27/05/2020 infocert - copyright 2019 · customer and the financial institution process...

www.infocert.digitalInfoCert - Copyright 201927/05/2020 2

INTRODUCTION

www.infocert.digitalInfoCert - Copyright 2019

THE ROLE OF TRUST IN DIGITAL RELATIONSHIPS

27/05/2020 3

Multichannel approach and digital customer journey require paperless processes to be flexible, device independent, accessible both in presence (agents, branches) and remotely (web, mobile).

Digital onboarding and contract subscription require highly trusted transactions and certification of online clients’ digital identity.

MobileBranch Agent or dealer

Web


DIGITAL CUSTOMER ONBOARDING PROCESS

27/05/2020 4

Onboarding is a process that requires identifying customers and verifying their identity with high level of security and low level of risk.Five elements need particular attention

Data collectionCollecting client’s personal data and ID documents

IdentificationThe anti-impersonation steps ensures that the customer applying for the product are "who they claim to be"

VerificationVerification of the customer's identity and compliance

Electronic signatureEnsure that a contract is duly signed between the customer and the financial institution

Process orchestrationIt is necessary to make a smooth and transparent experience for the customer who doesn't see all the systems used during the process


TRUSTED ONBOARDING PLATFORM (TOP)

27/05/2020 5

Trusted Onboarding Platform™ (TOP) is InfoCert’s

patented solution for customer identification and digital

subscription of contracts.

TOP enables easy and smart integration of e-signature

processes within existing systems, enhancing the user

experience and speeding up the customer journey.


FORRESTER’S TEI STUDY

Video onboarding

27/05/2020 6

Return on Investment: 174%

Payback period: 0.6 months

Fraud reduction rate: 80%

Increase signed customers: 30%

KPI computed for a TOP banking client, comparing a video onboarding process with traditional face-to-face identification at the branch.


FORRESTER’S TEI STUDY

Instant lending

27/05/2020 7

KPI computed for a TOP banking client, comparing a 100% digital process with previous paper-based process at the branch.

Return on Investment: 260%

Payback period: < 3 months

Abandon rate reduction: 80%

Increased personal loan demand: 100%


USE CASES

Orders authorization for contract

management

02

04

01

03Remote e-signature

for actual clients based on existing

identity

Face-to-face selling by a financial promoter or an agent/dealer

Consumer credit processes at the bank office, in a remote mode or by using a mobile app


CUSTOMERS THAT ALREADY BELIEVE IN TOP

Banking

Consumer credit

Insurance

Telco

Utilities

Government


MODULES


TOP MODULES

27/05/2020 11

TOP is a modular platform, comprising building blocks ready to be configured according to customer’s requirements. Components, that can be mandatory or optional for a specific process, are coherently set in a unique technological framework, a consistent data model, a complete auditing of all compliance related events, and a single set of APIs to guarantee an effective adoption path in every business environment.

Certificate

enrollment

Identity

assertion

Identity

proofing

Identity

corroboration

Electronic

signature

Authentication

system

eDelivery

system

Long term

preservation

Document

composition

Identification Electronic signature Services

Audit Framework

Integration layer (SOAP and REST)

Presentation layer (TOFE)


IDENTIFICATION

27/05/2020 12


IDENTITY PROOFING AND CORROBORATION

Convergence of technologies and activities

27/05/2020 13

The identity of new customers cannot be absolutely verified

("proven"), but high confidence in identity is crucial to protect

customers and revenue.

Identity proofing and corroboration are the combination of activities

that brings an identity claim within organizational risk tolerance.

The main goal of this activities is to prove that:

1. The real-world identity exists

2. The individual claiming the identity is in fact the authentic

possessor of that identity

This process must align three aspects of identity: the real-world

identity, the digital identity and the person submitting the identity

claim.


IDENTITY PROOFING

27/05/2020 14

Identity proofing process includes multiple activities that, starting from an identity claim, check:• The real-world identity exists• The individual claiming the identity is in fact the authentic owner of that identity

C U S T O M E R U X

D A T A R E C O G N I T I O N

D A T A V A L I D A T I O N

DOCUMENTEXTRACTION


IDENTITY PROOFING

Customer UX

27/05/2020 15

VideoID is InfoCert’s patented solution for remote video identification

▪ VideoID is based on WebRTC and during this session an Operator is able to Identify your Customer.

