MODULE 2
Verification 101
What a verified identity really is: what gets checked, what gets kept, what it is screened against and what a Citizen ID is for.
Claimed identity versus verified identity
Almost everything you do online runs on claimed identity: you type a name and an email, and the system believes you. It is cheap, it is convenient, and it is the reason a network can fill up with accounts that correspond to nobody.
A verified identity is the opposite: somebody has checked, with evidence, that the person behind it exists and is who they say they are. It is not a form field, it is a procedure with a result.
That procedure has three pieces, and they are worth separating because they get confused daily. Authenticating the document: checking that the passport or national ID is genuine and not a doctored photograph. Binding the document to the person: checking that whoever presents it is its holder, by matching the face against the photograph on the document. And checking that the person is alive and present at that moment, which the trade calls *liveness* and is what stops somebody presenting a photo of a photo.
All three are necessary and none is enough on its own. A genuine document in someone else's hands proves nothing; a face that matches a forged document proves nothing either.
And there is a final distinction the rest of this module needs: verifying is not identifying at every use. Checking who you are is one thing; having to prove it again, with the same papers, every time you open a door, is quite another. The second is what scatters copies of your identity everywhere.
Minimization: checking without keeping everything
The instinct of any system that verifies is to keep everything “just in case”. It is the wrong instinct, and not out of delicacy: what is not kept cannot leak. Every extra record held is a custody obligation and a risk that lasts for years.
The principle that orders this is called data minimization, and it says something very simple: collect only what the purpose strictly requires, and keep it only while that purpose is alive. In the European Economic Area it is a legal requirement, not a good intention.
From that comes an idea that changes the whole design: normally whoever is asking does not need your data, they need an answer. A shop does not need your date of birth, it needs to know whether you are of age. A bank does not need to keep your document, it needs to know that someone trustworthy checked it.
Separating the check from the query is what makes it possible to answer “yes, this is a real, verified person” without handing over the file behind it. The file stays in one place, and whoever asks receives only the result.
Where that one place is matters as much as the design. Personal data is subject to the law of where it is held and of who holds it. That is why CitizenStar is an Icelandic company: Iceland is part of the European Economic Area, with the data protection framework that entails, and it is a deliberate choice rather than an administrative detail.
Sanctions screening: OFAC, the United Nations and country lists
Checking that somebody is real does not answer the second question regulated services have to ask: may I do business with this person? There are individuals and entities the law forbids dealing with, and knowing who somebody is says nothing about that.
That check is called sanctions screening, and it consists of matching the verified identity against the public lists of sanctioned persons and entities.
The main sources are public and anyone can consult them. The OFAC SDN list, from the United States Treasury office that administers its sanctions programmes. The lists of the United Nations Security Council, binding on its member states. And the national lists each country maintains on its own, which do not always coincide with the others.
Screening has two practical difficulties that explain why it is not a simple text search. The first is that names do not match exactly: different transliterations of the same name, surnames in another order, typos. That is why comparison is by similarity rather than equality, and why matches turn up that a human has to review — the so-called *false positives*.
The second is that the lists change. Somebody clear today may appear on a list tomorrow, so screening once, on the day of sign-up, is not enough: the check has to be repeated for as long as the relationship lasts.
The Citizen ID: the passport of the verified client
Put the three previous pieces together — an identity that has been checked, held under a privacy framework, and screened against the public lists — and what is left is a credential: the Citizen ID.
Its job is a passport's, and the comparison is literal in what matters. A passport does not contain your life: it contains just enough, it is issued by somebody both parties trust, and it can be shown without handing over the file that was needed to obtain it.
That is what changes for the person using it: you verify once and prove it many times. Instead of repeating the full sign-up at every service — the document, the face, the address, again — you present the credential and the service checks that it is valid.
And it changes things for whoever is asking, too. A service that receives only the verification result does not accumulate an archive of identity documents it would have to guard, audit and answer for if it ever leaked. Fewer copies of your identity in the world is, at the same time, less risk for both sides.
One consequence is worth stating plainly, because it is what ties this module to the first one. A credential like this is exactly what a decentralized network needs before it can vote: without a way to know there is a distinct person behind each node, the majority can be bought by creating nodes. Verifying identity is not the opposite of privacy — it is what makes a private network you can also trust possible.
Questions, or want to go deeper?
If your organization has to verify people and today solves it by piling up copies of documents, there is a better way to do it. We are listening.
Talk to the team