US banks and credit unions have greater clarity on whether mobile driver’s licences (mDLs) can be used to verify customers, but many still face a technical challenge in accepting the credentials. In an analysis published by digital identity company Hopae, the regulatory clarification is presented as a turning point for customer identification, shifting the focus from legal uncertainty to whether banks have the infrastructure to support mobile credentials.
On 8 September 2026, the Financial Crimes Enforcement Network (FinCEN), alongside staff from the Federal Reserve, the Federal Deposit Insurance Corporation (FDIC), the National Credit Union Administration (NCUA) and the Office of the Comptroller of the Currency (OCC), confirmed that qualifying mDLs can be used to meet Customer Identification Program (CIP) requirements.
The agencies did not introduce a new regulation. Instead, FinCEN issued two new frequently asked questions and updated an existing CIP FAQ, clarifying how current rules apply to digital identification. The guidance does not change Bank Secrecy Act obligations, establish new supervisory expectations or require financial institutions to accept digital IDs.
For banks, the change addresses uncertainty around whether a mobile credential can satisfy existing identification requirements. Under CIP rules, financial institutions must verify a customer’s identity using information including their name, address and date of birth. Hopae’s analysis explains that a state-issued mDL is now explicitly recognised as government-issued identification for this purpose.
Other digital credentials may also qualify, including those issued by third parties, provided they meet the applicable requirements for a photograph or comparable safeguard and evidence of nationality or residence. Banks remain responsible for ensuring third-party credentials meet the required verification standard.
The distinction between a digital credential and an image of a physical licence is central to the guidance. A qualifying mDL must be digitally signed by its issuer, cryptographically linked to a specific device and protected by an activation factor such as a PIN or fingerprint. These features help establish authenticity and make it more difficult to copy a credential between devices.
Many US mDLs use ISO/IEC 18013-5, which supports short-range verification between a mobile device and a reader. For remote account opening, ISO/IEC 18013-7 extends verification to online interactions. Hopae notes that banks need to consider both scenarios when implementing digital identity checks, from customers presenting credentials in branches to those opening accounts through mobile apps.
Rather than relying on a photograph of an identity document, a digital verification process can request a cryptographic response, validate the issuer’s signature against its public key and check whether the credential has been revoked. This provides a way to authenticate the credential using cryptographic evidence rather than visual inspection alone.
However, regulatory acceptance does not guarantee that banks can process these credentials. According to the Secure Technology Alliance’s mDL Connection implementation tracker, 20 US states and territories operate live mDL programmes built to the relevant standard. As availability expands, banks using legacy verification systems may face difficulties integrating credentials that differ from the physical documents their systems were designed to scan.
Hopae is positioning its Hopae Connect platform to address this integration challenge. The company says the platform supports ISO/IEC 18013-5 mobile driver’s licences from around a dozen states and territories, including California, Arizona, Colorado and Georgia. Supported wallet implementations include Samsung Wallet, Google Wallet and Apple Wallet, alongside Google’s ID Pass.
For banks already using Hopae Connect for CIP verification, the company says mDL support can be added as another credential type within the existing identity verification API. This could reduce the need to build a separate integration specifically for mobile licences.
The guidance gives banks greater certainty about the regulatory treatment of qualifying digital credentials, but adoption will depend on technical readiness and implementation choices. Hopae argues that the next challenge is ensuring identity verification infrastructure can authenticate mobile licences across both in-person and remote channels. For compliance teams, the decision is no longer solely whether digital IDs can be accepted, but whether existing systems can verify them reliably.
Copyright © 2026 FinTech Global
Copyright © 2026 RegTech Analyst
