Level of assurance (LoA) describes the degree of confidence that can be placed in an identity claim. It is graded rather than binary, because different transactions warrant different certainty: opening a bank account and reading a public webpage should not require the same evidence.

Assurance is not a property of a single technology. It emerges from the whole chain: how rigorously the identity was proofed at enrollment, how resistant the authentication method is to attack, and how reliably the system can tell a genuine human from a representation of one.

Two frameworks dominate. eIDAS, governing electronic identification across the EU, defines three levels: Low, providing limited confidence; Substantial, requiring stronger proofing and authentication; and High, the highest in the framework, intended to prevent identity misuse and tampering. Under the revised regulation, European digital identity wallets must meet requirements corresponding to assurance level High.

NIST SP 800-63-4 instead separates assurance into three independent dimensions. Identity Assurance Level (IAL) measures the identity proofing process. Authentication Assurance Level (AAL) measures the authenticator’s strength. Federation Assurance Level (FAL) measures confidence in an assertion passed between systems. Separating them is useful because they can legitimately differ: an organization might require strong proofing once and lighter authentication for routine sessions.

What Raises the Level of Assurance?

Assurance rises as a system closes off ways it can be deceived. A signed NFC chip read from an ePassport carries more weight than an image of the same document. Face matching binds that evidence to the person presenting it. Presentation attack resistance is evaluated under ISO/IEC 30107-3 through conformance testing, injection resistance separately under CEN/TS 18099, and real-time assurance establishes that verification is happening now rather than being replayed.

iProov’s Dynamic Liveness addresses both classes by establishing that a user is the right person, a real person, and verifying right now.

Read more:

• Self Assessment Tool: Find Your Identity Proofing Level 
• Webpage: iProov Certifications Explained
• Encyclopedia Entry: Digital Injection Attack
• Blog: Balancing Risk and Convenience with Remote Identity Assurance
• Press: iProov Achieves eIDAS eID Level of Assurance High
• Encyclopedia Entry: Identity Assurance
• Report: Navigating the Complexities of Remote Identity Proofing