Most countries have well-established Know Your Customer (KYC) rules that specify identification, due diligence and risk assessment procedures for verifying identities. But many KYC guidelines and regulations don’t reflect the reality of digital transactions. While modifying laws to make them more applicable is possible, many countries have established electronic Know Your Customer (eKYC) regulations to match digital and mobile realities. In general, eKYC refers to fully digital processes that use identity verification solutions or digital ID systems. In India, for example, eKYC is a consumer term referring to identity verification through the Aadhaar system. Effective eKYC systems often have secure, authenticated, government-issued electronic identification (eID). A government eID guarantees widespread trust and ladders up to new services and capabilities, such as digital signatures, e-voting and accessing secure e-services. Leveraging digital ID systems Estonia is at the forefront of eID developments. The small, Baltic country has had digital ID capabilities on national ID cards since 2001. The eID is embeddable in a secure SIM card, giving mobile phones full identification capabilities. Estonia Estonians can use their eID for more than 600 government services, such as healthcare, filing and paying taxes, and voting. The eID also provides full legal status for any interaction in Estonia that requires identity confirmation, such as eCommerce, opening accounts at financial institutions, and signing contracts. The ID system also offers an advantage for Estonian businesses. More than 2,400 government e-services are available. What previously took days or weeks is now possible in minutes. For example, opening a business in Estonia takes approximately 18 minutes. Overall, eID has had a dramatic effect on Estonia. The country in 2014 took it a step further by introducing e-Residency, which provides eID to citizens of other countries, allowing them access to various e-Services. eIDAS In the European Union, the electronic Identification, Authentication and Trust Services (eIDAS) identity framework is intended to enable one EU member state’s eID to be used in all others. The goal is to create a modern identity framework that can perform electronic identification and trust services for digital transactions. In its current form, the framework requires member states create their own rules and notify others, which must accept the ID scheme when allocating public services. But not every EU country has implemented eIDAS yet. A more recent initiative, the European Digital Identity Wallet, is designed to provide an EU-wide eID that can be used for digital onboarding for cross-border services. Global eID systems While Estonia joined the game early, there are now more than 60 countries with eID systems. Others are creating digital identity frameworks and gathering feedback for eventual implementation: Australia – Trusted Digital Identity Framework Canada – Pan Canadian Trust Framework New Zealand – Digital Identity Services Trust Framework UK – UK digital identity and attributes trust framework Those frameworks are works in progress and require buy-in from various government and corporate agencies, as well as the public. India’s Aadhaar India’s Aadhaar system is one of the most prevalent, registering more than 1.29 billion people. Aadhaar-based eKYC allows financial services providers to verify the identity of Indian consumers electronically, reducing paperwork and time. A World Bank report cites an estimate that Aadhaar moving to eKYC could reduce the average cost of verifying customers from $23 to $0.15. Many estimates also suggest that customer verification can be done in seconds using eKYC compared to five to seven days when done manually. An Aadhaar goal is to help financial inclusion by creating verifiable identities for those who struggle to gain access. With India still primarily an agricultural economy, a large population resides in remote and rural regions. High levels of illiteracy, combined with poor access to government services, makes it difficult for many people to have an official identity. Video KYC Video KYC is a technique “through which customer-provided videos of themselves are compared against the images on their ID documents.” It’s much harder to falsify videos than still images. Add in a liveness factor, which ensures the video hasn’t been prerecorded, and the risk of falsification drops even lower. On the verification side, it’s necessary to have properly trained experts to offset fraudster’s evolving techniques. It’s important to note that in Germany, where video KYC is permissible, “video identification may only be carried out by appropriately trained employees of the obliged entity or of a third party to which the obliged entity outsourced the customer identification requirement.” Although it enables remote verification, the use of trained people performing the KYC raises questions as to whether it qualifies as electronic. Document verification Verifying ID documents electronically is another eKYC option. Image capture of an ID document enables a quick determination of its authenticity. That process can recognize different identity documents and performs comprehensive algorithmic-based checks on thousands of global document types. It can also check for unique enhanced security features available in some ID formats, such as U.S. driver’s licenses, and decodes those advanced security functions. A positive match provides confidence the document is genuine. An authentic document, however, doesn’t automatically imply identity verification. The identity information itself must be appropriately vetted. The importance of Digital Due