Federal regulators say mDLs can be used for bank identity checks

Banks and credit unions can use state-issued mobile driver’s licenses and other government-issued verifiable digital credentials to verify the identities of customers opening accounts, federal financial regulators said Tuesday, offering long-sought regulatory clarity on the use of digital identity in financial services.

The U.S. Treasury Department’s Financial Crimes Enforcement Network (FinCEN) has issued answers to two new Frequently Asked Questions (FAQs) and updated one existing FAQ addressing the use of state-issued mobile driver’s licenses (mDLs) and other government-issued verifiable digital credentials that may be used to verify the identities of customers under the Customer Identification Program (CIP) Rule.

The guidance does not alter existing Bank Secrecy Act requirements or create new supervisory expectations.

The new guidance resolves a fundamental question for financial institutions considering whether to build mDL acceptance into their identity verification systems by confirming that an unexpired government-issued digital credential qualifies as government-issued identification under the existing CIP rule.

FinCEN defines a verifiable digital credential (VDC) as a data structure containing information about an individual, digitally signed by its issuer, cryptographically bound to a device, and protected by an activation factor.

The activation factor can be something the holder knows, like a PIN or password, or a biometric, such as a face or fingerprint.

That definition distinguishes the credentials covered by the guidance from a digital image or scan of a physical identification document. A qualifying credential includes cryptographic protections that allow the information and its issuing source to be authenticated.

Biometric Update reported Monday that AI fraud accelerates US’ shift toward cryptographic digital identity.

FinCEN, together with staff from the Federal Reserve, Federal Deposit Insurance Corporation, National Credit Union Administration, and Office of the Comptroller of the Currency, said a bank or credit union may accept an mDL when opening an account in person or remotely via the Internet or another digital or virtual channel, provided its procedures otherwise comply with the CIP rule.

An unexpired government-issued VDC, such as an mDL, qualifies as “government-issued identification” for purposes of the rule’s documentary verification provisions when it evidences nationality or residence and carries a photograph or similar safeguard.

The institution must also have technology that can extract the required information, and its CIP must permit use of the credential.

The regulators are not requiring financial institutions to accept digital IDs. The CIP rule, the agencies said, “neither requires nor prohibits” relying on government-issued VDCs.

Banks also retain responsibility for determining that they reasonably believe they know the customer’s identity. If a digital credential shows indications of fraud, the institution must take that into account rather than relying on the credential simply because it was nominally government-issued.

The agencies separately updated a longstanding CIP FAQ addressing electronic credentials used as a non-documentary identity verification method.

A bank or credit union may use a digital certificate or VDC as a verification method if its CIP permits it. But when a non-government third party issues and maintains the credential, the financial institution remains responsible for ensuring the third party uses the same level of authentication the bank or credit union would use.

The distinction gives government-issued mDLs a clearer regulatory footing than privately issued digital identity credentials because a qualifying government credential can be treated as a documentary method of verification under the rule.

The guidance comes as the National Institute of Standards and Technology (NIST) has been working with the financial sector on precisely this use case.

In March, NIST’s National Cybersecurity Center of Excellence released an initial public draft of Special Publication 1800-42A, a technical roadmap for using mDLs for online identity proofing and high-risk financial transactions.

The project, conducted with 29 industry and government partners, built a standards-based demonstration showing how a financial institution could cryptographically verify an mDL during online account opening.

NIST mapped that demonstration against CIP requirements, including collecting a customer’s name, date of birth, and address; verifying the digital credential; and retaining required records. But NIST explicitly cautioned that its technical mapping did not guarantee regulatory acceptance or compliance.

Tuesday’s interagency guidance now directly addresses that regulatory question.

NIST has argued that mDLs can provide stronger protection against identity fraud than conventional online identity verification methods because the credential can be cryptographically authenticated rather than relying primarily on images of physical documents and database checks.

Its financial-sector project was designed in part to reduce fraud vectors associated with traditional identity management technologies.

The infrastructure needed to verify those credentials is also developing.

The American Association of Motor Vehicle Administrators (AAMVA) operates a Digital Trust Service that enables participating issuing authorities to make their cryptographic public keys available to relying parties.

AAMVA says participating mDL programs must conform to the ISO/IEC 18013-5 standard and its implementation guidelines, allowing a verifier to determine that a credential was issued by a legitimate authority and has not been altered.

ISO/IEC 18013-5 is the global technical standard that defines how mobile driver’s licenses are structured, transmitted, and securely verified in person.

FinCEN’s new FAQ does not require banks to adopt those standards or dictate how institutions must implement mDL verification technology. Instead, it leaves those decisions to institutions’ risk-based customer identification programs.

Banks and credit unions still must decide whether to build the technical infrastructure and procedures needed to accept digital credentials, and they remain responsible for detecting fraud and establishing a reasonable belief that a customer is who they claim to be.

Article Topics

digital ID  |  financial services  |  FinCEN  |  identity verification  |  ISO 18013-5  |  mDL (mobile driver's license)  |  U.S. Government  |  verifiable credentials