Digital Identity - Who Cares? - folio.id · DIGITAL IDENTITY WHO CARES? WHITEPAPER 6 DIGITAL IDENTITY DRIVES EFFICIENCY MANUAL MANUAL / DIGITAL MIX DIGITAL per identity per identity

DIGITAL IDENTITY - WHO CARES? WHITEPAPER | WWW.FOLIO.ID 1

Digital Identity - Who Cares?w w w . f o l i o . i d

W H I T E P A P E R


BANKING AND FINANCIAL SERVICES

Digital Identity - Who cares?

DIGITAL IDENTITY - WHO CARES? WHITEPAPER | WWW.FOLIO.ID 2DIGITAL IDENTITY - WHO CARES? WHITEPAPER | WWW.FOLIO.ID 2


5

9

17

23


Some dynamics at play

Who owns my identity and where is it?

Mobile Digital Identity for Banking

What makes us different? Some of the critical components of Folio’s platform

Contents

33






For a digital economy to function, institutions and

individuals must seamlessly integrate and transact.

Whether it is to enable an existing employee to

access resources remotely, or when onboarding

a new customer, being certain the user is who

they claim to be, is crucial. But as an industry, we

have made it very difficult to do just that. Twenty

years after we launched online banking, we still

haven’t cracked the seamless transaction vs trust

conundrum. Multiple text messages, confusing

language, passcode generators, and other

authentication methods just make it, well, difficult.

A recent study found that most people abandon

after 14m 20s – and most journeys take over 20m!

User experiences or ‘journey’s’ can be, frankly, awful

resulting in huge drop-off rates often in excess of 40%.

When trying to capture new customers, especially

new digital native customers, the cost of acquisition

is just unsustainable. Waves of e-commerce, social


DIGITAL IDENTITY DRIVES EFFICIENCY

MANUALMANUAL / DIGITAL

MIX DIGITAL

per identity per identity per identity

£20-£30 £10-£15 £3-£5

media, and the smartphone have come and still

there is still no seamless way to prove online that

you are who you claim you are, even a real person,

are over 21, or under 12, live at that address…..

Complicating the picture, the regulatory environment

which attempts to shield us all from fraud and toxic

behaviour, has done little to oil the wheels of digital.

The relics of yesteryear are still fundamental to the

everyday in financial services… plastic forms of ID

are required to open a new account, trips to a branch

or via video call, authentication via passwords, one-

time-passcodes and plastic mini-computers! As

consumers ourselves, we produce and assert these

identity ‘facts’ over and over again, in different

formats and variations for different banks, even

different departments within the same bank.

“There is a strong business case for financial institutions to lead the development of digital identity systems [that include] opportunities to: 1)

Streamline current processes, increase automation, and reduce error and human intervention; 2) Create new revenue streams from new products and services; and 3) Stretch outside of core business and capabilities to create transformational new business models and reach new customers.”

THE WORLD ECONOMIC FORUM

Until recently this was the only way, but now Digital

Identity is becoming far more of ‘a thing’… a government

conversation, a banking conversation, a consumer

conversation. It is actually hard to imagine how an

inclusive, global digital society can properly develop

without the cornerstone of good, trusted digital identity.

Digital identity can super- charge global inclusivity

and stimulate economic growth. It enables the billion-

plus individuals who are currently financially excluded

to participate in banking, markets and government.






Customer expectations have shifted and keep us

on our toes, many studies show abandonment rates

of anything from 30-67%... that’s a lot of leakage.

Users don’t have the documentation required with

them, often are uneasy about the amount of personal

information being requested, can’t find it in their

lever arch files somewhere under the stairs, get

annoyed by the latency on the app or website, or don’t

receive the one-time-passcode quickly enough.

Consumer expectations are actually quite simple

to conceptualize, but harder to implement and

are dependent on personas and contexts.

The nature of relationships is changing. People expect

to be able to run their lives from their sofa, their

morning commute, their sun lounger. Those who don’t

offer such experiences will be forced to sit and watch

while their clients walk into the arms of more agile,

digital competitors. They’ll be gone in 60 seconds.

