Every age gate you have shipped makes one decision, at one moment, inside one company’s stack. The user proves something, you write down what happened, and the transaction completes in the same session.
The UK’s new regime for remote knife sales does not work like that. It splits the decision across two moments, two companies and a physical hand-off, and it requires the second half to confirm something about the first half.
The Crime and Policing Act 2026 received Royal Assent on 29 April 2026. Its knife provisions carry the campaign name Ronan’s Law, after Ronan Kanda, and they rewrite what an online seller of bladed articles has to do. If you sell anything with an edge, or you run a marketplace where somebody else does, this is the first UK age assurance duty that reaches past your own servers.
What the Act asks for
Step one, at the point of sale. The seller must obtain an official photographic identity document, a UK or foreign passport or a UK driving licence, and a current photograph of the buyer to confirm the buyer is the person in the document. A tick box is not a check. A date-of-birth field is not a check. Secondary legislation can add other accepted document types, and the Home Office impact assessment points at the UK digital identity and attributes trust framework as the route for digital alternatives.
Step two, at the point of delivery. The courier must inspect photographic identification presented by the person receiving the package, confirm they are 18 or over, and confirm they are the person who placed the order. The step applies to residential deliveries in England and Wales.
Read the second half of that sentence again, because it is the part that changes your architecture. Not “an adult received it”. The purchaser received it.
That rules out a parcel locker. It rules out an automated collection point. It rules out leaving it in a safe place, handing it to a neighbour, or giving it to anyone else in the household. Those are the four behaviours that make modern parcel delivery economic, and all four are now unavailable for this product category.
The bulk sales duty. A retailer must report to the police where six or more bladed articles go to the same buyer within 30 days, whether in one order or across several, and the same applies to repeated deliveries to one address. The detail of how to report comes in secondary legislation.
Penalties. Selling a bladed article to a minor now carries up to two years’ imprisonment on conviction on indictment. The due diligence defence is available, but only if your verification system is functional, documented and consistently applied. Those three words are doing the work, and only the third one is about running code.
Separately, for platforms. Police can issue content removal notices requiring illegal weapons marketing to come down within 48 hours. Non-compliance runs to £60,000 for the company and £10,000 for a designated executive, with a further £60,000 penalty for failing to designate one at all. That limb covers social media services, online marketplaces and search, not direct retailers.
The hard problem is the hand-off, not the check
Both halves of this are solved problems on their own. Document reading plus a liveness-checked selfie at checkout is ordinary 2026 infrastructure. Checking an ID at a door is something off-licences have done for decades.
The problem is the join. You have to prove, at a doorstep, that the person holding out a driving licence is the same person who passed a check on your website three days ago. That is the binding problem moved out of the browser and into the physical world, with a worse set of constraints.
Four of them matter.
The courier is not your company. Royal Mail, Evri, DPD, a local courier, or a driver who signed up to an app this morning. Your due diligence defence depends on their behaviour at the door, and you control it through a contract, not through code review.
You cannot send them the document. The obvious implementation is to push the buyer’s ID image to the driver app so they can compare faces. Do not build this. You would be shipping a passport image to a consumer handset, cached by an operating system you do not control, on a device that gets lost, sold and rooted, for 120 deliveries a day. That is a data protection incident waiting for a date, and the retention lesson from the IDScan breach applies in exactly the same way. The size of the breach is a setting you chose.
The driver has about eight seconds. Any design that assumes careful visual comparison under time pressure, in the rain, at dusk, on a phone screen, will not survive contact with a delivery round. Human document comparison is weak even in good conditions. This is a known result and it does not improve outdoors.
Failure has to be cheap and reversible. A refused delivery is a returned parcel, a refund dispute and an angry customer who did nothing wrong. If your fail path is “driver decides”, your false rejection rate becomes a customer service cost you cannot forecast.
The shape that works: a reference, not a copy
The design that satisfies the Act without putting documents on driver phones has four parts.