Diligence and eKYC processes Effective ID verification is the first step, but it’s not the only requirement for a complete eKYC system. KYC also requires compelling due diligence, which requires companies undertake rigorous procedures to understand the customer’s financial activities. Those procedures include getting trustworthy answers to questions such as: What is the nature of their business? How do they get their money? Who are their customers? What is the volume of transactions? How much money do they handle? What countries do they do business in? To make a proper risk assessment, companies must, in effect, play detective and investigate the true nature of the client’s financial structure. The requirements for due diligence are becoming stricter as governments enact regulations to unveil complex ownership structures. Those beneficial ownership rules specify requirements for determining who owns and runs a company. Previously, ownership information was often obscured by convoluted paper trails through shell companies, trusts, nominees and other legal fabrications. Creating an effective eKYC regime includes elements for electronically checking, analyzing and verifying financial activities and risk assessments. Paper trails that are slow, expensive and prone to errors make for excellent hiding places for corruption, tax evasion and other financial shenanigans. With eKYC, the speed and transparency of digital processes offer a way to onboard trusted customers, detect bad actors and prevent account abuse. Powerful and efficient eKYC promises a way to better protect governments, institutions and people with rules that are more appropriate for modern digital financial processes. This post was originally published on Sept 28, 2017, and updated to reflect the latest industry news, trends and insights. France’s effort to improve its digital economy is making it a hot market for organizations looking to expand globally. The France Num initiative is at the heart of that effort with a focus on improving connectivity, expanding education and digitalizing French companies. The country, with the world’s seventh-largest economy and a population of 67.8 million, has the infrastructure and openness to investment that could make it an important market for strategic positioning in the EU. But expansion carries with it a need to understand that country’s requirements around Anti-Money Laundering (AML) and Know Your Customer (KYC) regulations and to ensure your company’s identity verification, Customer Due Diligence and risk management processes can comply. France AML regulations The Autorité des marchés financiers (AMF) is France’s main financial regulator. Others of note are the Autorité de contrôle prudentiel et de résolution (ACPR), which supervises banking and insurance and ensures financial system stability, and Traitement du renseignement et action contre les circuits financiers clandestins (TRACFIN), which processes financial intelligence. France takes a risk-based approach to combat money laundering. AMF’s guidance suggests “adapting the measures taken to the level of risk of money laundering and terrorist financing and by optimizing the resources allocated.” AMF specifies some scenarios, such as public or government entities, as low risk and others, such as Politically Exposed Persons or accounts from countries on the Financial Action Task Force’s black list, as high risk. But organizations must determine most risk measurements and classifications. Companies can help assess and counter risk by examining the joint guidelines on risk factors and simplified and enhanced customer due diligence. Those factors include product, country and client risks. Understanding the risk requires effectively identifying the customer and collecting enough accurate information about the business relationship. KYC requirements in France France has specified identity information organizations must collect and keep up to date for compliance: For a person — name, birthdate and place of birth For an organization — name, registration number and address of registered office or operations There are several legally acceptable remote options for verifying a person: Using electronic Identification, Authentication and Trust Services (eIDAS) certificates or an ID Using the National Information Systems Security Agency standard for Remote Identity Verification Service Providers (PVID) A certified copy of the business registration document directly from the registries is acceptable for remote business verification. In France, all new businesses must register with the Centre des Formalités des Entreprises (CFE), which is the business registration center, to receive the appropriate business registration number. Performing identity verification in France Privacy is paramount in France, whether through the General Data Protection Regulation or the country’s culture. People are generally reluctant to share personal information, so collecting confidential data can be challenging in the market. France also does not have a credit-scoring system, so identity verification has been difficult. One verification method gaining momentum is through mobile network operator data and one-time passwords. That method requires explicit consent. As for digital identity systems, the PVID standard is new, and certification is just beginning. While eIDAS has been around for longer, its uptake has been slow. But new initiatives using an updated French national eID card that is eIDAS compatible will let people complete online transactions using their phones. The system integrates with the FranceConnect platform, which allows digital access to government services and already has more than 28 million users