Cross-Jurisdictional Digital Identity: Why Credentials Issued in One State Need to Be Accepted in Another

A resident of Utah renews her state-endorsed digital identity using a new smartphone wallet and then drives to Nevada for a work trip. She tries to use her credential at a rental car counter. The counter agent's system returns an error: the credential format is unfamiliar, the issuer certificate is not recognized, and the verification app has no mechanism to evaluate the trust signal. Her credential is technically valid and cryptographically sound. It simply fails outside the state that issued it.

This scenario is not hypothetical. It describes the current reality facing states building digital identity programs independently: technically competent credentials that stop working at state borders. Solving it requires more than agreeing on a data format. Cross-jurisdictional digital identity involves layered coordination across trust frameworks, credential formats, verification protocols, and governance structures, all of which can fail independently even when the others are working.

The problem is worth working through carefully, because states investing in digital identity infrastructure today are making decisions that will either enable or foreclose national interoperability in the future.

Technical Standards and Governance Are Not the Same Problem

A common assumption in digital identity planning is that agreeing on a technical standard produces interoperability. It does not. Standards define how a credential is structured and how it is cryptographically verified. They do not answer the governance questions that determine whether a receiving organization will accept it.

Consider what actually needs to be resolved for a credential issued in State A to be accepted in State B. At the technical layer: both states must use compatible credential formats, both must support compatible exchange protocols, and the verifier in State B must be able to cryptographically validate the issuer's signing key. At the trust layer: State B (or the private verifier operating there) must have a policy basis for trusting State A's identity proofing standards, issuance process, and revocation procedures. At the governance layer: there must be a mutual recognition agreement or framework, formal or informal, that authorizes relying parties to treat State A credentials as equivalent to State B credentials for specific purposes.

These three layers interact, but none of them automatically resolves the others. Two states can both issue credentials in ISO/IEC 18013-5 format, operate compatible exchange protocols, and still have no legal or policy basis for accepting each other's credentials. Conversely, two states can have a mutual recognition agreement but issue credentials in incompatible formats that require a translation layer.

Interoperability in government digital services ultimately involves all three layers simultaneously. States that plan only for technical compatibility often discover the governance gap late, after infrastructure investments have been made.

What mDL Cross-State Acceptance Actually Requires

The mobile driver's license is the most developed cross-jurisdictional credential use case in the United States, which makes it a useful reference point for understanding what real-world acceptance involves.

TSA checkpoint mDL acceptance illustrates the layered nature of the problem clearly. States that issue mDLs compliant with ISO/IEC 18013-5 produce credentials that are structurally compatible at the technical layer. But TSA acceptance at checkpoints required not just technical standards compliance: it required TSA to develop and deploy verification readers capable of receiving the credential, establish a policy framework authorizing TSA officers to accept mDLs as acceptable identity documents, coordinate with REAL ID requirements, and build confidence in the identity proofing standards that different states apply. The technical standard was necessary but not sufficient.

For inter-state private-sector acceptance, the situation is more fragmented. A car rental company, hotel, or pharmacy operating in multiple states faces a practical question: which state-issued digital credentials will their verification system recognize, and under what conditions? Without a common trust registry or federation, each verifier must either build relationships with individual state issuers or rely on a third-party verification service that maintains those relationships. Neither approach scales easily to 50 states.

Cross-state credential recognition depends on states publishing issuer certificates in a discoverable and standardized way, on verification infrastructure that can look up and validate those certificates, and on some form of policy agreement that gives verifiers confidence that an issuer's standards are trustworthy. When any of these components is missing, the credential either fails silently or requires the holder to present backup documentation.

Trust Reciprocity Is a Political and Institutional Problem

The deepest challenge in cross-jurisdictional digital identity is not technical. It is the question of whether one state is willing to accept another state's assertion that a person is who they say they are, and under what conditions.

States vary considerably in their identity proofing standards. The NIST SP 800-63-4 guidelines define Identity Assurance Levels (IAL) at three tiers, but state programs are not required to conform to any particular tier for general-purpose identity credentials. A state that requires in-person identity proofing before issuing a digital identity has a different security posture than one that accepts remote proofing through a private identity verification service. A relying party in State B that accepts State A's credentials is implicitly extending trust to State A's issuance process, not just to the credential's cryptographic signature.

