Posts

verify

2+2 for Global Compliance – Your Expectations are Unreasonable

Due to increasing data requirements and best practices encouraged by various government and financial directives (like the 4th Money Laundering Directive – 4MLD) concerning customer due diligence in the UK and European Union, GDC has had many requests to provide enhanced levels of electronic identity verification combined with Watch List/PEP and Sanctions checks to meet these compliance needs.

While some customers are satisfied to have input-data verified against a single authoritative data source, many others require checks to be verified against multiple authenticated, in-country data sources of varying data types.  This difference between the single and multi-source checks has come to be called 2+2 vs. 1+1 – electronic Identity Verification (eIDV).

The data elements available in the source may vary – for example, below you see two sources described: one Credit and one Government each with three elements to match.

However, the source is typically of a single type, which is not a fit for the new EU compliance regulations (See post on 4MLD).  The types of data source that can be matched for either a 1+1 or 2+2 are:

Picture2

1+1 Identity Verification

GDC’s Worldview platform has been providing 1+1 electronic identity verification since its inception. Customers and partners typically work in the fraud or e-Commerce space mostly with high-volume transactional use cases.  Their goal is to reduce friction in a process (customer onboarding, sales, etc.), increase speed and efficiencies and cut cost.

Picture3

Most of what is gained in a 1+1 is efficiency and cost savings but there are compliance and regulatory rules met with this 1+1 check.  In the example below, we check the input of name, DOB and address against a single credit source and we may receive either of the matches listed in the OR and achieve a pass.

2+2 Identity Verification

By definition, GDC sees a 2+2 request as matching 2 different definitions of input against 2 different data sources.  For GDC to fulfill a 2+2 request, we check to a minimum of 2 different sources.

Thus to accomplish a 2+2 request  GDC is sending to a single request to a data provider which controls multiple unique sources (for example, a single partner with both an Electoral Role sources or a Public Utility source) or to multiple “best available” providers in country with unique data sources.

.

As a rule GDC requires a match based on two input elements verified against two independent data sources. For example, a match could be made on COMPLETE NAME plus DOB in a credit data source (1) and  COMPLETE NAME plus ADDRESS in a government (2) data source.

So Why are Your Expectations Unreasonable?

The rules sound simple enough, so you are probably thinking to yourself, what do you mean we have unreasonable expectations?

Country/Source Coverage

Country and source type are the two most important considerations in assessing potential match rates, across the world, data sources and data privacy regulations vary greatly. What works well in the United States and the United Kingdom does not neccessarily work in France and Poland.
In our many conversations with prospects, customers, and partners, the 2+2 topic immediately moves to:“Our compliance officers require the same levels and inputs for all countries: 2+2 checks with credit and government sources for Countries XYZ and we need a match rate of 70% or higher.”
This approach is not country-specific, and creates a challenge when trying to apply the same mindset to countries around the world.  For example, while matching COMPLETE NAME+ADDRESS and COMPLETE NAME+DOB in the Unites States returns great results, matching both a Credit and Government source in France is not possible. It is, however, likely to produce a 50% or better match rate in Australia, where there are multiple credit and government sources to leverage.

Why is France a challenge? The French data sources are tightly controlled and not available for access – further France does not really have a credit bureau open for query. However, matching COMPLETE NAME and DOB in two different telco sources in France is possible.
What is the take-away? In thinking about data sources, there is a major difference between “unique and from independent sources”vs. “unique and from Credit or Government”. Furthermore, 2+2 may be achievable with COMPLETE NAME and ADDRESS in a “telecom/mobile” source in Spain and a “commercial” source in Spain, but with no credit and very little government data source access. Thus, you cannot expect to use all the same inputs in every country ALL over the world and achieve the same match rate results.

What are the options?

