U.S. Regulators Clarify Banks Can Use Mobile Driver’s Licenses for Customer Checks

U.S. banks and credit unions may use state-issued mobile driver’s licenses and other government-issued verifiable digital credentials to verify customers under federal Customer Identification Program rules, according to new joint guidance from five financial regulators.

The Financial Crimes Enforcement Network issued two new frequently asked questions with staff from the Federal Reserve, Federal Deposit Insurance Corporation, National Credit Union Administration and Office of the Comptroller of the Currency. The agencies also updated an earlier answer to reflect current terminology for digital credentials.

The guidance defines a verifiable digital credential as a data structure containing information about an individual that is digitally signed by its issuer, bound cryptographically to a device and protected by an activation factor. That factor can be something the holder knows, such as a PIN, or a biometric attribute such as a face or fingerprint.

An unexpired state-issued mobile driver’s license can qualify as government-issued identification when it shows nationality or residence and includes a photograph or comparable safeguard. A bank may consider accepting one in person, over the internet or through another digital channel if its systems can extract the required information and the method is permitted by its customer identification program.

The agencies stressed that the Customer Identification Program rule neither requires nor prohibits reliance on government-issued digital credentials. Financial institutions must still form a reasonable belief that they know a customer’s true identity and must take indications of fraud into account.

The same framework allows an electronic credential issued by a private third party to serve as a non-documentary verification method. In that case, the bank or credit union remains responsible for ensuring the third party uses the same level of authentication the institution would apply itself.

The clarification arrives as core mobile ID standards have become easier for implementers to consult and more government agencies accept digital credentials. The Transportation Security Administration, for example, recently began accepting the myColorado mobile driver’s license at supported airport checkpoints.

FinCEN said the answers do not alter existing Bank Secrecy Act requirements or create new supervisory expectations. They instead explain how existing identification rules apply when a customer presents a cryptographically verifiable government credential rather than a physical card.

Sources: FinCEN, FinCEN FAQs, OCC

–

By the ID Tech Editorial Team