FinCEN Clarifies Use Of Digital Credentials Under CIP

FinCEN and the staffs of the Fed, FDIC, OCC, and NCUA, have jointly issued two FAQs addressing the use of verifiable digital credentials (VDCs), including state-issued mobile driver’s licenses (mDLs), to verify customer identities under the Customer Identification Program (CIP) Rule.

The principal clarification is that an unexpired, government-issued VDC, such as an mDL, may qualify as “government-issued identification” for purposes of the CIP Rule, provided that the VDC evidences nationality or residence and bears a photograph, the institution has the technology or systems necessary to extract the appropriate information, and the institution’s CIP permits its use. As with physical identification cards, however, a VDC is not automatically sufficient if there are indications of fraud. The institution must still be able to form a reasonable belief that it knows the customer’s true identity.

The agencies also updated an existing FAQ to clarify that VDCs issued or maintained by private third parties may be used as a non-documentary means of verification, but the financial institution remains responsible for ensuring that the third party uses the same level of authentication that the institution itself would use. Before relying on a third-party credential, the institution should therefore understand how the provider authenticates an individual and satisfy itself that the process is consistent with the institution’s CIP requirements.

The agencies emphasize that the FAQs “neither alter existing BSA [Bank Secrecy Act] legal or regulatory requirements nor establish new supervisory expectations” and that institutions are not required to accept digital credentials. The FAQs merely confirm that the existing CIP framework is technologically neutral and can accommodate digital forms of identification.