September 2026: FinCEN confirmed digital credentials satisfy KYC. Here is what that means.

On September 8, 2026, FinCEN, together with the staffs of the Federal Reserve, the FDIC, the NCUA, and the OCC, published two new frequently asked questions on the Customer Identification Program rule. They address state-issued mobile driver's licences and other government-issued verifiable digital credentials, and they amend an older FAQ to use the new terminology. It is a short document. It is also the clearest signal yet that US identity verification is moving from pictures of documents to credentials that can be checked.

What the FAQs actually say

The CIP rule neither requires nor prohibits relying on a government-issued digital credential. But an unexpired, government-issued verifiable digital credential, such as a state mobile driver's licence, qualifies as "government-issued identification" for documentary verification. Like any ID, it must evidence nationality or residence and bear a photograph or similar safeguard.

Two conditions follow. The institution's own CIP has to allow the method, and the institution has to maintain the technology or systems to extract the relevant information from the credential. The FAQs cover accounts opened in person, remotely over the internet, or through another digital channel. Credentials from private issuers are a different category: they remain non-documentary methods and need comparable authentication controls.

What did not change

The agencies were explicit that the FAQs neither alter existing Bank Secrecy Act requirements nor establish new supervisory expectations. Nobody is required to accept a mobile driver's licence tomorrow. What changed is the uncertainty. A compliance officer who wanted to accept digital credentials no longer has to argue that they fit the rule. The regulators have said so.

Who this reaches

The CIP rule applies to banks and credit unions. Most US fintechs and payment companies onboard customers through a sponsor or partner bank and run that bank's CIP, so the change reaches them through their partners. Once a partner's CIP permits digital credentials, every program running on it can use them.

That matters because document KYC is repeated at every hop. The same person uploads the same licence to the payout platform, the on-ramp, and the bank, and each one runs OCR, liveness, and review again. See The Problem for how that cost compounds.

The hard part is the technology clause

The phrase that will decide adoption is "maintains the appropriate technology or systems to extract the relevant information." Mobile driver's licences are issued state by state, presented from state apps and from Apple, Google, and Samsung wallets, and follow the ISO/IEC 18013-5 standard with online presentation profiles still maturing. Verifying one means checking the issuing state's signature, confirming the credential has not expired or been revoked, and reading only the attributes you asked for.

Every institution can build that for every state. Or it can be built once. That is the point of a credential layer: the institution asks for name, date of birth, and address, and receives a signed answer without touching a document. Read how it works for the six-step flow.

What to do now

Ask your sponsor bank whether its CIP will permit government-issued digital credentials, and when. Decide which attributes you actually need, because a credential lets you ask for less than a document shows. And plan for credentials beyond the US: India's DigiLocker is live, and the EU's wallet mandate lands in December 2026. The corridors page tracks each scheme.

The ruling makes digital credentials acceptable. It does not make them easy to accept. Syntex is the integration layer that makes that ruling actionable.