and 900 service providers. A holistic approach to gathering identity verification data can streamline the process in France. Using multiple data types and sources can provide strong coverage in a difficult-to-access market. Advanced address matching technology can deliver higher match rates than traditional results. Technology that adds to its verification capabilities as new sources and channels become available can help maximize success in France’s growing digital economy. When it comes to onboarding individual or corporate clients, risk assessment is essential. Performing Know Your Customer (KYC) and Anti-Money Laundering (AML) risk assessment checks help ensure compliance, deter fraud and provide insights into your new clients and their activities. Risk assessments are a fundamental part of a risk-based approach and help identify potential issues, understand the risk of dealing with a customer, and determine what measures are necessary to counter the threat. If the risk is not in line with company policies, rejecting the application before opening an account might be advisable. Practical risk assessment tools let you tailor the information gathering process to your needs and gain risk assessment insights specific to your business. As each jurisdiction and customer poses different risk considerations, the tools should enable automated workflows to handle different scenarios quickly. While you must protect your business, you also want to ensure the onboarding process is relatively quick and seamless. The importance of risk assessment You wouldn’t go into business with just anyone, and nowadays, you don’t have to rely on a hunch to decide who’s a little fishy and who’s a safe bet. By having a risk assessment system, you can better understand who your clients are and dictate the parameters of how you wish to serve them. Mitigating potential risks that may harm your business before becoming a customer is the safest strategy. But just because a client is high-risk doesn’t mean they’re off limits, and you shouldn’t onboard them. It just means they may require special attention from your end. A system to help you actively manage risk assessment when onboarding can help you comply with KYC/AML regulations and improve your services. Traditionally, customer risk levels are divided into four buckets that will determine the nature of your relationship with them and how you should manage them: Low: A customer whose identity and information are easily verifiable. They pose a low amount of risk to unwanted or illegal activity. Medium: A customer who may pose a higher risk than the average customer. This customer may require further due diligence and monitoring. High: A customer requiring considerable due diligence needs close monitoring. Prohibited: A customer profile that strongly indicates suspicious behavior and risky transactions have occurred in the past. Avoiding these customers helps prevent your bank or a financial institution from being implicated. It is not a calculated risk if you haven’t calculated it. ― Naved Abdali, Author of INVESTING — Hopes, Hypes, & Heartbreaks. Performing KYC/AML risk assessments at onboarding Identity verification can provide numerous layers of data to better inform your risk management procedures; you can start conducting your risk assessments during onboarding before any official AML checks even begin. With an effective solution, you can build and customize risk models that directly connect to your digital onboarding process. You’ll receive a client’s risk score once they reach the end of the onboarding flow by inputting rules, values and thresholds. You can have different risk categories to choose from, including a customer’s place of residence, financial background, employment history and services you may want to consider offering them. Adding in more identity data or additional identification procedures helps create a more robust profile to base your onboarding decisions. For example, adding an ID document verification on top of a digital identity verification process provides much more complexity for a criminal to overcome. You can set rule conditions. If these conditions are triggered, your client will receive an extra point on their risk assessment score. For example, suppose your business considers onboarding clients from Yemen a higher risk than England. In that case, you can set the system to identify these data points when onboarding, automatically adding them to their risk score. You can set up as many customized rule conditions as you want, giving you a comprehensive risk assessment that provides a thorough summary of your clients’ risk rating, so you know how to move forward confidently. You can adapt rules to assess clients across several branches and countries, catering to specific needs. It allows all data and risk variables to be accessible to all relevant stakeholders, meaning your teams can be more informed and efficient and paves the way for risk-based decisions with greater assurance. Risk assessments don’t need to be risky. With modern, robust and adaptable onboarding solutions, you can better understand who you are going into business with. You can build custom risk assessment models based on the conditions most important to your company. And you can make risk-based decisions in real-time while onboarding your clients. Your digital onboarding experience can be fast and straightforward for customers while providing compliance, risk and security professionals with a highly customizable KYC/AML risk assessment tool. In the digital world, effective identity verification should deliver a friendly onboarding for good customers and appropriate risk assessment measures. Posts navigation Previous 1 … 8 9 10 … 157 Next
