Federal financial regulators have clarified that banks and credit unions can use government-issued digital credentials to verify customers’ identities, potentially streamlining account onboarding. But according to an analysis by Anderson Insights, reliance on digital credentials could place new demands on institutions’ verification technology, compliance procedures and fraud controls.
The Financial Crimes Enforcement Network (FinCEN), together with staff from federal banking agencies, issued two frequently asked questions (FAQs) Sept. 8 addressing the use of state-issued mobile driver’s licenses and other government-issued verifiable digital credentials (VDCs) under the Bank Secrecy Act’s Customer Identification Program (CIP) requirements.
The guidance establishes that qualifying digital credentials can satisfy existing documentary identification requirements. However, institutions must ensure their systems can use those credentials to establish the reasonable belief that they know a customer’s true identity required by the law.
According to Anderson, the central issue is not whether digital identification is legally acceptable, but whether banks’ technology, records and exception-handling procedures can support a defensible identity-verification decision.
The FAQs distinguish verifiable digital credentials from electronic images of traditional identification documents.
A VDC contains information about an individual that is digitally signed by the issuing authority, cryptographically bound to a device and protected by an activation factor, such as a PIN, fingerprint or facial recognition.
Unlike a photograph or screenshot of a driver’s license, a VDC can provide cryptographic evidence concerning the credential’s issuer and integrity.
Under the guidance, an unexpired government-issued VDC may qualify as documentary identification if it establishes nationality or residence, includes a photograph or comparable safeguard and can be processed by the institution’s technology.
The institution’s CIP must also permit its use.
The distinction has practical implications for banks and FinTech vendors developing digital onboarding systems. Simply extracting information from a digital image does not establish that a credential’s signature, device binding or status has been authenticated.
The FAQs, issued jointly with staff from the Federal Reserve, Federal Deposit Insurance Corp., National Credit Union Administration and Office of the Comptroller of the Currency, do not require institutions to accept digital credentials or establish new supervisory expectations.
Instead, they clarify how existing requirements under 31 C.F.R. § 1020.220 apply to emerging identification technologies.
We’d love to be your preferred source for news.
Please add us to your preferred sources list so our news, data and interviews show up in your feed. Thanks!
Banks generally may rely on qualifying government-issued credentials, but indications of fraud must be considered when determining whether the institution reasonably believes it knows the customer’s identity.
Anderson Insights emphasizes that even a technically valid credential cannot resolve discrepancies involving sanctions screening, account records, addresses, device risks or previous customer information.
Institutions therefore need procedures for requesting additional documentation, applying nondocumentary verification methods, suspending onboarding or escalating potential fraud.
The guidance also leaves existing customer due diligence, beneficial ownership, sanctions compliance and suspicious activity monitoring obligations unchanged.
Its scope is limited to banks and credit unions, per Anderson. Broker-dealers, investment advisers, money transmitters and other financial intermediaries must assess their own applicable identification requirements.
For institutions adopting digital credentials, Anderson recommends documenting supported credential formats, issuing authorities, account types and verification channels before implementation.
Vendor diligence should examine issuer authentication, cryptographic key management, credential expiration and revocation checks, privacy protections, record retention and system reliability.
Institutions should also test how systems respond to altered credentials, unsupported issuers, lost devices, failed authentication and inconsistent customer information.
Banks remain responsible for CIP compliance even when vendors provide the underlying technology.
Ultimately, the guidance removes a legal obstacle to digital identification without reducing institutions’ accountability for verification decisions. The compliance challenge shifts toward demonstrating that digital onboarding systems can reliably authenticate credentials, identify exceptions and produce sufficient records to substantiate customer identity determinations.