BIMI for Banks and Fintechs: How a Verified Inbox Logo Helps Against Phishing

By Yamm Labs · Updated October 2026 · 12 min read

A customer opens Gmail on her phone and sees two emails about her credit card. One says her statement is ready. The other says her card is blocked and asks her to “verify KYC” through a link. Both show the bank’s name in the sender line, and both have a grey circle with a letter where a logo would go. She has no quick way to tell them apart, and the fraud team will hear about it next week. BIMI for banks exists to fix the second half of that problem: the real email carries the bank’s verified logo, and the fake one cannot.

What is BIMI for banks and fintechs?

BIMI is an email standard that puts a brand’s logo in the inbox next to messages that pass authentication. The BIMI Group, the industry working group behind the standard, describes the setup in four pieces: DMARC at enforcement, a logo in a format called SVG Tiny PS, an optional but recommended mark certificate, and a DNS record that points to the logo and certificate.

For a bank or fintech, the definition that matters is narrower. BIMI is a reward for having locked down who can send email as your domain. Mailbox providers show the logo only after your domain tells them to quarantine or reject mail that fails authentication. So the project your compliance and IT teams will spend most of their time on is DMARC, and the logo is the thing marketing gets to show the board at the end.

Three terms come up in every BIMI conversation, so define them once. SPF (Sender Policy Framework) lists the servers allowed to send for your domain. DKIM (DomainKeys Identified Mail) signs each message so the receiver can check it was not altered. DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receivers what to do when a message fails both checks, and sends you reports about who is sending as you.

Why does BIMI matter for a regulated financial brand?

BIMI for banks and fintechs matters because their customers are the people phishers copy most, and the inbox is where the copy meets the customer. A regulated brand also carries a duty that a retailer does not: customers act on its emails with money, KYC documents and one-time passwords.

Look at what each team gets from it. The fraud team gets DMARC at enforcement, which tells Gmail, Yahoo and other receivers that honour DMARC to quarantine or reject mail that pretends to come from your exact domain. The CRM team gets a logo that appears on every authenticated statement, renewal reminder and newsletter, which makes the real email easier to recognise. The brand team gets a consistent mark in a place where most banks show a coloured initial.

The rules around financial promotion add a second reason. IRDAI’s 2024 policyholder-protection regulations require an insurer’s advertisements to show its registered name together with its trade name or logo, prominently. A verified logo in the inbox does not satisfy that rule by itself, because the email body still has to carry the registered name. It does mean the mark a customer sees in the inbox and the mark inside the email are the same approved artwork, which is one less thing for your compliance reviewer to query.

BIMI is also a deliverability project in disguise. Google’s sender guidelines, in force since February 2024, require anyone sending more than 5,000 messages a day to Gmail accounts to set up SPF, DKIM and DMARC. Those rules accept a DMARC policy of none. BIMI does not. The gap between “compliant with Gmail” and “eligible for a logo” is where most of the BIMI work sits.

SIGNALNewsletter by Yamm Labs

The next piece, straight to your inbox.

New writing on BFSI brands, B2B and influencer marketing, and AI search.

Email *

Subscribe

Subscription form is not available at the moment

One click to unsubscribe. Privacy policy

How does BIMI work? The four parts a bank has to get right

BIMI works when four parts line up: an enforced DMARC policy, a logo file in the right format, a mark certificate that proves you own the logo, and a DNS record that ties them together. Each mailbox provider then runs its own checks before it shows anything.

1. DMARC at enforcement. The BIMI Group’s implementation guide says DMARC must be at quarantine or reject on the organisational domain and its subdomains, with the policy applied to 100 percent of mail. Google’s BIMI page says the same for Gmail: p=quarantine or p=reject, and pct=100. A policy of none, or a partial percentage, means no logo.
2. The logo as SVG Tiny PS. This is a restricted version of the SVG vector format. Google asks for a square logo with a solid background, a minimum of 96 by 96 pixels in absolute dimensions, and recommends keeping the file at 32 KB or less. Your brand guidelines probably contain a horizontal lockup with a wordmark; the inbox needs the symbol alone, centred in a square that survives being cropped to a circle.
3. A mark certificate. A Verified Mark Certificate (VMC) proves the logo is a registered trademark you own. A Common Mark Certificate (CMC) covers logos that are not registered, based on a history of use. Google accepts either for Gmail and recommends the VMC. Gmail shows a blue checkmark only for VMC senders. The BIMI Group lists DigiCert, GlobalSign and SSL.com as mark certificate issuers, and notes that being on its list does not guarantee a mailbox provider will honour a certificate.
4. The BIMI DNS record. A TXT record at default._bimi on your sending domain, written as v=BIMI1, then an l= tag with the HTTPS address of the SVG and an a= tag with the address of the certificate file. Google notes that Gmail reads the logo from the certificate file, so the certificate and the SVG must match.

