WASHINGTON — Credit unions may use state-issued mobile driver’s licenses and other government-issued digital credentials to verify the identities of consumers opening accounts, including through online and other remote channels, under updated federal guidance released Tuesday.
The Financial Crimes Enforcement Network, working with the Federal Reserve, Federal Deposit Insurance Corp., National Credit Union Administration and Office of the Comptroller of the Currency, issued new frequently asked questions explaining how verifiable digital credentials can be used under Customer Identification Program requirements.
America’s Credit Unions said the guidance better reflects the increasingly digital ways credit unions and other financial institutions open accounts and verify identities.
The FAQs do not change existing Bank Secrecy Act or CIP requirements and do not establish new supervisory expectations, according to FinCEN and the regulators.
Mobile Driver’s License Can Qualify as Government ID
A central question addressed by the guidance is whether a credit union can accept a state-issued mobile driver’s license, or mDL, instead of a traditional physical driver’s license when verifying a person’s identity.
The answer is yes, provided the credit union can satisfy existing CIP requirements.
FinCEN said an unexpired government-issued digital credential, including a state-issued mDL, can qualify as “government-issued identification” for purposes of the CIP rule if it provides evidence of nationality or residence and includes a photograph or similar safeguard.
A mobile driver’s license contains the same information as the physical driver’s license or identification card issued by the state, according to the guidance.
The CIP rule neither requires nor prohibits financial institutions from relying on government-issued digital credentials.
That means credit unions can determine whether to accept the credentials as part of their own CIP procedures and technology capabilities.
For a credit union to use an mDL or similar credential as a documentary method of verification, it must have technology or systems capable of extracting the relevant information from the digital credential, and its use must be permitted under the credit union’s CIP.
What Is a Verifiable Digital Credential?
FinCEN and the regulators defined a verifiable digital credential, or VDC, as a data structure containing information about an individual that is:
- Digitally signed by the source issuing the information.
- Cryptographically bound to a device.
- Protected by an activation factor.
An activation factor can be something the consumer knows, such as a PIN or password, or a unique physical characteristic the person possesses, such as a facial or fingerprint biometric.
Can Be Used for Remote Account Opening
The guidance makes clear that qualifying digital credentials can be used regardless of whether the customer or member is opening an account in person or remotely.
A credit union may consider accepting a government-issued VDC when an account is opened:
- In person.
- Remotely over the internet.
- Through another digital or virtual channel.
The institution must still comply with the fundamental requirement of the CIP rule: It must be able to form a reasonable belief that it knows the customer’s true identity.
As with a physical driver’s license or other government identification, a credit union generally may rely on a government-issued digital credential for identity verification.
But FinCEN said that if the credential shows indications of fraud, the credit union must take that into consideration when determining whether it can reasonably conclude it knows the person’s true identity.
Non-Government Digital Credentials Also Addressed
The agencies also updated a previously issued FAQ addressing electronic credentials used as a non-documentary method of identity verification.
A credit union may use an electronic credential, including a digital certificate or VDC, as one method of verifying a customer’s identity if its CIP permits that approach.
Different considerations apply when the credential is issued and maintained by a nongovernment third party.
In those circumstances, FinCEN said the credit union is responsible for ensuring the third party uses the same level of authentication that the credit union itself would use.
Regardless of the technology involved, the credit union remains responsible for satisfying the CIP requirement that it have a reasonable belief it knows the customer’s true identity.
No New BSA Requirements
America’s Credit Unions emphasized that the FAQs do not impose additional Bank Secrecy Act obligations or supervisory expectations.
Instead, the guidance clarifies how existing CIP requirements apply as state governments and other entities increasingly replace or supplement physical identification documents with digital credentials.
The clarification potentially gives credit unions greater flexibility in digital account opening while leaving decisions about whether and how to accept the credentials to individual institutions based on their CIP policies, technology and ability to appropriately verify a person’s identity.
The FAQs can be found here.
