SOLO pilots reusable identity verification across US banks

Banks are testing whether identity verification can become portable across the U.S. financial system, potentially allowing customers to reuse document and biometric checks performed by one regulated institution when opening accounts at another.

The SOLO Network has begun what it describes as a government observed pilot to test whether banks can reuse identity verification work performed by other financial institutions instead of requiring people to repeat document and biometric checks – or businesses to repeat entity and ownership checks – whenever they open a new account.

The pilot, which SOLO says began June 8, is being observed by the Treasury Department’s Financial Crimes Enforcement Network (FinCEN) and conducted in coordination with the Treasury Department, Office of the Comptroller of the Currency (OCC) and Federal Deposit Insurance Corporation (FDIC).

SOLO described it as the first coordinated engagement across Treasury, FinCEN, the OCC and FDIC intended to make bank-to-bank reliance work at scale.

As of Aug. 11, none of the four federal bodies appeared to have issued a companion announcement. SOLO also acknowledges that regulatory observation is not a no-action letter, formal safe harbor or government approval of its business model.

The experiment seeks to build an operational framework around authority banks have possessed since 2003.

Under the federal Customer Identification Program rule, a bank must use risk-based procedures that allow it to form a reasonable belief that it knows a customer’s true identity.

A bank generally obtains a customer’s name, address, identification number and, for an individual, date of birth. It then verifies enough of that information through identity documents, consumer reporting agencies, public databases or other methods to form the required reasonable belief.

But 31 C.F.R. § 1020.220 also permits a bank to rely on another financial institution to perform some or all of those procedures.

The reliance must be reasonable, and the other institution must be subject to a federal anti-money laundering program rule and regulated by a federal banking regulator.

It must also enter into a contract requiring annual certification that it has implemented its anti-money laundering program and will perform, either itself or through an agent, the specified identification procedures.

The provision does not permit direct reliance on just any unregulated fintech or identity vendor. Under SOLO’s model, a sponsor bank is the legal furnisher of a reusable verification certificate even when its fintech partner conducted the underlying check.

A bank may separately employ a vendor as its own agent, but it remains responsible for the vendor’s compliance with its identification program.

Bank examiners must also determine whether reliance on another institution is reasonable.

Federal Financial Institutions Examination Council procedures say the required contract and annual certification ordinarily provide a standard means of demonstrating compliance unless an examiner has reason to question the arrangement.

One reason could be that the institution performing the verification has been subject to a Bank Secrecy Act (BSA) or anti-money laundering enforcement action.

Banks with BSA deficiencies are generally subject to intense scrutiny by examiners.

SOLO says differences among bank policies have kept reliance largely confined to affiliate, sponsor-bank and other bilateral arrangements.

Federal rules establish common minimum requirements, but each bank adopts procedures tailored to its accounts, customers and methods of opening accounts.

A simple indication that another institution passed a customer does not necessarily show which evidence was examined, whether an identity document was authenticated, whether biometric or liveness checks were performed, or how recently the work occurred.

SOLO’s model is intended to fill that gap with standardized certificates describing the work already completed. A bank configures a policy specifying the verification methods, sources, freshness and other conditions it will accept.

SOLO then searches for verification furnished by another regulated institution that satisfies those requirements.

When qualifying work exists, SOLO says the receiving institution obtains a certificate identifying the procedures completed, the methods used, when the work occurred and which institution was responsible.

Furnishers must be able to produce supporting evidence on request. If the available information is incomplete, too old or based on unacceptable methods, the network returns no qualifying certificate and the receiving bank performs the missing work itself.

According to SOLO’s account of the pilot, one workstream maps each bank’s policies into discrete, auditable steps.

For an individual, those steps can include document review, address verification, identity corroboration, biometric comparison and liveness detection intended to determine whether a biometric sample comes from a live person rather than a photograph, recording or other spoof.

For a business, the process can include verification of the entity, ownership and control.

A second workstream connects bank and fintech systems so verification records and vendor results can be furnished in a common format.

A third evaluates each certificate according to the record type, completeness of the verification and how thoroughly SOLO validated the institution’s assertions.

SOLO says FinCEN, the OCC and FDIC have provided input on the contractual structure, step-level reliance model and grading standards.

Perhaps the most notable aspect of the pilot is SOLO’s statement that regulators identified NIST Identity Assurance Level 2 (IAL2) as the benchmark for evaluating verification completeness. While that does not certify participating banks or SOLO as IAL2 compliant, it suggests NIST assurance levels are becoming a common language for portable identity in financial services.

IAL2 requires stronger identity evidence and verification procedures than the lower assurance level and can be achieved through remote or in-person processes, with or without automated biometric matching.

Using it as a benchmark does not itself certify SOLO or a participating institution as IAL2 compliant.

SOLO is also testing a multilateral participation agreement intended to place each institution under the same reliance terms, avoiding a separate contract for every bank-to-bank relationship.

The company maintains that federal rules require a contract but do not require each contract to be bilateral.

Because regulators have issued no formal guidance, no-action letter or safe harbor addressing the arrangement, how consistently examiners treat that structure will be one of the pilot’s most consequential tests.

The identity certificates have defined limits. SOLO says a Know Your Customer or Know Your Business certificate cannot be used as the basis for declining an applicant.

It can satisfy an identification step or lead a bank to request additional documentation, but it is not an underwriting product. The certificates also exclude sanctions and Office of Foreign Assets Control screening, which each bank must conduct independently.

Reusing identity verification does not relieve a bank of separate customer due-diligence, transaction monitoring or suspicious activity reporting obligations.

For consumers, the intended result resembles a financial services version of TSA PreCheck. A person whose earlier onboarding included an identity document, selfie, liveness check and corroboration of identifying information could authorize another institution to evaluate that work rather than repeat it.

SOLO reports that its network includes 10 sponsor banks and more than 240 associated fintech programs representing more than 100 million consumer and small-business profiles.

Those figures describe the company’s claimed network coverage, not participation in the pilot. SOLO has not publicly identified the pilot banks or disclosed how many profiles are involved.

The privacy stakes extend beyond a simple assertion that a person has been verified. SOLO’s technical documentation says a certificate can include information about identity documents, biometric capture and review, liveness checks, addresses and identity corroboration.

An illustrative response contains fields for a passport scan and a biometric artifact identified as a selfie, although it does not establish whether those fields contain the files, references to them or merely illustrative filenames.

The pilot comes as federal regulators consider a substantially similar reliance provision for permitted payment stablecoin issuers.

A joint rule proposed in June by FinCEN, the OCC, Federal Reserve Board, FDIC and National Credit Union Administration would permit an issuer to rely on identification work performed by another federally regulated financial institution under comparable conditions.

The agencies also asked whether the rule should address digital identities and verifiable credentials.

Article Topics

financial services  |  FinCEN  |  IAL2  |  identity verification  |  KYC  |  reusable digital ID  |  SOLO  |  United States