The mailbox providers then decide. Yahoo’s sender FAQ says it shows a logo when the record points to a valid SVG, DMARC is at quarantine or reject, the mail is bulk mail and Yahoo sees enough reputation and engagement for the sender. Apple says Apple Mail on iOS 16, iPadOS 16 and macOS Ventura or later shows the logo when the receiving mail provider has verified a BIMI evidence document such as a VMC and added the required headers. The BIMI Group lists Microsoft as not supporting BIMI, which matters if your customers read email in Outlook.

Use the table below to pick the route. The criteria are what you need, where the logo shows, and whether a checkmark appears, as each provider’s own page states them in October 2026.

For Indian brands the trademark question is simpler than many teams expect. Sectigo, one of the certificate authorities, publishes the trademark offices it accepts for VMC validation, and Intellectual Property India is on that list. Gulf brands should check more carefully: the UAE and Saudi offices do not appear on that published list, so a Dubai or Riyadh fintech may need a registration in an accepted office, or a CMC. Ask your chosen issuer before you file anything.

How should a bank or fintech start with BIMI?

Rolling out BIMI for banks starts with a list of every system that sends email as your domain, because DMARC enforcement will block the ones you forget. In a bank, that list is longer than the marketing team thinks.

1. Map the senders. Card statements, loan EMI reminders, the CRM platform, the newsletter tool, the HR system, the branch locator’s form mailer, a collections agency and the OTP vendor’s email fallback can all send as your domain. Turn on DMARC with p=none and a reporting address, and let the aggregate reports show you every source for a few weeks.
2. Fix alignment one sender at a time. Each legitimate sender needs SPF or DKIM that aligns with your domain. Move high-volume marketing to its own subdomain, such as news.example.com, if your email provider supports it, so a newsletter problem never touches statements.
3. Move to quarantine, then reject. Raise the policy in steps and watch the reports between steps. BIMI needs quarantine or reject at 100 percent before any logo appears.
4. Prepare the logo. Brief your designer for a square symbol in SVG Tiny PS with a solid background, tested at small sizes and inside a circle mask. Our piece on fintech logo design mistakes covers why thin strokes and long wordmarks fail at this size.
5. Check the trademark and order the certificate. Confirm the exact registered artwork matches the SVG. Google’s BIMI page warns that registering a trademark can take 6 to 12 months, so start this step in the first week, not the last.
6. Publish and test. Add the default._bimi record, run the BIMI Group’s BIMI Inspector, which checks the record format and that DMARC is at enforcement, then send to test inboxes in Gmail, Yahoo and Apple Mail and screenshot the results for your file.

Two owners make this go faster. Name one person in IT who owns the DMARC policy and one in marketing who owns the logo and certificate, and give both the same weekly review of the DMARC reports. When those two jobs sit with the same agency or the same vendor, the trademark step tends to wait until the DNS work is done.

Which consent and deliverability decisions sit beside BIMI?

A verified logo makes your email more recognisable, so every email carrying it has to be one the customer agreed to and can easily stop. Our guide to email marketing for financial services covers the wider programme. Four decisions belong in the same project file as the BIMI record.

How the sign-up form asks for consent. India’s Digital Personal Data Protection Act, 2023 bases processing on consent given through a clear affirmative action, and expects withdrawing consent to be as easy as giving it; the DPDP Rules, 2025 phase in the detailed notice requirements. Europe’s GDPR also expects consent to be a clear, opt-in action, and the US CAN-SPAM rules expect a working opt-out and a postal address in commercial email. In practice, that means an unticked box for the email newsletter, kept separate from the box that accepts account terms, with one sentence saying what you will send and how often.

Where the unsubscribe sits. Google’s sender guidelines require bulk senders to support one-click unsubscribe in marketing and subscribed messages. Put a visible unsubscribe link at the top of the footer as well, in the same type size as the body text. Statements and transaction alerts are service messages, so keep them on a different stream from the newsletter, and the unsubscribe on one never stops the other.

Sender authentication per stream. Give statements, alerts and marketing their own subdomains under the same organisational domain, each with aligned DKIM. One BIMI record can cover them, and a spam complaint spike on marketing does not drag down the reputation of OTP and statement mail. Google asks bulk senders to keep reported spam rates below 0.30 percent and aims for under 0.10 percent.

