Source hierarchy
Ask what kind of source it is.
Not every source has the same authority. Title policy, vendor claims, trainer summaries, and AI answers may be useful leads, but they do not replace law or transaction evidence.
Authority ladder
Use this order before accepting a compliance claim.
| Rank | Source type | How to use it |
|---|---|---|
| 1 | Statute | Controls the legal framework unless superseded or limited. |
| 2 | Regulation | Explains enforceable administrative rules. |
| 3 | Official agency guidance | Useful for official interpretation and compliance expectations. |
| 4 | Court or regulator action | Shows adjudicated or enforcement treatment. |
| 5 | Transaction record | Shows what actually happened: date, notary, method, platform event, journal, audit trail. |
| 6 | Contract or underwriting policy | Shows private acceptance or risk policy, not public law. |
| 7 | Vendor documentation | Shows what a vendor claims or built; it is not a legal ruling. |
| 8 | Trade/influencer/AI summary | Use as a lead only. Verify against stronger sources. |
Virginia example
KBA and biometrics must stay separate.
KBA being added in July 2024 helps current Virginia workflows that actually use KBA. It does not transform selfie/liveness/face-match into Virginia's valid-digital-certificate biometric route.
For every transaction, ask what statutory identity method was used and what record proves it.