FinCEN, Banking Agencies Clarify Digital Credential Use for Customer ID

FinCEN, joined by the staffs of four federal banking agencies, issued frequently asked questions as to the use of verifiable digital credentials ("VDCs") to confirm customer identities.

The guidance addresses the use of state-issued mobile driver's licenses and other government-issued VDCs under the Customer Identification Program ("CIP") Rule. (A VDC is a data structure containing information about an individual that is digitally signed by the issuing source, cryptographically bound to a device, and protected by an activation factor.)

FinCEN and the staffs of the Federal Reserve Board, the FDIC, the National Credit Union Administration, and the OCC stated that an unexpired, government-issued VDC qualifies as a "government-issued identification" for purposes of the CIP Rule. Accordingly, a regulated entity may consider accepting a VDC to verify a customer's identity if three conditions hold: its own CIP allows it, it maintains the appropriate technology or systems to extract the relevant information, and the unexpired credential evidences nationality or residence and bears a photograph or similar safeguard. If a VDC shows indications of fraud, the institution must consider that factor in determining whether it can form a reasonable belief that it knows the customer's true identity.

The publication also amended a previously issued FAQ to reflect new terminology, clarifying that institutions may use electronic credentials issued by non-government third parties as a non-documentary verification method, provided the institution confirms the third party uses the same level of authentication that the institution itself would use.