▪ All the steps defined into the process are controlled and monitored by the platform

▪ All the pictures of Customer's ID Cards are taken during the session, through Webcam or Mobile Camera in case of Mobile experience

Chat

User

Video Operator


IDENTITY PROOFING

Data recognition

27/05/2020 16

A mixed set of technologies allow identity documents recognition and user liveness verification

MRZMachine Readable Zone (MRZ) is a document format containing the document holder's data in a form which is both visually readable and encoded for optical character recognition.

Liveness detectionLiveness detection ensures that there is an actual person in front of the camera, and not a photo or a streaming video.The user just have to look into the camera and do few movements, such as blinking, smiling or turn their head.

eID NFC readingThis component allows accessing any eMRTD (electronic Machine-Readable Travel Document) document via NFC, to obtain owner's personal data and photo.

Face matchingFace matching technology allows automatically checking the person providing the ID document is the same person the document belongs to.Through a simple interface the user can take a selfie, or a short video and their face is compared with the photo on the ID document.

Data extractionOptical Character Recognition (OCR) technology is used to identify and extract data from the ID document. The module can also work offline on mobile devices, using an SDK integrated in a mobile app.

Document analysis Biometric analysis


IDENTITY PROOFING

Data validation

27/05/2020 17

Data validation module performs an automatic and real-time verification of the validity of the identification document provided by the user and can query third party databases for additional checks and data collection.

The authenticity of an electronic document canonly be established if the document is signedusing a private key of which the correspondingcertificate is known.

Identity document validation Certificate validation

The module compare the ID Document again a database of real document template verifying the security feature under normal light conditions


IDENTITY CORROBORATION

27/05/2020 18

D I G I T A L A T T R I B U T E

A S S E S S M E N T

C O R R O B O R A T I O N H U B

The Identity Corroboration modules analyze onboarding transactions digital attributes and metadata detecting user behaviorpatterns and anomalies. Transactions that flag as high-risk can be automatically rejected or routed to Corroboration HUB forstep-up.

DOCUMENTEXTRACTION

Identity corroboration process includes multiple activities going beyond flawed legacy methods and embracing analytics that evaluate multiple positive and negative signals.



Digital Attribute Assessment

27/05/2020 19

Digital Attribute Assessment module leverages Smart Analytics technology providing an extremely powerful way of detect and analyze real-time both personal data of the customer and changes in user behavior by using advanced behavioral analytics and machine learning.

Efficiently Onboard CustomersUsing always a unique Platform (TOP),You can always know who is on the otherside of each transaction during theonboarding process and throughout thecustomer life cycle of your relationshipwith the client

Integration FlexibilityBy integrating itself into business processes for the purpose of acquiring and monitoring customers, the system makes it possible to consult not only the databases of specialised external providers but also local databases in order to achieve a high level of knowledge of its customers

Real-Time Risk ScoringThe Person Data Validation module carries out checks on the vast assets received and provides as an output a summary of the investigations carried out containing the results of the checks and findings made.

Global Verification CoverageMultiple search within specific Data Base for the verification of personal information provided by the customer in order to carry out an adequate verification of the user




27/05/2020 20

Credit Bureau

Score output

AML investigation collected data

AML Score Cards Repository

(Decision Rules)

AML application processing

(From onboarding front/office)

Audit LOGLocal Lists

Risk Rating

A dedicated platform to realizeautomatically all the Know Your Customer(KYC) activities checking external databases and creating a risk rating appling acustom set of rules.The platform is tipically used in a KYCcontexts and is usefull to verify aCustomer AML (AML – anti moneylaundering) Compliance.




27/05/2020 21

Useful for reconstructing the control chain and obtaining details on the subjects, such as, for example, taking over company boards, equity investments, associated companies, protests and prejudicial, risk assessment of the area in which the subject operates.

Used to recover crimes published in the Italian media giving greater weight to property crime.

Ministerial data bank for identity theft prevention.

