On May 2nd, the Nevada Cannabis Control Board published a significant update to their guidelines for ID scanning. As we have mentioned before, Nevada is the nationwide leader when it comes to protecting minors from cannabis access, and these new guidelines go a long way to clarify some of the confusing and redundant technology lingo that had bee present in their previous guidelines.

In this post we’ll break down each guideline, what it means for your dispensary or cannabis retailer, and how you can ensure compliance.

Age Verification Functionality

Scanners must include robust age verification functionality to ensure customers meet the legal age requirement for cannabis purchases. Additionally, scanners should have the capability to detect expired IDs to prevent unauthorized purchases.

What this actually means

Simply, you are required to use an ID scanner to check each ID. That scanner must be able to read the barcode of the ID and check the age against today’s date. It should also be able to read the expiration date of the ID to flag if the ID is expired. This is easy and is available in almost every commercially available ID scanning app or age verification system.

Can IDScan.net VeriScan comply? Yes.

Barcode/QR Code Scanning with High-Resolution Imaging

Utilize advanced barcode and QR code scanning technology with 400 DPI high-resolution imaging for accurate data extraction from identification documents. Manual security checks should be conducted to detect barcode format anomalies which may indicate an ID is fraudulent.

What this actually means

Some ID scanning software uses OCR (optical character recognition) to read the text on the front of the ID. This is slower, less accurate, and more easily tampered with, since it is much easier to fool OCR than barcode scanning. Nevada says explicitly that the ID scanning must scan the barcode of the ID, versus using OCR to determine the age/expiration.

In addition, the barcode reading software must be capable of performing barcode security checks. This is AI-driven format examination of the barcode’s format to look for anomalies or inconsistencies which are present in 50-60% of fake IDs. When underage customers are searching for a “scannable fake ID” they are specifically looking for a more sophisticated and expensive ID that can pass these kind of checks.

Can IDScan.net VeriScan comply? Yes.

Notable in this section is the requirement for 400 DPI high-resolution imaging. This exceeds the resolution capable on most mobile devices.

Large Scanning Window

Ensure the scanning window accommodates passports and other large-format identification documents for comprehensive verification.

What this actually means

The dispensary or retailer needs to be able to scan documents other than ICAO-sized cards (drivers licenses, passport cards, etc). They need a large enough scanning window to be able to accommodate passports. This means that slot-readers are not compliant with the Nevada regulations, unless they are paired with a large window device.

Examples of ID scanning devices that have large windows and are capable of meeting Nevada CCB’s requirements when paired with VeriScan software.

Notably they don’t mention ultraviolet light scanning here, which, in theory, could allow for a more diverse array of scanners. Because ultraviolet is listed below, and was included on the previous list of ID scanning requirements from the NCCB, we are continuing to recommend only ID scanners capable of performing in three lights (white, ultraviolet, infrared).

Can IDScan.net VeriScan comply? Yes with specific ID scanning hardware.

Multispectral Imaging with Infrared Illumination

Scanners should utilize multispectral imaging with both visible and infrared illumination to capture data and images effectively, including information embedded in ICAO compliant documents in near infrared.

What this actually means

A basic ID scanner or handheld image reader will typically not be capable of performing infrared checks on an ID. This requires specialty cameras and light sources. There are only a few scanners capable of infrared checks, while also possessing a large scanning window to accommodate passports.

Additionally, this implies that the ID scanning software used must also be capable of detecting infrared/near infrared marks on the identity document to determine authenticity.

Can IDScan.net VeriScan comply? Yes with specific ID scanning hardware and VeriScan ID Authentication.

Data Capture and Subscription Service

Scanners must capture data with optional subscription services for regular updates and support.

What this actually means

The ID scanner must sync data from the scanned ID or passport into a system. It can’t just flash a a red or green light and tell your budtender or security that the ID is authentic, the data must be saved.

A subscription service must be offered to provide updates for the latest ID formats, to ensure as new designs are released that they are compatible with the scanners and software.

Notably, NCCB has omitted any requirement to save images of the ID, nor have they specified a length of time for which the data must be retained, only that it must be synced into the system.

Can IDScan.net VeriScan comply? Yes.

OCR (Optical Character Recognition) for Text Extraction

Utilize OCR technology to extract text from images, enabling efficient reading of printed information on identification documents.

