From DMV to Wallet: Understanding Verifiable Digital Credential Issuance

In our last post in this series, we compared two credential formats that shape the digital identity ecosystem: ISO/IEC 18013-5 and -7 mobile documents (mdocs) and W3C Verifiable Credentials (VCs). Both formats define how a credential is structured and shared, but neither can function without an issuance process. 

This blog post explores what it takes to issue verifiable digital credentials, with a focus on mobile driver’s licenses (mDLs). We’ll look at how issuance works today in practice, where inconsistencies exist, and how standards bodies (FIDO, ISO and OpenID Foundation) are working to bring greater trust and interoperability.

Why Issuance Matters

Credit: NIST

Whether physical or digital, every credential starts with trust in the issuer. The process of verifying an applicant’s identity and creating a credential is what anchors the system. A strong issuance process ensures that only authorized individuals receive credentials, that those credentials are bound to the right person, and that relying parties can verify their authenticity later.

VDCs—a term that includes mDLs, SD-JWT VCs, W3C VCs, and other formats—introduce new ways to deliver strong identity credentials digitally. From your local department of motor vehicles (DMV) counter to a mobile phone, the same basic checks apply: confirm who the person is, validate their eligibility, and create a secure credential that the holder can control.

In this post, we’ll use mDLs to exemplify VDC issuance processes and highlight the technical standards that underpin the assurance that VDCs offer.

How mDL Issuance Works

The mDL issuance process builds on — but is distinct from — the procedure for obtaining a physical driver’s license. Applicants must still complete the standard identity proofing and eligibility checks to receive a physical license. Once a person has a valid driver’s license, many states allow the mDL to be issued remotely without requiring another visit to the DMV.

Remote issuance of an mDL to a digital wallet typically involves:

1. Identity proofing: Confirming the individual’s identity using their physical driver’s license and a selfie to match the individual against a valid record at the DMV.
2. Credential creation: Encoding verified data into an mdoc using standardized, predefined attributes.
3. Issuance Protocols: Transferring the credential to a mobile wallet or app that supports mDL presentation, with cryptographic keys binding it to the holder’s device.
4. Lifecycle management: Ensuring that credentials can be remotely updated, renewed, or revoked in line with DMV policy.

In these remote flows, the state verifies that the person requesting the mDL matches a verified identity in the DMV system of record — typically by confirming the existing driver’s license details and performing a biometric match against the portrait image on file at the DMV — before generating the mDL and delivering it securely to the user’s mobile device.

The Real ID Connection and the Role of AAMVA

The Department of Homeland Security (DHS) oversees compliance with the REAL ID Act, which sets the standards states must meet for issuing driver’s licenses and identification cards used for federal purposes, such as airport checkpoints. In November of 2024, the Transportation Security Administration (TSA) issued a Final Rule covering security controls and issuance practices (including identity proofing of individuals) that issuers might follow when issuing mDLs. As mDL programs expand, the DHS oversight ensures that digital issuance maintains the same security and verification rigor as physical credentials.

Additionally, the American Association of Motor Vehicle Administrators (AAMVA’s) Best Practices for the Mobile Driver’s License describes the recommended steps for secure issuance, including proofing, binding, and device management. These practices emphasize that digital issuance should maintain the same rigor as physical issuance, with additional safeguards for credential lifecycle management (e.g., renewal, suspension, and revocation).

Emerging Standards: Identity Proofing

While both DHS and AAMVA requirements have resulted in proofing practices that are similar across states, their high-level nature means that not all practices are entirely consistent.

This can create challenges for relying party organizations who may want to accept mDLs from multiple state issuers. Variations in the technology and DMV processes used to issue mDLs make it difficult to understand the degree to which the issuer’s credentials meet their needs. Identity Proofing guidelines and standards such as NIST SP 800-63A can be applied to provide more specificity and consistency in the execution of identity proofing practices. While NIST SP 800-63A was not designed specifically to address mDL issuance, the project team and collaborators developed an 800-63A profile to specifically address mDL issuance scenarios leveraging Identity Assurance Level Two (IAL2) controls as a starting point. The work, found in our Building Assurance in the mDL Ecosystem paper, proposes attributes about the mDL issuance process that could be included by the issuer with the credential.

