In an era where digital transformation is reshaping every aspect of our lives, international travel remains one of the last strongholds of physical documentation. The traditional passport has long been the cornerstone of cross-border movement, but while effective, passports are susceptible to loss, theft, and forgery. Moreover, the manual processes associated with physical document verification can lead to delays and inefficiencies at border crossings. The advent of Digital Travel Credentials (DTCs) promises to revolutionize this paradigm. By integrating biometric data and leveraging cryptographic algorithms, DTCs ensure that identity verification is both accurate and efficient. This digital documentation not only enhances security but also paves the way for a more streamlined and user-friendly travel experience.
The first Guiding Core Principles for the Development of Digital Travel Credential (DTC) were introduced by the ICAO in 2020. Five years later, the concept still feels like a glimpse into the future. In this article, we will look at why.
Understanding DTCs
DTCs are designed to serve as a digital alternative to traditional passports; they represent a person’s identity in electronic form and contain a secure dataset protected by advanced cryptographic techniques. According to ICAO’s core principles, DTCs must match the security level of electronic machine-readable travel documents (eMRTDs) and be verifiable via the issuing authority’s public key infrastructure. Today, verifying ePassports involves reading data from an embedded RFID chip, which stores information identical to what’s printed in the visual inspection zone, along with additional biometric details like fingerprints. Verification begins with Passive authentication, which checks the digital signature on the stored data to ensure it hasn’t been tampered with. Chip Authentication is used to confirm the chip’s authenticity and ensure the data is securely stored and accessed, and thus is protected against cloning or substitution.
The concept of DTC builds on existing security foundations by introducing a hybrid structure that combines a virtual component (DTC-VC) with a physical one (DTC-PC) to store it. The DTC-VC is a digitally signed file containing the traveler’s personal data, while the DTC-PC acts as the carrier for this virtual credential. In addition to leveraging strong cryptographic safeguards, DTCs mirror the data structure of RFID chips used in electronic passports, organizing identity details into standardized data groups for compatibility and consistency. Travelers can use the virtual component (DTC-VC) for online identity checks, while the physical component (DTC-PC) can be presented during in-person interactions, such as airport or border control procedures.
The three types of DTCs
There are three types of DTCs defined by the ICAO’s principles. Each of these types caters to different generation scenarios, use cases, and levels of digital integration.
- DTC Type 1 (eMRTD Bound): In this format, travelers can create a DTC-VC themselves by scanning the RFID chip embedded in their passport using a smartphone app or a self-service kiosk. This NFC verification confirms the authenticity of the physical document. Only after this step can the digital version be created and linked to the original passport, which remains the primary document.
- DTC Type 2 (eMRTD-PC Bound): With this type, both the digital credential and its physical component (DTC-PC) are issued by the passport-issuing authority. The virtual component is securely tied to both the digital medium and the holder’s physical passport, allowing for more flexible verification processes.
- DTC Type 3 (PC Bound): This fully digital solution is issued directly by the authority without the need for a traditional passport. Both the digital identity and its storage medium are generated and installed on a secure device, making it a standalone credential for identification and travel.
Why DTC is a game-changer
In 2024, ICAO published the High‐Level Guidance: Explaining the ICAO Digital Travel Credentials, an extensive document with deeper insights into the DTC concept, as well as its purpose and applications. According to this new guidance, DTCs are intended to enable more seamless and secure travel while contributing to creating a globally interoperable approach to identity verification. Below we are sharing major benefits that DTC can bring to travel and border-crossing operations:
Enhanced traveler experience
DTCs can enhance various stages of the travel process, starting from advance identity verification during travel booking or visa application. They integrate seamlessly with Advance Passenger Information (API) systems, which collect and transmit key biographic and travel document data to border control authorities before a traveler departs. This helps speed up pre-arrival screening and improves security while reducing friction at checkpoints.
In addition to API, DTCs are also compatible with processes like ticket purchases, check-in, and boarding. They can store multiple credentials on a single device, making them especially useful for group or family travel, such as parents storing digital IDs for their children.