At checkout, verify and derive. Read the document, run a liveness check, match the selfie to the document photo. Keep the outcome, the method, the threshold, the policy version, the timestamp, an age band and a stable subject reference. Delete the document image on a short clock. The subject reference is the only thing that travels.
Attach the reference to the consignment, never the identity. The delivery record carries an opaque token and the fact that a step-two check is required. It does not carry a name, a date of birth, a document number or an image. If the courier’s systems are breached, what leaks is a list of parcels that need an ID check, which is a nuisance rather than a disclosure.
At the door, match one to one, server side. The driver app captures the recipient’s document and a live capture, sends both to the verification service with the token, and gets back a yes or a no. The comparison happens against the record created at checkout. The driver never sees the buyer’s stored photo, nothing persists on the handset, and the decision is made by the same system that made the first one, under the same threshold. Your due diligence defence now rests on a logged machine decision rather than on a recollection.
Make the refusal path a product, not an exception. A failed match should offer a redelivery with a named alternative, a collection from a staffed point where a step-two check can happen properly, or a cancellation with an automatic refund. Build it before launch, because it will fire more often than your model predicts and it is the only part of this flow your customers will ever write a review about.
One honest caveat on that design: the Act and the factsheet describe the courier inspecting a document. Whether a server-side match satisfies the duty, or whether the regulations will require a human visual check as well, is not settled until the secondary legislation and guidance land. Build the machine check as the primary control and keep the driver’s visual confirmation as a second step, so you are covered either way.
The bulk sales duty is an identity problem in disguise
“Report six or more bladed articles to the same buyer in 30 days” reads like a reporting requirement. It is a data modelling requirement, and most e-commerce stacks fail it quietly.
To count six to the same buyer you need a stable buyer identity across orders. Your checkout probably does not have one. Guest checkout creates a new row. A customer who uses a work email once and a personal email the next time is two buyers. A shared household address with four people is one address and four buyers, and the Act’s wording reaches repeated deliveries to a single address too.
The verification you now have to run at step one gives you the thing you were missing. A document check produces a subject reference that is stable across orders without you storing the document. Use it as the aggregation key, keep a rolling 30 day counter against it and against the delivery address, and the duty becomes a query instead of a project.
Then there is the catalogue side, which is where the real effort goes. The exemption list is specific: disposable razor blade cartridges, non-locking folding pocket knives with a blade of three inches or less, cutlery other than pointed steak knives, qualifying knife sets of three or more different sizes, and business to business sales where you verify a VAT number or company registration. Every one of those is a product attribute, and if your catalogue does not carry blade length, locking mechanism and set composition as structured fields, nobody can write the rule. For a general retailer with tens of thousands of listings, the catalogue work is larger than the verification work by a wide margin.
Who is actually in scope
The Home Office impact assessment models between 1,384 and 5,752 distinct online businesses selling knives in the UK. That spread tells you something: the government does not know either, and it is not a list of specialist knife shops.
It includes supermarkets that deliver, kitchenware retailers, hardware and garden suppliers, craft and hobby sellers, fishing and camping stores, restaurant supply businesses, and every marketplace where a third-party seller lists a blade. If you run a marketplace, you have two separate problems: the content removal notice regime that applies to you directly, and the fact that your sellers’ compliance failures arrive at your customers’ doors in your packaging.
The impact assessment’s cost figures are small, in the low hundreds of thousands of pounds across the whole sector for first-year familiarisation and ongoing reporting. Those numbers are about reading the rules, not about building the systems. Do not use them to size your own project.
What to have in place
- Classify the catalogue. Blade length, locking mechanism, pointed or not, set composition, B2B eligibility, as structured fields. Nothing else can start until this exists.
- Put document plus liveness verification on the checkout path for in-scope lines only. Running it on the whole catalogue is the lazy version and it will cost you conversions on the 90% of orders that do not need it.
