Delegating the work, not the accountability
An identity verification provider performs identity proofing on behalf of another organization — checking documents and other evidence to confirm a real-world identity — so the relying organization doesn't need to build and operate that specialized capability itself. This is often the sensible choice: proofing rigor that would be expensive and specialized to build in-house becomes available as a service, and the relying organization gets a level of verification it likely couldn't cost-effectively replicate on its own.
What doesn't transfer along with the work is accountability for the outcome: if the provider's process has a gap or is fooled by a sufficiently sophisticated forgery, the relying organization's own accounts inherit that gap directly, and the affected users experience the consequence as the relying organization's failure, regardless of which party's process actually let the bad identity through.
Evaluating a provider's rigor as an ongoing responsibility
Because the accountability stays with the relying organization, evaluating a verification provider's actual rigor is a genuine, ongoing part of the relying organization's own risk management — not something that can be delegated away entirely along with the verification work itself. This means periodically reassessing whether the provider's methods still hold up against evolving techniques for defeating identity checks, rather than treating an initial vendor evaluation as a decision that never needs revisiting.