Notifications
Clear all
Topic starter
16/09/2026 9:21 am
TL;DR: Federal guidance now says an unexpired state-issued mobile driver’s license can qualify as government-issued identification under the CIP Rule when existing evidentiary requirements are met, according to Authsignal. The practical shift is not just onboarding convenience, but a broader verification option across the customer lifecycle where assurance, fraud checks, and channel orchestration matter most.
NHIMG editorial — based on content published by Authsignal: Mobile driver’s licenses for KYC: what new US guidance means for financial institutions
Questions worth separating out
Q: How should banks govern mobile driver's licence acceptance in KYC flows?
A: Banks should treat mDL acceptance as a governed identity-verification method, not a product feature.
Q: Why do digital identity credentials create governance risk if they are reused across every channel?
A: Because a credential that is appropriate for onboarding may not be appropriate for recovery, branch verification, or high-risk transactions.
Q: What are the main failure modes when institutions accept mDLs without strong controls?
A: The main failures are weak fraud screening, unclear evidence requirements, and overconfidence that a digital credential alone proves trust.
Practitioner guidance
- Define where mDLs are allowed in the identity lifecycle Limit mDL use to explicit checkpoints such as onboarding, re-verification, account recovery, and selected high-risk transactions.
- Separate verification policy from routine authentication Use mDLs as a higher-assurance verification signal and keep routine access on methods such as passkeys or equivalent session controls.
- Build fraud review into the acceptance decision Require checks for fraud indicators, data mismatch, and failed trust validation before a digital credential is accepted.
What's in the full article
Authsignal's full blog covers the operational detail this post intentionally leaves for the source:
- How Authsignal sequences passkeys, digital credential verification, and step-up assurance across web, mobile, contact centre, and branch flows.
- The specific orchestration model used to re-use mDLs at higher-risk moments without turning them into everyday authentication credentials.
- Practical examples of how financial institutions can introduce digital credential verification without building a separate journey for every channel.
- The vendor’s view of where mDL verification fits into existing customer identity and access patterns, including account recovery.
👉 Read Authsignal’s analysis of mobile driver’s licenses for KYC and CIP guidance →
Mobile driver’s licenses for KYC: what changes for identity teams?
Explore further
16/09/2026 9:21 am
mDLs are becoming a governance problem, not just a verification feature. The key shift in this guidance is that digital credentials now sit inside regulated identity decisioning rather than outside it. That means identity assurance, fraud review, and lifecycle controls have to be designed together, not treated as separate workstreams. For institutions, the question is whether the CIP implementation can prove that the credential was accepted under controlled policy, not simply whether the credential was technically readable.
A question worth separating out:
Q: Should institutions replace passwords and passkeys with mobile driver’s licenses?
A: No. mDLs are better used as a higher-assurance verification method, while passkeys or similar methods remain more suitable for routine authentication. Mixing the two creates control confusion and can weaken the separation between identity proofing and session access.
👉 Read our full editorial: Mobile driver’s licenses add a new KYC control point
