Banks and credit unions may use qualifying government-issued verifiable digital credentials, including mobile driver's licenses, as part of customer identity verification if their CIP procedures and technology support it. The FAQs do not create a new rule.
Updated September 26, 2026: This article retains its complete original text, with researched updates integrated into the relevant sections.
On September 8, 2026, the Financial Crimes Enforcement Network and staffs of the federal banking agencies issued two new frequently asked questions about state-issued mobile driver’s licenses and other government-issued verifiable digital credentials. The agencies also updated an older electronic-credential FAQ to use current terminology.
The guidance permits a bank or credit union to consider an unexpired qualifying credential as a documentary method under the customer identification program rule. It does not require acceptance of digital credentials, change the underlying Bank Secrecy Act requirements, or establish new supervisory expectations. The practical question is therefore not whether a digital credential is automatically “good enough.” It is whether the institution’s program, technology, records, and exception process can use that credential to form the reasonable belief the rule requires.
A credential is more than an image
The FAQs define a verifiable digital credential, or VDC, as a data structure containing information about an individual that is digitally signed by the issuing source, cryptographically bound to a device, and protected by an activation factor. That factor may be something the user knows, such as a PIN, or a unique physical attribute such as a face or fingerprint.
This architecture distinguishes a VDC from a photograph or scan of a plastic card. An onboarding process that asks a user to upload a screenshot may capture visible fields, but it does not necessarily validate the issuer’s digital signature, device binding, credential status, or controlled presentation. Product requirements should not call both experiences “digital ID” and assume they carry the same assurance.
A state-issued mobile driver’s license is one VDC format. The FAQ says a bank or credit union may accept an unexpired government-issued VDC if it meets the documentary criteria, including evidencing nationality or residence and bearing a photograph or similar safeguard, and if acceptance is allowed under the institution’s CIP. The institution needs technology capable of extracting the relevant information.
Digital identity is moving into regulated customer onboarding.
FinCEN's September 2026 FAQs explain how existing bank Customer Identification Program rules can accommodate that shift without creating a new identity-verification mandate.
A state-issued mobile driver's license can qualify as documentary identification
An unexpired government-issued credential can qualify as government-issued identification for documentary verification if it evidences nationality or residence and bears a photograph or similar safeguard.
A bank or credit union may therefore consider using a state-issued mobile driver's license as a documentary method if its CIP permits the approach and its systems can extract the required information.
The rule does not require digital credentials
The FAQs do not make mobile driver's licenses mandatory.
They also do not prohibit them.
The institution still must design a CIP that allows it to form a reasonable belief that it knows the customer's true identity.
The reasonable-belief standard remains
The CIP rule does not require or prohibit reliance on a government-issued VDC. As with physical government identification, an institution generally may rely on it. If the credential shows indications of fraud, however, the institution must consider that fact in deciding whether it can reasonably believe it knows the customer’s true identity.
That qualification should drive implementation. As an implementation matter, the institution should define what each technical validation or verification result actually means. Product and compliance teams should know which issuer keys or trust lists are used, whether the system checks credential status or expiration, what data is authenticated, how a photograph or similar safeguard is evaluated, and what happens when validation is incomplete.
The program also needs a response to contradictory information. A technically valid credential does not explain a mismatch with sanctions screening, account information, device risk, address records, or prior customer data. Exception rules should identify when to request another document, use a nondocumentary method, pause onboarding, or escalate possible fraud.
Nor do the FAQs erase other responsibilities. Customer due diligence, beneficial-ownership requirements when applicable, sanctions controls, fraud prevention, suspicious activity monitoring, and product-specific eligibility checks remain separate analyses. The guidance addresses use of VDCs to verify natural-person customers under the bank CIP rule, not every identity question for every financial intermediary.
The guidance is for banks and credit unions
The FAQs were issued by FinCEN together with staff from the Federal Reserve, FDIC, NCUA, and OCC.
They address the bank CIP rule in 31 C.F.R. § 1020.220.
That scope matters.
The guidance should not automatically be generalized to broker-dealers, investment advisers, money transmitters, or other financial institutions governed by different identification rules.
Fraud indicators still matter
A government-issued digital credential is not self-authenticating for every compliance purpose.
If the credential shows indications of fraud, the institution must consider that information when deciding whether it can form the required reasonable belief about the customer's identity.
Applicability should be stated narrowly
The new questions specifically discuss banks and credit unions under 31 C.F.R. § 1020.220. The announcement was issued jointly with staffs of the Federal Reserve Board, FDIC, NCUA, and OCC. Other regulated financial institutions have their own customer-identification provisions and should not import the answer without checking their governing rule and regulator guidance.
Fintech companies providing onboarding technology face a related boundary. A vendor can supply verification tools, but the regulated institution remains responsible for a compliant program. Contracts and diligence should define what the vendor validates, which credentials and jurisdictions are supported, how trust materials are updated, what records are returned, and how incidents are reported.
Marketing also requires discipline. Describing a vendor as “government verified” can overstate what the system actually checked. Customer-facing language should accurately distinguish receipt, extraction, cryptographic validation, biometric activation, and the institution’s ultimate verification decision.
Build the control evidence before launch
A sound implementation begins with a legal and product scope document. It should identify eligible institution types, account types, customers, issuers, credential formats, channels, and fallback methods. The CIP itself should describe whether VDCs are accepted and how the institution handles circumstances in which it cannot verify identity.
Vendor diligence should cover security architecture, standards support, issuer authentication, key management, revocation or status checking, accessibility, privacy, data minimization, retention, subcontractors, service continuity, and audit evidence. A demonstration should test altered credentials, expired credentials, unsupported issuers, lost devices, failed activation, mismatched data, and unavailable validation services.
The updated older FAQ also addresses electronic credentials used as a nondocumentary method. When a nongovernment third party issues and maintains the credential, the bank or credit union is responsible for ensuring that the third party uses the same level of authentication that the institution itself would use. That is a distinct route from treating a qualifying government-issued VDC as documentary identification, and procedures should not blur the two.
Records should show what the institution received and did without collecting unnecessary sensitive data. Legal, privacy, and security teams should decide which credential fields, validation results, logs, and images, if any, are retained and for how long. The record needs to support the CIP decision and examinations while limiting avoidable identity-theft risk.
Operational metrics can reveal whether the new method works equitably and reliably. Teams should monitor validation failures by issuer and device, manual-review rates, false positives, fallback completion, suspected fraud, customer complaints, vendor outages, and changes to supported standards. Material changes should return to compliance review rather than shipping as routine interface updates.
The FAQs remove one category of uncertainty: a qualifying government-issued VDC can serve as a documentary verification method for a bank or credit union. They do not remove the work of deciding whether a particular credential, system, and process supports a reasonable belief about a particular customer.
Considering digital credentials in your onboarding process? Contact Braeden Anderson to discuss the guidance’s application to your institution, vendor arrangements, and customer-identification procedures. Discuss digital-ID onboarding.
Non-government credentials fit differently
A bank or credit union may use electronic credentials issued or maintained by non-government third parties as a non-documentary verification method to the extent allowed by its CIP.
The institution remains responsible for ensuring that the third party uses an appropriate level of authentication.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
[View Source]