Tag Archives: financial identity

Immature AI Bots, Or Immature Banks?

Are we dealing with immature AI bots who don’t know what they’re doing, or immature banks who are panicking?

When we introduce any new technology there are always growing pains. Many of us don’t understand how the technology works and we need to adjust our behaviors. As I’ve said before, business problems are tougher than technology problems. We can technically do many things…but do we want to?

Royal Bank of Canada blocks personal AI agents

Take bots and banking. We can remove the drudgery of banking operations by assigning an AI agent to perform our banking for us.

Well…unless you bank with the Royal Bank of Canada, which is banning the bots:

“Royal Bank of Canada (RBC) has decided to block third-party personal AI agents from direct access to online banking and other RBC digital properties due to concerns about fraud and consumer harm.”

Why?

“…as these systems become more autonomous, the stakes go up when something goes wrong—from fraud and consumer harm to risks that could ripple more broadly through the financial system. That’s why, after careful consideration and based on what we know today, RBC has decided to block third-party personal AI agents from direct access to authenticated RBC digital properties including online banking.”

Traditional banks tend to act conservatively, so it’s not surprising that this bank is leery of personal AI agents. Some consider this a tacit admission that RBC is not ready to integrate the new technology yet.

Then again, is anybody? Is your local bleeding edge financial rockstar entity truly prepared for what AI agents can do?

Proof suggests a solution

The identity company Proof is monitoring these bot blocks and thinks there is a better way. Proof acknowledges the problem that threw Royal Bank of Canada (and Amazon) into a frenzy:

“There is no reliable way to know who an AI agent is acting on behalf of, or whether that person authorized what it is doing.”

Taking FinCEN’s verifiable credentials clarifications into account, Proof launched a new product.

“Proof became the first company to put verified legal identity and transaction authorization for AI agents into production with the launch of x401, an open protocol that lets any website ask an AI agent to prove who it’s acting for and what that person approved. Proof works with Meta’s Muse, ChatGPT dots, Grok, Claude and other assistants that support the Model Context Protocol (MCP).”

Is this enough to calm RBC and Amazon? We’ll see.

Money Laundering Risk at Bank of America

Financial institutions are supposed to reduce money laundering risk. But sometimes they don’t.

The Financial Crimes Enforcement Network (FinCEN), the Office of the Comptroller of the Currency (OCC), and the Office of Foreign Assets Control (OFAC) fined Bank of America for numerous violations of anti-money laundering laws. The agencies found that the bank was guilty of the following:

  • A “failure to mitigate and report priority national security risks, including Chinese Money Laundering Networks and illicit finance along the southwest border.”
  • A “deficient and ineffective BSA/AML (anti-money laundering) compliance program.”
  • “[A]pparent violations of numerous sanctions programs, including on Iran, Russia, narcotics, and global terrorism.”

It all boils down to “Know Your Customer.” If you don’t know who is doing business at your financial institution, you’re in trouble. You could promote illegal efforts from China, Iran, Russia, terrorists, and drug dealers.

Money laundering risk. Google Gemini.
Money laundering risk. Google Gemini.

How do YOU minimize money laundering? Let Bredemarket help you communicate your solution. https://bredemarket.com/watch-book/

Revised 10/28/2026.

Banking Use of mDLs: Can the Bank Recognize an mDL?

If your bank can’t recognize an mDL (mobile driver’s license), your money may be in danger. Someone with a fake mDL can steal your money.

If you recall my September 18 post on banking use of mobile driver’s licenses (mDLs), you know that the U.S. Department of Treasury’s Financial Crimes Enforcement Network (FinCEN) participated in a joint statement that clarified acceptable identification for banks and credit unions.

“[The agencies] are issuing two new frequently asked questions (FAQs) that address the use of state-issued mobile driver’s licenses (mDLs) and other government-issued verifiable digital credentials, which may be used to verify identities of natural person customers under the Customer Identification Program (CIP) Rule.”

Slam dunk, right?

Not according to Anderson Insights, as PYMNTS reports.

“According to Anderson, the central issue is not whether digital identification is legally acceptable, but whether banks’ technology, records and exception-handling procedures can support a defensible identity-verification decision.”