So, looking across the globe there are three elements you can control inside an electronic 2+2 identity verification to improve or optimize match and pass rates for your compliance use cases:
• Improve the quality of the input elements to match
• Tightening or loosening the rules on matching criteria
• Continue to add additional data sources to increase coverage and thus potential match rates

Improve the quality of the input elements to match upon

Data quality is a challenge in most organizations and if you are not able to produce input elements for matching in eIDV requests you will severely impact potential match rates. For example, GDC typically uses address verification, standardization and correction to enhance the quality of input address data and allow for more accurate matching on street/thoroughfare, house number, postal code and locality/city input elements.

Tightening or loosening the rules on matching criteria

After the quality of the input data the next piece that can be considered is the actual definition of a match and a pass. This is a good bit of what has been hinted at in the title around expectations. The most common place we see for making rules less stringent is in name matching. In many countries matching on a given/first name can be a supreme challenge, but many of these same countries will allow for higher match rates on first initial, sur/last name, full address and even date of birth. Matching first initial+last name or even a fuzzy match or distance match in place of the often-mandated exact match will sometimes drastically improve match rates.

Continue to add additional data sources to increase coverage and thus potential match rates

The final piece of the puzzle is the data sources themselves. If you are using two data sources and each cover 35% of the population your best result is 70%, but is more than likely closer to 30%. This does not consider the 2+2 rules that might require an exact match on first and last name when only 1 of the 2 sources has a first/given name available. The GDC approach is to recognize that the best match rates for 2+2 really require as many sources, that do not duplicate, as possible. These sources need to be different but ultimately 6 data sources (telco, government, credit, utility, postal, and consumer) – will produce a higher 2+2 match rate than just 2 of the data sources. Simply put, you are covering more of the adult population and thus have a better chance to match and pass.

To conclude – reasonable expectation to great expectations

When interpreting and crafting the compliance rules, such as for Customer Due Diligence, for your organization be aware and willing to utilize the data sources available within the required country, and country sensibilities and privacy regulations. Each will potentially be different. Be certain to provide the highest quality input data possible and let data quality work for your eIDV efforts not against them. Don’t be limited to 2 data sources in a 2+2 match but leverage as many as possible to get the job done. Lastly, don’t let your compliance rules hand-cuff your success with eIDV in a country – use what is available, how best it can be used to achieve success.

money laundering

4th Anti-Money Laundering Directive Prescribes Electronic Identity Verification for Customer Due Diligence

The 4th Anti-Money Laundering Directive (4MLD) came into force as an upgrade/replacement of the 3MLD (3rd Anti-Money Laundering Directive) on June 26th, 2017 with a clear goal of expanding the risk based approach established with 3MLD.  Further 4MLD expanded the requirements and general principles in the European Union which government the necessary checks required to meet money laundering and compliance guidelines.   

The overall focus for 4MLD is listed in the table below: 

Key 4MLD Focus areas of increased requirements:
Increased focus on risk based approach Required not just for Financial org. anymore
Focus on Tax Crimes Expanded Customer due diligence
Third country equivalence Politically Exposed Persons
Cross-border wire transfers Beneficial ownership

The 4th Anti-Money Laundering Directive (4MLD) came into force as an upgrade/replacement of the 3MLD (3rd Anti-Money Laundering Directive) on June 26th, 2017 with a clear goal of expanding the risk based approach established with 3MLD.  Further 4MLD expanded the requirements and general principles in the European Union which government the necessary checks required to meet money laundering and compliance guidelines.   

The overall focus for 4MLD is listed in the table below: 

(17)  Accurate identification and verification of data of natural and legal persons is essential for fighting money laundering or terrorist financing. Latest technical developments in the digitalisation of transactions and payments enable a secure remote or electronic identification.

It is this section that lays the ground work for eIDV’s requirement to meet CCD and 4MLD requirements.  Stay tuned to our next blog post where we break down the 2+2 rule set which meet the regulatory requirements for customer due diligence and discuss how your compliance team has unreasonable expectations for electronic Identity Verification. 

