ICAO Digital Travel Credentials (DTCs): How They Work

Digital Travel Credentials (DTCs) are digital representations of travelers' identities that can serve as companions or alternatives to physical passports. 

To develop the DTC concept, ICAO built on the existing RFID-based verification technology used in electronic machine-readable travel documents (eMRTDs), such as biometric passports. This technology allows authorities to verify that identity data comes from a trusted issuer and hasn’t been altered. 

The DTC concept builds on these mechanisms, offering a hybrid approach that includes both physical and virtual components:

• DTC Virtual Component (DTC-VC): A cryptographically secured file containing the holder's digital identity

• DTC Physical Component (DTC-PC): A physical authenticator linked to the DTC-VC. Depending on the DTC type, this can be the original ePassport or a separate device

The holder can use their DTC-VC for remote identity verification and present their DTC-PC in person, such as at a border crossing or airport checkpoint.

ICAO defines three types of DTCs based on how they are created and linked to physical travel documents. The main difference is whether the credential depends on an existing ePassport and what serves as its physical authenticator.

DTC Type 1 is derived from an existing electronic passport. Travelers can create the virtual component themselves, completing NFC verification with an NFC-enabled smartphone or a self-service kiosk. The DTC-VC contains digitally signed data from the original document, while the ePassport itself serves as the physical component. 

DTC Type 1 is the most mature of the three models, with established technical specifications and real-world pilot implementations. With it, travelers must continue carrying their physical passports.

DTC Type 2 is also based on an existing ePassport, but the credential is issued by the travel document issuing authority.

The authority generates the DTC-VC and cryptographically links it to a separate DTC-PC. The credential shares the same passport number as the underlying ePassport, which can also serve as a physical authenticator or backup.

DTC Type 3 is issued directly by a travel document issuing authority. The authority generates and digitally signs the DTC-VC, linking it to a separate physical authenticator, such as a compatible smartphone or smart card. Unlike Types 1 and 2, this model doesn’t depend on an existing ePassport.

In its 2024 guidance on DTCs, ICAO describes the technology as a way to make international travel more seamless while maintaining the security standards of electronic passports. They also serve as a solution for states “seeking to deploy a digital companion and/or digital alternative to physical passports.”

DTCs can be used at several stages of the traveler journey, including:

• Identification and authentication in travel apps — providing advance passenger information (API) 

• Buying tickets

• Check-in and boarding through passenger name record (PNR) information

• Border crossing

Additionally, DTC Type 3 can serve as an emergency travel document for citizens who lose their physical travel documents, so that they can return home or reach a location where a new document can be issued. QR codes or Data Matrix codes, currently used for this purpose, lack the holder’s photo, making them less secure compared to DTCs.

From ICAO’s perspective, the key feature of DTCs is that authorities can verify a traveler before the traveler arrives at a checkpoint.

For border authorities, this means more time for pre-arrival screening and potentially fewer document checks on arrival.

Airlines could also benefit from earlier identification of passengers who lack the documents or permissions required for their journey. This could help prevent boarding-related compliance issues and reduce the risk of penalties associated with transporting inadmissible passengers.

Travelers can complete airport or border formal procedures faster and more seamlessly. After presenting their DTC‐PC, they are matched to the DTC-VC using facial recognition technology. Multiple DTCs can also be stored on a single physical device. A parent could carry digital IDs for their children, making them convenient for family or group travel. 

Although DTCs are primarily designed for border processing, potentially, they could also support identity verification in other industries. For example, businesses could use cryptographically verified identity data from a DTC to check customer details or compare the credential's facial image with a live selfie. However, such applications are currently outside the scope of ICAO's DTC framework and would require appropriate verification processes and data protection safeguards.

DTC verification relies on the same chain of trust used for electronic passports. This cryptographic framework links DTCs to the issuing authority and the verifier through a unique digital signature. If the DTCs are altered, the chain of trust is broken, signaling a potential issue. 

The verifier must ensure both the authenticity and integrity of the DTCs using the issuer’s digital signature as a trust anchor. The process is similar to Passive Authentication during RFID chip verification, where Document Signer (DS) and Country Signing Certificate Authority (CSCA) certificates are involved.    

For travelers, the process can be relatively simple. One example is the DTC-1 pilot in the Netherlands, which tested how digital credentials could support airport and border procedures.

Here's how it worked:

1. Before departure: Participants used a mobile app to read their ePassport chip and complete selfie verification, generating their DTC.

2. Pre-arrival checks: The credential data was shared with participating airlines and border authorities for advance processing.

3. At the airport: Passengers with DTCs used a quick facial recognition check at the gate. The scanned image was matched with the DTC data

4. After verification: Passengers who passed the checks could proceed to their destination.

The pilot concluded in March 2024. According to the final evaluation report, the pilot recorded 113 successful border crossings, with an average processing time of 14.3 seconds. The Netherlands is now preparing a second DTC Type 1 pilot. According to an October 2026 government announcement, the new trial is expected to run from mid-2027 through the end of 2028.

Despite successful pilots and progress in standardization, several challenges still need to be addressed before DTCs can become a widely accepted alternative to physical travel documents.

ICAO has established the technical foundations for DTCs, but development is still ongoing, particularly for the physical components of Types 2 and 3. Implementations must also work across countries, issuing authorities, and verification systems.

Technical compatibility alone isn't enough. Countries need legal frameworks that recognize digital credentials and establish when they can be accepted for international travel.

The European Union is working to address these issues through its proposed digital travel framework, with the EU Digital Travel application currently expected to become operational by the end of 2030.

DTC adoption requires coordination between passport-issuing authorities, airlines, airports, and border control agencies. This involves upgrading both hardware and software. 

For instance, e-gates with biometric cameras and robust identity verification software must operate seamlessly. However, most airports lack passport-free gates, and many passport-issuing authorities struggle to adopt new digital identity formats.

DTCs contain sensitive personal information, including the holder's facial image. Although digital signatures protect data integrity and authenticity, they don't prevent unauthorized access, misuse, or data breaches. The risks of massive data breaches and illegitimate data use are pushing states to reconsider DTC implementation approaches.

Another challenge is data minimization. ICAO allows individual data groups to be shared separately while preserving their cryptographic verifiability. For example, an airline may receive a passenger’s MRZ data without their facial image. However, individual fields within a data group cannot be selectively disclosed. Such reduced datasets are treated as verifiable micro-credentials rather than full DTCs.

For DTC Types 2 and 3, smartphones are among the possible physical authenticators. Supporting these credentials requires secure storage, access controls, and compatible methods for communicating with verification systems.

Mobile platforms have made progress in this area. For example, Apple has expanded its NFC & Secure Element capabilities to support government IDs in eligible markets. However, this doesn't automatically mean that every mobile device can function as an ICAO-compliant DTC-PC.

The remaining challenge is ensuring that the chosen credential and authentication mechanisms work reliably across devices, operating systems, and verification infrastructure.

DTCs have proven viable in real-world pilots, but widespread adoption still depends on international recognition, compatible infrastructure, and clear rules for their use. For now, physical passports remain essential, and both formats are likely to coexist for some time.

Regula Document Reader SDK already supports DTC processing, including the generation of DTC virtual components and the processing of existing DTC credentials. Organizations can use these capabilities to explore digital travel document verification while continuing to support conventional ePassports.

For technical details, see the Regula Document Reader SDK documentation on DTCs.