Introduction
Financial institutions rely on reliable identity information to establish who their customers are, if transactions are genuine, and if financial services can be safely provided. Old identity systems, however, disperse personal data over banks, payment providers, credit institutions, and government records and verification service providers. This separation has the potential of having duplicate records, repeat identity verification, conflicting data and tempting targets for fraudsters. Blockchain identities are being seen as one application for enhancing the way identity information is verified, shared and controlled, in the increasingly digital financial services landscape. The Identity Management Institute offers an excellent overview in this article about blockchain identity management. Blockchain identity management financial institutions can use distributed technologies to complement existing ID infrastructure, providing an additional layer of security in verifying, authenticating, auditing, and controlling information exchange, rather than as an ID infrastructure replacement.
The Use of Blockchain Based Identity.
Blockchain is a distributed ledger technology which enables the parties involved to keep a synchronized record of the transactions made or events verified. The crucial concept in identity management is not to put a human’s passport, address or biometric data on a public blockchain. Rather, blockchain can be used to facilitate the creation of verifiable credentials, cryptographic proofs, identity references, and records of a specific verification event. Decentralized identity models have the potential to offer more control to people on the credential side and enable organizations to verify credentials without having to collect multiple documents. For instance, a bank would be able to confirm that another trusted institution has already confirmed a customer’s age, or identity, without having to store another copy of the original. This can help minimize duplication and provide a better audit trail of who issued, verified and/or relied on specific identity information.
How Blockchain Enhance Customer Verification
Customer verification is a core component to financial services as institutions need to identify a customer prior to opening an account, granting access to certain services or services that are deemed higher risk. Typical KYC processes involve the customer providing the KYC documents to multiple organizations, such as personal documents, personal details, photos and proof of address. These processes can be repeated and add to administrative costs, and leave room for inaccuracies in records. An identity framework supported by blockchain would enable the issuance of a verified credential by a recognized authority, and then to be presented to another financial institution. By using cryptographic verification, the receiving institution can be sure that the credential is authentic, has not been tampered with, and is current. It won’t take the place of due diligence, but it may help speed up parts of the customer onboarding process, and minimize the unnecessary handling of sensitive documents.
Supporting Transaction Authentication
Identity verification is just half the solution when it comes to financial security. Institutions also need to decide if the individual trying to access an account or to authorize a transaction is actually the account owner. Linking verified identity credentials with cryptographic keys owned by an authorized user or wallet can help with authentication, which is where Blockchain and decentralized identity can be useful. A customer might prove control over an identity credential by signing an authentication request with a private key, in addition to using passwords. The financial institution then could check the related public key and validate that the request is from a legitimate identity relationship. Other protections, like biometrics, device authentication, multifactor authentication, and transaction risk analysis would also be significant. Blockchain would then be considered as a part of the larger authentication system and not an ultimate solution to block every unauthorized transaction.
Fraud Detection and Prevention
Stealth, double, fake, altered and misused IDs, account takeover and duplicate identities are all common forms of financial fraud. Some of these activities might be more challenging in a distributed identity framework, as it would place more connection between the verified claims and the claim issuer. When a financial institution verifies a financial credential, it may verify the credential if the financial credential is cryptographically signed to detect if the financial credential has been altered in any manner. A shared record might also be used to track whether a verification event or credential has already been used or revoked, to apply the agreed rules. Authorized institutions could verify the status of a compromised identity credential before using it, for instance, if one is revoked by a credential issuer. But it doesn’t automatically identify fraud in blockchain technology. Despite all of those steps, the right information is still needed to make the right decisions, the identities are still not properly authenticated, analytics of fraud must be performed, and any anomalous activity must be reviewed by humans or automation to ensure the right decision is made.
Implementation of Secure Sharing of Financial Information
Information is being used to transfer between banks, payment providers, investment platforms, insurers, credit institutions and other organizations, increasingly across the financial services industry. Traditional forms of information sharing can include multiple copies of documents, EAI (Electronic Application Programming Interfaces), centralized databases and email attachments. Every extra copy may be a source of another potential leak or mishandling of information. Decentralized identity can enable a more controlled approach where customers provide specific verified identity elements to a trusted entity instead of providing access to their entire identity. The critical data can be safely stored off chain and blockchain can be used to provide proof of credential issuance, credential status changes, consent, or other activities. This separation matters since the data would be on an unchangeable ledger and it could lead to significant privacy and data loss issues.