To put it plainly, how does a bank teller know that I’m presenting a real mobile driver’s license? Does the teller have the knowledge and the equipment to detect fraudulent mDLs?

Whether evaluating a physical driver’s license or a mobile one, both knowledge and equipment are important. The person reviewing the license has to understand what a real license is like, and what a fake license is like. Ideally, the reviewer’s employer has provided the reviewer with equipment to help distinguish real licenses from fake ones.

If not, someone can present a fake mDL and steal your money.

Heck, we haven’t mastered this for physical driver’s licenses, which have been around for decades. What leads one to believe that we can detect mobile driver’s licenses?

Because sometimes a fake ID is obvious…and sometimes it isn’t.

Recognize an mDL? Recognize a fake one? Google Gemini.
Recognize an mDL? Recognize a fake one? Google Gemini.

Do you provide an identity solution and need to educate your audiences, both external and internal, about how it works?

Bredemarket can help. Learn more at https://bredemarket.com/watch-book/

Bredemarket services, processes, and pricing in 15 seconds. Revised 10/28/2026.

Is Cross-Border Payment Friction a Problem Or a Benefit?

We can avoid cross-border payment friction by using stablecoins, according to Mastercard, But is this a good or a bad thing?

Why cross-border payment friction

Back 50 years ago, the immediate transfer of money from one bank account to another was usually impossible. First you had to get your checkbook and a pen and write a check from your bank account. Then you had to mail the check to the other entity. The other entity would have to deposit the check into their bank account. Then they would have to wait for the check to clear.

Cross-border payments were even worse. Not only did you have to do all of the above (and account for the time it takes to send the check from one country to another), but you also had to deal with currency exchange.

And even if you used more “modern” methods than check writing, the process was still pretty manual. Typing transfer instructions into a Telex machine. Transferring money from the sending bank to the receiving bank via “correspondent banks.” Processing the transfer at odd local hours to meet the other bank’s regular business hours. Oh, and manual government monitoring of foreign transfers.

Things are a lot better today. Rather than one to three weeks, many transfers complete in one to three business days. While some are faster, other’s aren’t.

One to three business days isn’t fast enough.

Mastercard’s solution: stablecoins

Mastercard, which 50 years ago was known as MasterCharge, is one of four companies offering a much faster solution based upon stablecoins.

“[Michael] Miebach highlighted Mastercard’s backing of Open Standard and its recently issued U.S. dollar-backed stablecoin….

“Mastercard is one of the four integration paths through which businesses can get started with OUSD. The other three are Stripe, Coinbase, and Visa.”

Is the elimination of cross-border payment friction a good thing? Google Gemini.
Is the elimination of cross-border payment friction a good thing? Google Gemini.

Stablecoins are a form of cryptocurrency, pegged to specific real-world currencies such as the U.S. dollar. Because crypto transactions are instantaneous once they are recorded on the ledger, money can move much more quickly. No three-week wait to get your money from one country to another.

“For cross-border B2B transfers, stablecoins provide a solution for speed, cost and currency exposure. Stablecoins settle in seconds at a fraction of the cost of traditional cross-border wire transfers. In markets where local currencies are depreciating, stablecoins preserve purchasing power, access dollar-denominated liquidity and protect against inflation…”

So what could go wrong?

Four problems with using stablecoins for cross-border payment

There are potential drawbacks to using stablecoins for cross-border payments.

  • Converting to and from fiat currencies. If all of us, including the banks, used U.S. dollar denominated stablecoins, there would be no problem. But you have to transfer the money to stablecoins before sending, and then transfer it out of stablecoin (potentially into euros or a non-U.S. currency) after sending. And those processes aren’t necessarily as instantaneous as moving stablecoins across borders. Add in the conversion fees, and there’s still friction.
  • Regulations. Different countries impose different regulations on stablecoin transfers. Some ban “crypto-fiat” off-ramps. Some require collection and transmission of sender/receiver identity information, and hold up the transaction if any of this is missing.
  • Various risks. A fiat-backed stablecoin is only as safe as its issuer’s reserves. Market stress can affect this. And temporary issues in the market sometimes result in a “stable” coin not maintaining its 1:1 exchange rate with the fiat currency in question.
  • Lack of protection. Blockchain transfers are instantaneous and final. There’s no appeal procedure like you have with traditional financial institutions. If you send the stablecoin to the wrong wallet, tough.