Most countries have well-established Know Your Customer (KYC) rules that specify identification, due diligence and risk assessment procedures for verifying identities. But many KYC guidelines and regulations don’t reflect the reality of digital transactions. While modifying laws to make them more applicable is possible, many countries have established electronic Know Your Customer (eKYC) regulations to match digital and mobile realities. In general, eKYC refers to fully digital processes that use identity verification solutions or digital ID systems. In India, for example, eKYC is a consumer term referring to identity verification through the Aadhaar system. Effective eKYC systems often have secure, authenticated, government-issued electronic identification (eID). A government eID guarantees widespread trust and ladders up to new services and capabilities, such as digital signatures, e-voting and accessing secure e-services. Leveraging digital ID systems Estonia is at the forefront of eID developments. The small, Baltic country has had digital ID capabilities on national ID cards since 2001. The eID is embeddable in a secure SIM card, giving mobile phones full identification capabilities. Estonia Estonians can use their eID for more than 600 government services, such as healthcare, filing and paying taxes, and voting. The eID also provides full legal status for any interaction in Estonia that requires identity confirmation, such as eCommerce, opening accounts at financial institutions, and signing contracts. The ID system also offers an advantage for Estonian businesses. More than 2,400 government e-services are available. What previously took days or weeks is now possible in minutes. For example, opening a business in Estonia takes approximately 18 minutes. Overall, eID has had a dramatic effect on Estonia. The country in 2014 took it a step further by introducing e-Residency, which provides eID to citizens of other countries, allowing them access to various e-Services. eIDAS In the European Union, the electronic Identification, Authentication and Trust Services (eIDAS) identity framework is intended to enable one EU member state’s eID to be used in all others. The goal is to create a modern identity framework that can perform electronic identification and trust services for digital transactions. In its current form, the framework requires member states create their own rules and notify others, which must accept the ID scheme when allocating public services. But not every EU country has implemented eIDAS yet. A more recent initiative, the European Digital Identity Wallet, is designed to provide an EU-wide eID that can be used for digital onboarding for cross-border services. Global eID systems While Estonia joined the game early, there are now more than 60 countries with eID systems. Others are creating digital identity frameworks and gathering feedback for eventual implementation: Australia – Trusted Digital Identity Framework Canada – Pan Canadian Trust Framework New Zealand – Digital Identity Services Trust Framework UK – UK digital identity and attributes trust framework Those frameworks are works in progress and require buy-in from various government and corporate agencies, as well as the public. India’s Aadhaar India’s Aadhaar system is one of the most prevalent, registering more than 1.29 billion people. Aadhaar-based eKYC allows financial services providers to verify the identity of Indian consumers electronically, reducing paperwork and time. A World Bank report cites an estimate that Aadhaar moving to eKYC could reduce the average cost of verifying customers from $23 to $0.15. Many estimates also suggest that customer verification can be done in seconds using eKYC compared to five to seven days when done manually. An Aadhaar goal is to help financial inclusion by creating verifiable identities for those who struggle to gain access. With India still primarily an agricultural economy, a large population resides in remote and rural regions. High levels of illiteracy, combined with poor access to government services, makes it difficult for many people to have an official identity. Video KYC Video KYC is a technique “through which customer-provided videos of themselves are compared against the images on their ID documents.” It’s much harder to falsify videos than still images. Add in a liveness factor, which ensures the video hasn’t been prerecorded, and the risk of falsification drops even lower. On the verification side, it’s necessary to have properly trained experts to offset fraudster’s evolving techniques. It’s important to note that in Germany, where video KYC is permissible, “video identification may only be carried out by appropriately trained employees of the obliged entity or of a third party to which the obliged entity outsourced the customer identification requirement.” Although it enables remote verification, the use of trained people performing the KYC raises questions as to whether it qualifies as electronic. Document verification Verifying ID documents electronically is another eKYC option. Image capture of an ID document enables a quick determination of its authenticity. That process can recognize different identity documents and performs comprehensive algorithmic-based checks on thousands of global document types. It can also check for unique enhanced security features available in some ID formats, such as U.S. driver’s licenses, and decodes those advanced security functions. A positive match provides confidence the document is genuine. An authentic document, however, doesn’t automatically imply identity verification. The identity information itself must be appropriately vetted. The