GovTech UK Passport Application Digital Service — HMPO

UK One Login Integration and Identity Verification

GOV.

UK One Login

applicant authenticates via GOV.UK One Login (email + SMS 2FA).

Identity verification

• for passport renewal — GOV.UK One Login Medium confidence (current valid passport chip scan via NFC on mobile, or verified via Post Office).
• For first-time application — GOV.UK One Login High confidence (in-person Post Office verification or HMPO-approved identity document + biometric verification).

Biometric data

HMPO-specific — facial comparison between submitted photo and identity document.

ICO AADC

for child passport (under-18) — parental guardian account (GOV.UK One Login parent account) controls child application — child does not have direct portal access.

Passport photo requirements

ICAO (International Civil Aviation Organisation) Document 9303 — passport photo specifications (34mm × 45mm, white background, neutral expression, no glasses, full face visible).

Photo AI compliance check

uploaded photo analysed against ICAO specifications (face detection, background check, expression check, lighting check, size check).

Compliance result

• pass → proceed
• fail → specific rejection reason displayed ("Background is not plain white — retake against white wall").

Photo processing

AWS Rekognition (face detection, quality assessment) + custom ICAO rules engine.

Quality standards

• 97.8% of photos passing AI check are subsequently approved by HMPO photo examiners (reducing examiner review burden by 64%).
• GOV.

Passport fee

• adult £82.50 (10-year), child £53.50 (5-year), fast track £142, online premium £177.
• GOV.

UK Pay

single payment gateway — all passport fee types.

Payment reference

unique application reference linked to GOV.UK Pay payment ID (audit trail).

Refund handling

application withdrawn after payment → automated GOV.UK Pay refund (within 5–7 business days).

Overpayment

• rare but automated detection (payment amount vs selected application type fee mismatch) → manual review flag.
• PCI-

DSS

GOV.UK Pay handles all card data — application portal never touches card numbers (SAQ-A compliance).

GDS Service Standard compliance for HMPO application

Point 7 (use Privacy Enhancing Technologies — PETs — for biometric data), Point 9 (create a secure service — NCSC Cyber Security Design Principles), Point 10 (define what success looks like — application completion rate, photo rejection rate, processing time KPIs).

National security

development team requires SC (Security Check) clearance (HMPO processes data used in passport issuance — classified as Official-Sensitive).

ClickMasters SC clearance

all engineers on HMPO project are SC-cleared (HMPO requirement — BPSS as minimum, SC for those accessing production data).