If you are risk averse, then instantaneous stablecoin transactions are NOT for you.

Biometric News FOMO: What Did You Miss Last Week?

“Biometric news FOMO” (fear of missing out) occurs when a major biometric news story hits the wires and you know nothing about it.

Here at Bredemarket, I try to help.

I try. Google Gemini.

I try to fill the biometric news FOMO gaps for you at Bredemarket. Not just with breaking stories, but items that will be stories in the future.

A huge biometric bid. A not-so-huge biometric book. Changes in bank identification. Changes (maybe) in New Jersey courts. Tyranny trees. Identity Day.

Did you miss any of these stories? Read on.

Conquer biometric news FOMO.
Conquer biomertric news FOMO. Google Gemini.

Biometric bid due date FOMO

Take the Department of Homeland Security biometric capture device procurement (70RDA126R00000001): $440 million for finger, face, iris, palm, and multi-modal devices. So potentially up to five proposals, two volumes per proposal, two tabs per volume. That’s a lot of tabs.

Google Gemini.

Originally released Thursday September 10, the published due date was Friday, September 18 at 7:00 am Pacific. All the bidders waited for an extension announcement, which finally arrived less than half an hour before proposals were initially due. As I write this, bidders don’t have the real due date yet, other than it wasn’t due last Friday after all.

Biometric book FOMO

That last story was covered by Biometric Update. This next one understandably wasn’t.

Because Biometric Update concentrates on the biometric factor of identity verification and authentication. It occasionally touches on other factors, but not all six.

The cover of "Proving Humanity: The Six Factors of Identity Verification and Authentication" by John E. Bredehoft, Bredemarket.,
My book.

I do, which is why I plugged my book again. “Proving Humanity: The Six Factors of Identity Verification and Authentication” is for sale.

Banking digital identity FOMO

For a variety of reasons, ranging from detecting fraud to detecting terrorism, your bank or financial institution often asks you for your government identification. For example, your driver’s license.

But the Department of the Treasury clarified that instead of taking your wallet out of your pocket, you can use the wallet on your smartphone.

Google Gemini.

Yes, banks can now accept mobile driver’s licenses, making things easier for banking customers. After all, we may leave our wallets at home, but we tend to keep our smartphones with us.

New Jersey court fingerprint acceptance FOMO

Unlike the stories above, there were NOT any updates on Judge Carmen Messano’s forthcoming evidentiary hearing. This hearing, when held, regards the acceptability of fingerprints as evidence in New Jersey courts. It was mandated as part of State v. French G. Lee.

Google Gemini.

Nothing yet; Messano just officially started this month. But something will happen, so I’m tracking it.

Tyranny trees FOMO

If you haven’t noticed, Flock Safety cameras are unpopular. So unpopular that people are bringing them down. Take Jevon Martinez, who brought some “tyranny trees” (his term for automated license plate recognition cameras) down and helpfully returned them to the sheriff.

Google Gemini.

And was arrested. Two words: dumb crime.

Lacking identity FOMO

Then on (as the Africans say) 16/9 ID4Africa and many others observed Identity Day 2026. 16/9 isn’t just a date; it’s a reference to United Nations Sustainable Development Goal Target 16.9 to “[p]rovide legal identity for all, including birth registration, by 2030.”

Identity Day 2026.

Avoiding biometric news FOMO

And there’s more, but rather than going back an entire week, I stopped at Wednesday.

But how can you conquer your fear of missing out on biometric news?

Subscribe to the Bredemarket blog.

https://bredemarket.com/subscribe-to-bredemarket/

Subscribe to Bredemarket

Banking Use of mDLs

Is banking use of mDLs permitted when you have to prove your identity? Before we dive into this, let’s define some things.

This post looks at five acronyms:

  • CIP, for the Customer Identification Program (Rule)
  • VDC, for Verifiable Digital Credential
  • mDL, for mobile Driver’s License
  • FAQ, for Frequently Asked Question
  • FinCEN, for Financial Crimes Enforcement Network

Finally, we look at FinCEN’s FAQs regarding CIP acceptance of mDLs as VDCs.

