The Onboarding Discussion and Digital ID Verification
A Q&A with Mark Straub and the Team at Smile Identity
Welcome to this week’s newsletter and the growing community of Frontier Fintech subscribers. If you’re not subscribed, kindly subscribe below and start receiving an article every Monday morning on different topics within the African Fintech space.
The Digital Identity Layer
The Identity layer is a critical aspect of any modern fintech tech stack given the importance of Know Your Customer (KYC) and Anti Money Laundering (AML) in the provision of financial services. As the world shifts towards digital financial services, a shift that has been accelerated by the Covid-19 pandemic, the ability to perform digital KYC and AML checks whilst onboarding clients has become ever more critical.
Traditionally, banks have relied on physical verification of customer identification to onboard a client. How this typically works is that a customer walks into a branch and requests to open an account. Often, the bank requires three core pieces of information, though this may vary depending on jurisdiction on institution;
Proof of identification;
Proof of Address;
A character check - often by way of recommender or reference checks;
This is often verified by a human being with the usual maker-checker principle being applied prior to on-boarding. Once all the documentation is verified, a bank staff keys in the details of the new client into the core banking system or in some cases, the customer management system that interfaces with the core. This is then approved at a second level and the client is officially onboarded. Other enhancements may exist within the system that runs screening on whether the customer is a Politically Exposed Person (PEP) or is within a global sanctions list. Additionally, internal checks may be done manually as part of enhanced due diligence that is sometimes mandated by the regulatory bodies.
In the case of corporations and entities, the process is in principle the same but just with a different set of documents such as Memorandum and Articles of Association, proof of identity of directors as well as a board resolution giving both the instruction to open the account as well as specifying who will operate that account.
This same process applies across the financial industry be it insurance, investment products and wealth management.
The key for digital onboarding is thus how do you automate this whole procedure to run without any human intervention and on modern smartphone driven distribution. To tackle this question, I had a Q&A with the team at Smile Identity who are offering identity verification services to firms in Africa that are looking at digitising the onboarding process.
This is a critical aspect of the whole digitisation drive as onboarding is the first and most critical step of any digital product, if you have a poor onboarding process then the rest of the product doesn’t matter. Here’s a great podcast where Scott Belsky, co-founder of Behance talks about how customers are either selfish, lazy or vain and that creating a seamless first-mile i.e. first few interactions with the app are critical in any product strategy.
Overview of Main Identification Systems
In the past, identification was based on where you were born and to which family you were born.
Identity systems in Africa are as varied as they come. On one hand you have countries such as Rwanda, Kenya and Botswana that have relatively advanced ID systems. Some of these such as Kenya are a legacy of the colonial administration where ID was a critical element of control. We have intermediate countries like Nigeria and Tanzania where there was no legacy of a well entrenched administrative system that issued national IDs. You then have situations where multiple ID types are used such as driving licenses and state ID.
There are cases such as DRC, Guinea Liberia where there are disconnected registers typically from small administrative levels such as districts or villages. ID systems are often paper based and easy to tamper with. Here is a useful resource on identification systems in Africa from the World Bank.
Nonetheless, Nigeria, Kenya and South Africa have all embarked on modernising their ID Systems. Nigeria introduced a National Identity Number (NIN) in an effort to centralise and modernise their identification system. Here’s a good breakdown of NIN. Kenya recently introduced the Huduma Namba system which is meant to be an upgrade on the old national ID system whilst South Africa is also working on a new biometric ID system.
The central thesis behind these ID systems are;
Moving from a control and administrative mindset towards ID to a more service oriented approach i.e. using your Identity as a means of offering government services more efficiently;
Moving towards a better life-cycle understanding of citizen data by enabling even the registration of minors;
Introducing modern features such as biometrics and API driven systems to enable seamless service provision.
The new vintage of ID systems being implemented in these countries are functionally more advanced than the existing systems and would thus be more useful for financial service providers. The Huduma Numba for instance would be a marked improvement as it would enable a better customer life cycle view of the client and would offer a single ID for nationals and foreigners thus simplifying on-boarding. Here is a very useful podcast resource on the digital ID space in Kenya.
