Digital identity and financial inclusion

How digitising customer due diligence can strengthen providers during COVID-19 and beyond

For the last two decades, financial inclusion practitioners have been addressing the barriers that prevent adults from accessing and using financial services that can improve their livelihoods. One of the major barriers, originally uncovered by FinMark Trust in their research on obstacles to mass banking in 2003, was the customer due diligence (CDD) required to open a bank account — often associated with know-your-customer (KYC) requirements.

The requirement to undertake CDD comes from the Financial Action Task Force (FATF), the international standard setter and global authority for anti-money laundering and combating the financing of terrorism (AML-CFT). Recognising the importance of financial inclusion and the barrier potentially posed by customer due diligence requirements, the FATF has released various guidelines on the implementation of CDD, including its Guidance on AML-CFT Measures and Financial Inclusion.

Despite these efforts, as recently as 2017, the Global Findex survey reported that in some countries in sub-Saharan Africa up to half the adult population were not able to open a bank account because they lacked the necessary identity documentation. This shows that there is a real need to properly implement the FATF recommendations, particularly the CDD component, to ensure that people are not excluded from formal financial services because they don’t possess the right documents.

Responding to the demands of COVID-19

COVID-19 has placed this need in the spotlight for a few reasons. From the consumer perspective, lack of access to formal finance means the only options are informal alternatives. And informal financial services are severely constrained right now, as they rely on cash and face-to-face meetings which are currently restricted. Further, governments are distributing relief to individuals and businesses through digital payment channels, but financially excluded adults cannot receive these funds unless they’re able to open bank or transaction accounts.

From the provider perspective, COVID-19 has put significant pressure on revenues, forcing them to consider how they can reach customers who were normally excluded, or who were using informal services due to lack of documentation. Cenfri and FSD Africa’s latest research with financial service providers (FSPs) in Africa during the pandemic has confirmed this. Of 48 insurers surveyed in Eastern and Southern Africa, 65% said that they have experienced a reduction in sales as a result of COVID-19, and 63% said they are digitalising their sales process to combat this.

Another common challenge FSPs are facing across product markets involves digital sales, which is part of a broader process of virtually signing up new clients that’s referred to as “remote on-boarding.” In particular, providers are unsure how to identify and verify new customers remotely, while still complying with AML-CFT measures.

The advantages of digital identity systems

Cenfri and FSD Africa’s work on digital identity systems has highlighted that the first important step in addressing this challenge is to stop thinking that traditional analogue identification and verification systems are more robust and appropriate for customer due diligence than digital alternatives. Digital identity systems (which can perform identification and verification remotely on an ongoing basis) have been around for some time and are much more appropriate for the CDD process for several reasons:

• First, digital identity systems may, in fact, present lower risk of improper/incomplete CDD than in-person verification. This is because they typically rely on more robust methods for identifying and verifying individuals than simple pieces of paper, which can be forged. And in countries that are still stuck in traditional ways and are requiring physical documents for CDD, digital systems can more robustly check their validity because they employ technology for document verification rather than subjective, in-person assessments. Technology can enable the analysis of the meta-data contained within images to ensure they are not fake or tampered with, and can analyse data from the digital channel used to upload documents to adequately verify that the person is who they say they are. For example, if documents are sent from a mobile phone, accompanying channel data such as the phone’s International Mobile Equipment Identity number, GPS location, etc. can be compared against other databases to correlate with the sender’s identity. The use of digital systems is supported by the Financial Action Task Force, which states that “customer identification/verification measures that utilise reliable, independent digital ID systems, with appropriate risk-mitigation measures in place, may be standard risk, and may even be lower risk” (FATF Digital Identity Guide, p5).
• Second, digital identity systems view the identity management process as ongoing rather than once-off, and many systems use various data (for example transactional data combined with GPS and IP address data) to constantly update a person’s identity profile. This process is referred to as identity proofing, and it is critical for maintaining an up-to-date, accurate identity profile that can be assigned proportionate AML-CFT controls as per the requirements of the risk-based approach. (The risk-based method, as defined by the FATF, means that countries, competent authorities and financial institutions are expected to identify, assess and understand the money laundering and terrorist financing risk to which they are exposed, and take the appropriate mitigation measures in accordance with the level of risk.)
• Third, digital ID systems can help address financial inclusion challenges. This is because they can be used instead of documents for the verification process, or they can employ technologies to replace physical documents while achieving the same objective. One example of this is the use of GPS technology where proof of address is specifically required by regulation. Digital identity systems can also potentially automate the on-boarding process, which can significantly reduce cost. For example, an official from the Ministry of Finance in India estimated that moving to digital identity proofing, enabled by the Aadhaar digital identity system, reduced the average cost of customer verification from US $15 to US $0.50.

