WASHINGTON–Credit unions and banks may use state-issued mobile driver’s licenses and other qualifying government-issued digital credentials to verify customer identities under existing federal rules, but the institutions remain responsible for ensuring the technology meets regulatory requirements, according to an analysis by Anderson Insights.
The analysis examines two frequently asked questions issued Sept. 8 by the Financial Crimes Enforcement Network (FinCEN) and staff from the Federal Reserve, FDIC, NCUA and Office of the Comptroller of the Currency. The agencies also updated earlier guidance involving electronic credentials.
According to Anderson Insights, the guidance clarifies that qualifying digital identification can satisfy documentary verification requirements under the Bank Secrecy Act’s Customer Identification Program (CIP) rule.
The CU Daily has coverage of the new rule here.
However, the guidance does not require financial institutions to accept digital credentials, change existing BSA obligations or establish new supervisory expectations.
What Qualifies as Digital Identification?
Anderson Insights explained that a verifiable digital credential differs significantly from a photograph or scanned copy of a traditional identification card.
A qualifying credential contains information digitally signed by the issuing authority, is cryptographically linked to a device and is protected by an authentication method such as a PIN, facial recognition or fingerprint.
An unexpired, government-issued digital credential may qualify as documentary identification if it establishes nationality or residence, includes a photograph or similar safeguard, and can be processed by the institution’s technology.
The institution’s CIP must also permit its use.
Fraud Controls Still Required
According to the analysis, the fundamental regulatory standard remains unchanged: A financial institution must have a reasonable belief that it knows the customer’s true identity.
Even when a digital credential is technically valid, institutions must investigate indications of fraud or conflicting information.
Anderson Insights said credit unions and banks should establish procedures for handling discrepancies involving customer records, addresses, sanctions screening or other potential fraud indicators.
Those procedures could include requesting additional documentation, using alternative verification methods or escalating suspicious applications for further review.
Vendor Oversight Remains Critical
The analysis also emphasizes that credit unions using third-party technology providers retain responsibility for compliance.
Institutions should evaluate vendors’ authentication capabilities, security controls, credential validation processes, record retention practices and procedures for handling service interruptions.
Anderson Insights noted that nongovernment-issued electronic credentials may also be used, but generally fall under nondocumentary verification methods rather than the documentary provisions applicable to qualifying government-issued credentials.
When third parties issue or maintain those credentials, institutions must ensure the authentication standards are appropriate.
Other Requirements Unchanged
The guidance does not eliminate obligations involving customer due diligence, beneficial ownership, sanctions compliance, fraud prevention or suspicious activity monitoring, the analysis noted.
Anderson Insights recommended that institutions establish clear policies governing acceptable digital credentials, verification failures, customer alternatives and documentation before introducing digital identification into account-opening processes.
The analysis also recommended monitoring validation failures, manual reviews, suspected fraud, customer complaints and vendor outages after implementation.
The guidance applies specifically to banks and credit unions covered by the federal bank CIP rule and should not automatically be extended to other financial institutions operating under different regulations, Anderson Insights said.
The analysis concluded that while the federal clarification removes uncertainty about whether qualifying digital credentials can be used for documentary identity verification, it leaves individual institutions responsible for determining whether their systems and procedures can reliably establish a customer’s identity.