importance of Digital Due Diligence and eKYC processes Effective ID verification is the first step, but it’s not the only requirement for a complete eKYC system. KYC also requires compelling due diligence, which requires companies undertake rigorous procedures to understand the customer’s financial activities. Those procedures include getting trustworthy answers to questions such as: What is the nature of their business? How do they get their money? Who are their customers? What is the volume of transactions? How much money do they handle? What countries do they do business in? To make a proper risk assessment, companies must, in effect, play detective and investigate the true nature of the client’s financial structure. The requirements for due diligence are becoming stricter as governments enact regulations to unveil complex ownership structures. Those beneficial ownership rules specify requirements for determining who owns and runs a company. Previously, ownership information was often obscured by convoluted paper trails through shell companies, trusts, nominees and other legal fabrications. Creating an effective eKYC regime includes elements for electronically checking, analyzing and verifying financial activities and risk assessments. Paper trails that are slow, expensive and prone to errors make for excellent hiding places for corruption, tax evasion and other financial shenanigans. With eKYC, the speed and transparency of digital processes offer a way to onboard trusted customers, detect bad actors and prevent account abuse. Powerful and efficient eKYC promises a way to better protect governments, institutions and people with rules that are more appropriate for modern digital financial processes. This post was originally published on Sept 28, 2017, and updated to reflect the latest industry news, trends and insights.
France’s effort to improve its digital economy is making it a hot market for organizations looking to expand globally. The France Num initiative is at the heart of that effort with a focus on improving connectivity, expanding education and digitalizing French companies. The country, with the world’s seventh-largest economy and a population of 67.8 million, has the infrastructure and openness to investment that could make it an important market for strategic positioning in the EU. But expansion carries with it a need to understand that country’s requirements around Anti-Money Laundering (AML) and Know Your Customer (KYC) regulations and to ensure your company’s identity verification, Customer Due Diligence and risk management processes can comply. France AML regulations The Autorité des marchés financiers (AMF) is France’s main financial regulator. Others of note are the Autorité de contrôle prudentiel et de résolution (ACPR), which supervises banking and insurance and ensures financial system stability, and Traitement du renseignement et action contre les circuits financiers clandestins (TRACFIN), which processes financial intelligence. France takes a risk-based approach to combat money laundering. AMF’s guidance suggests “adapting the measures taken to the level of risk of money laundering and terrorist financing and by optimizing the resources allocated.” AMF specifies some scenarios, such as public or government entities, as low risk and others, such as Politically Exposed Persons or accounts from countries on the Financial Action Task Force’s black list, as high risk. But organizations must determine most risk measurements and classifications. Companies can help assess and counter risk by examining the joint guidelines on risk factors and simplified and enhanced customer due diligence. Those factors include product, country and client risks. Understanding the risk requires effectively identifying the customer and collecting enough accurate information about the business relationship. KYC requirements in France France has specified identity information organizations must collect and keep up to date for compliance: For a person — name, birthdate and place of birth For an organization — name, registration number and address of registered office or operations There are several legally acceptable remote options for verifying a person: Using electronic Identification, Authentication and Trust Services (eIDAS) certificates or an ID Using the National Information Systems Security Agency standard for Remote Identity Verification Service Providers (PVID) A certified copy of the business registration document directly from the registries is acceptable for remote business verification. In France, all new businesses must register with the Centre des Formalités des Entreprises (CFE), which is the business registration center, to receive the appropriate business registration number. Performing identity verification in France Privacy is paramount in France, whether through the General Data Protection Regulation or the country’s culture. People are generally reluctant to share personal information, so collecting confidential data can be challenging in the market. France also does not have a credit-scoring system, so identity verification has been difficult. One verification method gaining momentum is through mobile network operator data and one-time passwords. That method requires explicit consent. As for digital identity systems, the PVID standard is new, and certification is just beginning. While eIDAS has been around for longer, its uptake has been slow. But new initiatives using an updated French national eID card that is eIDAS compatible will let people complete online transactions using their phones. The system integrates with the FranceConnect platform, which allows digital access to government services and already has more than 28 million users and 900 service providers. A holistic approach to gathering identity verification data can streamline the process in France. Using multiple data types and sources can provide strong coverage in a difficult-to-access market. Advanced address matching technology can deliver higher match rates than traditional results. Technology that adds to its verification capabilities as new sources and channels become available can help maximize success in France’s growing digital economy.
