On September 8, FinCEN, the OCC, the FDIC, the Fed, and the NCUA issued interagency FAQs clarifying that banks and credit unions may accept state-issued mobile driver’s licenses and other government-issued verifiable digital credentials (VDCs) to verify the identity of customers under the Customer Identification Program (CIP) rule. The FAQs stated that the CIP rule neither requires nor prohibits reliance on such credentials, and that an unexpired, government-issued VDC qualifies as “government-issued identification” for CIP purposes provided it “evidence[s] nationality or residence and bear[s] a photograph or similar safeguard.” The agencies confirmed that institutions may use these credentials to verify customer identity in person, remotely over the internet, or through other digital or virtual channels, so long as the institution maintains appropriate technology or systems to extract the relevant information and the credential is permissible under the institution’s CIP.

The agencies also amended a previously issued FAQ addressing VDCs and electronic credentials issued by non-government third parties, clarifying that a bank or credit union may use such credentials as a non-documentary method to verify customer identity, but the institution is responsible for ensuring that the third party uses the same level of authentication as the institution itself would use. The agencies noted that if a government-issued VDC shows indications of fraud, the institution must consider that factor in determining whether it can form a reasonable belief that it knows the customer’s true identity. The FAQs do not alter existing BSA legal or regulatory requirements or establish new supervisory expectations.