Federal Agencies Authorize Banks to Accept Mobile Driver's Licenses for Identity Verification

When the Transportation Security Administration began accepting mobile driver's licenses at airport checkpoints in 2022, the verification relied entirely on physical proximity and in-person hardware. The joint regulatory guidance issued this week by 3 federal banking agencies differs in one critical respect: it explicitly authorizes these cryptographic digital credentials for remote, unmediated transactions. The Financial Crimes Enforcement Network (FinCEN), alongside the Federal Deposit Insurance Corporation (FDIC) and the Office of the Comptroller of the Currency (OCC), confirmed that banks can use state-issued digital IDs to satisfy Customer Identification Program (CIP) requirements.[1][2][5]

The clarification arrives as the financial sector grapples with surging synthetic identity fraud. According to the FBI's 2025 annual report, Americans filed more than 22,000 cases with an AI connection, reporting roughly $893 million in losses. Until now, banks operating under the Bank Secrecy Act faced regulatory ambiguity regarding whether a digital credential—transmitted over a network rather than inspected in person—met the legal threshold for a "documentary" verification method.[7]

Under the new framework, a mobile driver's license (mDL) is legally classified as a reliable documentary method, provided it is issued by a recognized state authority. The guidance specifies that banks must not merely look at a screen rendering of the ID, but must cryptographically authenticate the data payload directly against the issuing state's public key infrastructure.[3][6]

The shift places the burden of verification on the cryptographic signature rather than the visual inspection of a plastic card. "The agencies emphasize that the bank must verify the digital credential directly with the issuing authority or its authorized representative," the OCC stated in Bulletin 2026-44. This ensures that the credential has not been altered or revoked since its issuance.[1]

Identity verification providers have anticipated this regulatory green light. SpruceID, a digital credential infrastructure firm, noted that the ruling shifts the industry's focus from acceptance to implementation. Banks now need to integrate the ISO 18013-5 standard, the technical protocol that governs how mDLs transmit data securely between a user's mobile device and a relying party's reader.[6]

The federal endorsement is expected to accelerate state-level rollouts of digital IDs. As of September 2026, more than 15 states offer some form of mobile driver's license, typically housed in Apple Wallet, Google Wallet, or dedicated state applications. However, adoption by private-sector relying parties had stalled due to compliance uncertainties at the federal level.[3]

Legal analysts view the joint statement as a necessary modernization of the 2001 USA PATRIOT Act provisions that originally mandated the CIP rules. InfoBytes, a legal publication by Orrick, highlighted that banks must still incorporate these digital methods into their broader Anti-Money Laundering (AML) compliance programs. Institutions are required to update their risk assessments to account for the specific vulnerabilities of digital transmission, such as man-in-the-middle attacks.[4]

For retail banking, the immediate consequence is a streamlined onboarding funnel. Customers will increasingly be able to open accounts by tapping their smartphone to transmit an encrypted identity payload, bypassing the friction of photographing physical cards and waiting for optical character recognition to parse the text. The timeline for widespread consumer availability now depends on how quickly core banking software providers can deploy the necessary cryptographic verification modules to their institutional clients.[5][6]