Stakeholder Letter - Consultation on the Regulation of Digital Identity Service Provider Business (2026-08-26)

Summary

This is a stakeholder letter from the Bermuda Monetary Authority summarising feedback on its 2025 consultation paper proposing a standalone prudential licensing regime for Digital Identity Service Provider (DISP) business, and announcing a change in policy direction. Rather than creating a new licensing regime, the Authority will instead pursue targeted enhancements to Bermuda's existing AML/ATF framework to address the use of digital identification solutions in customer due diligence.

• No standalone DISP licence: The Authority has decided not to proceed with a standalone prudential licensing regime for digital identity providers, citing limited evidence of a sustainable domestic market and early-stage international interoperability standards.
• AML/ATF guidance instead: The Authority will conduct a targeted review of the existing AML/ATF framework and develop supervisory guidance on the use of digital identification solutions for customer due diligence purposes.
• Guidance scope: Planned guidance will cover digital onboarding and identification/verification requirements, reliability/independence/assurance assessments, assessment of foreign digital identity frameworks, record-keeping expectations, and ongoing digital identity lifecycle considerations.
• Principles-based approach: RFIs will remain responsible for determining whether a digital identification solution is sufficiently reliable, independent and appropriate given the relevant risks, consistent with Bermuda's existing risk-based framework.
• Further consultation: The Authority intends to consult further where appropriate before finalising supervisory guidance, and will continue monitoring international digital identity developments.

This letter is purely informational and does not itself impose new binding requirements; it signals that future supervisory guidance under the AML/ATF framework, rather than a new licensing regime, will govern the use of digital identity solutions. Stakeholders wishing to provide further input can contact the Authority at policy@bma.bm.

Applies to

Regulated Financial Institutions (RFIs), Digital Identity Service Providers (prospective, not currently regulated)