What this actually means

The ID scanning software must have OCR capabilities as well. The exact purpose of this requirement is slightly unclear, because OCR has fallen out of favor as the standard for reading or verifying IDs as it is slow and easily fooled by tampered IDs. The desire to include this could be for one of two reasons:

• Nevada wants to ensure that IDs without barcodes can be read. This includes tribal IDs, some international documents, etc. which don’t use a PDF417 barcode.
• Nevada wants dispensaries to perform front/back crossmatch, which is a key check when authenticating an ID. We use OCR to ingest the text on the front of the ID, and then we compare it to the data stored in the ID’s barcode. This is another crucial check that can often reveal fraudulent IDs, and the flatbed ID and passport scanners listed above are capable of performing this feature.

Can IDScan.net VeriScan comply? Yes.

International Document Verification

Scanners must have the ability to scan global passports, meeting regulatory requirements for international customers.

What this actually means

The software must be able to scan passports. No mystery here. Nevada is a global destination and they want to ensure all international visitors have the same access and great experience.

Can IDScan.net VeriScan comply? Yes.

Database Integration for Real-Time Verification (Recommended)

Integrate scanners with online databases for real-time verification of identification information, enhancing security and compliance, particularly for those used for curbside or deliveries when there is no ability to authenticate.

What this actually means

Your ID scanning software should have the ability to query against some sort of third-party database that can perform an additional identity check. Most common are queries against the DMV database, which will confirm/deny whether the information on the identity document has been issued by their jurisdiction. There are also other third party checks, which don’t have the state limitations of AAMVA, and can check against multiple sources such as the Social Security Administration and fraud lists.

We have always recommended these third party checks as a great option for delivery businesses, or in situations in which use of a Windows-powered ID scanning device or ID authentication is not possible.

Can IDScan.net VeriScan comply? Yes. You can purchase buckets of third party checks which can be triggered on-demand when you have an ID that you would like some additional assurance on.

In addition to the above requirements, retail (dispensary) cannabis establishment agents must take additional security measures during the delivery of cannabis or cannabis products:

Ultraviolet (UV) Light Inspection

Perform a thorough UV light inspection of the ID card under an ultraviolet UV light source to detect UV reactive elements unique to every state, such as holograms, hidden images or patterns, and evidence of tampering.

What this actually means

We’re a little stumped here. We’ve made the NCCB aware that there is no ability to perform ultraviolet/UV checks using a handheld scanner, so these type of checks are difficult to perform in a delivery or curbside environment.

They could mean use of a simple UV light to quickly check ultraviolet markings on the ID upon handoff of the delivery purchase.

Or they could simply have meant to include the UV checks for retailers, as ultraviolet scanning is a capability of many Windows-based scanners, and is a native feature of ID authentication.

Can IDScan.net VeriScan comply? Yes.

Customer Signature on Delivery Manifest

Ensure customers sign the delivery manifest as an additional verification step.

What this actually means

Customers must sign for their delivery.

Can IDScan.net VeriScan comply? This feature would existing inside the dispensary’s POS or delivery software, though webhooks can be used to sync ID data to the delivery manifest.

Completion of Delivery Log

Agents must ensure the completion of the delivery log, as referenced by NCCR 7.050 (5)(b), which should be made available for inspection upon request to maintain compliance.

Can IDScan.net VeriScan comply? This feature would existing inside the dispensary’s POS or delivery software, though webhooks can be used to sync ID data to the delivery manifest.

What has changed from the NCCB’s old guidelines?

You can view the originally published guidelines here.

Specifically, several bullet points were removed or significantly amended:

• They have removed the need to capture images. This makes sense as many dispensaries do not want to deal with the PII concerns and data storage volume associated with image capture. Additionally, some dispensaries are using POS integrations that have not yet been configured to accept images.
• They have removed 1D barcode reading. This makes sense as 1D barcodes are a symbology that is rarely used and is not present on most modern iterations of drivers licenses.
• They have removed magstripe reading. This also makes sense as magstripes contain very little data, and so are not useful when determining whether an ID is a fake.
• They removed the requirement that the system be USB high speed 2.0 compatible to allow for more flexible configurations.
• They removed the requirement to authenticate the ID cards of foreign nationals. Simply reading these documents is enough.

Conclusion

Nevada CCB ID scanning has gotten much less murky, and with the exception of a couple of slightly confusing bullet points, it has become much more clear and easy to understand. Our VeriScan tools can cover all of the needed requirements for both in-person purchase and delivery. Contact us if you need assistance making sure your Nevada dispensary complies.