Unhindered by the legacy infrastructures, systems

and data issues of other banks, and more natively

focussed on new customer journeys - the challengers

have simplified their offerings, designing services with

better user experience in mind. Consumers expecting

mobile-first, slick processes and ‘always-on’ services

are starting to see some innovators deliver. In return,

they are awarded with customer loyalty and retention

as well as significantly lower onboarding costs

User demand

8


IN PERSON VIDEO REMOTE ONLINE

SMARTPHONE

BIOMETRIC ENABLED

APP

Immediate Access

Round the clock

Typical processing time 10 mins (Plus travel) 10 mins 2 mins 60 seconds

Conversion SuccessMEDIUM

LOWMEDIUM HIGH HIGH

Cost HIGHHIGH

MEDIUMLOW LOW

Level of Assurance HIGH MEDIUM HIGH HIGH

Convenient Multi Factor(Passwords/ Passcodes)

Multi department/business line reuse

Passport/EMC chip enabled

Practical for ongoing authentication

(SCA)

Issue credentials and notifications

Costs to remediate/ongoing data compliance HIGH HIGH MEDIUM LOW

Post

Onb

oard

Onb

oard

ing


New banking channels emerge, but old channels

never die!!



Proving you are who you say you are is one

challenge, nefarious actors masquerading as

you, is another. The balance of convenience,

security and trust has rarely been found and in

a recent Experian study of business leaders,

“84% said that if they were certain about a customer’s identity, the need for fraud risk mitigation would be reduced.”

A digital identity solution should make life

significantly harder for fraudsters by raising the level

of assurance for key processes and operate more

conveniently, almost invisibly, to the mobile, digital

user. In 2018 alone the costs of account takeover

in the US alone tripled to $5.1 billion. Banks are

making life far too easy for fraudsters and the

impact on reputation cannot be underestimated.

Endless threat of fraud

New methods for identification emerge, but the

old authenticators don’t go away... Something you

have (identification document, card…) Something

you know (password or pin) are the most frequently

relied upon. Recently Something you are (voice,

fingerprints, face) has become more prominent.

How can the strongest assurance be gained

with lowest friction, across all channels,

the physical, the digital, the phygital?

How can I be sure whatever I implement wont

become obsolete within 12 months?

Complexities of interoperability

The intimacy, privacy and trust made possible by a

physical meeting has been a mainstay for banking

and capital markets firms for generations. To prove

somebodies identity, their eligibility to some product

– the face-to-face would be the default, but times

have changed with Covid-19 as people try to do

business ‘at a distance’. They are also expensive

and resource intensive which leads to bottlenecks,

and business continuity challenges. They aren’t as

effective in limiting identity fraud either, as research

shows humans are more affected by unconscious

bias and manipulation than previously expected.

The friction of beginning any trust relationship should

be minimized, but not compromised -even with

the overwhelming pressures to be ‘more digital’.

Some firms are commoditising the experience in

the chase to strip cost, but this digital-emotional

connection can’t be established if user journeys,

apps and interfaces are just retrofit to a banks ageing

processes. If the user is a victim of self-serving,

paranoid service design they will assume a more

transactional, non-loyal posture accordingly!

To summarise, digital relationships need low friction,

alongside the highest possible assurance.

Nature of relationships



Digital identity is not yet universal, not even across

Europe, despite attempts to make it so, such as the

EU’s eIDAS regulation that aims to make schemes

interoperable across Europe. And varying cultural

attitudes to risk are a frequent stumbling block

to industry-wide, international, digital Identity.

Standards are emerging but many markets demand

their own control, their own flavours and as such

we have a patchwork quilt of credentials, schemes,

trusted authorities… but this is also changing.

“For banks to pro-actively create a new set of identity services would not be that far removed from what they are required to provide today to comply with KYC and other regulations. It would also offer a welcome opportunity to strengthen customer relationships and encourage customer loyalty at a time when other aspects of the banking business are being disrupted.”

DAVE BIRCH

Standards

The volume and frequency of data breaches is

burning a trust hole in most consumers minds. Trust

and cyber-confidence is now a real factor choosing

who to bank with, for retail consumers right up to

corporates. The smartest firms are able to turn

compliance regulations into promises, building

confidence that they are ahead of the curve.

