xxx
Portable identity enables people to safely and securely re-use their verified identity across financial services and other organisations, so that they don’t need to be re-verified every time they want to access new services.
From Onfido, Deloitte and Evernym Prove that Re-usable Digital Identity is Market-Ready with the FCA Regu:
So, a customer presents a passport or driving licence to open an account at Bank A. Onfido verify the documents and Evernym create a digital identity that is then stored on a blockchain by Deloitte. Then, when the customer wants to open another account at Bank B, they do not need to present the documents again, they simply point Bank B at the digital identity on the blockchain. Bank B knows that the identity has been verified by Bank A, so they do not need to verify the documents again. This saves everyone time and money.
It’s a timely demonstration of where the industry might go next. The Financial Action Task Force (FATF), the global inter-governmental money laundering and terrorist financing (ML/TF) watchdog, recently published its new “Guidance on Digital ID” (6th March 2020). These aim to encourage governments and financial institutions to use the FATF’s risk-based approach to “encourage use of digital customer onboarding” and to take advantage of “simplified due diligence” to tackle the challenges of COVD-19 whilst remaining alert to “new and emerging” risks.
What is particularly interesting about the new guidelines is that, in common with the EU’s Fifth Anti-Money Laundering Directive (AMLV), they recognise that there is role of digital onboarding beyond convenience or necessity. Paragraph 87 of the document says very clearly that given the advances in the technology and standards in the digital ID world that “non-face-to-face customer-identification and transactions that rely on reliable, independent digital ID systems with appropriate risk mitigation measures in place, may present a standard level of risk, and may even be lower-risk (my emphasis) where higher assurance levels (eg, NIST IAL2) are implemented and/or appropriate ML/TF risk control measures are in place.
Of course, digital and “face-to-face” are not alternatives. The use of digital onboarding to support and enhance face-to-face interactions to also going to accelerate. Here’s an example from Canada. In March 2020, Royal Bank of Canada (RBC) introduced an enhancement to its mobile application to allow customers to verify their identities when opening a new account in branches. The app can use the contactless interfaces in mobile phones to read the chips in electronic passports to speed things along. Why bother? Well, RBC say that when a customer verifies their identity this way, there details are immediately flashed to the computer screen of the RBC employee helping them, so giving “a stronger connection between the branch and the app” and cutting the account opening time by more than two-thirds.
Since the FATF made the new recommendations, regulators around the world have issued their own statements supporting such action including the UK’s FCA, Hong Kong’s HKMA and the US FinCEN as James Mirfin of Refinitiv pointed out. In the UK, for example, the Financial Conduct Authority (FCA) issued a letter noting that while organisations have to meet their obligations under the relevant regulations (in this case, the UK’s Money Laundering Regulations 2017), they can be flexible. Now, some of this flexibility is a little old school (allowing people to send scanned documents as PDFs by e-mail instead of producing original documents, for example, is what I label “digitised identity”) but some of it is, I think, a considered and sound response to the new environment.
The FCA have said that they will accept “third-party verification” (where a lawyer or accountant corroborates data) and, in a step towards the federated digital identity of the future (the “financial services passport” that I have been going on about for years), organisations can rely on CDD performed by other organisations (the example given is the obvious one of customer’s primary bank account provider) and on commercial providers who “triangulate” data sources to verify documentation. This is why the sandbox experiment is so timely. We may be about to see a step change in the costs