Banks are not using the regulatory potential for digital onboarding

  • Saba Ullah
  • PaymentsDigital identityOnboarding

In this digital era, customers expect a fully digital experience when onboarding with a new company. This is already offered by some of the challenger banks, for instance Bunq and N26. Unfortunately, incumbent banks still seem to focus too much on the risks, and therefore miss out the digital opportunities.

Our earlier blog on redesigning your onboarding process explained that the ideal set-up is a fully online procedure to cater for customer expectations. This blog focuses on the current and future European regulatory requirements that both restrict and facilitate digital onboarding.

AML Directives prescribe the requirements for onboarding in the financial sector

Customer onboarding within the financial sector is covered by the European Anti-Money Laundering Directives (AMLD), which include Customer Due Diligence (CDD) and Know Your Customer (KYC) procedures. Based on the European regulation, obliged entities (entities that are subject to AMLD requirements) need to identify their customers and verify their identity to prevent the use of the financial system for money laundering and terrorism financing purposes. CDD includes the identification and verification of a customer's identity based on documents, data or information obtained from a reliable and independent source (art. 8-1 AMLD3).

Currently, AMLD3 is the basis for applicable law in all member states, however changes are already being implemented based on AMLD4, which will enter force on June 26, 2017. Transposition into national law and additional national guidance have resulted in different interpretations and requirements throughout the EU of AMLD3, this will most probably remain the case for AMLD4.

Incumbent banks do not use the digital onboarding potential of AMLD3

AMLD3 prescribes a risk-based approach, meaning that obliged entities should assess the risk of the procedures they apply, of their customer base, and of the products and services they offer. Based on this risk assessment and the obliged entities’ risk appetite, the decision is made whether to apply stricter or less strict measures as part of the onboarding process on a case-by-case basis.

In practice, we see here that incumbent banks have a low risk appetite and take a more conservative approach to avoid fines and/or reputational damage. It is still common practice to expect the customer to visit one of the branches and show their ID in person as part of the onboarding process. New challenger banks have a different focus (e.g. a limited client scope, no corporate clients) and thus usually have a higher risk appetite when assessing money laundering and terrorism financing risks. Consequently, challenger banks dare to be innovative and apply a more creative and customer friendly onboarding procedure.

Risk based approach of AMLD3 offers extensive possibilities for digital onboarding

The current AMLD3 regulation states that digital onboarding is allowed, but Enhanced Due Diligence procedures (EDD) need to be applied due to the higher risk of money laundering and terrorism financing (art. 13-2 AMLD3). The figure below provides an overview of the EDD-process, based on AMLD3, that needs to be applied to natural persons who are not physically present.

SignicatThe directive offers specific and adequate solutions to mitigate the risk associated with digital onboarding, as illustrated in above figure:

-        establishment of an identity based on additional documents;

-        taking additional measures to verify or certify document; or

-        a first payment from an account with another regulated credit institution.

However, this list is not exhaustive; obliged entities are free to apply other measures that are adequate to mitigate the enhanced risk. This means that from a regulatory perspective, obliged entities are allowed to come up with creative solutions, as long as risks are mitigated.

Great variety in solutions exists between countries

Interestingly, measures for digital onboarding provided in national laws and guidance differ per country. For instance, Germany and Luxembourg have a guidance that explicitly allows for the use of video identification during onboarding, without making use of derived identification. Some Scandinavian countries offer the possibility to use BankID for identification purposes. Other countries remain from prescribing technology, which seems to make sense as there is the risk technology becomes outdated too fast as mostly innovation is ahead of regulation. These different interpretations challenge banks when they want to offer their services cross-border.

In addition, different risk appetites combined with the risk assessment per institution result in a variety of onboarding procedures within countries. In the Dutch market, the first challenger bank is already making use of video identification, without making use of a first payment for derived identification purposes. This solution removes the dependency of another bank, which enables a bank to become the primary bank of a new customer. Innopay sees that more financial institutions are considering similar solutions, and we expect that more will follow.  

Under AMLD4 new solutions as electronic signatures and digital identities will be introduced

Our expectation that more financial institutions will make use of innovative ways to onboard their customers is supported by the new European directive, AMLD4, that is currently being transposed into national law. By June 26 of this year, each member state must have its national law in place.

The fourth directive does not stipulate that EDD must be applied if the customer is not physically present, which means that absence of the customer does no longer represent a higher risk by itself. However, Annex III, which provides potentially higher risk situations, states that non-face-to-face business relationships without certain safeguards in place creates a potentially higher risk situation. Obliged entities may decide, based on their risk assessment and risk appetite, which measures they find adequate under these circumstances (art. 18-3 AMLD4). Annex III advises to use electronic signatures. We expect that next to electronic signatures, other (new) techniques such as digital identities and facial recognition will also serve as adequate safeguards.

It remains to be seen how countries will follow with their local laws and guidance. Austria has been one of the first countries to finish transposing AMLD4 into national laws in January 2017. They have explicitly allowed the use of video-identification for onboarding as a sufficient safeguard. The first Austrian financial institutions are already anticipating by offering video-onboarding to their customers, Erste bank for example. We expect that similar initiatives will follow once other EU member states provide clarity in their national laws.

AMLD5 and eIDAS will bring even more opportunities

While AMLD4 is still being implemented in most member states as we speak, amendments to the fourth directive have already been proposed. Several “versions” of AMLD5 circulate within the compliance community. At this moment, negotiations on these amendments are still ongoing. We cannot provide any clarity on the final changes, but so far, not much has been mentioned with regards to digital onboarding.

However, with the eIDAS regulation on the horizon, the use of digital identity schemes is expected to increase in the next years. eIDAS also provides many opportunities for cross-border usage of digital identity schemes. Although the use of these schemes is not part of the proposed amendments, the use of digital identity schemes compliant with eIDAS requirements might be allowed under AMLD5 for obliged entities.

Innopay expects that when it comes to onboarding, regulation will increasingly provide options in the near future. But which new solutions provide adequate safeguards for onboarding? What are the differences between countries? What fits within the risk appetite of a specific bank? And how will the digital solutions benefit the bank and their customers? These are some questions banks have to deal with. Now is the time for banks to anticipate on these changes, to understand new solutions, to review their risk appetite and start providing the onboarding experience that customers are looking for.

Saba Ullah

saba.ullah@innopay.com

+31 6 46 09 13 00

〈  Back to overview