To respond to both your points,
I agree with Martin that an address of record is attached to a verified identity, but that it need not be evidence of the identity, and that the subscriber uses their authentication factors, not their address of record, to authorize the CSP to act on their behalf. The address of record is a communication channel for the applicant/subscriber to receive important communications from the CSP (e.g. proofing notifications) and as a delivery channel for the subscriber's authenticators.
As it relates to validation and verification, it is reasonable to argue that an address can be validated by confirming deliverability (i.e. by sending mail either physically or electronically to the address and having it reach the expected destination) and that it can be verified through the applicant's return of the enrollment code. Also, because an address of record is not used to establish the core identity, it does not need to be on the identity evidence. (See 800-63A § 4.4.1.6(2) which allows a CSP to confirm address of record by validating information supplied by the applicant that's not on their identity evidence and pages 37 & 38 of the current Conformance Criteria which allow an enrollment code to both validate and verify an address, establishing it as the applicant's address of record.)
Regarding Blake's point, I interpret the previously cited Conformance Criteria as supporting the position that validation with external records separate from an enrollment code should not be required. I am also unclear about the relevance of GLB to this discussion. GLB requires financial institutions to protect consumer PII which includes addresses, but does not touch on the reliability of records for confirming addresses. (It is also not referenced in 800-63 regarding addresses of record.)
Whether addresses of record can also serve as identity evidence to prove the actual identity, such as through a phone carrier lookup confirming the applicant's ownership of the phone number is not necessary to fulfill the purpose of an address of record and should not be required by the 800-63 standards. While you are absolutely correct that an address of record must be established as a part of the identity proofing process, the definition of address of record and its associated requirements point to its primary function as a communication/delivery channel, rather than a form of identity evidence.
Yehoshua Silberstein | Associate Counsel, Core Product
(857) 577-8144
Notarize is now a Proof brand 🎉 We hope you love our new look and feel as much as we do!