In certain cases, a DTC Type 3 can also act as a temporary travel document for individuals who have lost their physical passport. Unlike standard QR codes, which often lack a photo and offer limited security, DTCs include a facial image, providing a more reliable and secure solution for emergency travel scenarios.
Pre-arrival verification
According to ICAO, one of the core advantages of DTCs is the ability for authorities to verify a traveler’s identity before they even arrive at their destination. This advance verification model offers significant benefits for both border officials and passengers.
For inspectors, it enables more effective pre-arrival screening using authenticated data, including biometric elements like a facial image stored in the DTC-VC. For travelers, it translates into quicker, smoother airport or border control procedures. Once the DTC-PC is presented, facial recognition is used to confirm the identity by matching it to the DTC-VC.
Airlines also stand to benefit from this technology. By enabling early validation of travel eligibility, DTCs help prevent inadmissible passengers from boarding. This reduces the risk of costly deportation fines, much like existing pre-clearance systems such as ESTA, but with improved interoperability and security.
Benefits for governments and authorities
Identity document issuing authorities are also likely to benefit from adopting DTCs. ICAO notes that the management of a DTC’s lifecycle does not have to mirror that of an eMRTD. This opens the door for DTCs to evolve into an independent and trustworthy alternative to traditional passports.
For issuing states, the benefits include more streamlined and potentially more cost-effective procedures for issuing, revoking, renewing, or canceling identity documents. For instance, if a DTC is reported lost, stolen, or canceled, authorities can promptly invalidate all associated DTC-VCs through national or international systems. In such cases, the eMRTD may still remain active, meaning travelers would continue with standard in-person verification until a new credential is issued.
Beyond border crossing
While DTCs are primarily intended for use in border control, their value extends well beyond aviation and immigration. They can be applied to a wide range of online identity verification scenarios. In such cases, only essential biographical details are shared with the service provider, safeguarding user privacy while still allowing for effective verification. For authorities and businesses, DTCs offer more than just access to machine-readable data; they also include the holder’s photograph, which is essential for biometric matching and security checks. This additional layer enables thorough cross-referencing with watchlists, including databases of politically exposed persons (PEPs) and individuals flagged for security reasons.
How DTC verification works
No matter the specific type or application of a DTC, verification hinges on cryptography—namely, a foundational concept known as the chain of trust. This cryptographic framework establishes a secure connection between the issuing authority and the verifier using a unique digital signature. Any unauthorized change to the DTC disrupts this chain, immediately flagging a potential compromise.
Step-by-step DTC verification
For travelers, the process of verifying DTCs is designed to be fast and user-friendly. This was demonstrated during the ICAO DTC-1 pilot project in the Netherlands, where passengers created their digital credentials through a mobile app and used them for boarding and border checks. Here’s how it works:
- The journey begins with travelers registering in the app prior to departure, completing both e-passport and facial recognition verification.
- This verified information is then securely distributed to all relevant stakeholders in the travel chain: airlines, immigration authorities, and security services, enabling thorough pre-arrival vetting.
- At the airport, passengers present themselves at the gate, where facial recognition is used to match their appearance with the data stored in the DTC.
- If the comparison succeeds, they are cleared for travel. In this pilot, verification revolves around passive authentication of the virtual component. This cryptographic check confirms the integrity and authenticity of the data without requiring access to the issuing authority in real time. While the project in the Netherlands did reveal some challenges around integration and interoperability between systems, it also showcased the transformative potential of DTCs in building a more secure, streamlined identity verification ecosystem. Since all personal data is digitally signed by an official authority, the information is pre-authenticated, accurate, and reliable.
The inclusion of biometric data, particularly a facial image, further strengthens the verification process, making it more resistant to fraud.