PEP/PIL lists and international anti-terrorism.

Market leader aggregator of hundreds of international lists and PEP.

Real estate assets database, protests, prejudicial.

Group internal lists can be integrated and managed by the Customer.

Based on Customer needs, we are able to connect to Engine several services together with the "weight" of the results on the total scoring and various other parameters. External providers are essential to carry out an adequate screening of individuals or companies.The connectors already available are:




27/05/2020 22

Digital Attribute Assessment module leverages Smart Analytics technology providing an extremely powerful way of detect and analyze real-time changes in user behavior by using advanced behavioral analytics and machine learning.

The Network Behavioral model Smart Analytics Toolset

The ThreatMetrix Digital Identity Network protects 1.4 billion unique online accounts using intelligence harnessed from 2 billion monthly transactions.

Based on a user’s history derived from TheNetwork, ThreatMetrix behavioral model usesbehavior and metadata for automated detectionof user behavior patterns and anomalies.

The Smart Analytics toolset allows TOP customersto create custom variables, rules, models andpolicies to analyze patterns specific to their usersand automate responses for transactions.Transactions that flag as high-risk can beautomatically rejected or routed to CorroborationHUB for step-up, while legitimate usersexperience no friction.



Corroboration HUB

27/05/2020 23

Identity validation module performs an automatic and real-time verification of the validity of the identification document provided by the user and can query third party databases for additional checks and data collection.

RealtimeAll the information captured during the process (personal data, video streaming, photo, documents, selfie) are available in real-time.

Security and ComplianceEach operator is provided with personal credential and a qualified certificate that to sign an identification report

ReportAn operator can access all the evidences and a scoring on the automatic checks. A detailed report which details all the phases of the analysis can be downloaded.


IDENTITY ASSERTIONS

Available options

27/05/2020 24

TOP provides multiple identity assertion modules to fit different scenarios and enable business processes to identify customers and verify their identity with high level of security and low level of risk.

Identification is the core of eIDASregulation, that is named “Regulation on electronic identification and trust services”

USERLiveID

VideoID

SelfID AutID

SignID

AMLID


LIVEID

Face-to-face identification

27/05/2020 25

The LiveID identification requires a face-to-face meeting between the person being identified and one of the subjects entitled to perform the recognition.The process is 100% digital: ID documents are digitally collected (e.g. through a mobile device camera), contracts are signed electronically and delivered via e-mail.


VIDEOID AND SELFID

Balance customer UX and trust level

27/05/2020 26

The combination of user experience and the need for trust is essential to design the process that best fits business and compliance requirements.

A self-identification and unattended process, that leverages on machine learning and biometric technologies to automate the identification steps.

Unattended

Self video wizard

SelfID

A remote assisted identification process where an Operator verifies the customer’s identity through a live video call.

Live

Assisted photo wizard

Video Conference

VideoID

An hybrid process that can be realized with the same UX defined for SelfID, with the addition of a short live video identification with an operator.

