Page 59 - ITU-T Focus Group Digital Financial Services – Technology, innovation and competition

ITU-T Focus Group Digital Financial Services
Technology, Innovation and Competition

4.2 Transaction authentication

Once an account has been opened, all use of the service by the customer, whether it is related to account
maintenance or to transactions, must be authenticated.

How this is achieved is an important decision. In the case of India – and soon Pakistan – it is a requirement
that all such touchpoints should be authenticated against the national identity service. Whilst this may meet
various state objectives, it is arguable that it is not practical in the longer term. Even a simple projection of,
for example, Aadhaar authentications against projected use in five years’ time would suggest that the UIDAI
servers are likely to be amongst the world’s busiest, with commensurate availability requirements.
It is possible that a more practical approach might be to devolve the customer authentication requirement to
the financial service providers (backed by suitable regulatory reporting and data access requirements, which are
outside the scope of this document). This can be achieved by enhancing the customer registration process to
include the creation of a transactional digital identity, derived from, and linked to, the state-issued foundational
identity. This bank-issued digital identity would be backed by suitably robust customer authentication methods,
such as biometrics.

The reliability and efficiency of this approach can be enhanced still further by ensuring that the customer
authentication takes place at the edge of the network, and is sufficiently robust to support substantial confidence
in the process. This would mean matching a strong biometric or other authentication mechanism locally in a
suitably secure environment, such as a smartcard or a mobile phone. The result of the authentication would
of course be available to the bank and (via reporting and other mechanisms) to the regulatory authorities.

4.3 Customers without identity documents

Although many potential DFS customers will have a suitable set of identity documents (for example, it was
reported that Aadhaar registrars found that a remarkable 99.97 per cent of Indians had two identity (“breeder”)
documents, sufficient to register for Aadhaar), this is not always the case, and an approach to the financial
inclusion of such customers’ needs to be defined.

An approach that might be worthy of consideration is the creation of a dynamic digital identity for such
customers; so they can be registered with self-asserted attributes (name, address, mobile phone number,
etc.). Such a digital identity has a very low level of assurance , and would need to be developed before it can
17
be considered sufficient for the delivery of financial services. Development of the dynamic identity can be
achieved by:

• Associating a strong form of authentication, such as biometrics (subject to the considerations set out in
Section ‎3.2.3), with the identity at time of registration, so that the service provider can be assured that
the same person is accessing the service on each occasion through an authentication challenge.
• Attaching an attribute noting sponsorship/endorsement from someone who does have the necessary
documentation/state-issued digital identity .
18
• Verifying the 2FA opportunity based on the self-asserted mobile phone number. A higher level of assurance
may be achieved where the SIM has been registered by the mobile operator to the customer using, for
example, biometric authentication against a national identity scheme, followed by KYC processing. For
example, his is the approach used by mobile operators in Pakistan, who use NADRA for SIM registration.
However, in that case it is often the head of household who registers all SIMs for his family, and this
aspect may be problematic.
• Adding additional attributes as further documentation becomes available – for example, if a passport is
issued to the customer.
• Noting repeated/consistent usage of the digital identity over a period of months.

17 It is analogous to the digital identities created by UNHCR when registering refugees.
18 This is the basis of the other 0.03 per cent of Aadhaar registrations.

45