Current challenges and hurdles to wide DTC adoption
Enrolling in DTCs marks the third stage in the evolution of machine-readable travel documents (MRTDs). This progression began several decades ago with traditional non-biometric documents and advances toward DTC Type 3—a fully digital identity securely stored on a personal smart device. Despite this forward-looking vision, many countries are still in the early phases of widespread biometric passport issuance. This hinders global DTC adoption. Moreover, there are other significant challenges that must be addressed.
Need for consistent global standards
While ICAO has published documentation detailing the technical foundations for DTC development (such as the Technical Report on the Virtual Component Data Structure and PKI mechanisms), the overall framework is still work in progress. So far, only DTC Type 1 has undergone real-world testing. As more pilot implementations emerge, challenges related to interoperability and security may arise, highlighting the need for continued evaluation by ICAO’s Technical Advisory Group.
In the absence of a universally accepted standard, the rollout of DTCs remains largely confined to bilateral or regional agreements between countries and airlines operating under their own local protocols.
Infrastructure limitations
Widespread adoption of DTCs hinges on significant infrastructure upgrades across all stages of the traveler journey, including both hardware and software systems. One example that would illustrate this would involve the deployment of e-gates equipped with biometric cameras to ensure identity verification software can function smoothly and reliably. In practice, most airports are not equipped for passport-free processing, and many issuing authorities face ongoing challenges in transitioning to newer digital identity formats.
Privacy and security concerns
Entities such as mobile operating system providers, which serve as platforms for storing DTCs in digital wallets, could potentially access sensitive personal data from users worldwide. This raises serious privacy concerns. The threat of large-scale data breaches or unauthorized data use poses significant national security risks. As a result, many governments are reevaluating how DTCs should be implemented. To build trust, future frameworks must prioritize user control, ensuring that individuals remain active participants in managing the issuance and use of their digital travel credentials.
The future of DTCs
ICAO’s guidelines make it clear that states currently issuing e-passports are not required to adopt DTCs unless they actively choose to do so. As a result, the rollout of DTCs is expected to be gradual and based on individual country readiness and priorities.
Of the three DTC types, Type 1 (which is bound to an existing eMRTD) is the most feasible in the near term due to its relative simplicity and ease of implementation. In contrast, Type 2, which links both the DTC and the eMRTD to a new physical component, is still several years away from mainstream adoption. As for Type 3, the fully digital version with no dependency on a physical passport, widespread use is not anticipated until later in the next decade.
Traditional passports will continue to serve as the most universally accepted and trusted form of identity verification for international travel. DTCs signal a future where identity verification is instant, secure, and fully mobile. While their roots lie in aviation, the potential applications go far beyond border control. Financial institutions, for instance, can leverage DTCs to streamline customer onboarding while significantly reducing fraud. Governments may use them to simplify access to public services, and telecom providers can adopt them to ensure secure, seamless SIM provisioning. In healthcare, DTCs could enable reliable identity verification for telemedicine, enhancing both patient safety and data security.
The success of DTCs depends on more than just technological innovation. It requires global interoperability, robust privacy protections, and a secure-by-design approach that earns public trust at every step. While DTCs remain in the early stages of adoption, solutions like Regula’s NFC-based verification technology are already equipped to support electronic identity documents across all DTC formats. This might be a practical bridge between current systems and the digital credentials of tomorrow.
As an ICAO TV sponsor, Regula has contributed valuable insights to the global aviation community through a series of expert video segments. These videos explore topics such as identity verification, digital transformation at borders, and the future of secure travel—all aligned with ICAO’s mission to enhance aviation security and facilitation. By sharing their expertise on this international platform, Regula continues to support the advancement of secure, efficient, and technology-driven processes across the air transport sector. You can explore their contributions on the ICAO TV platform.
About the contributor
Regula is a global developer of forensic devices and identity verification solutions. With 30+ years of experience in forensic research and the most comprehensive library of document templates in the world, we create breakthrough technologies for document and biometric verification. Our hardware and software solutions allow over 1,000 organizations and 80 border control authorities globally to provide top-notch client service without compromising safety, security or speed.
Regula was repeatedly named a Representative Vendor in Gartner® Market Guide for Identity Verification.