Frequently Asked Questions Regarding Treatment of Verifiable Digital Credentials Under the Customer Identification Program Rule

1 Frequently Asked Questions Regarding Treatment of Verifiable Digital Credentials Under the Customer Identification Program Rule The U.S. Department of Treasury’s Financial Crimes Enforcement Network (FinCEN), jointly with the staffs of the Board of Governors of the Federal Reserve System, the Federal Deposit Insurance Corporation, the National Credit Union Administration, and the Office of the Comptroller of the Currency (the “Agencies”), are issuing two new frequently asked questions (FAQs) that address the use of state-issued mobile driver’s licenses (mDLs) and other government-issued verifiable digital credentials, which may be used to verify identities of natural person customers under the Customer Identification Program (CIP) Rule.1 These FAQs explain how the CIP Rule may apply to such verifiable digital credentials (VDCs). Additionally, FinCEN and the Agencies are amending a previously issued FAQ to reflect updated terminology being used to describe VDCs. 2 The answers to these FAQs neither alter existing BSA legal or regulatory requirements nor establish new supervisory expectations. 31 C.F.R. § 1020.220(a)(2)(ii) - Customer Verification

1. What is a verifiable digital credential? A verifiable digital credential, or VDC, is a data structure that contains information about an individual, is digitally signed by the issuing source of the information, is cryptographically bound to a device, and is protected by an activation factor. An activation factor is something the user knows (e.g., a PIN or password) or a unique attribute they possess (e.g., a physical biometric, like a face or finger-print).
2. Can a bank or credit union use a government-issued verifiable digital credential (VDC), such as a state-issued mDL, to verify the identity of a customer who opens an account, either in-person, remotely over the Internet, or through some other digital or virtual channel? Yes, a mobile driver’s license, or mDL, is a VDC format for a driver’s license or identity card that is issued by a state government and contains all of the same information as a physical driver’s license. As such, a bank or credit union may consider accepting such a credential provided that the bank or credit union can meet the requirements of the CIP Rule. The CIP Rule neither requires nor prohibits reliance on such government-issued VDCs as a means of verifying a customer’s identity. For the purposes of 31 C.F.R. § 1020.220(a)(2)(ii)(A)(1), an unexpired, government-issued VDC, such as an mDL, would qualify as a “government-issued identification,” though it must also “evidence nationality or residence and bear a photograph or similar safeguard.” Accordingly, if the bank or credit union maintains the appropriate technology or systems to extract the relevant information from a government-issued VDC and it 1 31 C.F.R. § 1020.220 2 See Board of Governors of the Federal Reserve System, Federal Deposit Insurance Corporation, FinCEN, National Credit Union Administration, Office of the Comptroller of the Currency, Office of Thrift Supervision, and Treasury, FAQs: Final CIP Rule, 31 C.F.R. § 103.121(b)(2)(ii) -- Customer verification, FAQ #3, available at https://www.fincen.gov/system/files/guidance/finalciprule.pdf.

2 is allowable under the bank’s or credit union’s CIP, it may consider unexpired state-issued mDLs or other unexpired government-issued VDCs that “evidenc[e] nationality or residence and bear a photograph or similar safeguard” as one of the documentary methods it uses to verify a customer’s identity. As with other forms of government-issued identification, a bank or credit union generally may rely on a government-issued VDC as verification of a customer’s identity; however, if a government-issued VDC shows indications of fraud, the bank or credit union must consider that factor in determining whether it can form a reasonable belief that it knows the customer’s true identity. Update to previously published Final CIP Rule FAQ: 31 C.F.R. § 103.121(b)(2)(ii) -- Customer verification

3. Can a bank or credit union use an electronic credential, such as a digital certificate or a verifiable digital credential, as a non-documentary means to verify the identity of a customer who opens an account either in-person, remotely over the Internet, or through some other digital or virtual channel? A bank or credit union may obtain an electronic credential, such as a digital certificate or a verifiable digital credential, as one of the methods it uses to verify a customer’s identity, to the extent permitted by the bank’s or credit union’s CIP. However, the CIP Rule requires the bank or credit union to have a reasonable belief that it knows the true identity of the customer. Therefore, for example, for electronic credentials and verifiable digital credentials issued and maintained by a non-government third party, the bank or credit union is responsible for ensuring that the third party uses the same level of authentication as the bank or credit union itself would use. See also FFIEC guidance titled “Authentication in an Electronic Banking Environment” (Updated: September 2026)