When it comes to onboarding individual or corporate clients, risk assessment is essential. Performing Know Your Customer (KYC) and Anti-Money Laundering (AML) risk assessment checks help ensure compliance, deter fraud and provide insights into your new clients and their activities. Risk assessments are a fundamental part of a risk-based approach and help identify potential issues, understand the risk of dealing with a customer, and determine what measures are necessary to counter the threat. If the risk is not in line with company policies, rejecting the application before opening an account might be advisable. Practical risk assessment tools let you tailor the information gathering process to your needs and gain risk assessment insights specific to your business. As each jurisdiction and customer poses different risk considerations, the tools should enable automated workflows to handle different scenarios quickly. While you must protect your business, you also want to ensure the onboarding process is relatively quick and seamless. The importance of risk assessment You wouldn’t go into business with just anyone, and nowadays, you don’t have to rely on a hunch to decide who’s a little fishy and who’s a safe bet. By having a risk assessment system, you can better understand who your clients are and dictate the parameters of how you wish to serve them. Mitigating potential risks that may harm your business before becoming a customer is the safest strategy. But just because a client is high-risk doesn’t mean they’re off limits, and you shouldn’t onboard them. It just means they may require special attention from your end. A system to help you actively manage risk assessment when onboarding can help you comply with KYC/AML regulations and improve your services. Traditionally, customer risk levels are divided into four buckets that will determine the nature of your relationship with them and how you should manage them: Low: A customer whose identity and information are easily verifiable. They pose a low amount of risk to unwanted or illegal activity. Medium: A customer who may pose a higher risk than the average customer. This customer may require further due diligence and monitoring. High: A customer requiring considerable due diligence needs close monitoring. Prohibited: A customer profile that strongly indicates suspicious behavior and risky transactions have occurred in the past. Avoiding these customers helps prevent your bank or a financial institution from being implicated. It is not a calculated risk if you haven’t calculated it. ― Naved Abdali, Author of INVESTING — Hopes, Hypes, & Heartbreaks. Performing KYC/AML risk assessments at onboarding Identity verification can provide numerous layers of data to better inform your risk management procedures; you can start conducting your risk assessments during onboarding before any official AML checks even begin. With an effective solution, you can build and customize risk models that directly connect to your digital onboarding process. You’ll receive a client’s risk score once they reach the end of the onboarding flow by inputting rules, values and thresholds. You can have different risk categories to choose from, including a customer’s place of residence, financial background, employment history and services you may want to consider offering them. Adding in more identity data or additional identification procedures helps create a more robust profile to base your onboarding decisions. For example, adding an ID document verification on top of a digital identity verification process provides much more complexity for a criminal to overcome. You can set rule conditions. If these conditions are triggered, your client will receive an extra point on their risk assessment score. For example, suppose your business considers onboarding clients from Yemen a higher risk than England. In that case, you can set the system to identify these data points when onboarding, automatically adding them to their risk score. You can set up as many customized rule conditions as you want, giving you a comprehensive risk assessment that provides a thorough summary of your clients’ risk rating, so you know how to move forward confidently. You can adapt rules to assess clients across several branches and countries, catering to specific needs. It allows all data and risk variables to be accessible to all relevant stakeholders, meaning your teams can be more informed and efficient and paves the way for risk-based decisions with greater assurance. Risk assessments don’t need to be risky. With modern, robust and adaptable onboarding solutions, you can better understand who you are going into business with. You can build custom risk assessment models based on the conditions most important to your company. And you can make risk-based decisions in real-time while onboarding your clients. Your digital onboarding experience can be fast and straightforward for customers while providing compliance, risk and security professionals with a highly customizable KYC/AML risk assessment tool. In the digital world, effective identity verification should deliver a friendly onboarding for good customers and appropriate risk assessment measures.