For over twenty years, opening a bank account in the US has meant the same thing: typing who you are into a form and hoping the bank believes you. The customer identification rules written after 2001 fixed the questions, the industry built its applications around them, and everything we have covered in this series - the abandonment, the ten-question ceiling, the document uploads - descends from that one design. Then, on September 18 of this year, five federal agencies - FinCEN, the Federal Reserve, OCC, FDIC, and NCUA - jointly confirmed that banks may accept a mobile driver’s license from a phone’s wallet as government-issued identification for account opening. Read properly, that is not about compliance. It is the beginning of the end of the form. Last week we covered account opening as it is and the vendors who build it; this week, where the door goes, because the application of 2030 will not ask who you are. It will be shown.

Four Shifts, One Direction

Everything in this research points the same way, and it can be said in four lines. Identity will be presented, not typed, a signed credential from a wallet, not fields and a license photo. Eligibility and risk will be decided by data, not documents - verified sources and machine review, not uploads and manual queues. The account will be funded and armed in the same session - instant money in, card in the wallet, direct deposit switched before the customer leaves. And it will be opened anywhere - the bank’s app, a software platform the customer already uses, or sooner than most planning horizons assume, by the customer’s own AI agent. Each shift has shipped product behind it today. What follows is the evidence.

License in the Phone

Start with the September ruling, because it removes the industry’s standing excuse. The five agencies confirmed the customer identification rule “neither requires nor prohibits” accepting a mobile driver’s license - acceptance is voluntary, and conditioned on the credential being state-signed, bound to the device, and protected by an activation factor such as a biometric. In plain English: a license in an Apple or Google wallet, cryptographically signed by the issuing state, now satisfies the ID requirement if your technology can read and validate it. The supply side is arriving: 22 states and territories have live mobile driver’s license programs on the ISO standard (per industry tracker data), and roughly four in ten Americans live in a live-mDL state today, three in four counting programs in development. Airport security checkpoints are training the population to present the phone.

Here is the state of play: as of this writing, no US bank has publicly announced production acceptance of a mobile driver’s license for account opening. The FAQ is weeks old; the compliance excuse is gone; 2027 is the first-mover year, and a verification-vendor layer - SpruceID, Trinsic, Credence ID, Mattr - is already positioning for the remote-presentment standard that lets a customer present the credential to a website, not just a scanner. Pair this with the passkey - the cryptographic login credential that has gone mainstream in banking authentication and the shape of the future application appears. The wallet proves who you are at the door, and the passkey created in that same session is how you return, with no password ever existing to be phished. Europe, for contrast, legislated all of this. The EU’s digital identity wallet regulation obliges every member state to offer a wallet and will require financial institutions to accept it - and 24 of 27 member states are expected to miss the deadline. Europe wrote the mandate; the US market-led path may ship usable credentials first.

Why the Camera Loses

If the wallet credential is the future, the selfie is the past, and the fraud data says so bluntly. Entrust’s 2026 identity fraud research found deepfakes now account for one in five biometric fraud attempts, with deepfaked selfies up 58% in a year and injection attacks - fraudulent images fed directly into the verification software, bypassing the camera - up 40% (vendor threat research). iProov logged a 741% annual rise in injection attacks on iOS (same caveat). The pattern is structural, camera-based identity verification is an arms race against generative AI, and generative AI is winning. A cryptographically signed credential does not care how good the deepfake is - the signature verifies or it does not. This is the same fraud paradox we wrote about on October 13, resolved at the infrastructure layer: the strong check moves into mathematics, where the customer cannot feel it, and the friction the customer can feel goes away. Fraud economics, not customer experience, will be what forces the industry off the form.

When the Applicant Is Not a Person

AI is entering account opening from both sides. On the bank’s side it is already here: Narmi’s AI Decision Assist reviews applications and produces auditable recommendations (the vendor claims manual review cut from hours to minutes), and Socure has shipped a suite of AI agents for identity-risk and compliance decisioning. On the customer’s side, the rails are being laid in payments first: Visa’s Trusted Agent Protocol, Mastercard’s Agent Pay, and the Stripe-OpenAI agentic commerce protocol all shipped in 2025 - frameworks for a consumer’s AI agent to transact on their behalf. “Know Your Agent” is now a live compliance debate, and specialist vendors are shipping product for it - Vouched launched an agent-verification checkpoint this February.

