Know Your Customer: improved security, customer convenience and efficiency
New digital IDs offer a host of benefits
Over the last few years, many financial service providers have had to create entire new departments to comply with 'Know Your Customer' requirements. As well as being expensive and time-consuming for service providers, essential KYC checks can be annoying for customers, who have to share personal information with a succession of different service personnel. Surely there must be a better way?
Public trust in the financial system depends on the integrity of financial institutions. Consequently, increasingly strict legal requirements have been imposed on financial service providers in the fields of Customer Due Diligence (CDD) and Know Your Customer (KYC).
The requirements necessitate diligent checking of customers, aimed at ensuring that transactions are above board. Service providers have to confirm their customers' identities and put control mechanisms in place. Dealings with anyone who could, by association, harm the service provider's reputation must be avoided.
Time-consuming, multi-stage KYC processes are replaced by a single procedure that's completed in seconds
Essential to that is the screening and checking of customers by reference to various sanction lists and registers. Service providers' responsibilities in this field are defined in the Financial Supervision Act (Wft), the Money Laundering and Funding of Terrorism (Prevention) Act (Wwft) and the Sanctions Act (Sw). Any financial service provider that fails to comply with the rules is at risk of a heavy fine or even licence revocation. The importance of being able to meet CDD and KYC requirements therefore can't be overstated.
Three challenges with authentication
In practice, banks and insurance companies often have multiple records relating to the same customer scattered across various systems. Whereas it used to be sufficient to ensure that a single 'golden record' was accurate, it's now essential that all recorded data is correct.
Against that background, many service providers have set up sizeable KYC departments where specialist staff identify and investigate potential risks. That often implies preparatory groundwork by the customer service team. Customers will typically be called to check their details, an approach that gives rise to significant challenges:
Contacting a large number of customers individually is expensive and time-consuming. Multiple processes may be involved, such as making phone calls and document scanning.
Customer record validation implies customer service personnel having access to personal data. And the more widely data is shared, the greater the risk of a security breach.
Customers are liable to feel that their privacy is compromised by the enquiries. Daan Vermeer, a journalist with a leading Dutch financial daily, recently described how a simple money transfer led to a call from his bank to establish whether he was laundering money or funding terrorism. "Where is the boundary between due diligence and privacy infringement?" he asked.
The solution: eIDs based on self-sovereign identity
What's the best way to address those challenges? As a service provider, what you need is a solution that supports automatic verification and updating of your customer data and your golden records: an eID that can be used anywhere and meets the highest privacy and security standards.
In the insurance world, such solutions are already in use: self-sovereign identity applications (SSI apps). As the name suggests, an SSI solution is based on the principle that the user – the customer – has control over their own verified personal data, or 'attributes', to use the technical jargon. Attributes take the form of digital documents issued and digitally signed by authorised bodies, such as a local authority or the Chamber of Commerce. They may relate to basic facts such as the user's name and address, or to other matters such as their public service number (BSN) or power to sign off transactions for a company. Where relevant, an expiry date can be attached to an attribute. Another key feature of SSI solutions is that most use a decentralised data storage model. So the user shares attributes directly with the verifying service provider, without the service provider having to consult a third party. That does away with the need to store and process large volumes of customer data, greatly reducing the security risk.
SSI solutions are therefore fully aligned with the principles of privacy by design and ensure that personal data is always handled with respect. First and foremost, they put the customer in control of their personal data and how it's shared. In consequence, online service providers have to restrict information requests to the data they really need. Finally, SSI solutions ensure that all personal data sharing has the subject's explicit consent. And that in turn means 'automatic' compliance with many GDPR requirements by the online service provider.
No need for further verification
SSI also makes life easier for the KYC department. When a customer uses an SSI login, many of the department's routine tasks are performed automatically: digital evidence of identity or other characteristics is requested and provided as part of the login process. So there is rarely any need for telephone verification or the submission of scanned documents, such as a passport scan. Time-consuming, multi-stage KYC processes are replaced by a single procedure that's completed in seconds -- benefiting the service provider and service user alike.
Traditional ID documents falling out of favourIf you'd like to know more about SSI, we recommend reading our Dutch-language whitepaper. As well as exploring the authentication-related challenges facing the financial services industry, the whitepaper outlines how the IRMA solution works and how it can help the sector overcome those challenges.