Emerging Standards: OpenID4VCI

While ISO, IETF, and W3C standards define credential formats, and jurisdictional frameworks such as the RealID Act and NIST SP 800-63A define the requirements for identity proofing, the technical requirements to communicate between the wallet and issuer to provision a credential requires its own separate technical protocols.

One such effort to accomplish this is the OpenID Foundation (OIDF) OpenID for Verifiable Credential Issuance (OID4VCI) specification. OID4VCI defines a standardized, API-based protocol for issuing verifiable digital credentials, whether they’re mdocs, SD-JWT VCs, W3C VCs, or other credential formats. It builds on familiar web technologies such as OAuth 2.0 and OpenID Connect (OIDC), making it easier for issuers to integrate credential issuance into existing identity systems. OpenID4VCI provides:

• A standard interface for discovering what credentials an issuer offers and how a specific credential can be requested.
• Security patterns inherited from OIDC and OAuth 2.0, including client authentication and token proof-of-possession.
• Support for multiple credential types, allowing issuers to choose the format that best fits their use case.
• Improved user experience because it can be invoked using the W3C Digital Credentials API for secure cross-device transfer (e.g., "Save to my wallet").

While OID4VCI seeks to provide a consistent, interoperable way for issuers to deliver digital credentials to wallets or apps, like many standards in the mDL ecosystem, OID4VCI is still evolving to meet emerging needs.

However, issuers and technology providers seeking to implement OID4VCI now can take advantage of the OIDF conformance tests to support interoperable implementations and self-certification.

Increasing Trust and Interoperability

As already noted, issuance and identity proofing practices vary between states. Similarly, not all wallets offer the same security features and capabilities. To determine if a wallet meets the specific needs of the issuer (for example, the wallet's ability to protect the credential), issuers must execute time consuming one-off engagements to make determinations with each wallet provider they consider using. While this gives the issuer greater control over trust processes, it limits the scale and increases the timeframe for adoption of new wallets. In many instances the ecosystem would benefit from mechanisms that can support more rapid trust establishment and automated discovery by issuers of wallets.

These variations in the technology and DMV processes used to issue mDLs make it a challenge for High Assurance Relying Parties (HARPs), such as financial institutions, to understand the risks they are accepting when integrating mDL into current identity verification processes.

These challenges could potentially be mitigated through certification programs. In the U.S., the FIDO Alliance Digital Credentials Working Group is taking on the workstream of developing a wallet certification program that will establish security, privacy, and interoperability criteria for wallets. This will help issuers ensure that common practices are used for the mDL issuance ceremony across all wallets and provide Relying Parties (RPs) with more information about the rigor applied to a given set of wallets the issuers support.

Further HARP concerns over issuance process inconsistencies could also be addressed if the mDL itself provided HARPs with information on how it was issued. The NCCoE’s Building Assurance in the mDL Ecosystem paper talks about this topic in depth, proposing attributes that could be passed to RPs, providing them assurance around the issuance process. Currently, two efforts are underway that can potentially address certain aspects of RP trust.

• In the OpenID Foundation, the Identity Assurance Working group is looking at the development of issuance metadata that can be included directly in credentials.
• Similarly, ISO/IEC SC17 WG4 is developing 23220-5, which establishes processes for encoding and conveying trust information including identity proofing and issuance practices into mDOC’s and mDOC transaction data.

Beyond Government IDs

Although the mDL standard was developed to support government-issued identification, its underlying model can extend beyond that context. The same issuance principles could support high-assurance credentials in sectors such as healthcare, finance, professional licensing; or anywhere a trusted authority must confirm a person’s identity before granting access or privilege.

These non-government deployments are already appearing in pilots and standards discussions, signaling that issuance processes can evolve without losing their foundation in identity assurance and data protection.

Summing it Up

Issuance defines the foundation of trust in any digital identity ecosystem. Getting it right means that credentials, whether a mobile driver’s license or a university diploma, can be relied upon by others without re-verifying every transaction.

As mDL pilots expand and standards mature, the challenge is in ensuring that digital issuance preserves the same assurance, privacy, and accountability that have long underpinned physical credentials.