- Produce a stable subject reference at verification and store it against the order. Not a name. A reference.
- Negotiate step two into your courier contracts before you need it: the duty to check, the format of the check, audit rights, a reporting feed of outcomes, and who carries the cost of a refused delivery.
- Disable locker, safe place, neighbour and unattended delivery for in-scope consignments at the point the basket is built, not at dispatch.
- Build the refused-delivery flow with a redelivery option, a staffed collection option and an automatic refund.
- Stand up the bulk sales counter against subject reference and address, with a 30 day rolling window, and hold the output until the reporting mechanism is specified.
- Write the due diligence file. What the system does, which version has been running since when, who reviews exceptions, and what the measured outcome rates are. “Functional, documented and consistently applied” is three claims and you need evidence for each.
The honest limits
Royal Assent is not commencement. The Act commences in parts, and the detail of both the accepted identity documents and the bulk sales reporting mechanism depends on secondary legislation that has not been made. Vendor blog posts asserting the regime is “already in effect” are moving faster than the statute book. Check the commencement position for the specific provision before you tell your board a date.
The delivery step as described covers residential addresses in England and Wales. Scotland and Northern Ireland follow different routes, and Northern Ireland’s position has been through a legislative consent process. If you ship UK-wide, you have more than one rule.
We have found no published guidance yet on whether a server-side one-to-one match discharges the courier’s inspection duty, which is the single most consequential open question in this post. Treat our recommended design as a reading of the text, not a settled answer, and keep the driver’s visual check in place until it is.
None of this is legal advice. A retailer with real exposure here should get a view on its own catalogue and its own courier contracts.
How Xident fits
One document check, two decision points. Xident reads the document, runs liveness and matches the face at checkout, then exposes the same subject for a one-to-one match at delivery. The second check does not require the buyer’s document to exist anywhere outside our systems, and nothing is cached on a driver handset.
Decision records instead of retained images. Every check returns outcome, method, threshold, confidence, policy version and timestamp. Document images are deleted within 24 hours of processing. That record is what a due diligence defence is made of, and it is also what makes the bulk sales counter possible without you holding identity documents for 30 days.
The arithmetic for a two-stage flow. The expensive part is step one. A document Verification on Growth is €0.20. The door check is a returning-user Check at €0.02, because the identity already exists. A retailer shipping 20,000 in-scope orders a month pays about €4,000 for the checkout verifications and about €400 for the delivery matches. One conviction on indictment is not a number you can put next to that. Rates are on the pricing page.
Metered, not stopped. Starter, Growth and Scale meter past the included Check volume rather than halting, so a Christmas spike in kitchen knife orders does not turn your age gate off mid-season. Basic stops at its boundary by design, which makes it the wrong plan for seasonal retail.
The free sandbox grants 1,000 Checks and 100 document Verifications as one-time allowances rather than a monthly quota, which is enough to run a full purchase-to-doorstep flow end to end before you renegotiate a courier contract.
The short version
The Crime and Policing Act 2026 makes a remote knife sale a two-part age decision: document plus live photo at checkout, and a courier confirming at the door that the recipient is the buyer. Lockers, safe places and neighbours are out.
The engineering answer is a reference, not a copy. Verify once, keep a subject reference and a decision record, send the courier a token and a requirement, and resolve the match server side so no identity document ever reaches a driver’s phone. Use the same reference as the aggregation key for the six-blades-in-30-days counter, because your checkout does not otherwise know that two orders came from one person.
Then do the unglamorous part, which is the catalogue. You cannot gate a product category you have not described in structured fields, and that is where this project will actually spend its time.
Xident provides age and identity verification infrastructure built on one-to-one document matching, with decision records kept in place of images and a returning-user Check priced an order of magnitude below a document Verification. The free sandbox includes a one-time allowance of 1,000 Checks and 100 document Verifications. Talk to us about proving that the person at the door is the person who paid.
