Frequently Asked Questions Regarding Treatment of Verifiable Digital Credentials Under the Customer Identification Program Rule

1
Frequently Asked Questions Regarding Treatment of Verifiable Digital Credentials Under the Customer Identification Program Rule The U.S. Department of Treasury’s Financial Crimes Enforcement Network (FinCEN), jointly with the staffs of the Board of Governors of the Federal Reserve System, the Federal Deposit Insurance Corporation, the National Credit Union Administration, and the Office of the Comptroller of the Currency (the “Agencies”), are issuing two new frequently asked questions (FAQs) that address the use of state-issued mobile driver’s licenses (mDLs) and other government-issued verifiable digital credentials, which may be used to verify identities of natural person customers under the Customer Identification Program (CIP) Rule.1 These FAQs explain how the CIP Rule may apply to such verifiable digital credentials (VDCs). Additionally, FinCEN and the Agencies are amending a previously issued FAQ to reflect updated terminology being used to describe VDCs. 2 The answers to these FAQs neither alter existing BSA legal or regulatory requirements nor establish new supervisory expectations. 31 C.F.R. § 1020.220(a)(2)(ii) - Customer Verification

1. What is a verifiable digital credential?
   A verifiable digital credential, or VDC, is a data structure that contains information about an individual, is digitally signed by the issuing source of the information, is cryptographically bound to a device, and is protected by an activation factor. An activation factor is something the user knows (e.g., a PIN or password) or a unique attribute they possess (e.g., a physical biometric, like a face or finger-print).
2. Can a bank or credit union use a government-issued verifiable digital credential
   (VDC), such as a state-issued mDL, to verify the identity of a customer who opens an account, either in-person, remotely over the Internet, or through some other digital or virtual channel? Yes, a mobile driver’s license, or mDL, is a VDC format for a driver’s license or identity card that is issued by a state government and contains all of the same information as a physical driver’s license. As such, a bank or credit union may consider accepting such a credential provided that the bank or credit union can meet the requirements of the CIP Rule. The CIP Rule neither requires nor prohibits reliance on such government-issued VDCs as a means of verifying a customer’s identity. For the purposes of 31 C.F.R. § 1020.220(a)(2)(ii)(A)(1), an unexpired, government-issued VDC, such as an mDL, would qualify as a “government-issued identification,” though it must also “evidence nationality or residence and bear a photograph or similar safeguard.” Accordingly, if the bank or credit union maintains the appropriate technology or systems to extract the relevant information from a government-issued VDC and it 1 31 C.F.R. § 1020.220 2 See Board of Governors of the Federal Reserve System, Federal Deposit Insurance Corporation, FinCEN, National Credit Union Administration, Office of the Comptroller of the Currency, Office of Thrift Supervision, and Treasury, FAQs: Final CIP Rule, 31 C.F.R. § 103.121(b)(2)(ii) -- Customer verification, FAQ #3, available at https://www.fincen.gov/system/files/guidance/finalciprule.pdf.