Colombia Identity Verification

Shared Visions – Identity Verification in Latin America

One of the best parts of my job at GDC is meeting founders of data services companies around the world. In many cases these founders have created unique identity focused solutions targeted for use within their local markets. Their customers are banks, insurance firms and in some cases the government. In some cases I will find entrepreneurs who have begun to look at expansion to other countries that are proximate to their home country. In every case when I sit down with founders and share our global mission they start off with a skeptical view but then quickly become very interested in how we have been able to achieve the progress made thus far. Most importantly they want to find a way to participate in making our global vision a reality. The most recent example of this was during a sourcing trip to Colombia.

Our goal was to meet with a number of possible data sources to help significantly improve our ability to provide Colombian identity verification within a 2+2 compliance framework. We spent three days meeting with various providers to get a sense of what was available and whether we could find local partners with the right alignment. One provider stood out from the rest because of the vision of the founder.

Daniel is one of Colombia’s pre-eminent tech entrepreneurs. He’s built a 100+ employee company that manages varying aspects of digital data and cyber security for the Colombian government. The data his company works with is the de-facto source data for Colombian consumer and business ID. This is Daniel’s third company and he is very clearly a knowledge base for all things identity in Colombia. He has a vision for growing a strong business throughout Latin America.

The conversation started on a familiar path. I spent time talking about GDC, what we do, how we do it and what we look for in data partners. Daniel spent time describing his business and what they were focused on in the market. He described how he helps to manage the core data provided by the government to deliver identity based services to the market. As I was listening I realized we had found a key source provider. At the end of his piece he directly states I’ve studied what you do and we would like to explore using your platform for your services in other countries. In that moment the conversation flipped from my focus on data sourcing to looking at his company as more of a bi-directional partnership which is the goal of the “Consortium” aspect of GDC. We saw value in Daniel’s ability to provide Colombian identity verification through his API and he saw value in our ability to provide identity verification for Mexico, Argentina and other countries through our API.

Our meeting ran over the 60 minutes we had mutually allotted for. We spoke of the challenges in the Colombian market, the need for identity verification to counteract fraud and the compliance requirements (4AML and GDPR) of banks and other financial service institutions that created a framework for identity verification in other countries.  We continued the communications via email and we will begin sharing technical details with each other after the holidays. Within a few months we will have his service up and running within our Worldview platform. We will continue to shape the offering utilizing feedback from our Latin American customers. This process will produce the best results and service for Colombia identity verification globally. Alongside our solutions for Mexico, Argentina, Brazil and over 40 additional countries we will continue to expand our coverage globally.

Whether it is Ricardo in Brazil, or Mariana in Argentina or Daniel in Colombia, the story is the same. Shared visions of how identity verification can help enable consumers and businesses transaction globally. Each provider brings their data and local expertise and together we help solve problems globally. Founders working together to achieve a common goal.

Shared Visions - Colombia Identity Verification

Shared Visions – Colombia           Identity Verification

sg-place-icon

Singapore: “Chili Crab” or ID?

The island nation of Singapore is known for many things.  Specifically, it is a “melting pot” of sorts including a mixture of cultures, languages, alphabets and nationalities. The city state is known for its cuisine, especially for its famous dish, the “chili crab.” Just like the food, the people are a fusion of all who come to reside there – Chinese, Indonesian, Malaysian and the list goes on.  One thing is for certain, the needs for identity verification are as dynamic and diverse as the cultures.  For those of you looking for the best places for “chili crab” in Singapore you can look here.

