What is reusable KYC?

Reusable KYC means verifying a person's identity once, issuing them a verifiable credential that attests to the result, and letting them present that credential to other services instead of repeating document capture and selfie checks each time. The next service checks the issuer's signature, the holder binding and the revocation status, then decides whether the credential meets its own assurance and compliance rules.

How do verifiable credentials reduce KYC costs?

They replace repeated document capture and manual review with a signed, instantly checkable credential. That cuts per-verification work, reduces onboarding drop-off, and shrinks the amount of sensitive identity data each verifier has to collect and store. How much you save depends on your current per-check price and fallback rate, so measure it in a pilot rather than relying on vendor claims.

Can reusable credentials satisfy regulatory KYC requirements?

It depends on the jurisdiction and the assurance level. Government-issued credentials such as EUDI Wallet person identification data and mDLs carry high assurance, but relying on another party's verification must still meet your AML and customer due diligence rules, including record-keeping and ongoing monitoring. Confirm the reliance model with compliance before you drop your existing checks.

What is the difference between reusable identity and a digital ID?

A national digital ID is one high-assurance source that can seed a reusable credential. Reusable identity is the broader pattern of issuing and reusing verifiable credentials, which may draw on a national ID, a mobile driver's license, a bank, or a specialist identity verification provider that runs its own reusable network.

Does a reusable credential prove the person presenting it is the subject?

Not by itself. A signature proves the credential is genuine and unaltered. Holder binding, where the wallet proves possession of a key bound to the credential, shows it is presented from the device it was issued to. For high-risk onboarding, add a liveness or face match against the credential photo, because a stolen phone or a coerced user can still present a valid credential.

Is the EU Digital Identity Wallet a reusable KYC credential?

It is the largest source of one. Every EU member state must offer at least one wallet, which the Commission says means availability by the end of 2026, and regulated private relying parties such as banks must later accept it on user request under Article 5f of eIDAS 2. Wallets carry person identification data as SD-JWT VC or ISO mdoc credentials with selective disclosure.

Reusable Identity and KYC with Verifiable Credentials

Reusable KYC is identity verification done once and reused many times: a trusted issuer verifies a person, issues a verifiable credential attesting to the result, and the person presents that credential to the next bank, exchange or marketplace instead of uploading documents again. The verifier checks a signature, a holder binding and a revocation status in seconds. In 2026 it is the clearest near-term return from decentralized identity, because government-issued sources (the EUDI Wallet and mobile driver's licenses) are arriving at scale.

This guide is for onboarding, fraud and compliance teams. It covers the flow, the credential sources, the regulatory reliance question, the failure modes and a pilot plan. For the consumer-facing explainer, read reusable identity verification; for the wider context, decentralized identity explained.

The problem with today's KYC

Every service that needs to know who you are runs its own KYC: capture an ID, take a selfie, run checks, store the data. The same person repeats this at every bank, exchange, marketplace and gig platform. It is expensive, it causes onboarding drop-off, and it scatters copies of identity documents across dozens of databases.

Those copies are a real breach surface, not a theoretical one. Coinbase's May 2025 8-K says the data paid support insiders collected included government ID images such as driver's licenses and passports. In October 2026, DigiCert reported that an internal system archiving customer-provided identity-validation documents, including some driver's licenses, passports and utility bills, was reachable through self-registered accounts that skipped MFA. Reusable credentials with selective disclosure let a verifier record "verified, over 18, resident of X" without keeping the document image at all.

How the verify-once, reuse-many flow works

Proofing. An issuer (a government, a bank, or an identity verification provider) performs identity proofing to a defined assurance level.
Issuance. The issuer signs a credential and delivers it to the person's wallet, usually over OpenID4VCI 1.0, bound to a key held on the device.
Presentation. The next service sends an OpenID4VP request for only the claims it needs. The wallet shows who is asking and returns a verifiable presentation.
Verification. The verifier checks the issuer signature, the key binding against its nonce, the status list entry, and whether the issuer is on its trust list.
Decision and record. The verifier applies its own risk rules and stores the verification result and evidence reference, not the source document.

