Liability Shift

Liability shift is the question of who bears the financial loss when a check turns out to have been wrong, the party that performed the check, or the party that relied on its result. It's not an abstract question in identity verification; it's the exact thing a compliance officer is actually worried about when asked to accept a credential their own team didn't produce: if this turns out to be fraudulent, who pays for that, legally and financially?

Where the named version of this comes from

The clearest, most concrete public example is the EMV chip liability shift in payments: when card networks (Visa, Mastercard, Amex, Discover) moved merchants to chip-card acceptance, they attached a rule, a merchant not equipped to read a chip card became liable for counterfeit-card fraud losses that, before the shift, would have fallen to the card issuer instead. The mechanism that made it work wasn't a new technology; chip cards already existed. It was the networks explicitly reassigning who eats the loss, which is what actually changed merchant behavior. The same question, reassigning who bears a loss, separate from who performed the underlying check, comes up in any system where one party's verification gets relied on by another, identity credentials included, though no card-network-style formal liability-shift regime exists yet for reusable identity credentials anywhere, Solidus included.

Why this is the real question behind "will you accept a reused credential"

A relying party asked to accept a credential it didn't issue is really being asked to take on a risk it didn't fully control the inputs to. If the person behind that credential turns out to be a fraud victim, a synthetic identity, or a sanctioned individual the issuer's check missed, the relying party that accepted the credential, not the issuer, is typically the one holding the regulatory and financial exposure, unless a contract explicitly says otherwise. No such contract exists as a general market practice for reusable KYC credentials today. This is the deeper version of the trust-network problem named throughout this Lexicon (see Trust Registry, Verification Reuse): accreditation and de-listing address whether an issuer is credible, but neither one, by itself, moves the financial liability for a bad check anywhere. That's a separate, unsolved piece.

Solidus today

Solidus offers no liability shift. Every vertical GTM document Solidus has written states the same position without exception: the relying party accepting a reused credential keeps its own program of record, its own regulator relationship, and its own compliance liability. Solidus sits upstream as an optional identity-proofing input, never as an indemnifying party standing behind the check. There is no insurance product, no contractual liability-shift clause, and no committed roadmap date for one. A business accepting a Solidus-issued credential today is making an uninsured trust decision on its own judgment, and this entry states that as directly as Solidus's own internal sales materials do.

See also

Reliance is the legal concept describing the act of trusting a credential in the first place, liability shift is about what happens when that reliance turns out to be misplaced. Trust Registry and Level of Assurance reduce the chance of a bad check being relied on, without resolving who pays if one slips through anyway.