Five Agencies Have Told Banks a Phone Can Carry a Customer ID. Who Issued the Credential Decides How It Counts.

Five federal agencies published frequently asked questions on 8 September 2026 addressing whether a bank can accept a digital identity credential — a state mobile driver licence held in a phone wallet, for example — to satisfy the Customer Identification Program rule when opening an account. The answer is yes, with conditions. The more useful answer is that where the credential came from determines which set of rules the bank has to satisfy.

Who issued it, and what the answer was

The FAQs came from the Financial Crimes Enforcement Network together with the Federal Reserve Board, the Federal Deposit Insurance Corporation, the National Credit Union Administration and the Office of the Comptroller of the Currency. The OCC circulated them as Bulletin 2026-44; the FDIC issued a Financial Institution Letter and the Federal Reserve a Supervision and Regulation letter covering the same material.

The OCC bulletin applies to national banks, federal savings associations and community banks with assets up to $30 billion.

The answers to these FAQs clarify how banks may use such VDCs to comply with the Customer Information Program (CIP) Rule.

The documentary line

The Customer Identification Program rule, which sits under the Bank Secrecy Act, requires a bank to form a reasonable belief that it knows the true identity of each customer. It offers two routes. Documentary verification means checking an identification document. Non-documentary verification means confirming identity by other means — comparing information against a consumer reporting agency, a public database, or another source.

The distinction is the practical core of this guidance. A government-issued verifiable digital credential is treated as documentary evidence. A privately issued one is not; it remains a non-documentary method, and the institution has to satisfy itself that the authentication is of equivalent standing. Two credentials that look identical on a screen can therefore sit in different compliance categories depending on who signed them.

The conditions

As reported, the FAQs set out the conditions under which a digital credential can carry documentary weight:

• The credential must be unexpired and government-issued.
• It must evidence nationality or residence and bear a photograph or an equivalent safeguard.
• The institution must hold technology capable of extracting the required identifying information from the credential.
• The bank keeps responsibility for forming the reasonable belief that it knows the customer identity. Government issuance does not transfer that responsibility.
• Where indicators of fraud are present, an institution cannot rely on government issuance alone.

The credential may be presented in person or through a remote digital channel. That last point is what makes the guidance operationally significant for account opening that never involves a branch.

What this is, and what it is not

This is interpretive guidance, not a rulemaking. There was no notice-and-comment process, no Federal Register rule text and no change to the underlying regulation. The agencies framed their position as neither requiring nor prohibiting reliance on government-issued verifiable digital credentials. A bank that wants to keep checking physical identification documents can carry on doing so.

The FAQs also amended terminology in an earlier FAQ describing verifiable digital credentials, which suggests the agencies expect the vocabulary in this area to keep moving.