Data Ownership and Privacy
One of the key challenges in blockchain identity systems is privacy. Financial identity data may contain names, addresses, identification numbers, financial histories, biometric information and other sensitive information. An inadequately designed blockchain solution might reveal too much information or leave permanent records which are hard to amend. These are often the key goals of decentralized identity models: minimizing data, disclosure by the user, encryption, and user control. Selective disclosure is a person’s ability to establish a specific fact without the introduction of unrelated information. For example, a customer could provide proof of age without giving her actual date of birth. Despite such safeguards, the information may not be fully under the control of the individual in practice since financial institutions and regulators have legal obligations. Any good system should strike a balance between customer control and acceptable customer verification, record keeping, security and investigation needs.
Cybersecurity Considerations
Although blockchain can enhance some parts of the security of identities, it does not make identity systems invulnerable to cyberattacks. Private keys might be lost, wallets could be breached, credential issuers could be compromised and applications may have vulnerabilities linked to a blockchain. At the start of the process a fraudulent identity may be presented if an attacker is able to fool the bank that is the first point of contact to verify an identity. All of these critical pieces of the identity puzzle on a blockchain from identity proofing, key management, credential issuance, storage and recovery plans, smart contracts, user interfaces, and connected databases are crucial to any blockchain identity ecosystem’s security. An adequate access control, encryption, monitoring, incident response, key recovery system, and regular security testing would be required for the financial institutions. While Blockchains can offer records that are tamper-proof, they don’t fix inaccurate information and they won’t help with poor operational security.
Compliance and Governance
Financial identity systems are part of the large regulatory systems that address customer identification, anti-money laundering, data protection, cyber security, consumer rights and record retention. Hence, blockchain based ID projects can’t be achieved simply with technology. The institutions have to decide which institutions can issue credentials, who can validate them, how to deal with the revocation of credentials and who will be held accountable when the information they provide is incorrect and leads to damage. When two or more banks (or service providers) are connected to the same network, governance is particularly relevant. Access rights, technical requirements, liability, procedure for dispute resolution, audit responsibilities, and actions in response to compromised credentials are all areas that need to be addressed in rules. Regulators might also mandate the availability of information for investigations or for a stipulated time. A decentralized architecture requires good accountability, as decentralization of data/infrastructure does not get rid of legal accountability of participating organizations.
Practical Challenges of Implementation
While the blockchain-based identity systems have the promise to deliver benefits, there are significant practical challenges for financial institutions in implementing these systems. Current banks tend to have “legacy” systems complex systems that have been built at various times and with incompatible databases, customer identification and security protocols. Adding a new identity network onto these systems may take a lot of investment and technical know-how. The other issue is interoperability. Only if other authorized institutions can understand and trust the format, issuer, verification method and status information of a credential will it be useful. The adoption also needs cooperation between various stakeholders, including banks, governments, technology providers, and customers, as identity issuers. The utilities of a shared identity infrastructure can be small if there are only few organizations involved. Costs, business value, operational readiness, customer experience and industry standards are important considerations for institutions to make before they expand their use of pilot projects to widespread deployment.
Future of Blockchain Identity in Financial Services
The trajectory of financial identity’s future with blockchain is less clear cut as of yet and will likely rely on more on interoperability and building bridges between trusted identity services. Financial institutions can adopt verifiable credentials, digital wallets, cryptographic authentication, privacy enhancing technologies, automated compliance processes and other methods, in addition to traditional databases and security measures. In this approach, blockchain could function behind the scenes as a layer of trust and verification for the customer, instead of making an impact on their lives. Success will be achieved if industry actors can come to an agreement on standards, rules of management, liability, privacy and ways to retrieve lost identities. It seems that the best solutions will be ones that address certain problems that customers are facing, such as repeatedly having to ask customers for their verification credentials or for their credential to be checked, but that also fit into the existing financial infrastructure and do not force financial institutions to overhaul the entire systems they have in place.
Conclusion
The concepts of blockchain and decentralized identity are intriguing for financial services and present a complex yet promising way to combat identity theft and verify identity. These technologies can help mitigate some of the issues with fragmented identity systems and multiple document interactions, using cryptographic verification, verifiable credentials, controlled information sharing and tamper evident records technology. They can also help to improve the integrity and sharing of trusted identity data between trusted organizations. But blockchain cannot be considered as a blanket safeguard against fraud. All of these privacy risks, cyber security issues, regulatory requirements, governance issues, interoperability issues, misaligned and incorrect source data, as well as implementation costs, have to be addressed. The best way is thus a balanced one: financial institutions should adopt blockchain as long as it offers a tangible gain in security or efficiency, but with an unchanged set of control measures, human supervision, privacy protection and compliance with regulations. Blockchain ID infrastructure is a potential valuable element of safer, more user controlled and managed financial services, if used responsibly.
Get more well researched information about Blockchain identity verification here.