Zero-knowledge proofs push minimization further, for example proving age without revealing a birth date; see age verification.

Credential sources compared

Source	Assurance	Reach in late 2026	Best for	Watch out for
EUDI Wallet person identification data	High, government-issued	Member states must offer wallets by end of 2026; rollout uneven	EU onboarding, cross-border banking	Relying-party registration, per-state wallet differences
Mobile driver's license (mDL, ISO mdoc)	High, issuing-authority signed	US states and other jurisdictions issue their own	Age checks, US onboarding	Coverage varies by state; online use needs ISO 18013-7 or OpenID4VP
National digital ID schemes	High, varies by country	See digital IDs by country	Domestic regulated onboarding	Scheme-specific APIs, not always VC-based
Bank or IDV-provider reusable credential	Depends on the issuer's proofing	Network-dependent	Fintech, marketplaces, gig platforms	Reliance contracts and liability
Self-asserted or social credentials	Low	Wide	Low-risk personalization	Not KYC

Reusable networks already exist outside the VC standards too: ID.me and CLEAR run reusable consumer identity networks strongest in the US, and Dentity issues reusable credentials on open standards. For VC-based acceptance across many digital IDs through one API, see Trinsic. Ranked options: best decentralized identity for KYC.

The regulatory reliance question

A credential is evidence, not a compliance outcome. Two 2025-2026 developments matter:

EU. eIDAS 2.0, Regulation (EU) 2024/1183, requires each member state to offer at least one wallet within 24 months of the implementing acts, which the Commission says means availability by the end of 2026, with public authorities required to accept them. Article 5f then extends acceptance duties to regulated private relying parties, including banking and financial services; our eIDAS 2 page tracks the clock.
US. NIST SP 800-63-4, final on 31 July 2025, describes two federation models in SP 800-63C-4: general-purpose identity providers and subscriber-controlled wallets. That gives US agencies and regulated firms a vocabulary for accepting wallet-held credentials.

Neither removes your AML duties. Document who did the proofing, to what level, how you validated the credential, and how you handle revocation and ongoing monitoring.

Failure modes

Trusting the signature, not the presenter. A valid credential on a stolen or shared phone still passes a signature check. Require holder binding and, for high-risk flows, a face match or liveness step.
Recovery is the soft spot. If a lost wallet can be reissued over a phone call, attackers will call. That is help desk social engineering, the path used against MGM Resorts. Reissue through the same proofing as first issuance.
Lawful access abused at scale. In Denmark, a company's lawful access to the national CPR register was used for about 14 million automated searches covering about 8.8 million people. Central lookup services are a target; presentation-based checks avoid giving every verifier a query interface.
Stale status. Caching a status list too long accepts revoked credentials; fetching per presentation leaks timing. Set a cache window per risk tier.
Over-collection. Requesting the full PID when you need "over 18" defeats the privacy benefit, and under the EU wallet rules a request beyond your registered intended use is what wallets are built to catch.

Pilot plan

Pick one flow where document capture hurts conversion, such as account opening for returning customers or age-gated checkout.
Accept one high-assurance source (for example mDL or an EUDI Wallet PID) as an alternative to document capture, with full fallback.
Define acceptance rules with compliance: accepted issuers, assurance level, claims, status freshness and record-keeping.
Measure completion rate, time to verify, fallback rate, and cost per verified customer against your current baseline. As a planning estimate, run at least one full billing cycle before judging cost.
Expand to more sources and flows, and consider becoming an issuer once your own verification is reusable by partners.

The verifiable credentials implementation guide covers the build, and choosing a decentralized identity platform covers vendor selection.

Where to go next

Directories: identity verification vendors, digital IDs by country. Guides: customer identity verification guide. Standards: Verifiable Credentials, OpenID4VC, mDL, eIDAS 2 / EUDI Wallet.