Identity assurance levels (IAL) are standardized tiers, defined by NIST, that describe how rigorously a person’s real-world identity has been proofed, from self-asserted with no verification, up to strongly verified identity evidence. They let organizations match the strength of identity proofing to the risk of the service.

Not every interaction needs the same certainty about who someone is. IALs give a common language for "how sure are we this is a real, specific person," so requirements can be set deliberately rather than by guesswork.

The three IAL tiers (NIST 800-63A)

• IAL1, no requirement to link the applicant to a real-world identity; attributes are self-asserted. Fine for low-risk services.
• IAL2, identity is proofed with evidence, remotely or in person; requires validating real identity documents and verifying the person (document plus biometric). The common bar for financial services onboarding.
• IAL3, the highest assurance; requires in-person or supervised remote proofing with stronger evidence and biometric collection. Reserved for the highest-risk services.

(NIST’s framework also separates authentication assurance, AAL, and federation assurance, FAL, IAL specifically concerns how well the identity was established.)

Why IALs matter

IALs turn "verify the customer" into a precise, defensible requirement. A regulator or risk owner can specify IAL2 for account opening, and everyone knows what that entails. They also prevent two opposite mistakes: over-verifying low-risk journeys (needless friction) and under-verifying high-risk ones (fraud exposure). Mapping each journey to an appropriate IAL is the backbone of a risk-based identity program.

IAL in practice

Achieving IAL2 remotely (the sweet spot for most digital financial services) means real document verification, biometric matching, and liveness/presentation-attack detection, all done smoothly enough not to wreck conversion. That’s exactly what modern AI-driven IDV is built to deliver: high-assurance proofing (meeting IAL2 requirements) with high first-attempt pass rates. As deepfakes pressure remote proofing, maintaining genuine IAL2 assurance increasingly depends on strong anti-spoofing.

IAL, AAL, and FAL

NIST’s framework actually defines three separate assurance scales, and mixing them up is a common error. IAL (identity assurance level) is about how rigorously the real-world identity was proofed, how confident you are the person is who they claim. AAL (authentication assurance level) is about how strong the authentication is, how confident you are that a returning user is the same person, with the highest levels requiring phishing-resistant methods. FAL (federation assurance level) concerns how securely identity information is conveyed between an identity provider and a relying party.

They’re independent dials. You can proof someone to a high IAL at onboarding and then protect their account with weak authentication (low AAL), or vice versa, and both mismatches are real risks. A strong program sets each deliberately based on the service: rigorous proofing (IAL2) at onboarding, phishing-resistant authentication (AAL2+) for ongoing access, and appropriate federation assurance if identity is shared across systems. Thinking in all three dimensions, rather than a single vague notion of "how secure," is what the NIST scales are for.

Frequently asked questions

What does IAL stand for?

Identity assurance level.

What are the IAL levels?

IAL1 (self-asserted), IAL2 (proofed with evidence, remote or in person), and IAL3 (highest, supervised proofing).

Which IAL do financial services need?

IAL2 is the common bar for digital account opening, though requirements vary by service and jurisdiction.

Is IAL the same as authentication assurance?

No, IAL is about how identity was proofed; AAL is about authentication strength.

Related: NIST 800-63 Digital Identity Guidelines · Identity Proofing · Identity Verification (IDV) · Know Your Customer (KYC)