New Era for Banking Identity: VDCs Support Customer ID

On September 8, 2026, US financial regulators provided important clarity on the use of verifiable digital credentials (VDCs), including mobile driver’s licenses (mDLs), for identity verification. The guidance confirms that banks and credit unions can now use state-issued mDLs to verify the identity of individual customers opening accounts in person, online or through other digital channels under their Customer Identification Program (CIP).

For financial institutions, the opportunity is immediate, and the time to prepare is now. VDCs can make customer onboarding more secure, seamless and privacy-conscious, and IDEMIA Public Security is ready to help institutions leverage this opportunity. With decades of financial-services expertise, the first ISO/IEC 18013-5-certified mID Reader and Mobile ID deployments across seven U.S. state programs, IDEMIA Public Security provides the experience and technology to move from regulatory clarity to operational VDC acceptance.

A clearer path for digital identity acceptance

On September 8, 2026, the Federal Reserve, FDIC, NCUA, OCC and the US Treasury’s Financial Crimes Enforcement Network issued joint guidance on the use of Verifiable Digital Credentials (VDCs) under the Customer Identification Program (CIP) Rule.

The guidance confirms that banks and credit unions may use qualifying government-issued VDCs, including state-issued mobile driver’s licenses, to verify the identity of individual customers opening accounts in person, online or through other digital channels.

A VDC may be used as a documentary verification method when it meets the applicable CIP requirements. For government-issued credentials, this can include an unexpired credential that provides evidence of nationality or residence, contains a photograph or similar safeguard, and can be processed by the institution’s systems. Importantly, the guidance does not change existing legal requirements or require institutions to accept VDCs. Instead, it gives banks and credit unions greater clarity as they assess how VDCs can fit within their existing CIP processes, risk assessments, and internal policies.

Why it matters for financial institutions

• Strengthen trust in digital interactions: A qualifying VDC is digitally signed by its issuer, linked to the customer’s device and protected by a security check such as a PIN, password, facial recognition or fingerprint.
• Create more seamless onboarding experience: Customers can present their identity information digitally, helping institutions reduce manual data entry and reliance on uploaded images of physical documents.
• Support CIP, KYC and fraud controls: Cryptographic verification helps institutions confirm where identity information came from and whether it has been altered before applying their own compliance and risk policies.
• Give customers greater control: Customers can review and approve the information they share, helping them provide only what is required for the transaction.

How does it work

The financial institution requests the identity information needed to onboard the customer. The customer selects an mDL or another qualifying government-issued VDC, reviews the requested information and approves sharing it. The institution then verifies the credential and uses the verified identity attributes within its existing CIP, KYC, fraud and risk workflows.

Figure 1 — How a verifiable digital credential reaches a bank identity decision.

Sources: FinCEN and the Agencies, Frequently Asked Questions Regarding Treatment of Verifiable Digital Credentials Under the Customer Identification Program Rule, 8 September 2026. Credential behaviour per IDEMIA Public Security, New York Mobile ID press release, 11 June 2024.

• 01 · Customer wallet: The customer holds a state-issued mobile identity credential. Only the holder can open it, with a face or fingerprint biometric or a six-digit PIN. That activation factor proves control of the device.
• 02 · Presentation and consent: The customer must consent before anything is shared. The issuing agency pushes status updates, so a revoked or cancelled credential shows as revoked. In branch or remotely over the internet.
• 03 · IDEMIA Public Security verification: The issuer signature is checked, the binding to the device is checked, and the credential is checked for validity and revocation. A live biometric check is what ties the credential to the person presenting it.
• 04 · Attribute extraction: Name, date of birth, address and identification number are read from the signed credential. The bank receives structured data it can record against the customer identification program rule.
• 05 · Bank decision: The bank forms the reasonable belief that it knows the customer’s true identity and weighs any indication of fraud. The decision, the written program and the record stay with the bank.

A VDC contains identity information protected by three core security features:

• Digitally signed by the issuer: Confirms that the information came from the issuing authority and has not been altered.
• Securely linked to the customer’s device: Helps confirm that the credential is being presented from the device to which it was issued (clone prevention).
• Protected by a security check: Requires the customer to unlock the credential using a PIN, password, facial recognition or fingerprint.

Why choose IDEMIA Public Security?

VDC verification is on track to become the new standard for customer identification, and IDEMIA Public Security’s solution is already live in production today, so financial institutions can integrate it into their existing CIP workflow now, quickly and without disruption.

Simplify VDC verification without rebuilding your identity infrastructure

• Verify state-issued mDLs presented through supported DMV wallet applications.
• Support DMV wallets from New York, Kentucky, Arkansas, Iowa and West Virginia, with additional U.S. coverage underway.
• Expand acceptance to native wallets such as Apple Wallet, Samsung Wallet and Google Wallet as ecosystem support grows.
• Return verified identity attributes directly to existing CIP, KYC, fraud and risk workflows.
• Offer document capture and identity verification as an alternative for customers without an eligible VDC.
• Reduce integration complexity while preserving cryptographic trust, customer approval and privacy-by-design principles.

A trusted partner with proven expertise and industry-leading credentials

• Certified verification technology: IDEMIA Public Security’s mID Reader was the first mobile ID reader certified to the ISO/IEC 18013-5 standard following evaluation by UL Solutions. IDEMIA’s mID Reader technology is also used by TSA officers at participating U.S. airports.
• Proven Mobile ID leadership: IDEMIA Public Security supports the mobile driver’s license (mDL) ecosystem, providing both issuance and verification solutions that enable governments and organizations to securely issue, manage, and accept digital credentials. Our technology powers multiple U.S. state mDL programs, helping accelerate trusted digital identity adoption at scale.
• Financial-services expertise: IDEMIA Public Security has decades of experience helping financial-services organizations strengthen identity verification, improve onboarding conversion and reduce identity fraud. This expertise helps institutions operationalize VDC verification within existing CIP, KYC, fraud and risk workflows while preserving trust, privacy and customer control.

One trusted identity. Secure access everywhere.

Sources:
Joint US regulatory guidance — Federal Reserve, September 8, 2026
IDEMIA Mobile ID state programs
IDEMIA’s ISO/IEC 18013-5-certified mID Reader and Verify SDK