The disclaimer a financial newsletter carries. A mutual fund newsletter that promotes a scheme should carry SEBI’s standard warning, “Mutual Fund investments are subject to market risks, read all scheme related documents carefully”, in legible type. An insurer’s newsletter carries its registered name with the logo. A lending newsletter that quotes a rate should link to the product page with the full terms, and those terms should match the Key Facts Statement that RBI requires lenders to give borrowers before they sign. This is general guidance, not legal advice; your compliance team decides.

How do you measure whether BIMI is working?

Measure BIMI in two layers: whether the authentication behind it holds, and whether customers and the fraud team see a difference. Open rates are a weak test, because Apple’s Mail Privacy Protection hides when a message is really opened, so lead with authentication numbers.

• DMARC pass rate by source. Messages that pass DMARC divided by all messages claiming your domain, split by sending source. It shows whether a vendor has broken alignment before customers notice.
• Volume at enforcement. Share of your sending domains and subdomains at quarantine or reject, against the total. Below 100 percent, some mail is still easy to spoof.
• Spoofing blocked. Messages from sources you do not recognise that failed DMARC, per week. A rising count with no customer complaints is the system working.
• Logo display check. A monthly screenshot from test accounts in Gmail, Yahoo and Apple Mail, kept with the date. Certificates expire, and a missing logo is often the first sign.
• Phishing reports from customers. Tickets and emails to your report-phishing address that mention email lookalikes, before and after enforcement. The number is noisy, so compare quarters, not weeks.

Report these to finance as risk numbers. The useful sentence for a CFO is how much mail now carries a verified mark, how many spoofing attempts receivers rejected, and what the certificate costs each year. Do not promise a lift in open rate or revenue; nothing published by the mailbox providers supports one.

What goes wrong with BIMI, and what are the early signs?

Most BIMI failures trace back to DMARC, the logo file or the certificate, and each one gives a warning before it hurts. The table pairs the failure with the signal you will see first.

One failure does not show up in any report. BIMI only marks mail from your own domain. A phisher who registers a lookalike domain sends mail that passes its own DMARC, without your logo. Customers notice the missing mark only if you teach them to expect it, so put a line in your statement emails and security page that tells customers what genuine emails from you look like.

A verified logo in the inbox is the receipt for DMARC work done; buy the certificate last, after enforcement holds.

When is BIMI the wrong choice?

BIMI is the wrong first project when your domain is far from DMARC enforcement, when your readers sit mostly in Outlook, or when your logo is about to change. In each case the money and attention do more good somewhere else first.

A B2B fintech selling to bank treasury teams and CFOs should check where its buyers read email. If most of them use Microsoft Outlook, which the BIMI Group lists as not supporting BIMI, the logo will be seen by few of the people who sign contracts. DMARC enforcement still protects your domain, so do that part and park the certificate. Our article on B2B fintech positioning for the CFO covers what those buyers do read.

A bank with dozens of unmapped senders should spend the first quarter on DMARC reports, not on a certificate. Buying a VMC before enforcement means paying for a certificate that cannot display. A brand mid-rebrand should wait for the new mark to be registered, because the VMC certifies a specific image and a new symbol means a new certificate. And if your customers mainly hear from you over SMS, WhatsApp or the app, the same budget may do more in those channels, with email authentication as the baseline.

The test is simple. If you can say yes to three questions (all senders mapped, DMARC at quarantine or reject at 100 percent, a registered logo that matches today’s brand), BIMI is a small final step. If any answer is no, that answer is the project.

People also ask

Does BIMI stop phishing emails on its own?

No. BIMI displays a logo; the protection comes from the DMARC enforcement it requires, which tells receivers to quarantine or reject mail that fakes your exact domain. Lookalike domains still get through, so customer education stays part of the plan.

Do Indian banks need a trademark for BIMI?

For a Verified Mark Certificate and Gmail’s blue checkmark, yes: the logo must be a registered trademark at an office the issuer accepts, and Sectigo’s published list includes Intellectual Property India. Without a registration, a Common Mark Certificate based on prior use can still put the logo in Gmail, without the checkmark.

Which email apps show BIMI logos?

The BIMI Group lists Google, Yahoo, Apple, Fastmail and Zoho Mail among the providers that support BIMI, and lists Microsoft as not supporting it. Each provider applies its own conditions, so test in each one and keep screenshots.

How long does BIMI take to set up for a bank?

The DNS record takes minutes; the work before it takes longer. DMARC enforcement depends on how many senders you have to fix, and Google notes that registering a trademark can take 6 to 12 months, so a bank without a registered mark should plan for the longer end.