Be precise about what is and is not real here. Agent-initiated payments are shipped; agent-initiated account opening is roadmap, and no US regulatory framework yet says how a bank verifies both the human principal and the agent’s mandate to act. But the direction is set, and the planning question is concrete: when a verified agent, acting for a verified customer, requests an account under a defined mandate, will your institution’s front door recognize it - or will your competitor’s? Your next new customer may arrive as your customer’s software.

Instant Everything

The last mile of the future is the least speculative, because all of it is shipped product - just unevenly bought. Funding: with FedNow past 1,600 institutions and RTP at scale, funding a new account by instant credit transfer inside the opening flow is feasible today - yet most institutions still fund by debit card or micro-deposit, which means the day-one account the customer expects is an implementation decision away, not a technology wait. Card: digital-first issuance that pushes the debit card into the Apple or Google wallet at the moment of approval is shipped product from Marqeta, Fiserv, and Jack Henry - the mailed plastic becomes the backup copy. Primacy: same-session direct deposit switching is now the state of the art - Atomic powers PNC’s automated direct deposit switch, covering roughly 85% of US payees, and Pinwheel is embedded in Q2’s platform alongside Q2’s own ClickSWITCH. Connect the three and the activation problem from last week’s Spotlight collapses into the opening itself: the customer leaves minute one with a funded account, a working card in the wallet, and the paycheck already redirected. That is not a better application. That is a different product.

Rules Are Moving Toward the Door

Regulation, unusually, is running ahead of most banks on this front. The TIN order of June 2025 already lets identity data come from third-party sources rather than the customer’s keyboard. The September mobile-license FAQ opens presented identity. And the embedded channel just completed a full regulatory arc worth registering: the Synapse collapse produced the 2024 interagency crackdown on bank-fintech arrangements, and this September the agencies proposed replacing the 2023 third-party risk guidance with a streamlined, risk-proportionate version and rescinding the 2024 joint statement outright. Read that as: embedded account opening survived its stress test and now has a lighter rulebook - with clean ledgering and account-ownership records as the enduring expectation. The platforms building distribution-embedded opening - Unit, Treasury Prime, Synctera, Increase, Stripe Treasury inside vertical software - are the channel through which “opened anywhere” arrives, and the credit union movement has its own version already producing: Union Credit’s embedded marketplace is approaching $1 billion in credit lines two years in, turning a loan acceptance at the point of need into a new membership. The one drag: business account opening keeps its friction, because the beneficial-ownership registry died while the bank-side collection duty survived - the business door modernizes last.

2030 Door

Our team at CCG Catalyst summarizes the account opening of 2030, and who is building each piece today:

What Belongs in the 2027 Plan

Five items, in the order I would sequence them. First, put the mobile driver’s license question to your account opening vendor now - specifically, when they will support wallet-presented identity including remote presentment - because the answer tells you whether their roadmap runs ahead of the agencies or behind them. Second, replace the password with a passkey at account creation; it is the cheapest fraud reduction on this list. Third, close the instant gap you can close today: funding on the instant rails, card provisioned to the wallet at approval, deposit switch in the opening session - all purchasable now, and together they collapse opening and activation into one event. Fourth, ask your identity-verification vendor one uncomfortable question: what happens to your product when a deepfake defeats the selfie - and judge the answer against the injection-attack data. Fifth, assign someone to watch the agent question, because “Know Your Agent” will arrive the way FedNow did: discussed for years, then suddenly a planning-cycle item.

My final comment: this series began with a scoreboard and ends its account opening arc with a prediction I will stand behind - the form is dying, and the institutions that mourn it least will win the most. For twenty plus years the industry has asked new customers to prove who they are by typing. The customers who grew up presenting a phone at an airport gate will not accept that much longer, the fraudsters with generative AI already do not care, and the regulators - for once ahead of the market - have opened the door. Tomorrow, in the final piece of this series, we widen the lens to the whole platform: the future of digital banking, 2026 to 2035.

CCG Catalyst advises banks, credit unions, and fintech companies on digital strategy, vendor selection, and contract negotiation. If your institution is planning the next generation of its front door, reach out to our team at www.ccgcatalyst.com.

See our latest announcement: CCG Catalyst’s Paul Schaus Named a 2026 Top Consultant by Consulting Magazine

By: Paul Schaus | Founder & Managing Partner, CCG Catalyst Consulting

Disclaimer: The views expressed in this article represent the perspective of CCG Catalyst Consulting based on our direct experience advising financial institutions. This commentary is intended to stimulate industry discussion and does not constitute legal, accounting, or regulatory advice.