Chili Crab

Chili Crab

First, let’s take the Singapore national ID card.  The ID card represents the melding of peoples in the way it represents individual’s identity attributes.  Document validation, to verify identity, will tell you accurately that the format is correct (but not necessarily verified).  When a National ID/Passport scan or image is sent to the Document Validation provider they perform an automated analysis checking the validity of the information on the document ensuring the information makes sense and goes together, and that none of the images or data is forged. A Document Validation service provider may check the following data points:

  • Full Name
  • Nationality
  • Date of Birth
  • Photo
  • Gender
  • Document Expiration Date
  • Passport MRZ (Machine Readable Zone – two 44 character rows that convey the data on the Passport)
  • In the case of Singapore, the national ID includes elements very like a passport given the nature of the multicultural country.
  • Full Name – English then Native
  • Race – Example Chinese
  • Birth Date
  • Country of Birth – China, Singapore

Document Validation providers may also check characteristics of a document to ensure it has not been forged or altered.   This can include checking the background print, micro text, whether the document photo has been replaced, whether the fonts used are consistent and correct, and other authenticity checks.  These checks generally require manual review and often supplement automatic checks of the document data points.

However, verifying the data associated with a National ID against trusted sources is a different matter. For example, let’s look at one of the elements on the National Registration Identity Card – race. Surprisingly, Singapore allows TWO RACES in accordance with their race diversity disclosures.  

Front

Front

This is called “double-barreling” which applies to all babies born as of January 1st, 2011.  The ID card represents the melding of peoples in the way it represents race.

Here’s how it works.  Your race must be a logical combo of your mom’s and dad’s races. e.g. Malay-German or Malay-Caucasian. The race in front is regarded as the dominant one e.g. in the above example, “Malay” is the dominant race.  All siblings from the same parents must have the same race, if the kid gets married to someone else of mixed parentage, only the dominant race counts for both.

Next, let’s examine the card and how it represents the melding of peoples in the way it represents names. If you are of origin in another country – perhaps China, but have a Latin English name you will see both the English name and the Chinese name listed on the card in the order – English to Chinese. In other cases, the name may only be the traditional Chinese name, and it can vary and exposes a challenge of using only document verification.  

Name and race are two examples of the challenges of validating identity using document checks without electronic identity verification.

 The best solution is to combine document validation/authentication (Doc check) and electronic identity verification (eIDV).  This both checks the characteristics of the document and the accuracy of the data on it.  Combining Doc check with eIDV check for countries like Singapore will allow you to accurately and correctly verify one’s identity.  

Portugese Flag

Portugal: A Population of Global Explorers and Diasporas

Vasco da Gama Bridge

Vasco da Gama Bridge

I am sitting in a nondescript office in the harbor sector of the city of Lisbon looking out at the beautiful Vasco da Gama Bridge. This bridge is the longest bridge in Europe spanning over 12 kilometers across the Tagus River in Lisbon. While this bridge is a modern wonder, the discussion taking p
lace inside the office is also a bit of a wonder in the world of global identity verification.

I am reviewing the results of a test file with our Portuguese Data expert. We had originally processed his file and achieved somewhat lower results than desired. The timing of the file processing and my trip to Portugal allowed for me to sit down directly with him and a colleague to review the results and better understand why the results were so low.

One of the first things we discovered about the data is that a percentage of the data was made up of foreign names meaning non-Portuguese in origin. As a result, these people were likely not citizens of the country but might still be residents. Portugal is unique in Europe because it has a large and growing population of ex-pats who retire there from the United Kingdom and France. The way our expert described it is that Portugal was a country where “many people are passing through”. Some stay for a little time and some stay forever. Given the temperatures, the beauty of its beaches and the great cost of living I completely understand this.

So while we could not accurately validate those people with our Portuguese Identity Verification we were able to architect within our system to run those people who did not validate in Portugal through our UK and then French Identity Verification providers all within the same system. This “waterfall” approach allowed for us to gain some immediate lift in the results and better validate the ex-pats that had settled in the region.