Five acronyms

A Customer Identification Program (CIP), mandated by Section 326 of the USA Patriot Act and other legislation, specifies how financial institutions implement Know Your Customer (KYC) and anti-money laundering (AML) programs to stop terrorists and others from sending illicit money through the institutions. Each individual financial institution writes its own CIP, and at a minimum it dictates that the institution collect the customer’s name, address, government-issued identification number, and (for individuals) their date of birth.

A Verifiable Digital Credential (VDC) is one way to gather the information mandated by a financial institution’s CIP. NIST breaks down the three words in the name:

  • Verifiable: cryptographically, to verify the authenticity and integrity of the data.
  • Digital: on a smartphone, a cloud wallet, or somewhere similar.
  • Credential: issued by a government, educational institution, or some similar holder of personal information.

We’ve talked about mobile Driver’s Licenses (mDLs) before. They’re VDCs that display the same information (or a subset) that is contained on your physical driver’s license. And they’re not restricted to the United States.

A collection of Frequently Asked Questions (FAQs) supposedly answers the most pressing questions about a particular service. Even Bredemarket has a collection of FAQs, but they’re hopelessly outdated. Add to to-do list.

Finally, the Financial Crimes Enforcement Network (FinCEN) is part of the U.S. Department of the Treasury. We’ve talked about FinCEN before also: what it does, and what it doesn’t do.

Is banking use of MDLs allowed?

A mobile driver’s license does you no good if no one accepts it.

There are precious few places where I can use my California mDL. The Transportation Security Administration people at Ontario International Airport accept them, but that’s about it.

Which is why FinCEN’s new FAQs are so important.

“The U.S. Department of Treasury’s Financial Crimes Enforcement Network (FinCEN), jointly with the staffs of the Board of Governors of the Federal Reserve System, the Federal Deposit Insurance Corporation, the National Credit Union Administration, and the Office of the Comptroller of the Currency (the “Agencies”), are issuing two new frequently asked questions (FAQs) that address the use of state-issued mobile driver’s licenses (mDLs) and other government-issued verifiable digital credentials, which may be used to verify identities of natural person customers under the Customer Identification Program (CIP) Rule.”

I will save you from having to read the FAQs.

Yes, the industry supports banking use of mDLs.

Banking use of mDLs is permitted.
Google Gemini.

Breach Reporting For Financial Institutions, Including Car Dealers

(Update: Statement from IDScan.net. You heard it here last.)

I’ve talked about breach reporting a lot…and expect to talk about it more over the next few days.

Car dealers

But who has to report?

The Federal Trade Commission (FTC) is one of many agencies that regulate financial institutions.

Including one type of financial institution that we normally don’t think of as such.

A limousine with tinted windows in which one passenger is barely visible.
An automobile. Google Gemini.

From the FTC:

“The FTC’s Safeguards Rule, which dates back to 2003, requires financial institutions to maintain safeguards to protect customer information. The FTC issued the Rule to implement the requirements of the Gramm-Leach-Bliley Act, and it applies to financial institutions subject to the FTC’s authority.”

Go on…

“That includes most automobile dealers who finance or lease automobiles.”

The safeguards

So what safeguards do car dealers need to implement?

His private information leaked. Did the leaker perform required breach reporting?
The leak. Google Gemini.
  • Maintain a comprehensive written information security program that covers the customer information, including unauthorized access to the information. The program must cover any third-party service providers that can access the customer information, including anyone who bought or sold the data.
  • Create a written security incident response and recovery plan so that when things go wrong, you are prepared.
  • Update your information security program as necessary.

Mechanics of breach reporting

The most visible part of the response and recovery plan is breach reporting in accordance with federal law and state law.

Breach reporting requires notification of affected consumers.
Notifications. Google Gemini.

I previously outlined California breach reporting requirements:

“Under California SB 446, a firm must notify affected California residents within 30 calendar days of discovering or being alerted to the breach.”

Other states have their own notification requirements.

The third-party effect

And here’s where it gets interesting.

For the last few days, I’ve been waiting for a particular identity verification provider to report a breach of over 153 million driver’s licenses and other data.

But that firm will be just one of many firms that will be reporting. Many if not all companies that provided data to this identity verification provider will ALSO have to report.

Third party risk management, illustrated by a locked safe connected to a breached safe.
TPRM. Imagen 3.