This is why trust frameworks matter. A trust framework is a set of agreed-upon standards for identity proofing, credential issuance, security practices, and governance that a community of participants agrees to meet. When State A and State B both conform to the same trust framework, a relying party in State B has a policy basis for accepting State A credentials: the framework establishes that both states meet common baseline requirements.

The challenge is that no fully operationalized multi-state trust framework for government-issued digital identity credentials exists at national scale yet. The American Association of Motor Vehicle Administrators (AAMVA) plays a significant coordination role for mDL programs through its Digital Trust Service, which maintains a trust list of participating states' issuer certificates. But AAMVA's framework is specific to mDLs, and a comprehensive cross-state trust framework for general-purpose digital identity is not yet established. The SEDI framework emerging from Utah's SB 275 explicitly anticipates a SEDI Consortium of states, but as of mid-2026 that consortium is aspirational rather than operational. The SEDI framework is structured to enable this kind of multi-state governance, but the governance agreements themselves require political coordination that moves more slowly than software.

Credential Formats Are a Real Interoperability Variable

Even within states that share a trust framework, credential format differences create practical friction. Two major standards families are currently in play for government digital identity in the United States: ISO/IEC 18013-5 (and its web-extension sibling 18013-7), which is the basis for most mDL programs; and the W3C Verifiable Credentials Data Model, which underlies a broader class of digital credentials including professional licenses, education records, and benefits credentials.

These formats are not directly interchangeable. A verifier equipped to receive ISO/IEC 18013-5 credentials cannot automatically read a W3C VC without additional software. A state that issues credentials in one format and a receiving state or verifier that only understands the other creates a compatibility gap that requires a translation layer or a multi-format verification system.

Credential format selection has long-term interoperability implications because it shapes what verification infrastructure verifiers need to deploy and what wallets holders need to use. States that have not yet locked in a format choice have more flexibility to align with peer states. States already committed to a single format face a choice between retrofitting compatibility layers and advocating for their format to become the recognized standard for cross-state exchange.

The practical answer for most state programs is likely multi-format support: issuing credentials in both ISO/IEC 18013-5 and W3C VC formats, or deploying verification infrastructure that can handle both. This adds complexity but avoids locking residents and verifiers into format silos. Portable credentials depend on exactly this kind of format flexibility, because a credential that only works in one system is not meaningfully portable regardless of its technical quality.

Verification Protocol Alignment Shapes the Resident Experience

Even when trust frameworks and credential formats align, the exchange protocol used during a presentation can create or eliminate cross-jurisdictional friction. A resident presenting an mDL in person at a TSA checkpoint uses Bluetooth Low Energy (BLE) or NFC for proximity-based exchange. A resident presenting a credential online uses a web-based exchange protocol. The two situations require different verification infrastructure, and not all verifiers support both.

OpenID for Verifiable Presentations (OID4VP) has emerged as a leading protocol for online credential exchange, with support growing across wallets, issuers, and verifiers that implement the W3C VC ecosystem. ISO/IEC 18013-7 extends the mDL standard for web contexts. States that deploy credentials supporting OID4VP for online use and ISO/IEC 18013-5 for in-person use give residents the broadest practical acceptance surface, because verifiers supporting either protocol can read the credential.

From a state CIO's perspective, the verification protocol question has procurement consequences. Selecting a verification infrastructure vendor means selecting the protocols that vendor supports, which determines which credentials the state can receive and verify. States building inter-agency verification infrastructure should evaluate protocol support explicitly, rather than assuming that standards compliance translates into protocol interoperability.

What a Multi-State Digital Identity Ecosystem Would Actually Need

The architecture for genuinely cross-jurisdictional digital identity involves several components that do not yet exist at national scale and that require sustained coordination to build.

A discoverable trust registry. Verifiers need a way to look up whether an issuer is a recognized participant in the trust framework and to retrieve the issuer's current signing certificates. This can be implemented as a federated directory, a chain of trust anchored to a root authority, or a decentralized registry. What matters is that it is maintained, authoritative, and queryable by verification infrastructure without requiring bilateral relationships.