The next data validation challenge that was unique to Portugal (and likely unique to Brazil) was what I dubbed “The Maria Effect”. A large number of the women in Portugal are named Maria. This is a statement made by a guy who has spent more than 20 years working with consumer data in Portugal so I am going to choose to believe this statement of fact. Many of the Marias have secondary first or middle names which create differentiators (example: Maria-Theresa). Additionally the last name of her family and/or the last name of her husband might be used when completing some types of documentation thus Maria becomes possibly Maria Theresa de Salvo Carlos de Herrera. This a complete legitimate full name. At 32 characters this name likely would not even fit into most online data entry fields but that is the smaller of the concerns. Maria may also express her name as any combination of the above depending on how she choosing to distinctly represent herself. So she might be Theresa de Salvo or Theresa de Herrera or Theresa Carlos de Herrera. In all of these examples Maria may be substituted for Theresa creating a database of Marias that may or may not link back to a known identity in Portuguese data systems. This is where customized and localized fuzzy matching and rules logic are needed to ensure the best possible match result when attempting a identity verification for this country.

The next example of local data uniqueness is the “da Effect”. Many last names in Portugal have a preposition of da or de associated with them. Names can thus be represented in systems as Vasco da Gama or Vasco Gama. In both cases they are the same person. Many identity verification systems may choose to work with a hard 1:1 match and thus this would not generate a match on this particular name. Other systems may elect to drop the da/de as extraneous characters and not recognize them as part of the last name thus corrupting the name and likely generating a poor response.

After reviewing all of these examples we were able to ensure that we tuned our inputs to properly parse data going into our platform for Portuguese nuances. This allowed for us to create a better result and improve the overall match rates. This in turn helps satisfy our customer’s needs which at the end of the day was the goal of the conversation.

The above is a great view on how hyper-local knowledge and skills will produce quantifiably better results for global eKYC and identity resolution efforts. Whether it is mobile customer onboarding at BBVA or HSBC; or fraud risk analysis at Kreditech of fulfillment of European 4th Money Laundering Initiative compliance regulations between customer transactions. At GDC we enjoy learning these nuances from our local partners and much like the vision of da Gama we seek to spread this knowledge throughout the world.

blog_br

Spotlight on Brazil and Electronic Identity Verification

Next month the eyes of the world will once again be on Brazil, this time for the 2016 Summer Olympics. Despite all its recent turmoil  – the trifecta of political, economic and health issues – I’m optimistic that Brazil will put on a fun and safe show for us all. More importantly, I’m optimistic about the country’s overall prospects.

The turmoil has kept many companies away from Brazil. But over the long run, businesses with ambitions in Latin American will have no choice but invest there. It is, after all, the world’s sixth largest country by population and seventh largest economy by GDP. Ignore it during this short-term instability, and you might lose your chance to participate in the long run.

The big eCommerce marketplaces recognize this. The financial press prints story after story of Alibaba, Rakuten, Amazon, Mercado Libre and others investing heavily in Brazil. Why do this in the face of the country’s current instability? Because competition among them is brutal. If any of them cedes market share today, competitors will be all too happy to take over relationships with their sellers and buyers.

GDC got the chance to see this competition firsthand earlier this year. We launched a Brazil electronic identity verification service to help eCommerce marketplaces onboard sellers quickly.

Verifying the identities of merchants before they can begin selling goods on marketplaces has become common practice in the industry. Without it, bad actors are quick to infiltrate a marketplace with counterfeit goods and other forms of fraud. Using identity verification – asking the seller to provide information proving he is who he says he is – stops fraudsters from registering under false pretenses. They never get access to buyers, so fraud goes down and customer satisfaction goes up.

One of the big eCommerce marketplaces recently started using the Brazil electronic identity verification service. Previously, they had a clunky seller onboarding process. It leaned heavily on a manual workflow, used multiple data reference sources, and required new merchants to provide a lot of personal information. For example, applicants had to scan and submit photo ID’s to a document verification service as part of the process. The whole thing was time-consuming, inconvenient for sellers, and expensive for the client to maintain. Worst yet, they were losing sellers. The friction of onboarding had legitimate merchants abandoning their registrations before they could be approved.

