The September 2026 FAQs from FinCEN and four federal banking regulators confirm that government-issued verifiable digital credentials qualify as documentary identification under the CIP Rule. The regulatory permission is clear. The infrastructure questions are not. Before a bank can accept a mobile driver's license or other VDC for customer identification, it needs to answer five questions about the verification, format, trust, fallback, and audit infrastructure behind that acceptance.
This is the threshold question. A verifiable digital credential issued under ISO/IEC 18013-5 is a signed data structure: the issuing authority's digital signature binds the data to a trusted public key, and device binding ties the credential to the holder's phone. If a bank's system reads the data (name, date of birth, document number) but does not validate the digital signature against the issuer's public key, the bank has extracted information without establishing its trustworthiness.
As we discussed in our analysis of the FinCEN ruling, acceptance without cryptographic verification provides less assurance than examining a physical ID, because the security model of a digital credential depends entirely on cryptography rather than on the difficulty of reproducing a physical artifact. Banks evaluating VDC acceptance should confirm that their planned implementation includes full signature validation, device-binding verification, and expiration checks, not just data extraction.
Two credential format families dominate the landscape. ISO/IEC 18013-5 (and its online counterpart, ISO/IEC 18013-7) defines the mobile driver's license format used by state DMVs across the United States. The broader W3C Verifiable Credentials Data Model defines a general-purpose credential format used for a wider range of identity and attestation use cases.
For CIP compliance using government-issued mDLs, ISO/IEC 18013-5 is the immediate priority: it is the format that state DMVs issue and that the FinCEN FAQs implicitly reference when describing government-issued VDCs. The W3C format becomes relevant when banks consider non-government credentials for non-documentary verification, or when future government credentials are issued in both formats.
The practical question for a bank's technology team is whether to build support for one format now and add the other later, or to invest in multi-format verification from the start. A single-format approach reduces initial complexity but may require rework. A multi-format approach increases upfront investment but avoids a second integration cycle.
A bank in Georgia receiving an mDL issued by Oregon needs Oregon's public key to verify the credential. The AAMVA Digital Trust Service (DTS) solves this problem by aggregating Issuing Authority Certificate Authority (IACA) certificates from participating jurisdictions into a single trust list. A bank that connects to the DTS can retrieve public keys for every participating state from one source.
But not all mDL-issuing states participate in the DTS. More than 22 states and territories have mDL programs, while approximately 11 jurisdictions are fully in the DTS. Banks operating nationally should understand which states they can currently verify, which states are expected to join the DTS in the near term, and what their procedure will be for credentials from states not yet covered. The answer may be a phased rollout that expands mDL acceptance as DTS coverage grows, combined with fallback to non-documentary verification for uncovered states.
Digital credential acceptance should expand the set of verification options available to customers, not replace the existing ones prematurely. Adoption of mDLs is growing rapidly: roughly 41 percent of Americans now live in a state with an active mDL program. But many customers within those states have not yet enrolled, and customers in states without mDL programs will not have a government-issued digital credential to present.
Banks need clear, documented procedures for handling customers who present physical IDs alongside those who present digital credentials. The CIP Rule already accommodates both documentary and non-documentary verification methods, so the regulatory framework supports parallel processes. The operational challenge is ensuring that branch staff, online platforms, and back-office workflows handle both paths without confusion and without creating a two-tier customer experience where digital credential holders receive faster or preferential service.
Fallback design also matters for accessibility. Customers without smartphones, customers with older devices that do not support mDL wallets, and customers who prefer not to use digital credentials should all have a straightforward path to account opening.
The CIP Rule requires banks to retain records of the identifying information obtained, the documents or methods used for verification, and any discrepancies identified. When the verification method is a photocopy of a physical license, the audit artifact is the photocopy itself. When the method is a cryptographic credential verification, the audit artifact changes.
Banks should define what constitutes a compliant verification record for digital credentials. A well-structured log might include the credential format and version, the issuing jurisdiction, the verification timestamp, the outcome of each check (signature valid, device binding confirmed, credential unexpired, revocation status clear), and the specific data elements obtained. This log, combined with the retained CIP data, provides an examiner with a clearer picture of the verification process than a photocopied license ever could.
Banks should also consider how they will demonstrate their verification infrastructure to examiners. Regulators may want to understand the bank's connection to the AAMVA DTS, the certificate update procedures, the handling of verification failures, and the fallback procedures for unverifiable digital credentials. Documenting these procedures before examiners ask about them is preferable to reconstructing them afterward.
The NIST NCCoE mDL project and its published practice guide for financial institutions provide a useful reference for structuring these processes. The FFIEC BSA/AML examination procedures for CIP will likely be updated to address digital credentials explicitly, but banks that have clear documentation and consistent procedures will be well positioned regardless of when updated examination guidance arrives.
The FinCEN FAQs resolve the policy question of whether digital credentials are acceptable for CIP. The five questions above address whether a bank is operationally ready to accept them in a way that is secure, compliant, and scalable. Banks that work through these questions before deploying VDC acceptance will build infrastructure that strengthens their CIP process. Banks that skip them risk adopting a new credential format without capturing the security and efficiency benefits that make the format worth adopting.
About SpruceID: SpruceID builds digital trust infrastructure for government. We help states and cities modernize identity, security, and service delivery — from digital wallets and SSO to fraud prevention and workflow optimization. Our standards-based technology and public-sector expertise ensure every project advances a more secure, interoperable, and citizen-centric digital future.