90% of companies say business security is a competitive differentiator and can help win new customers

Regulations are enablers to some, providing

customers with more banking choices, control

and a competitive banking market that permits

third parties to access their financial data for new

services, beyond those provided directly by their

bank, like in the new Open Banking reforms called

for by the Competition and Markets Authority

(CMA). These clearly run alongside the associated

EU Payment Services Directive (PSD2) regulations.

One of the biggest changes under the terms of

PSD2 is that it will require all online transactions

over certain thresholds to be authenticated using

a Strong Customer Authentication (SCA) compliant

process. By March 2021, after an 18-month period,

the FCA expects all firms to have made the necessary

changes and undertaken the required testing to apply

and the recent Strong Customer Authentication.

And in a landmark ruling earlier this year, the EBA

ruled that sending a one-time passcode to a mobile

phone could not be used to prove both knowledge

(of the passcode) and possession (of the mobile

phone). This is a ruling that has left many within

the industry scrambling for a compliant solution.

But all is not lost! Financial institutions can, and will,

innovate with new products and services within this

ever-changing landscape and grow market share.

PSD2 will likely transform the way customers on-

board with financial services providers, forever.

Banks must now must open up their infrastructure

presenting an opportunity for to become curated

marketplaces from which their customers can easily,

and continually, access additional financial services

Digital identity is key for this.

Regulations and compliance

12


of Americans want to do more to protect their

online activities and personal information

84%

don’t know how...

43%






Where does the trust emerge from? Largely the same institutions that built up the authority of many generations.

Actually banks are often the most trusted institutions to provide and manage

digital identity, especially in the Nordics where the BankID scheme has been

rolled up to >85% of the population, with government schemes lagging and

social media platforms at the very bottom of the pile. Unsurprising perhaps.




of Americans believe it’s important for companies to give

customers control of how their personal

data is used

90%



Over 70% of consumers aged below 35,already use biometrics to access and control their most private information. Adoption is simple and use both online and in the physical world is seamless, equally convenient, equally secure.



The perceived convenience of Social media as an Identity gateway is counterbalanced with an understandable trust problem.

Following on from the Cambridge Analytica scandal,

associated fines and more recently the transcribing of

voice calls made through the Facebook app – the user

perception, increasingly, is that their most private data

should be kept away from the ‘GAFA’ behemoths.

Users feel their data is not safe with the big tech

elite. GAFA motivations around privacy are a murky

swamp open to interpretation by them and their

partners. Their data models have been tuned for

research and advertising and are not fit-for-purpose

to be the central control system for Identity.

And what about consumers owning their own

identity – a self sovereign model, and it stored

on the blockchain? Distributed ledger technology

has so much potential to transform complex use

cases, such as Crypto banking and Payments and

the blockchain could theoretically act as massively

federated identity data store, combining all digital

records that, in aggregate, define the digital identity.

But, the promise of a blockchain solution is immutable,

borderless and elastic is actually not as relevant to

identity management use cases as it is for others. The

immutability of blockchains is actually a risk factor.

Private information placed on a blockchain could

mean it might not be possible to remove it, ever -

possibly exposing things not meant to be exposed.

DLT will play its part, but while latency and privacy

challenges remain its isn’t the key enabler right now.

So where should this critical Identity data sit?

Smartphone penetration is already over 5Bn, 67% of global population and expected to be 95% in the next few years.

Todays smartphones are blessed with incredibly

powerful sensors, cameras and processors

that when twinned with powerful AI software

deliver a comprehensive biometric verification

capability that in seconds can deliver 99.999%+

certainty. Decentralised, yes, but on the

personal smart device, not the blockchain.



Mobile Digital Identity for Banking



But while all roads may lead to Rome, many

competing interests demand compromises sometimes

forcing the lowest common denominator.

Different transactions and use cases require fit-for

purpose ID processes. Many online transactions

are gated only by a social media log in. Simple for

the user, but a very low level of assurance of the

user’s identity (just something someone knows).

The other end of the scale? Bring your photo ID,

proofs of address, to an appointment at a branch

to meet with an expert member of staff.

Digital identity will replace all legacy forms of proof of identity, not overnight but in the near future. It will give banking customers more convenience and control than traditional plastic and face-to-face meetings, scale more efficiently for the institutions and vastly lower the risks for all parties.