Self photo wizard

Light Video Conference

Live

FastID

Self photo wizard


VIDEOID AND SELFID

Processes

27/05/2020 27

Customer UXData

recognitionDocument validation

Back office UX

Self Identification

Self Service Automatic AutomaticASYNC

Back-office

Fast Identification

Hybrid Automatic AutomaticLIVE inVideo

Conference

Video Identification

Led by Operator

by Operator by OperatorLIVE in Video

ConferencePR

OP

OS

ED

S

OL

UT

IO

NS

F O C A L P O I N T F E A T U R E S

POSITIONING STRATEGY

TRUST

USEREXPERIENCE

COSTTECH IMPACT

EFFICIENCY


VIDEOID AND SELFID

SelfID

27/05/2020 28

PR

OP

OS

ED

S

OL

UT

IO

NS


Customer UXData


Back office UX

Self Identification


Back-office

Fast Identification


Conference


Led by Operator


Conference


TRUST

USEREXPERIENCE

COSTTECH IMPACT

EFFICIENCY


VIDEOID AND SELFID

FastID

27/05/2020 29

PR

OP

OS

ED

S

OL

UT

IO

NS


Customer UXData


Back office UX

Self Identification

Self Service Automatic AutomaticOFFLINE in

Automatic Back-office

Fast Identification


Conference


Led by Operator


Conference


TRUST

USEREXPERIENCE

COSTTECH IMPACT

EFFICIENCY


VIDEOID AND SELFID

VideoID

27/05/2020 30

PR

OP

OS

ED

S

OL

UT

IO

NS


Customer UXData


Back office UX

Self Identification

Self Service Automatic AutomaticOFFLINE in

Automatic Back-office

Fast Identification


Conference


Led by Operator


Conference


TRUST

USEREXPERIENCE

COSTTECH IMPACT

EFFICIENCY


VIDEOID AND SELFID

Assertion enrollment

27/05/2020 31

Assertion enrollment

Advanced Assertion

Qualified Assertion

PR

OP

OS

ED

S

OL

UT

IO

NS


Customer UXData


Back office UX

Self Identification


Back-office

Fast Identification


Conference


Led by Operator


Conference


AUTID

Authentication ID

27/05/2020 32

With AutID method, InfoCert identification is based on a pre-existing means of identification.This identification means can either be eIDAS-notified or private identity schemes, at different trust levels.


SIGNID

Identification based on a Qualified Certificate for e-Signature

27/05/2020 33

With SignID, InfoCert leverages the identification already performed by another Qualified Trust Service Provider.To complete the identification phase, the user, that already owns a valid qualified certificate for electronic signature, needs to digitally sign a request form provided by InfoCert.


AMLID

Anty-money laundering identification

27/05/2020 34

With no prejudice to InfoCert’sliability, the identity of the Subject can be verified by Entities subject to the obligations under Anti-Money Laundering (AML) laws transposing Directive2005/60/EC of the European Parliament and of the Council on the prevention of the use of the financial system for the purpose of money laundering and terrorist financing, and subsequent EU implementing legislation.


ELECTRONIC SIGNATURE

27/05/2020 35


CERTIFICATE ENROLLMENT

27/05/2020 36

TOP can enroll different types of certificates in terms of trust level, lifetime, and scope, depending on the requirements of the target process.

Non-qualified certificateTo be used for AdES.

Qualified certificateIt can be issued only by a QTSP and is required for a QES. Specific identification methods must be adopted.

Trust level

Long termConfigurable lifetime, from 1 day up to 3 years.

One shotA remote certificate that can be used only for a single signature process to digitally sign a set of documents/contracts.

Validity

Cloud/RemoteNo hardware is required on signer side, with the certificate remotely hosted a Hardware Security Module (HSM) managed by a QTSP.

Device

OpenThe certificate can be used to sign any kind of document via any compatible signature tool.

EnterpriseIt can be used only in a specific domain, to sign only a restricted set of documents. A common example is a certificate available in a private area (e.g. home banking) to sign documents with a bank. No other personal documents can be signed by the user.

Scope


AUTHENTICATION SYSTEM

27/05/2020 37

Strong customer authentication is based on the use of two or more possible authentication elements, categorized as:

Something only the user know

Something only the user has

Something only the user is

Knowledge

Possession

Inherence

Strong authentication is any method of verifying the identity of a user or device that is intrinsically stringent enough to ensure the security of the system.This method is used to unlock the certificate and apply the electronic signature on documents.

The enrollment and signature processes configured in TOP expect a well-defined ownership of the system used to authenticate the user. TOP can manage several authentication mechanisms

A text message containing the One-Time Password (OTP) is sent to the mobile number of the user

OTP is displayed or notified to an APP Mobile on the user device.

Based on the authentication already used by InfoCert customer

OTP SMS

OTP push

Out-of-band


ELECTRONIC SIGNATURE

27/05/2020 38

Electronic signature module can manage both Advanced Electronic Signature (AdES) and Qualified Electronic Signature (QES), to meet different risk and trust levels required by business processes.

Advanced Electronic Signature (AdES)

A flexible solution able to grant:

a) The identification method that fit with the Client idea of CustomerExperience and legal trust;

b) The signature experience that best fit the use case;c) Brand new authentication method, that can make a smoother

Customer Experience and a fast onbarding.