Mutual recognition agreements. States need formal or informal policy agreements establishing that each state's identity proofing and issuance standards meet the common baseline. These agreements are the legal and policy complement to technical trust registries. Without them, verifiers have no institutional basis for accepting out-of-state credentials for consequential transactions.

Conformance programs. States and vendors that participate in the framework need a way to demonstrate conformance with its standards. Conformance testing programs verify that issuers, wallets, and verifiers meet technical and security requirements, providing verifiers with confidence that accepting a credential from a conforming issuer is not a security risk.

Governance for changes. Standards and policies evolve. A multi-state framework needs a governance mechanism for updating technical requirements, adding or removing participants, and handling disputes or violations. Without this, the framework becomes rigid and difficult to maintain as technology and threat models change.

Cross-state digital identity infrastructure has been a recognized goal for several years, but assembling these components requires coordination across federal agencies, state governments, standards bodies, and the private sector simultaneously. Progress has been uneven, with the mDL space further along than other credential types, partly because AAMVA provides an existing coordination structure.

The SEDI Model as a Framework for Multi-State Coordination

Utah's State-Endorsed Digital Identity framework, enacted through SB 275 in 2026, includes explicit provisions that anticipate multi-state coordination. The framework is designed around open standards (specifically mandating publicly available, royalty-free technical specifications), peer-to-peer verification architectures that do not require issuers to be contacted during presentations, and wallet portability requirements that prevent lock-in to any single provider.

The "Protecting Liberty" policy document that frames SEDI calls for a consortium of states that adopt the SEDI approach. If other states adopt SEDI-compatible frameworks, shared standards and rights would provide the foundation for mutual recognition: two states both operating under SEDI governance have a common baseline for identity proofing, privacy protections, and technical requirements, which makes mutual recognition politically and institutionally more tractable.

What SEDI does not yet provide is the trust registry infrastructure, the formal mutual recognition agreements, or the conformance programs that cross-jurisdictional acceptance requires. Those are the pieces that would need to be built at the consortium level. The framework is structured to make building them possible; the building itself still requires sustained effort.

For states evaluating whether to align with SEDI-style frameworks, the cross-jurisdictional question is a practical consideration. A state that builds its digital identity program around the same open standards, rights structure, and governance model as SEDI is positioning itself for eventual mutual recognition with other SEDI states, rather than building a proprietary system that requires custom integration for every cross-state exchange.

What State CIOs Should Evaluate Now

States at the early stages of digital identity programs have more flexibility to align with emerging national frameworks than states with established deployments that would require significant retrofitting. The decisions that have the most long-term interoperability implications fall into four areas.

Credential format and standards selection

Choosing formats with broad market adoption (ISO/IEC 18013-5, W3C VC) rather than proprietary formats preserves options for cross-state exchange. Supporting both formats where technically feasible reduces dependency on any single verification ecosystem.

Trust framework participation

The question is whether the program's identity proofing and issuance standards would qualify for mutual recognition under emerging federal or multi-state frameworks. Programs built to NIST SP 800-63 guidelines have a stronger basis for future mutual recognition than programs built to proprietary standards.

Trust registry architecture

Designing issuer key publication to be compatible with federated trust registries rather than requiring bilateral key exchange is a technical design decision that has low marginal cost at build time and high retrofitting cost afterward.

Governance structure

Building relationships with peer states, AAMVA for mDL programs, and relevant federal agencies early enough to influence the emerging governance frameworks rather than conforming to them after they are established.

The infrastructure investments states are making now will shape the national interoperability picture for years. Credentials issued in one state can only be reliably accepted in another when trust, format, protocol, and governance are all aligned. Technical standards provide the foundation for that alignment, but they do not create it automatically.

States asking how to ensure their digital identity program will remain relevant as national frameworks mature should start with the governance and trust framework questions, not the technical ones. The technical problems are largely solved. The governance problems are where the real work is.

About SpruceID: SpruceID builds digital trust infrastructure for government. We help states and cities modernize identity, security, and service delivery — from digital wallets and SSO to fraud prevention and workflow optimization. Our standards-based technology and public-sector expertise ensure every project advances a more secure, interoperable, and citizen-centric digital future.