Creating unfaltering confidence that a human

being’s actual, physical identity is represented

correctly as a precise, tamper-proof, digital

equivalent and can be verified remotely.

Enabling convenient, low friction experiences for

users to access critical services and exclusive content

from a high value ecosystem offline and online.

20


One takeaway from this? As the level of assurance increases –

the cost and effort, both for the relying party and the user step

up dramatically. One goal of shifting to a digital identity paradigm

is to bring these into mutual alignment and the good news is

that this is no longer a trade-off. Great customer experiences

across a vast range of use cases and sectors can be achieved

without compromising on security, trust and other objectives.

Preferred for high threshold onboarding

Preferred for returning customers to gain access

Multi factor, Multi use, high convenience, biometric, AI

LEVEL OF ASSURANCE

USE

R F

RIC

TIO

N

SIGN IN BY FACEBOOK

High risk of customer leakage

USERNAME AND PASSWORD

2 FACTOR AUTH

ONE TIME DIGITAL ONBOARD

VIDEO ASSISTED REMOTE ID

BRING PHYSICAL ID TO BRANCH



Based on average customer completion rates for digital/omni channel onboarding.

52%

ABANDOMENT RATE REDUCTION

(New customer drop rates)

Reduced costs as fully digital and less vendors.

>90%

REDUCED ONBOARDING COSTS(New customer drop rates)

Onboarding flows massively simplified and automated with the use of AI and biometrics.

STREAMLINECUSTOMER JOURNEY

(Efficiencies)

*Figures are provided by ORX over a 6 year period2013-2019 and are an average per bank per year.

£10M*

REDUCED FRAUD RATES

GBP

• 24x7 Operations

• Improved customer retention

• Real time remediation

• Authorise over any channel

• Improve brand and market share

• Easier mechanism to upsell new products to existing customers

ADDITIONAL UPSIDE

Benefits of Folio in Digital Banking

Speed increased from c20 mins to

3mins


The anchor for the Folio identity is often a government issued photo ID or legal form of identity, which Folio

scans, verifies matches rigorous format and content rules, and, where appropriate, performs an online check.

Where an NFC chip is present, this is integrated automatically further tamper proofing the Folio identity.

Optimum ExperienceAll online, all digital, all mobile

Maximum AssuranceBiometrically locked and verified

Highest ProductivityAutomated and hyper efficient

Folio supports document validation against

nearly 4,000 Photo ID documents globally, and

can quickly add more



It ensures you are PSD2 SCA compliant while providing a seamless, user-friendly, mobile

experience for digital banking. Onboarding has enormous, obvious value and Folio also

provides additional authentication service such as our own digital identity issuance,

and online authentication - integrating with existing IAM solutions where required.

Folio enables full lifecycle digital identity processing for the bank.

DIGITAL IDENTITY - WHO CARES? WHITEPAPER | WWW.FOLIO.ID


Retail Banking

Confidently onboard anyone, anywhere in

the world with a valid ID document and a

smartphone. Improve the mobile experience

whilst improving customer acquisition

rates. Enhance Loan origination processes

and enable a re-think of legacy, costly and

friction based transactional workflows.

Private Wealth and Banking

Reduce drop-out rates during the customer

onboarding process whilst enhancing

the user journey. We ensure that you

remain fully compliant with regulations,

as well as performing the necessary

Facial, Liveness, and ID checks.

AML / KYC

You don’t need to compromise on user

experience to meet the identity verification

requirements of KYC and AML regulations.

Folio fully complies with 5AMLD regulations

and also complies with Strong Customer

Authentication requirements.

PSD2 SCA

Strong Customer Authentication is a

requirement of PSD2 on payment service

providers within the EEA. The requirement

ensures that electronic payments are performed

with multi-factor authentication. Folio is natively

multi factor includes biometrics and eIDV.

Trade Affirmation

Verify user IDs and validate identity prior to

affirming or finally confirming or approving

any buy/sell orders over mobile devices using

frictionless multi-factor authentication.

Credit Card Processing

Using the latest fraud detection techniques

and data integrity analytics, significantly

credit card fraud. Verify customers’ identity

documents and ensure the person holding

the card is who they say they are.