McKinsey predicts that improvements in digital ID have the potential to drive an increase of between 6 - 13% of GDP by 2030. Of course, Estonia is the gold standard of digital ID and many countries should aspire to this. The massively successful Aadhar project in India is even more relevant given the similarities between India and most African countries with regards to infrastructure, education levels, rural populations and general demographics.
Within overall identity and particularly digital ID, players such as Google, Facebook and Apple are key providers of digital ID as they enable you to log into other apps by verifying your digital identity.
Overview of Regulatory Environments;
Most countries have similar frameworks as regards to KYC and AML - often you have Central Bank circulars that give general guidance towards principles towards KYC and AML. In Nigeria, the CBN has issued two useful circulars on KYC - the 2009 general circular and an adjustment in 2013 that highlights a tiered approach to KYC. In addition to Central Banks, regulatory bodies such as the Financial Reporting Centre in Kenya and the Financial Sector Conduct Authority in South Africa exist to police the conduct of financial institutions particularly as regards KYC and AML. In principle, the main elements that regulators require are;
ID and Address - Ability to verify your customers identity and have proof of physical address;
Timing - These records should be used upon onboarding and also whilst verifying transactions that fall between set regulated transaction limits;
PEP and Enhanced Due Diligence measures for large accounts and private banking clients;
Record retention - the ability to maintain these records for in most cases 7 years;
Here is a good breakdown of the different regulatory models in the world revolving around KYC for those who want to get into the regulatory rabbithole.
Q&A with Mark Straub and the team at Smile Identity
Smile Identity is an Africa focused digital identity and KYC services company offering its services mainly in Kenya, Ghana, Rwanda, Nigeria and South Africa with a view towards serving more markets in the future. At the heart of Smile Identity’s product offering is the utilisation of machine learning algorithms, Artificial Intelligence and facial recognition technologies to run identity checks making use of centralised government databases.
CEO and Co-Founder Mark Straub and his team were kind enough to do a Q&A with Frontier Fintech to shed more light on digital ID verification in Africa and what Smile Identity is working on.
You can find Mark on Twitter at @markstraub
Samora: Kindly give us a background of Smile Identity - what is the origin story?
Mark: During my time as an investor across Africa and India I kept seeing the same recurring issues of fraud and identity verification causing frustration to startups and their customers.
Every time a startup wanted to grow onboarding from say... 50 customers / day (or sales people, or agents) to something more like 500 / day, they would run into substantial fraud.
They would respond by introducing what I call the 3Ps: People, Process or Paperwork.
That introduced friction to their customers and created a limit on their natural rate of growth.
I knew there must be a technology solution and I spent a year talking to anyone who would listen, including lots of fintech entrepreneurs across Africa and some technologists with experience in security — one of whom became my co-founder. He suggested we explore face recognition since the technology had made huge gains in the prior year from open-sourced algorithms.
Samora: What is the problem you're trying to tackle and can you give us an overview of what you have accomplished so far and what scale you're currently operating on?
Mark: Proving your identity online is still an unsolved problem, globally, not just in Africa, but it is most acute in Africa. Africans spend an inordinate amount of time trying to prove or verify their identities in order to gain access to financial accounts, SIM cards and social services. And an estimated 500 million Africans still struggle to prove their identities at all, not just online. This must change and it is changing. We hope to be part of the solution.
So far we’ve helped over 75 companies across Africa verify the identities of millions of customers in seconds to minutes. Saving people time, money and hassle and reducing online fraud.
Samora: Let's take the Kenyan market - how are you set up technically as regards eKYC and identity with the relevant regulatory bodies and databases e.g. IPRS - what services can you thus offer?
