Verifiable Credential

A verifiable credential is a set of claims about a person, organisation or thing, such as a name, a date of birth, a licence or a company registration, that has been digitally signed by its issuer in a standard format. Anyone to whom the credential is presented can check cryptographically that it was issued by the stated issuer, that it has not been altered and, where the system supports it, that it has not been revoked.

The concept is standardised by the World Wide Web Consortium (W3C), whose Verifiable Credentials Data Model was first published as a formal recommendation in 2019 and revised as version 2.0 in 2025. Verifiable credentials are a building block of decentralised identity and are often used with a decentralized identifier (DID), though they do not require a blockchain. In finance, they are being adopted as a way to reuse the results of identity checks.

The model has three roles. The issuer makes claims about a subject and signs them; examples are a government issuing an identity document, a university issuing a degree or a bank attesting that it has verified a customer. The holder, usually the subject, stores the credential in a digital wallet under their own control. The verifier is the party that needs to rely on the claims, such as a bank opening an account.

When asked, the holder creates a verifiable presentation containing one or more credentials, or parts of them, and sends it to the verifier. The verifier checks the issuer's digital signature against the issuer's public key, which it finds through a trusted registry or the issuer's published identifier, and checks the credential's status and expiry. The issuer is not contacted during this exchange and need not learn where the credential is being used. This differs from federated login systems, in which the identity provider is involved in every transaction.

• Standard data formats. The W3C model expresses credentials as structured data secured with a cryptographic proof. Related formats in use include selective-disclosure tokens developed at the Internet Engineering Task Force and the ISO mobile driving licence standard. The variety of formats is a practical obstacle to interoperability.
• Selective disclosure. Some signature schemes let a holder reveal only chosen claims from a credential. With a zero-knowledge proof, a holder can prove a statement, such as being over 18, without revealing the underlying data.
• Revocation. Issuers publish status information, typically as a compact list, so that verifiers can see whether a credential has been withdrawn without identifying the individual holder to the issuer.
• Holder binding. A credential is tied to a cryptographic key or identifier controlled by the holder, so that a copied credential cannot be presented by someone else.

The most discussed application is customer onboarding. Under know your customer rules, each institution verifies a new customer's identity separately, repeating work already done elsewhere. A credential issued by a government or by a regulated firm could be presented to other institutions, allowing digital identity verification without sending copies of documents each time. Whether a firm may rely on another's check, and who is liable if it is wrong, depends on local anti-money laundering law and not on the technology.

For companies, the organisation that oversees the legal entity identifier system has developed a verifiable form of the identifier, which lets a business and its authorised representatives prove their identity and roles digitally. This is relevant to know your business checks, signing of regulatory filings and beneficial ownership verification.

In digital asset markets, credentials are used to show that a wallet belongs to a verified or eligible investor without publishing personal data on a public ledger. A token issuer can require a valid credential before an address is added through token allowlisting, and proposals for compliance in decentralised finance rely on the same idea.

The European Union's revised electronic identification regulation, known as eIDAS 2, entered into force in 2024. It requires member states to offer citizens and residents a European Digital Identity Wallet that can hold identity data and attested attributes such as qualifications, and it obliges banks and other regulated sectors to accept the wallet where strong authentication of users is required. Other countries have built comparable systems around mobile driving licences or national digital identity schemes, and international work continues on making credentials recognisable across borders.

A credential is only as reliable as its issuer. Cryptography proves who signed a claim, not that the claim is true, so verifiers still need rules, often called a trust framework, defining which issuers they accept and for what purposes. Other open issues include the recovery of credentials when a device is lost, the risk that holders are pressed to disclose more data than a transaction needs, the possibility of tracking through repeated use of the same identifiers, and exclusion of people without suitable devices. Adoption also faces a coordination problem: issuers, wallets and verifiers each gain little until the others are in place.

• W3C: Verifiable Credentials Data Model v2.0
• Global Legal Entity Identifier Foundation (GLEIF)