NIST Publishes Draft Practice Guide for Financial Institutions Checking Mobile Driver’s Licenses

The NIST National Cybersecurity Center of Excellence (NCCoE) has released the initial public draft of Special Publication 1800-42A, “Digital Identities: Mobile Driver’s License (mDL): Accelerating Development and Adoption of Digital Identity for Financial Institutions.” The document is the result of collaborative work involving 29 industry and government partners and addresses security, privacy, and interoperability challenges specific to mDL adoption in the financial sector. The public comment period is open through May 8, 2026.

The guide helps financial institutions understand how mDL technology integrates with existing identity systems and Know Your Customer and Customer Identification Program compliance requirements. A mobile driver’s license is a digital version of a state-issued credential stored on a smartphone that can be verified in-person or remotely using standardized protocols. Key contributors include NIST Digital Identity Program Lead Ryan Galluzzo, Security Engineer Bill Flanagan, and Heather Flanagan of Spherical Cow Consulting.

The NCCoE’s central finding is that while the technical foundation for a functional mDL ecosystem exists, the industry must shift away from innovation toward stability to create a cohesive, real-world functioning system. The publication states: “Institutions that begin market research, proofs of concept, and pilots now will be better positioned to onboard mDL verification and realize the technology’s potential benefits.” It also calls on standards development organizations to prioritize finalizing critical specifications and consolidating standards to ensure scalability as the market transitions from pilot to commercial deployment.

The draft builds on the collaborative framework established when NIST NCCoE’s mDL financial services project partners were announced in 2024. The guide’s architecture recommendations reference the ISO/IEC standard for remote mDL verification, which extended mobile driver’s licenses beyond in-person use to online identity checks. The privacy section addresses civil society concerns about mDL surveillance risk raised by coalitions seeking stricter data minimization in the underlying standards.

The document covers architecture, threat models, privacy considerations, and specific recommendations for establishing trust across various mDL verification scenarios. The first phase focuses on financial sector use cases, with subsequent NCCoE projects planned for other industry verticals. The push for standards stability aligns with OpenID4VCI interoperability testing results that showed 87 percent success across global credential implementations, signaling the ecosystem is maturing past its experimental phase.

Sources: NIST NCCoE, NCCoE mDL Project

–

By the ID Tech Editorial Team