ASC X9 Financial PKI gains traction ahead of DTCC deadlines

Adoption of the ASC X9 Financial PKI is rising ahead of DTCC certificate deadlines, with more than 1,900 organisations deploying, evaluating or testing the system, according to DigiCert.

DTCC now requires ASC X9 Financial PKI certificates for certain services that use mutually authenticated network connections. Testing environments must comply by the end of November, with production environments following by the end of December.

The requirement puts the industry-governed trust framework at the centre of a broader shift in how some financial institutions manage secure communications with counterparties, partners and service providers. DigiCert operates the infrastructure, while the framework was established and is governed by the Accredited Standards Committee X9.

Introduced in 2025, ASC X9 Financial PKI provides a common framework for organisations to authenticate each other and exchange information securely. It is designed to support trusted network connections independently of browser root programmes, which have traditionally underpinned many certificate models on the public internet.

Participation spans financial institutions, payment processors, technology providers and enterprises in sectors including manufacturing, healthcare, telecommunications and critical infrastructure, DigiCert said. The breadth of adoption suggests the framework is being considered not only by banks and market infrastructure providers, but also by companies connected to financial networks and supply chains.

The push comes amid changes to public TLS requirements that, DigiCert said, are narrowing the role of browser-trusted certificates in mutual authentication between servers. In that environment, private or industry-specific trust models can become more relevant where institutions need a shared way to verify each other outside the browser ecosystem.

ASC X9 Financial PKI uses a common trust anchor and policies tailored to financial services to support mutual TLS authentication without relying on browser root programmes. Mutual authentication is used when both sides of a network connection must prove their identity before exchanging data.

That is particularly relevant in financial markets, where firms exchange settlement instructions, payment messages and other sensitive operational traffic across institutional boundaries. A common certificate framework can reduce fragmentation when multiple organisations need to connect under shared security and identity rules.

"Financial institutions depend on secure connections that extend well beyond their own networks," said Dean Coclin, Senior Director of Industry Strategy at DigiCert.

"The growth in ASC X9 Financial PKI participation reflects demand for a common trust framework built around those relationships. DigiCert is helping organizations put that framework into practice as they prepare for DTCC's deadlines," Coclin said.

Industry framework

ASC X9 is the standards body behind the framework. Its role gives financial institutions and other participants a formal mechanism to influence the policies and requirements that shape the trust infrastructure.

That governance model may matter for institutions reluctant to rely solely on bilateral arrangements or public web trust mechanisms for business-critical machine-to-machine communications. An industry framework can offer a more consistent route to onboarding and interoperability, particularly when a market utility such as DTCC requires it for specific services.

"The ASC X9 Financial PKI was established to address a critical industry need for secure, interoperable communications between financial institutions and their partners," said Steve Stevens, Executive Director of ASC X9.

"DTCC's adoption demonstrates the value of a common, industry-governed trust framework. Through ASC X9, financial institutions and other stakeholders have a voice in shaping the policies and requirements that will allow the ASC X9 Financial PKI to evolve as technology and industry needs change," Stevens said.

DigiCert was selected by ASC X9 as a certificate authority to provide the managed PKI infrastructure and launched the production environment in 2025. As a result, organisations that need to comply with the DTCC requirement can obtain the relevant certificates through DigiCert.

For firms still preparing, the practical work includes identifying which connections are affected, installing the applicable trust chain and allowing enough time for testing before moving into production. The process can involve internal systems as well as links with third-party providers and external platforms.

One large bank pointed to the collective nature of the effort. "The financial sector has always advanced through a shared commitment to stability, trust and collective progress," said Sudha Iyer, Chief Officer for PKI and Cryptography at Citi.

"Critical infrastructure security delivers its greatest value when the entire ecosystem can participate, rather than only a select few institutions. ASC X9 Financial PKI provides a common foundation that enables banks, financial institutions and service providers to strengthen security, maintain interoperability and evolve together at a pace that supports long-term resilience and trust across the industry," Iyer said.