Given the value that digital identity systems can bring in solving challenges related to COVID-19 as well as systemic challenges in the market, it’s time to break old habits and move away from analogue systems and outdated concepts such as “KYC.” But how should FSPs approach the adoption of these systems for ongoing identity proofing? This will depend on the regulatory environment a provider finds itself in, as well as the various systems at its disposal.

How providers can move toward digital approaches

An ideal approach is to utilise a digital ID system that has been officially declared appropriate for customer due diligence by the state. This may be a system that was developed by the government itself or a system that was developed by the private sector then approved by the government. FSPs can use these ID systems to conduct remote identity proofing for individuals without undertaking any assurance checks on the digital ID system themselves. (According to the FATF’s Digital Identity Guide, assurance checks consider the level of confidence in the reliability and independence of a digital ID system and its various components — including technology, architecture and governance — thus, assurance refers to the robustness of a digital ID system.) In Singapore, for example, the government has recognised MyInfo as an independent and reliable digital ID system to verify a customer’s identity. It has explicitly stated that when MyInfo is used for customer on-boarding, banks are not required to collect any documents. To open an account, individuals can simply apply online and authorise MyInfo to send the bank the necessary CDD information. This is efficient, fast and convenient for customers.

Alternatively, FSPs can leverage digital ID systems that have not been officially recognised as appropriate for CDD by the state, so long as they assess these systems themselves and ensure that their level of assurance is appropriate for the associated money laundering/terrorism financing risks. These systems could perform similar functions to MyInfo, or other functions such as the digital verification of documents. Ultimately, FSPs need to assess their needs, the legal environment and the tools at their disposal to determine the best approach.

Ensuring robust digital ID systems

A key challenge, particularly in the developing world, is that many individuals are not part of digital ID systems that are sufficiently robust (like MyInfo), or they don’t have any documents that can be digitally verified. When this is the case, the flexibilities of the risk-based approach should be fully leveraged.0

According to the FATF, financial institutions can on-board lower-risk individuals using digital ID systems with lower levels of assurance for identity proofing (i.e.: low levels of verification that the person is who they say they are) — as long as the digital ID system has sufficient authentication controls (i.e.: the system has strong measures in place that prevent an account from being used by an unauthorised person). Since assurance for identity proofing is low, these accounts should be subject to limitations on usage and balances, to reduce the chance of money laundering. However, over time, as more data is used to strengthen the account holder’s identity profile through identity proofing, these restrictions could be removed. Leveraging this flexibility granted by the FATF is of utmost importance for financial inclusion and inclusive growth, because people who don’t have an official identity from the state may have some alternative identity that could be utilised instead. However, it won’t be possible if countries still require rigid sets of documents, or if FSPs are stuck in traditional ways of doing business.

COVID-19 and the associated social distancing implications have shone a light on industries and institutions that are stuck in traditional, increasingly obsolete ways of doing business. The financial sector is trying to adapt to the new conditions imposed by the pandemic, and remote identity proofing is a pivotal approach that will enable them to weather these unprecedented challenges and change the way they interact with consumers in the future. Looking beyond the current crisis, FSPs that implement these solutions effectively will also have a serious advantage in a post-COVID-19 landscape, as their processes will be better adapted to a digital world.

This article was first published on Next Billion as part of the Openi2i series an initiative of Cenfri and Finmark Trust.