"There is a lot of activity going on in both the US and the UK around leveraging government data to help both the public sector and private enterprises verify identities."
Michael Magrath, Director at OneSpan
As the finance industry increasingly adopts digital onboarding technologies, they are utilizing and storing more of our biometric data and personal identification information. To keep pace with the need for the finance industry to accelerate their digital transformation programs, standards organizations and governments around the world are now creating new and updating existing regulations on how the finance industry must manage, protect, and store our data.
In the second part of our interview with Michael Magrath, Director of Global Regulations and Standards at OneSpan, we discuss the critical need for digital onboarding identity verification technology in the finance industry and why this area needs robust regulation to ensure that companies adopt compliant solutions that will protect the consumer.
The events of 2020 created huge pressure on businesses across all sectors but, from your perspective, what do you think has been the main pressure point on the finance industry?
“2020 was a very different year for everyone but especially for our banking customers and the financial industry as a whole - everyone has to now revisit everything. When we were talking to banking clients back in 2019, it was all about the migration to digital, electronic signatures and leveraging digital onboarding technology. Those were presented as a competitive and cost-saving advantage but, with the pandemic, it’s become a reality where if they don’t do those things, customers aren’t going to open up any new accounts or conduct transactions.”
With this increase in demand for digital onboarding technologies, there now seems to be a greater number of companies offering solutions. Do you think this an area in now need of better regulation?
“Yes, there are a lot of vendors in this space. It has created an eco-system of digital onboarding identity verification companies, but there is no distinct standard in how to do it. The FIDO alliance is right now in the process of developing standards that vendors, like OneSpan, can take their solutions through and perform a certification criteria and be audited by an independent third party.”
Digital onboarding, rather than being one thing, seems to encompass a range of technologies. If I were looking into my options to develop compliant solutions as part of a digital onboarding project, what should I now be looking at?
“At OneSpan, we help organizations digitally onboard customers, and we do everything from consumer identity verification, making sure that the ID is legitimate, and we have facial matching technology as part of this. Some companies do things piecemeal, but where we differentiate ourselves is that we also have the electronic signature technology – we’re one of the leading vendors in the world. By using e-signatures and the authentication technology we have, you can have a very secure and trusted digital experience.”
You talked about the need to ensure that an ID is legitimate. What are the latest developments in this area?
“There is a lot of work being done on verification processes around ‘who’ somebody is when they are presenting themselves digitally. At the end of the day, it is federal, state, and provincial governments that create and the data – they’re the ones who issue national IDs, Social Security numbers, driving licenses where they assign you a number, take your photo, and in some cases, capture fingerprints, etc. There is a lot of activity going on in both the US and the UK around leveraging government data to help both the public sector and private enterprises verify identities.”
Naturally, there are potential privacy concerns around the sharing of government data. Is this an area already under tight regulation to ensure that companies adopting digital verification solutions that utilize government IDs are compliant?
“There was bipartisan legislation that was introduced in the US House of Representatives called the Improving Digital Identity Act 2020. Members of Congress have introduced this legislation to create a task force that will be housed within the executive office of the President and it will have members from federal agencies and Congress but, most importantly, it will also have state and local government members. The Obama administration realized that this was a void that needed filling and with the Biden administration, I expect similar people were taking positions within the new administration and so this could gain some traction. Although the legislation dies at the end of the last Congressional session, the co-sponsors, Congressmen Bill Foster (D-IL) and John Katko (R-NY), have announced plans to reintroduce the legislation during the first quarter of 2021."
"It is also critical at the federal level to move forward on privacy and data protection legislation, as that has already happened in other parts of the world. I think substantive success in digital identity services requires a concerted and sustained effort at the national level. However, any such effort will have limited success without clarity on privacy and citizens’ ability to control the use of their own data at the attribute level.”
In your opinion, what would a compliant digital identity verification solution look like?
“An example of compliance is what has become the industry standard for identity verification - using a smartphone, taking a picture of a government-issued ID, having that ID verified and using facial matching technology to take a photo and then matching that photo with the one on the government-issued ID to have a high assurance as part of verification process that the person is the same person on the ID.”
Are there any good examples of where government ID based digital identity verification is being used successfully right now?
“In the US, the Social Security Administration just launched an electronic consent-based program to verify Social Security numbers. So I, as a consumer, can provide my consent to my bank as part of the onboarding process when I’m opening up an account, I’ll write down what my social security number is on the application, but in real-time, the bank will be able to ping the Social Security Administration’s database to get a ‘yes’ or ‘no’ return – they’re not going to provide personal information back to the bank. But, instead, confirm the details are correct.”
Finally, in terms of the future for digital onboarding ID verification, is this something you see becoming more widespread?
“Across the US, similar programs are being piloted as we speak, such as the US State Department for Passport Data and also the United States Postal Service for current mailing address data. This is going to be an extension of what the private and public sector can do to help verify identities and it will create more trust in the digital world.”
Digital onboarding identity verification solutions were already fast being adopted long before 2020. However, the COVID-19 pandemic highlighted the need for secure, compliant solutions in the finance industry. With this, of course, comes an increasingly complex global regulatory environment with more data privacy and data protection laws, each bringing unique regulatory requirements for financial institutions, but it is the industry experts such as Michael Magrath who are helping today’s finance industry leaders embrace new solutions and navigate the uncertainty by arming them with the information they need to remain both successful and compliant.
Part One of our interview with Michael Magrath: Global Finance Industry faces further regulation after pandemic exposes weaknesses