GDC was glad to help. Our Brazil electronic identity verification service consolidated their entire process into a single registration form. When a seller submitted his name, address and national tax ID, a single API call to our platform queried multiple sources of credit, government, commercial and consumer identity reference data from our in-country Brazilian partners. The various sources cover over 95 percent of Brazil’s addressable adult population, and we were able to help our client match and approve nearly 75 percent of all applications within seconds.

We streamlined their process, limited the need for manual intervention in the workflow, and reduced their dependence on document verification and multiple data services. Most importantly, we got rid of the friction that had so many sellers abandon the registration process.

This is what GDC does both in Brazil and in the many other countries integrated into our global electronic identity verification platform. We give you one point of access to instantly verify the identities of customers, partners or counterparties no matter their country of origin. We help you bring in the good customers quickly while weeding out the bad ones.

If your business is expanding into Brazil, and you need help with verifying the identities of your customers, let’s talk. In the meantime, enjoy the Olympic show Brazil has prepared for the world.

Thanks for reading!

Best,

Paul

Paul Dryden
Global Data Consortium
paul@globaldataconsortium.com

18monthreport

Our Report Card

Today is a memorable day for GDC. 18 months ago our first customer went live with our Worldview product, relying on GDC and Worldview to provide Address Verification. This client took a chance –to meet their needs for the best verification rates possible, they had to embrace a new model.

When we first speak with clients we explain our model – we find, qualify and integrate local companies that have the best address processing technology in their country. We harmonize our partner’s technologies and serve up all of that global value with a single OnDemand API. We understand that this model differs from other companies who build a single product, from a single data source, delivered the same way year-after-year.

Our clients embrace Worldview for innovative use cases. Companies validating address information as a key component of Identity Verification. eCommerce companies supporting cross-border commerce. Global organizations verifying and locating millions of points of interest. Delivery companies testing addresses to de-risk their logistics processes.

Now that we have been live for 18 months we can test the assumptions we made at the beginning. We had certain beliefs at the onset, how did we do? Let’s look at 4 of our initial suppositions.

Local Partners = Local Insight

We believed at the beginning that local partners would understand their country best and three themes have emerged. Within their country our partners handle regional variation, bad data patterns, and multilingual challenges better than anyone else.

Local Partners = Access to Unique Local Data

We thought that our partners would have insight on accessing, integrating and utilizing additional local data into their solution. GDC partners understand how to blend unique data into their solution, and they have the time and focus to do this work. Over half of our partners are using some form of data that is not being used by a global player.

Local Partners = Battle Tested Technology

Great address technology only gets great because it gets utilized; no one starts with an A+ product. We surmised our partners’ technology would be battle tested. For example, one partner’s offering is used by their country’s national post, and is accessed over a million times per week; the national post validates the goodness of their technology. This is representative of all of our partners – their technology is great because it gets used in-country, by clients that demand the best results.

Local Partners = Awesome Responsiveness

We knew our partners would be responsive in many ways. Our partners react quickly to new use cases and new address forms. Last month one of our customers had an issue with how a certain address suffix type was being handled, a pattern that would never be used in-country. Our partner enhanced their behavior and a correction was available the following day. Our partners are creating the next required services. A great example is our India partner that launched an advanced service. Our partners must continuously innovate; they don’t have the luxury of only revisiting their technology once a year, or when enough complaints for their country have piled up.

Where Are We Now?

After 18 months we have proven our beliefs at the beginning of this journey. We have worked with partners and clients that are willing to challenge conventions for how global address processing gets done. We continue to add countries to Worldview, and continue to tune Worldview to handle innovative eCommerce, Identity Verification, global point of interest, and delivery logistics use cases.

So that’s where we are 18 months since going live. Let’s see what the next 18 months brings. As always, we enjoy speaking with clients about how we can help you solve your business problems. Give us a shout and let’s see how we can expand your Worldview.