Public Key Infrastructure (PKI)

What is PKI?

Public Key Infrastructure (PKI) is a comprehensive framework comprising technologies, policies, processes, and trusted entities, all designed to manage public-key cryptography and digital certificates. By linking an identity to a cryptographic public key, PKI enables systems to establish trust before securely sharing information.

The framework commonly includes Certificate Authorities (CAs), Registration Authorities (RAs), certificate repositories, certificate management processes, and policies governing how certificates are issued and maintained. X.509 certificates serve as the recognized standard for a wide range of internet public key infrastructure applications.

This structure matters because encryption alone does not establish trust. PKI integrates cryptographic safeguards with systems for verifying digital identities.

How Does Public Key Infrastructure Work?

Public Key Infrastructure is built on the principles of asymmetric cryptography, which involves a pair of mathematically linked public and private keys.

The public key can be freely shared, but it’s crucial to keep the private key secure. Depending on the specific cryptographic scheme and its intended use, public and private keys can facilitate encryption, authentication, or digital signatures. For instance, in TLS, a certificate allows a client to verify a server’s identity before any secure communication begins. Following this, the TLS handshake sets up session keys that enable encrypted exchanges.

A simplified PKI process looks like this:

• An organization or system generates a cryptographic key pair.
• A Certificate Authority verifies the identity or domain in question and provides a certificate.
• This certificate associates the identity with the public key and is digitally signed by the Certificate Authority (CA).
• A connecting system validates the certificate and its trust chain.
• The systems establish authenticated and encrypted communication.
• The certificate is renewed, replaced, or revoked as part of its lifecycle.

As a result, PKI creates a well-organized chain of trust that underpins authentication and ensures secure communication during the entire lifecycle of certificates.

Consider a banking API that exchanges customer information with an external verification provider. The provider’s certificate allows the bank’s system to authenticate the intended service, while TLS protects information exchanged during the connection. The PKI layer does not determine whether the customer is high risk. Instead, it helps establish trust in the systems carrying the information used for that assessment.

What Is a PKI Certificate?

A PKI certificate serves as a digital credential that connects an individual’s identity to a public key. It can identify a website, server, device, user, or service, depending on its intended purpose.

An X.509 certificate typically includes essential information such as the subject, the associated public key, the validity period, the issuer’s details, and the issuer’s digital signature. A receiving system uses this information, together with its trust configuration and certificate validation rules, to determine whether the certificate can be trusted.

Certificate management has also become more operationally demanding. The CA/Browser Forum has adopted a schedule that reduces the maximum validity period for publicly trusted TLS subscriber certificates from 398 days to 200 days on March 15, 2026; to 100 days on March 15, 2027; and to 47 days on March 15, 2029.

Shorter certificate validity periods therefore increase the operational need for automated certificate discovery, renewal, and lifecycle management, particularly in large, distributed environments.

Why Is Public Key Infrastructure Important for Financial Institutions?

Financial institutions share sensitive customer, payment, and operational data on websites, APIs, apps, internal systems, and connected devices. PKI helps protect these communication channels while establishing the identity of participating systems.

Common applications include:

• TLS protection for banking and payment websites
• Digital signatures for documents and software
• Secure email and enterprise communications
• Device and machine authentication
• VPN and network access
• Mutual TLS for service-to-service communication
• Protection of APIs and internal applications

FinCEN has emphasized that robust customer identity processes are foundational to financial institutions’ AML/CFT programs and has highlighted the potential for digital identity innovations to strengthen AML/CFT compliance.

PKI is therefore complementary to KYC and AML controls. It protects the digital infrastructure through which customer and compliance information is exchanged, while AML controls assess the risk of financial crime.

What Is Hosted Public Key Infrastructure?

Hosted public key infrastructure refers to public key infrastructure services that are not run or managed within an organization’s infrastructure.

The hosted model can help reduce the burden of certificate authority infrastructure, deployment, renewal, and life-cycle management. It can be especially applicable for organizations deploying certificates to applications and APIs across cloud environments and distributed devices.

External operation does not remove the need for governance. Financial institutions should assess access controls, key protection, audit capabilities, service resilience, data handling, and the provider’s responsibilities before adopting hosted PKI.

How Does PKI Support AML and KYC Operations?

PKI can support AML and KYC operations in which sensitive identity and compliance information must move securely among customers, verification providers, financial institutions, and internal systems.

PKI can help authenticate systems and protect data exchanged between identity verification services, compliance platforms, financial institutions, and customers. This becomes especially relevant as remote onboarding and API-based financial services expand. FATF guidance recognizes that reliable digital identity systems can support customer due diligence when applied through a risk-based approach.

AML Watcher operates on the financial crime intelligence layer, supporting screening across sanctions, PEPs, watchlists, adverse media, and international leaks. PKI can sit alongside these controls by supporting the secure digital infrastructure through which compliance information is exchanged.

Strengthen the Security Behind AML Compliance

When secure digital infrastructure is paired with reliable financial crime intelligence, financial institutions can build a stronger foundation for customer risk assessment. AML Watcher supports this intelligence layer with screening across sanctions, PEPs, watchlists, adverse media, and international leaks.

Request a Demo to explore how AML Watcher can support financial crime screening and risk assessment.