Regulators Clear Path For Verifiable Digital Credentials In Customer Identification

Overview

On September 8, 2026, the US Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN), together with the staffs of the Federal Reserve Board, the Federal Deposit Insurance Corporation, the National Credit Union Administration, and the Office of the Comptroller of the Currency, issued and revised frequently asked questions (FAQs) addressing the use of state-issued mobile driver’s licenses (mDLs) and other government-issued verifiable digital credentials (VDCs) under the Customer Identification Program (CIP) Rule.¹ For the first time, federal regulators have expressly confirmed that properly authenticated digital credentials may satisfy CIP verification requirements, removing a source of uncertainty that has slowed adoption of digital identity solutions across the financial sector.

In depth

The guidance reflects a broader regulatory trend toward technology-neutral, risk-based compliance frameworks. Consistent with FinCEN’s recent focus on anti-money laundering/countering the financing of terrorism program effectiveness, the agencies clarified that compliance turns not on the medium through which identity information is presented, but on whether institutions can establish the reliability of the information received and appropriately manage associated risks. The FAQs confirm that physical identity documents are not the exclusive path to CIP compliance and that institutions may incorporate digital credentials into their onboarding processes where supported by appropriate controls.

The guidance is permissive rather than prescriptive. Institutions remain free to determine whether, and to what extent, adoption of VDCs is appropriate given their customer base, fraud environment, technological capabilities, and risk tolerance.

Government-issued digital credentials may qualify as documentary verification

The agencies confirmed that an unexpired government-issued VDC may constitute documentary verification under the CIP Rule.² A VDC contains identity information authenticated by the issuing authority, bound to a device, and protected through mechanisms such as biometric authentication, passwords, or PINs. State-issued mDLs are the most common example and are generally designed around the ISO/IEC 18013-5 framework governing issuance, presentation, and verification of digital credentials.

The most significant aspect of the guidance is not the recognition of digital credentials, but the agencies’ emphasis on authentication. A VDC qualifies because its authenticity and integrity can be independently validated, including through verification of the issuing authority’s digital signature. Merely reviewing an image or electronic copy of an identity document remains fundamentally different from validating a credential whose authenticity can be cryptographically confirmed.

The FAQs therefore reinforce an important principle: Digital identity solutions can strengthen, rather than weaken, customer identification controls when implemented appropriately. At the same time, institutions remain responsible for identifying and responding to indicators of credential manipulation, misuse, or other fraud. The agencies did not prescribe a particular technology or verification methodology, leaving institutions flexibility to adopt solutions appropriate to their operational environment and risk profile.

Third-party credentials remain non-documentary verification

The FAQs distinguish government-issued credentials from credentials issued by private-sector providers. Third-party credentials remain a non-documentary verification method under the CIP </div>a
a level of identity assurance comparable to the institution’s own standards.

As a result, reliance on digital identity providers should be incorporated into the institution’s broader vendor oversight framework, including appropriate diligence, contractual protections, testing, and ongoing monitoring.

Compliance takeaways

The broader significance of the FAQs lies in what they signal about the direction of identity verification regulation. Rather than treating digital credentials as an exception to traditional CIP requirements, the agencies recognized them as a potentially reliable source of identity evidence when supported by appropriate controls. Consistent with FinCEN’s broader emphasis on effective, risk-based compliance programs, the guidance focuses less on how identity information is presented and more on whether institutions can verify its authenticity and manage associated risks.

Institutions considering adoption of VDCs should review their written CIP procedures, determine which credential types and issuers they will accept; establish verification and exception-handling processes; and ensure appropriate fraud, operational, and recordkeeping controls. Particular attention should be given to the distinction between a cryptographically verified credential and a static image of an identification document, which underpins the agencies’ analysis.

Although directed to banks and credit unions, the reasoning is likely to be influential for other regulated financial institutions with comparable customer-identification obligations, including broker-dealers and mutual funds. More broadly, the FAQs provide another indication that FinCEN expects institutions to evaluate digital identity solutions based on demonstrable reliability and risk management.

The guidance leaves open important questions concerning foreign-issued credentials, revocation standards, interoperability, and the interaction between digital identity verification and beneficial ownership requirements. Nevertheless, it provides meaningful regulatory clarity on a question many institutions have been evaluating for years and removes a significant obstacle to broader adoption of digital identity technologies in customer onboarding.

Footnotes

1 FinCEN et al., Frequently Asked Questions Regarding Treatment of Verifiable Digital Credentials Under the Customer Identification Program Rule (Sept. 8, 2026).

2 31 C.F.R. § 1020.220(a)(2)(ii)(A)(1).