Qualified Electronic Signature (QES)

A solution to grant a fast and user friendly onboarding while:

a) The identification methods are given by the Qualified Trust ServiceProvider (QTSP) and approved by the Italian Supervisory Body (AgID).The Client can choose the identification method that best fits itsonboarding process;

b) The signature experience has a great usability, but it is fixed both tolegal and technical requirements.


SERVICES

27/05/2020 39


DYNAMIC DOCUMENT COMPOSITION

27/05/2020 40

Documents can be generated using standard models or custom templates and in both cases the integration with pre-existing data is guaranteed, usually sourced from ERP or CRM applications.

Organizations often face the dilemma of communicating efficiently with customers without compromising the quality of personalized contact. This is where dynamic document composition comes into play.


E-DELIVERY SYSTEM

27/05/2020 41

Signed documents can be distributed through InfoCert’s registered delivery service, granting proof of sending and

receiving the data, and protecting of transmitted data against the risk of loss,

theft, damage or any unauthorized alteration.


LONG TERM PRESERVATION

27/05/2020 42

Evidences and documents collected during the process are safely archived in LegalDoc – InfoCert’s long-term preservation system – granting legal value over time.

Our mission is to equip our clients with a document preservation system able to guarantee integrity, readability, accessibility, and durability of the preserved documents overtime.


AUDIT FRAMEWORK

27/05/2020 43

The audit framework grants the collection of evidences during a TOP process, providing a high-performance solution to guarantee reliability, integrity and low risk.

An Information Technology audit is an examination of the management controls within an IT infrastructure. InfoCert, as Certification Authority known for its trust services, provides high performance solutions in order to guarantee reliability, integrity and low risk

Events

•Certificate Autority

•Electronic signature

•Certificate enrollment

•SOAP/REST APIs call

Data

•Identity assertion

•VideoID evidences package

•Acceptance clauses

•Digital certificate

Audit framework


INTEGRATION LAYER

27/05/2020 44


INTEGRATION IN BUSINESS PROCESSES

27/05/2020 45

Customer systems and infrastructures

SOA Layer (SOAP, REST)

Salesprocesses

Internal processes

Identity

proofing

Identity

corroboration

Electronic

signature

eDelivery

system

Authentication

system

Certificate

enrollment

Document

composition

Identity

assertion

Long term

preservation


MOBILE SDK

27/05/2020 46

Mobile SDKs are available for the creation of custom native user experiences in mobile apps.

TOP offers a set of Mobile SDKs, compatible with iOS and Android, dedicated to the use InfoCert's Services on Mobile as: o Liveness Detectiono Face Matchingo Identity Document management (e.g. OCR)o Video identification


PRESENTATION LAYER

27/05/2020 47


TOP FRONT END (TOFE)

27/05/2020 48

TOP front-end can be used out-of-the-box using the default responsive interface built on standard technologies (HTML5 + CSS3 + AngularJS).

This interface can be provided using:• InfoCert look & feel• Customer’s look & feel


LANGUAGES

27/05/2020 49

TOP natively supports multiple languages.Each language can additionally be customized to fit specific business contexts and communication styles.


CUSTOM FRONT END

27/05/2020 50

For a seamless user experience, custom front end can be implemented based on exposed APIs.


SAMPLE CUSTOMER JOURNEYS


SELFID WITH STANDARD IDENTITY DOCUMENT

27/05/2020 52

User signs contracts via OTP via SMS

User selects his ID document

Pre-filling of registration fields

Face matching and Liveness detection

OCR system to read data on the ID document

ID DocumentDefinition

BiometricChecks

SignatureRegistration

FieldsID Document

DaptureView

ContractsBack-Office

Identity Check

Contract Preview Sign ContractTake a selfie and follow the procedure for Liveness

Confirm Your DataFrame and click your document

Frame your face into the detection area


SELFID WITH ELECTRONIC IDENTITY DOCUMENT

27/05/2020 53

User signs contracts via OTP via SMS

User selects his ID document

Face matching and Liveness detection

User reads the contract and

request a certificate

Contract Preview Sign ContractTake a selfie and follow the procedure for Liveness

