Today, opening a bank account requires proving your identity. In a branch, that usually means handing a physical driver's license to a teller, who examines it, photocopies it, and files the image. Online, it means uploading a photo of the same license, where an automated system or a human reviewer evaluates the image for authenticity. Both processes depend on the difficulty of forging a physical artifact or producing a convincing photograph of one.
The joint FAQs published on September 8, 2026 by FinCEN and four federal banking regulators change this picture. By confirming that government-issued verifiable digital credentials (VDCs), including mobile driver's licenses (mDLs), qualify as documentary identification under the CIP Rule (31 CFR 1020.220), the ruling opens three distinct channels for credential-based account opening. Each channel has different presentation mechanics, different infrastructure requirements, and different implications for what the bank retains.
In-person presentation under ISO/IEC 18013-5 replaces the photocopy with a cryptographic exchange. The customer holds their phone near an NFC reader or establishes a Bluetooth Low Energy (BLE) session with a reader device at the teller station. The bank's system sends a presentation request specifying the data elements it needs: typically name, date of birth, address, portrait photo, and document number. The customer's wallet displays the request and asks for consent. Once the customer approves (authenticating with a PIN, fingerprint, or face unlock on their device), the wallet transmits the signed credential data to the reader.
The bank's verification system then performs the cryptographic checks: validating the issuer's digital signature against a trusted Issuing Authority Certificate Authority (IACA) certificate obtained from the AAMVA Digital Trust Service, confirming device binding, and checking that the credential is unexpired. The entire exchange takes seconds.
What changes for the customer: no physical card changes hands, no photocopy is made, and the customer controls exactly which data elements are shared through selective disclosure.
What changes for the bank: the identity check produces a deterministic, logged verification result rather than a subjective visual assessment. The bank retains the CIP-required data elements and a record of the verification outcome, not a photocopy of a physical document.
Remote presentation is where the operational change is most significant. Today's online account opening typically involves the customer photographing their physical license with their phone camera and uploading the image. The bank's system runs the image through document authentication software that checks for visual security features, then extracts data via OCR. This process is slow, error-prone, and increasingly vulnerable to sophisticated image manipulation.
ISO/IEC 18013-7 and OpenID for Verifiable Presentations (OID4VP) define how the same mDL credential presented in person at a branch can also be presented online through a browser or mobile application. The flow works like this: the bank's website or app generates a credential request, typically encoded as a QR code or a deep link. The customer's wallet receives the request, displays the requested attributes for consent, and transmits the signed credential data back to the bank's server over an encrypted channel.
The bank's backend performs the same cryptographic verification as the in-person flow: signature validation, device binding, expiration check. The difference is that no physical document image is ever captured, no OCR is required, and no human reviewer evaluates a photograph. The data arrives already structured and signed.
For banks, this eliminates a major friction point in remote onboarding. Document image capture is one of the leading causes of application abandonment. Customers take blurry photos, upload the wrong side of the license, or fail to capture all security features. A credential presentation replaces this entire sequence with a consent-and-transmit interaction that is faster for the customer and more reliable for the bank.
The third channel is fully digital: a customer opening an account through the bank's mobile app presents a credential from their wallet app without ever leaving the mobile environment. The bank's app invokes the wallet through a system-level API or a cross-app protocol defined by the operating system or credential exchange standard. The wallet handles user authentication, consent, and selective disclosure. The credential data returns to the bank's app with cryptographic proofs intact.
This channel is relevant for digital-first banks and for institutions building mobile-native onboarding experiences. It removes the friction of switching between apps, scanning QR codes, or navigating to an external browser. The credential exchange happens within the device's application layer, with the wallet serving as the trust broker between the customer and the bank.
App-to-app exchange is the least mature of the three channels in terms of widespread deployment, but it represents the direction that mobile-native financial services are heading. The NIST NCCoE mDL project has demonstrated this flow as part of its financial institution use case, providing a reference architecture that banks can evaluate.
Under the CIP Rule, a bank must retain a record of the identifying information obtained from each customer, including name, date of birth, address, and identification number. The bank must also retain a description of the document or method used for verification and a record of any discrepancy in the identifying information.
With physical documents, banks typically retain a photocopy or scan of the license itself, which contains all visible information on the card regardless of whether the bank needs it. With verifiable digital credentials, selective disclosure changes this equation. The bank can request only the data elements required by regulation, and the customer's wallet shares only those elements. The bank retains the verified data and a log of the verification event (credential type, issuer, verification timestamp, outcome) rather than a full document image.
This shift has several practical consequences. It reduces the volume of personally identifiable information the bank stores, which reduces exposure in the event of a data breach. It simplifies records management because structured, verified data is easier to index and retrieve than scanned document images. And it creates a cleaner audit trail for regulatory examination, because the verification log demonstrates exactly what was checked and what the result was, rather than relying on an examiner's inference from a filed photocopy.
The transition from document-based to credential-based CIP is not a software upgrade to the existing process. It requires changes across several operational layers.
Branch hardware. In-person mDL acceptance requires NFC or BLE reader devices. Many bank branches do not have this equipment today. Deployment planning, staff training, and integration with the core banking system's CIP workflow are prerequisites.
Online platform integration. Remote mDL presentation requires the bank's digital account opening platform to generate credential requests, receive credential responses, and invoke cryptographic verification. This is a different architecture from document image capture and OCR.
Trust service connectivity. As discussed in FinCEN's confirmation that banks can accept verifiable digital credentials, verification requires access to issuer public keys through a trust service like the AAMVA DTS. Banks need to integrate with the DTS and maintain current issuer certificates.
Fallback procedures. Not every customer will have an mDL. As of mid-2026, more than 22 states and territories have active mDL programs, but adoption remains uneven across demographics and geographies. Banks need to maintain parallel processes for physical documents alongside credential-based verification, potentially for years.
Staff training. Branch staff need to understand the new workflow: how to initiate a credential request, how to handle verification failures, and when to fall back to physical documents. The verification itself is automated, but the human process around it requires preparation.
The practical effect of VDC acceptance is that identity verification stops being the slowest, most error-prone step in account opening and becomes one of the fastest. A credential presentation and verification can complete in under ten seconds across any channel. The customer shares less data, the bank gets higher assurance, and the verification record is automatically structured for compliance.
The infrastructure to support this transition is available. The standards (ISO/IEC 18013-5, 18013-7, OID4VP) are published. The trust service (AAMVA DTS) is operational. The regulatory permission (the FinCEN FAQs) is in hand. The remaining work is integration, and the banks that begin now will have the smoothest path as credential adoption accelerates.
About SpruceID: SpruceID builds digital trust infrastructure for government. We help states and cities modernize identity, security, and service delivery — from digital wallets and SSO to fraud prevention and workflow optimization. Our standards-based technology and public-sector expertise ensure every project advances a more secure, interoperable, and citizen-centric digital future.