Mark: We have been incorporated in Kenya since 2018 and are growing our team in Nairobi. Like banks, telecoms and major financial services entities we have an MOU with the identity authority that allows us to validate whether an ID number is real and confirm the associated basic identity information for that ID number. We can also verify whether a user provided Selfie matches a user’s photo ID or photo on file. Finally, we have several liveness and deduplication checks we can perform to ensure that the Selfie being provided is of a real live person and is not a duplicate user.
Samora: What are some of the use-cases that your product is currently being used for?
Mark: The most common use case is financial account opening, for bank accounts, money transfers, or loans. We’ve also been used in several social welfare programs this past year to help verify beneficiaries prior to them receiving payouts from governments for Covid relief.
Samora: One of the main issues with ID in Africa largely centres around fraud and identity theft? How does Smile identity deal with fraud and give your partners assurances about the people they're onboarding?
Mark: We greatly reduce fraud by blocking fake ID numbers and ensuring that users who present Identity credentials are in fact who they say they are. We do this by matching Selfies, names and other information against sources of truth — whatever they are for a given market. We’ve done over 6 million identity verifications across Africa and we’ve caught and blocked hundreds of thousands of cases of attempted fraud.
Samora: I listened to an interview in which you talk about meeting the relevant regulatory bodies for 17 straight months prior to making any progress - can you talk of the issues you've faced in terms of regulators?
Mark: We actually think very highly of regulators in this space. They have a hard job, and they are often doing it with limited resources. They also have their own diligence processes that play a large role in the time factor, which is as it should be.
The officials we’ve spoken to in Government understand the issues around identity and want to solve them just as much as we do. It takes time to build trust and to build good software.
Ultimately, we see governments and regulators as the sovereign sources of truth. We share the technical learnings and best practices we’re seeing from across Africa with any regulator who asks. And we’re getting a lot of learnings.
Samora: On the same - I would also like to touch on data and data governance - for sure identity data is very critical from a sovereign perspective. How does Smile Identity handle customer data? What national data policies do you like globally that African countries should aspire to as regards digital identity and the data that surrounds this?
Mark: In terms of global standards, most people will point to the EU’s GDPR, but Ghana’s data protection act actually predates GDPR with many of the same principles. African countries are actually leading the way on some of this stuff. I think the Kenya Data Protection Act of 2019 is well written. It’s shorter than GDPR and easier to read in some ways. Time will tell as it’s still being implemented, but it’s a good standard for other African countries to consider.
Under Kenya DPA and GDPR we’re a data processor, which means we have to follow the rules set for us by our enterprise clients, who act as data controllers and must get user’s consent to have their identity information validated by us.
Samora: For fintech founders, some of the main concerns around choosing partners such as Smile Identity would centre around how your solution works at scale - could you speak more to this? particularly since on-boarding is one of the most critical elements in Fintech.
Mark: Unlike some solutions from Europe or the US that solely focus on the ID Card, we are also verifying elements of the identity (ID number, date of birth, etc) against a source of truth.
We make synthetic identity fraud — making up identities that are not real — very challenging.
This allows companies to spend money on marketing and customer acquisition to grow faster, knowing that they are paying for real users, not bots. We have some clients who now onboard 10,000 users a day because they have confidence in their KYC process. This is not possible with humans alone.
Samora: From a fintech perspective particularly a bank - one would want a one-stop identity provider - the concerns around this would be around offering more than just identity verification and would go deeper into KYC/AML and elements such as criminal records and credit checks - are such capabilities within your product or at least your product pipeline?
Mark: Most companies around the world, especially the big banks, use multiple providers for different KYC needs. This diversity of needs is increasing, not reducing, as more of our lives move online and the complexity of online transactions grows and customer bases are more international.
We actually provide services to a number of international companies that use “global KYC providers” for the US or Europe but use us in Africa because the global providers just don’t understand Africa or don’t have good solutions here.
Our company is made up of 30 people from 12 different countries, including 8 African nations. 80% of our employees are African, based in 6 countries across Africa. When a new ID type comes out, we know about it. When a new law comes out, we read it. We are here to serve Africa and help African entrepreneurs and executives scale their businesses across the continent.