Mortgage Applications

Remove friction from the mortgage application

process by authenticating documents online

and meeting your KYC requirements.

Payments

By merging payments and a verified ID in

a comprehensive way, Folio can help solve

a number of key issues that are holding

the industry back, as well as opening

up the doors to a major new wave of

innovation. Less friction and less fraud.


Advanced Biometrics

The users face is checked over a hundred

inspection points and matched to the ID. Without

any human bias or fatigue, there is now an

immutable bond between the present, real human

user and the verified identity document.

The user can now apply for that account, if the firm’s

policy requires more documents, she can add them,

or if the wallet contains sufficient verified documents

already – she can just ‘Tap-to-share’ and a public key-

encrypted message is sent directly to you, instantly.

Need to refresh information periodically? You can

send a notification to Folio and request updates.

Some transactions may be deemed lower risk,

others – large payments or new account opening

for example, understandably justify higher levels of

assurance. For that Folio provides a configurable

authentication rule set… just need a passcode?

OK? Thumbprint, Selfie, Moving Selfie…?

The levels of assurance are yours to control but in all cases, the simplicity, convenience and speed for the user is so much faster than traditional means.

And their privacy is entirely in their control, they

must consent to any ‘share’ request, and have

control over which attributes are shared.

Their data is theirs alone, encrypted on their smart

device and nobody can see it unless they explicitly share

at that time. Folio can’t see it, neither can the bank.

Folio is built to integrate best in class component

technologies, as well as referencing external

resources. If a better document validation technology

is established, Folio can plug it in, future proofing

our clients in a fast-moving technology space.


9 AI driven face matching

9 24/7 operation

9 100% online

9 Multi factor authentication

9 Zero bias, no fatigue

9 1000’s of valid ID’s

Billion unique mobile users

3.5


9 Ongoing compliance

9 NFC chip compatible

9 Onboard in 60 seconds

9 Authenticate in 1 second

9 Multi mode biometrics


What makes us different?Some of the critical components of Folio’s platform



What makes us different?

Some of the critical components of Folio’s platform:



Best in class eIDV:Few identity solutions expose

their technology to the cold, hard

reality of the app store and google

play. Of the few that do, Folio has

by far the highest user ratings

(4.7 app store, 4.2 Google Play)

Frictionless:The end-user ratings evidence

that Folio delivers a seamless

user experience and that many

other app-based solutions are

letting their client banks down.

Private-by-design:Folio takes great care to ensure

this message is clearly articulated

to end users and organisations

- removing fear and uncertainty

barriers-to-adoption.

High Assurance:Folio’s combination of AI, and

proprietary IP and processes

ensure the highest level of

ID assurance any given step

and any given moment

Integrated:Folio is built to integrate best in

class component technologies,

as well as referencing external

resources, future proofing

our clients in a fast-moving

technology space.

Global Reach:Folio supports document validation

against over 3000 photo ID

documents globally, and can quickly

add other templates and rule sets

making it the most flexible solution

even for global institutions.

Re-usable:By focussing on the user, Folio

supports an end-to-end solution

design that removes KYC friction

at every interaction point. Once

onboarded, the identity building

blocks can easily be applied as

authorisation steps throughout

the customer journey.

Low maintenance:Folios RESTful API model operates

in a SaaS-based deployment

model with POP throughout

the world and conformity to all

key international regulations.


Digital Identity - Who Cares?

W H I T E P A P E R

H E L L O @ F O L I O . I D | W W W . F O L I O . I D / T R Y F O L I O

88 Baker Street, LondonW1U 6TQ, United Kingdom

U K

2450 Colorado Avenue Suite 500Santa Monica, CA 90404

U S A

PH Level Suite 32, Suntec Tower Three,8 Temasek Blvd. Singapore 038988

S I N G A P O R E

/ C O M P A N Y / F O L I O LT D/ T R Y F O L I O

Standards, accreditations and conformity:

Active participation in international bodies:

Available hosted on major platforms:

Documents

Digital Identity - Who Cares? - folio.id · DIGITAL IDENTITY WHO CARES? WHITEPAPER 6 DIGITAL IDENTITY DRIVES EFFICIENCY MANUAL MANUAL / DIGITAL MIX DIGITAL per identity per identity