Good old third-party risk management in a high-risk breach.

Expect a flood of notifications, possibly very soon.

What should you say in advance of breach reporting?

But breach reporting is not enough. Your firm, whether it’s a car dealer, an identity verification provider, or someone else, needs to proactively communicate how you handle breaches. And communicate this long before a breach occurs.

Why? To give your customers reassurance that if a breach happens, you’ll handle it.

Have you developed:

  • the strategy to explain how you will handle PII breaches?
  • the tactics to write these explanations for your content and your proposals?

If you haven’t, bring on an experienced identity, privacy, and product marketing consultant to help you with your strategy and tactics.

John E. Bredehoft in Bredemarket’s worldwide corporate headquarters in Ontario, California.

Bring on Bredemarket.

And book a free appointment to assess your needs.

Feel free to reshare using the “Share this” buttons below.

Somewhat It Whys: The Intent of AI Agents

I missed a golden opportunity.

In mid-August I wrote the post “Beware, Amazon: Credit Has Been Extended Beyond Humans” that details how Mercury and Ramp are extending credit cards to non-human AI agents.

What could go wrong? Plenty. But there are ways to mitigate potential issues, as PYMNTS notes.

“A valid card credential may tell an issuer that an artificial intelligence agent can pay. It does not necessarily tell the issuer whether the AI agent should make this particular purchase.”

Ah, intent. Sounds like the “somewhat you why” test that I proposed for human identities.

Which gives me another excuse to hawk my book. Just remember that the book “Proving Humanity: The Six Factors of Identity Verification and Authentication” ONLY covers human identities.

For more information, click the image below.

Four pages from "Proving Humanity: The Six Factors of Identity Verification and Authentication" by John E. Bredehoft, Bredemarket. Click on the image to purchase.

American Firms No Longer Have to Report Beneficial Ownership

I promised Diana Wales that I was going to write about this, so I’d better get cracking.

Beneficial ownership

I’ve talked about beneficial ownership before and why it’s important. As I said while discussing the ownership of Hungarian firm FaceKom:

“De facto control without de jure control could very well be wielded by a powerful politician, or his son-in-law.”

And to make things juicier, FaceKom was acquired by another Hungarian firm (4iG Informatikai) with government links. Viktor Orbán has since left office, and I don’t know the current status of either firm.

Because of this, businesses throughout the world track beneficial ownership, and the U.S. Government is here to help.

U.S. firms no longer have to report

Well, it used to be.

“The U.S. Treasury Department announced on Tuesday (Aug. 11) that its Financial Crimes Enforcement Network (FinCEN) is permanently removing U.S. companies and U.S. persons from beneficial ownership reporting under the Corporate Transparency Act and will delete previously reported information. Foreign reporting companies remain subject to narrower requirements involving foreign beneficial owners.”

In essence, the idea is that U.S. companies don’t have to engage in beneficial ownership reporting because all U.S. owned companies are good and would never break the law. It’s only those foreign companies that do evil beneficial ownership disguises.

But financial entities are still responsible

Of course, this doesn’t only benefit the U.S. companies who are relieved of the reporting requirement. It also benefits financial firms who don’t have to worry about the beneficial ownership of U.S. owned companies because…oh wait…financial firms still have to worry.

“But eliminating a government reporting requirement does not eliminate the financial system’s need to understand corporate ownership. Banks, broker-dealers and other covered financial institutions remain subject to customer due diligence obligations designed precisely to prevent criminals from hiding behind legal entities. They must identify and verify beneficial owners in specified circumstances, understand customer relationships, build risk profiles and monitor for suspicious activity.”

So since there’s no central source of beneficial ownership information, the financial institutions must rely on alternate sources. Multiple alternate sources.

And the U.S. firms, breathing a sigh of relief from eliminating a government reporting requirement, will now have to submit reports to a myriad of private entities, and maybe some state authorities also. And if Texas demands that you file a beneficial ownership report, don’t mess with Texas.

Welcome to the world of efficiency.

And one more thing: how do we know that these U.S. owned companies AREN’T under foreign control?

A word from our (U.S. owned) sponsor

If your firm must explain its know your business processes to your own clients, perhaps you can take advantage of Bredemarket’s marketing and writing services.

Bredemarket: Services, Process, and Pricing.