Our roadmap includes some of the items you mentioned, but we will stick to verification of claims — be that identity claims, business registration claims or academic degree claims.
Samora: On the same, what hurdles or constraints that may not be apparent at first blush hinder you from offering a comprehensive identity solution;
Mark: We don’t do transaction monitoring or credit scoring. There are companies who specialize in those adjacent areas and we have partnerships with some of them and can recommend them.
But if what you need is verification of African users, you should be using Smile Identity.
Samora: With regards to on-boarding, a number of financial institutions typically deal with customers from multiple nationalities - how would you go around solving this issue for them given that you integrate directly with national ID databases?
Mark: We’re rapidly expanding our coverage across Africa. It's not uncommon for a company to use us in all the markets where we have coverage and to work with another company for external markets in say Europe or Asia. It might seem compelling to use a single “global solution” but overtime companies who are focused on Africa or have substantial businesses on the continent tend to find that our services are not only better for verifying African IDs but they are also substantially less expensive than what they are paying outside of Africa.
Samora: Within the same, one of the areas that hasn't really gotten much attention is digital ID and KYC for organisations and corporations. This space has largely focused on individuals. Could you talk about some of the things you're seeing within this space? digital ID and KYC for registered entities?
Mark: We’re seeing increased demand for comprehensive KYB or “know your business” solutions.
This starts with verifying a business registration or license but it quickly expands into doing a sanctions screening check on the officers or doing a beneficial owners check on the shareholder base. We have a very basic offering in this space right now but we expect that both the market and our offering in this area will grow significantly by next year.
Every fintech we meet who has successfully scaled with consumers is now asking us about scaling with SMEs and businesses. This is exciting news for Africa, because the range of digital services available for entrepreneurs — large and small — is going to grow.
Samora: With regards to the overall digital kyc and identity eco-system in Africa - could you tell us of some positive developments you're seeing that energise you?
Mark: The positive news is that change is happening, in many places at once.
As your readers know, Africa is a young continent -- the average African is just 19 years old and the generation that is coming of age is digitally native. They expect access to the modern conveniences and services that are available via the Internet, and especially the mobile Internet. Making the Internet work well for higher value digital services like credit and asset-finance, money transfers, ride sharing and even job applications or academic credentials requires building robust payment and KYC APIs with easy to understand consent layers and strong security. This translates into a growing market for these tools and investment is starting to flow to meet this demand which will improve life for everyone.
Well conceived data privacy legislation is also getting passed in many countries and so far it seems to be following themes consistent with GDPR while allowing for reasonable public comment and implementation periods so that companies can keep pace with the changes.
All of this is important for getting the long-term set of solutions right and so far the signs are encouraging.
Closing Thoughts
Mark provides some very useful insights, generally data policies tend to be improving and governments are focusing a lot on this. Additionally, as their systems are trained with more faces and IDs, they are likely to get better and better. The space is thus bound to improve and get bigger and by 2023 full digital onboarding will be the standard - existing institutions thus need to rejig their systems;
Mark makes interesting points about having a variety of ID/KYC partners within your tech stack thus having a separate partner for credit checks, reference checks, source of fund checks and identity verification. It may actually be better to have the best of breed across the range of services rather than having one average provider. Smile Identity has a laser focus on verification of claims;
The global digital ID space is growing with a number of players regionally such as Appruve and Verifyme. Globally suppliers include Trulioo, Shuftipro, Jumio, Veriff, Onfido and Passfort. The main services are digital ID verification, document verification, claim verification, customer lifecycle management and KYC/AML checks. Given that big data plays such a critical role in the success of these business, might we see a winner take most industry appearing with a few key players emerging in the long term?
Overall, I think we’re having an interesting confluence between improving government ID systems and improving digital ID verification technology that will make the digital onboarding experience even better with time. Firms across the financial industry would be well advised to prepare for a future of exclusively digital onboarding and regulators need to be proactively supporting this transition.