deepfakes, and other identity threats as well as biometric match rates (incl. False accept and false reject rates) as defined in the Digital ID Act 2024.

• User-friendly experience – Quick, simple, and accessible for all users, including those with accessibility needs

• Device compatibility – Works reliably across a wide range of mobile devices, platforms, browser types and operating systems

• Accessible – Must be tested and meet minimum WCAG requirements as defined in the Digital ID Act 2024

• Scalable – Supports high volumes of identity checks with consistent performance, reliability and up time

• Cost-effective – Offers a sustainable pricing model aligned with government procurement frameworks demonstrating value for money.

• Comply with the law – Complies with the relevant liveness and biometric verification standards and disclosure requirements prescribed in the Digital ID Act 2024.

• System integration and maintenance – Seamlessly integrates with existing ATO infrastructure and future digital identity ecosystems/architecture. Upgrade and maintenance of solutions can be adopted with minimal effort and impact to production systems

• Provides value for money – Solutions and associated costs must represent value for money for Government.

High Level Requirements & Prioritisation

Requirements are prioritised as follows for this RFI:

M – Mandatory: requirements that are essential; failure to comply will render a solution unviable.
D – Highly desirable: requirements that materially improve viability and performance.
O – Optional: value-added capabilities that are beneficial but not essential.

Technical requirements

Biometric Capture and Liveness Detection

Technical Verification and Biometric Binding

[TABLE]

Scalability

Performance

[TABLE]

Availability

Hosting

Integration

Compliance

Security and Confidentiality

Operations, Support and Maintenance

Operations

Vendor Implementation, Support & Maintenance

Maintainability

Reporting and Monitoring

Usability & Accessibility

User Experience and Accessibility

Response Instructions

Respondents should provide responses in Part 3a Techincal response form, detailed written responses mapping their capabilities to each requirement identifier above. For each requirement, include technical details, architecture diagrams, implementation approach, security controls, validation/testing evidence, and relevant certifications(if needed attach information in separate documents). Attach case studies, third-party testing reports, and sample SLA terms where available. Responses should be concise, clearly referenced, and submitted per the AusTender process.

Appendices

Appendix 1 – Legislation, Guidelines and Standards

Respondents must demonstrate compliance with relevant Commonwealth legislation, guidelines and standards including but not limited to: the Digital ID Act 2024 (commenced 1 December 2024), Digital ID (Accreditation) Rules 2024 and Accreditation Data Standards, the Australian Government Information Security Manual (ISM), Trusted Digital Identity Framework (TDIF), ASD Essential Eight, and ATO procedures and guidelines for contractors.

Digital ID Act 2024 - Federal Register of Legislation 

[TABLE]

For the purposes of clause 12. Additional Information of the RFI Part 1 Conditions of Tender, the applicable ATO procedures and guidelines are the:

Ethical business relationship statement

ATO information security guidelines for contractors

WH&S requirements for contractors and suppliers to the ATO

Recordkeeping management for our contractors 

Specific Requirements\

IT Goods

In the event of a procurement process post this RFI that progresses to a contract, the Respondent must:

Have an EMS Certified or aligned to ISO 14001; or align business processes to the ISO 14001 within 6 months of the Contract being signed; and must maintain EMS certification or alignment to ISO 14001 during the term of the Contract, and

Be a signatory to the Australian Packaging Covenant or comply with the requirements of the National Environment Protection (used packaging materials) measure (unless exempt by legislation).

Indigenous Procurement Policy Reporting

In the event of a procurement process post this RFI that progresses to a contract, the Respondent must provide such written reports and evidence of its compliance with their Indigenous Procurement Policy obligations every quarter/6 months/year during the Term.

Security Requirements

The Vendor must:

Complete and submit the following attachments:

1. Attachment A – FOCI Form

If already completed and returned to the ATO in the last 12 months, these are documents are not required.

The ATO Cyber Security reserves the right to conduct a go-no-go penetration test.