Frame your face into the detection area

Reading the Chip via NFC to access the digital data

NFC Data Extraction

ID DocumentDefinition

BiometricChecks

SignatureRegistration

FieldsID Document

DaptureView

ContractsBack-Office

Identity Check


FASTID

27/05/2020 54

A short video conference to grant the highest level of trust

ID document capture

Identity validation

ReportVideo

identificationID document verification

Biometric checks


VIDEOID

27/05/2020 55

A full video identification session performed by a call center operator

Video identification

start

Video identification

endReport

Identity validation

ID document capture

ID document verification


BACK OFFICE IDENTITY CHECK

27/05/2020 56

Data validation on external providers

Automated controls to validate the ID document

Corroboration HUBChecks outcome and scoring

Identity validation

Check OverviewBPO

ID documentvalidation

ID Document Validation

Identity Document Fraud Database

Customer Data Validation

Know Your Customer


SUCCESS STORIES


BANKING

REMOTE CUSTOMER ONBOARDING

27/05/2020 58

Launched in 2014, first Italian bank to offer 100% online experience and allow remote customer onboarding for account opening.


BANKING

MULTICHANNEL CUSTOMER IDENTIFICATION

27/05/2020 59

Client identification via remote and in presence channels for account opening.


BANKING

INSTANT LENDING

27/05/2020 60

Digital process on bank website for fast loan funding.


BANKING

CONTACT CENTER IDENTIFICATION AND SELLING

27/05/2020 61

Contact center enabled for remote customer identification and upselling thanks to electronic signature.


CONSUMER CREDIT

PERSONAL LOANS AT THE STORE

27/05/2020 62

Personal loans for good purchases with identification performed by dealers


INSURANCE

ONLINE AND OFFLINE SUBSCRIPTION

27/05/2020 63

In presence contract subscription with biometric signature, both in online and offline environments.


TELCO

ONLINE IDENTIFICATION FOR SELLING SIM CARDS

27/05/2020 64

Remote online identification to sell SIM cards from company website, in compliance with anti-terrorism regulation.


PRICING MODEL


PRICING COMPONENTS

27/05/2020 66

One-off Annual Volume based

o Analysis and definition of requirements

o Compliance support

o Contractual documentation in local language

o Configuration of specific TOP processes

o Set up of environments (e.g. development, production) and connection (e.g. VPN)

o License for TOP modules enabled for the configured processes

o Platform maintenance and evolution

o Based on selected modules and their specific configuration, e.g.:

• Identity Proofing

• Identity Assertion

• Electronic Signature

• Authentication

• Long term preservation

• Etc.

o Transaction price reduction depending on total annual volume

Set up and configuration Licensing Transaction


LICENSING AND TRANSACTION

Units scheme

27/05/2020 67

AutID

VideoID

LiveID

SignID

AMLID

SelfID

1

3

2

2

1

2

NFC

OCR 5

5

Enabled

Disabled 0

? Enabled

Disabled 0

? 3 years

Oneshot

2

5

AES

QES

2

3 Push

SMS

Out-of-band

2

1

1

Enabled

Disabled 0

? Enabled

Disabled 0

2

?: to be defined depending on specific implementation

Liveness detection

4

Enabled

Disabled 0

?

Facematching

4

Disabled 0

* Agent notincluded

Electronic

signature

Authentication

system

eDelivery

system

Certificate

enrollment

Document

composition

Back-office Audit

framework

Custom

Standard 0

?

Identity

proofing

Identity

corroboration

Identity

assertion

Long term

preservation

Other 3


UNITS PRICING TIERS

27/05/2020 68

Pricing tier Tier limit € per Unit

Tier 1 50K units € X

Tier 2 100K units € (X * 0.95)

Tier 3 250K units € (X * 0.9)

Tier 4 500K units € (X * 0.85)

Tier 5 1M units € (X * 0.8)

Tier 6 2.5M units € (X * 0.75)

Tier 7 5M units € (X * 0.70)

Tier 8 10M units € (X * 0.65)

Sample tiers and discounts. To be defined depending on specific project and expected volumes.


Thank you

27/05/2020