Self-Sovereign Identity: The Next Evolution for KYC

The know-your-customer (KYC) process has long been a headache for banks—it is an often complex, time-consuming, and duplicative endeavor, and it doesn’t directly provide revenue for the institution. While there have been efforts to make KYC requirements easier to handle—through the use of utilities, automation, or even enterprise knowledge graphs—it is much easier said than done.

The evolution of KYC, though, might just be self-sovereign identity (SSI) solutions, which can help overcome some of these issues by reducing the time it takes for banks and their corporate clients to conduct KYC checks.

Essentially, SSI allows the owners of the data to control when and with whom they share it. Ivar Wiersma, head of venture development at blockchain company R3, says there is now a trend toward using SSI, which builds on the immutability characteristics of blockchains and other distributed-ledger technologies. As is the case for most technology developments within the financial services industry, this trend, he says, is emerging more prominently in the retail segment of financial firms.

“I think we’ve already seen a lot of advances from manual authentication and identification into more digital forms of identification—where facial recognition is used; where AI and ML are used to scan passports and make, for instance, onboarding to neobanks very efficient. But it is still siloed, and personal data is still stored in centralized databases, and it can still be hacked,” Wiersma tells WatersTechnology.

He says SSI models can be a key differentiator for companies to offer transparency in how their clients’ data is processed. “So if you, as an end-user, own all your data, and you control it, and it’s been put back in your hands, you can actually take that information from context to context. So once you have onboarded to a bank, and you decide to become a customer of an insurance company, you can actually use that verified data and those verified credentials to onboard to another company you want to do business with,” he says.

One of R3’s partners, Clipeum, is developing a solution that provides corporates with a digital wallet to store all their information and documents required to, for example, open a bank account or become a customer of another institution. “The corporates decide when and where to share what type of documents and with what institutions. So they securely store their information on an immutable ledger. And if a bank requests for documents to apply their KYC processes, the corporate then decides what to share with that institution,” he says.
  
Currently, document and information-sharing is still done over email, which Wiersma says isn’t secure. SSI models, on the other hand, provide security, control, and transparency, as well as convenience for corporate customers.

For example, if “Corporate X” wants to open an account at a new bank because it is going to be part of a syndicated loan, there is still a lot of communication through email, phone calls, and even faxes, as the bank starts to gather the documents required to comply with the KYC procedures. During that time, there is little to no transparency around the documents required or a sense of how long the process will take. “From the perspective of the corporate, it is very much a black box, until suddenly—and often after weeks—the process is done, there’s a green light, and they get access to their new bank account,” he says.

Using an SSI model, the corporate would hold a secure wallet on a blockchain, which acts as the repository for the documentation and the secure communication line between the company and the bank. The company can submit documents to the bank to perform KYC checks. Once the bank has executed a certain check on a document, it can digitally stamp the document, marking the document as a “verified credential.” Wiersma says this verified credential then goes back to the corporate, which stores it in its wallet.

“Now, if the corporate wants to deal with another bank to open another bank account, they can share the same document via the same secure blockchain system. Holding a stamp of another bank that has previously performed a check, the new bank can conduct more security checks to that document, which will make it stronger over time. It doesn’t mean, per se—depending on all kinds of jurisdictions, laws, regulations, and so on—that the next bank can actually rely on the complete process of bank number one, but they can take value out of the fact that it’s already been digitally stamped and it’s a verified credential,” he says.

Financial services consulting and technology provider Synechron has done some work in this area.

In June 2018, the platform Synechron built on R3’s Corda enterprise blockchain—Leia II—went through a four-day collaborative pilot with 39 firms, including ABN Amro, BNP Paribas, Deutsche Bank, and Societe Generale. The trial involved completing more than 300 KYC transactions in 19 countries across eight different time zones. During the trial, banks could request access to customer KYC test data, while corporate customers could approve requests and/or revoke access.

According to R3, Leia II is still in the prototype stage.

It’s important to also remember that onboarding procedures and checks for KYC processes are more complex on the capital markets side than on the retail side, according to Wiersma. “They have much more information—more document collection—and therefore it is much more costly. So it’s a more difficult problem to solve for the industry as a whole,” he says. But, as is often the case with wholesale capital markets technology, advancements made on the retail side of the institution can pave the path for the wholesale side.