planning your identity verification strategy in global markets

PLANNING YOURIDENTITYVERIFICATIONSTRATEGY INGLOBAL MARKETS

Knowing the true identities of customers before conductingbusiness with them is crucial, regardless of where those customersare located. Global Data Consortium (GDC) provides global, instantverification of individuals/customers through access to unique in-country reference data from our local strategic partners. Thesestrategic partners are known as Consortium Member and rangefrom large credit bureaus to small data quality firms.

Increasingly, GDC has been receiving requests to conduct CustomerDue Diligence (CDD) using electronic identity verification (eIDV) tomeet international compliance regulations. It is important tounderstand that eIDV in other countries works differently than itdoes in the U.S. and expectations and strategies need to beadjusted accordingly.

In this eBook, we will discuss the common misconceptions andchallenges surrounding eIDV in markets outside of the U.S. andhow you can adjust your verification strategy to achieve the bestmatch rates globally.

01Planning eIDV in Global Markets

VERIFICATION ISNOT THE SAMEEVERYWHERE

When it comes to global eIDV, the most important thing to keep inmind is that accessible personal identifiable information variescountry to country. Across the globe, available data sources andprivacy regulations vary tremendously so while having a full nameand date of birth may be enough information to gain access to theinformation you need to achieve excellent match rates in the U.S.,those inputs may not be enough to provide the same match ratesinternationally.

It all comes down to which country you are working with, whatsources they have available, and what personal identifiableinformation you are able to access.

Planning eIDV in Global Markets 02


This is not the case in a country such asFrance, where their Data Protection Act of1978 is extremely broad and applies to thecollection of any information on Frenchsoil that can be used to identify a person.

To put it simply, most countries place a greaterimportance on information privacy than the U.S.

In the U.S., data privacy is not legislated on a federal level to thesame degree as it is in many other countries, since the federalgovernment leaves many of the details on data privacy regulationup to individual states.

https://uk.practicallaw.thomsonreuters.com/Cosi/SignOn?comp=pluk&redirectTo=%2f6-502-1481%3fservice%3dcrossborder%26__lrTS%3d20181019130033168%26transitionType%3dDefault%26contextData%3d(sc.Default)%26firstPage%3dtrue%26comp%3dpluk%26bhcp%3d1


In Spain, for example, the protection ofpersonal data is considered aconstitutional right under Law 15/1999.

This means that when collecting personal data in Spain, one mustprovide a user with what is called “fair processing information”including the data collector’s identity and address, the purpose ofwhy they are processing a person’s data, the user’s legal rights,whether participation is voluntary or mandatory, and anyconsequences that may arise from not providing personal data.

As you can imagine, these varying privacy regulations presentchallenges for U.S. businesses looking to expand into foreignmarkets, especially if they plan to require the same levels andinputs to achieve the same eIDV match rates that they are able toachieve in the U.S.

https://rm.coe.int/CoERMPublicCommonSearchServices/DisplayDCTMContent?documentId=09000016806af30e

VERIFICATION:1+1 VS. 2+2

For organizations selling across borders, identity verification isbecoming critical to prevent bad actors or as a way to meet moneylaundering and compliance guidelines. In order to do this,organizations will implement customer due diligence (CDD) orenhanced customer due diligence (ECDD) programs, which includeregularly verifying customer identities electronically.


But before we get into best practices for Global Markets eIDV, it’simportant to review the difference between single and multi-sourcechecks, or what we call the 1+1 vs. the 2+2 approach to verification.The numbers in 1+1 and 2+2 in these checks represent the numberof rules for passing verification and the number of data sourcesavailable for matching.


1+1 Verification

In 1+1 eIDV, user input data is verified against a single authoritativedata source.

The benefit of 1+1 eIDV is that it’s fast and efficient, however, itmay not meet global compliance needs, such as the new EUcompliance regulations.

For this, you need to need to employ a 2+2 verification strategy.

For example, a user’s name, address, and date of birth can beentered and checked against a single credit source, receivematches, and achieve a pass.


2+2 Verification

As a rule, GDC requires a 2+2 match based on two input elementsverified against two independent data source. For example, acomplete name and date of birth in a credit data source, and acomplete name and address in a government source.

GDC views 2+2 eIDV as matching 2 different definitions of inputagainst 2 different data sources.

To accomplish a 2+2 request, GDC will send a single requestto a data provider that controls multiple unique sources, suchas a single partner with both an electoral role source or apublic utility source, or multiple “best available” in-countryproviders with unique data sources.


While this all may sound relatively simple, it gets vastly morecomplicated when it comes to eIDV in non-U.S. markets.Expectations and practices need to be adjusted when it comes toinputs, sources, and match rates when conducting 2+2 verificationchecks outside of the U.S.

In the next section, we will begin to explore the sources ofinformation available in other countries, and how they differ fromsources in the U.S.

INTERNATIONAL SOURCES:THINK OUTSIDE OF CREDITAND GOVERNMENT

Businesses that are looking to expand into non-U.S. markets maystart the international eIDV process with unreasonableexpectations. For example, compliance officers may expect to usethe same levels and inputs across all countries and receive 2+2verification checks with credit and government sources to achieve ahigh match rate.

This is problematic for a few reasons:


This approach is not country-specific and does not account forvarying privacy regulations. Not every country has a credit bureau that is available for query. Not every country will allow access to their government sources.


Thankfully, however, credit and government sources are not theonly sources that can be used to complete a 2+2 eIDV check. Let’stake Spain, again, as an example. In Spain, you have very littleaccess to government source data and no credit source access atall. However, if you have a user’s complete name and address, youcan achieve a 2+2 check with a telecom/mobile source and acommercial source.

In France, where data sources are tightly controlled and few areavailable for access, there is no credit bureau you can check, but ifyou have a user’s complete name and date of birth, you cancomplete a 2+2 check using two different telco sources.

The bottom line is that you cannot expect to use the same inputsand sources for every country and achieve the same results. YoureIDV approach needs to change from country to country to optimizeyour match rates. In this next section, we will explain how localexperts can serve as some of the best data sources when it comesto international eIDV.

THE BENEFITS OFLEVERAGING IN-COUNTRYEXPERTISE FORINTERNATIONAL EIDV

Now that we’ve covered some of the major challenges surroundinginternational eIDV, the question remains: How can you access thebest international data sources to ensure optimal match rates? Thekey is to tap the power of local expertise. Local experts with a deepknowledge of the area and access to local data sources that offer awider coverage of their country populations are the best resourcesto use when you’re trying to achieve high match rates.

11 Planning eIDV in Global Markets

The best experts benefit from the wealth of knowledge they’vegained working with clients in their home countries. They canprovide unique, invaluable insights that only locals can give,especially when it comes to a country’s particular legal and politicalenvironment, as well its data privacy regulations.


For example, at GDC, local expertise is a big part of what we dobecause we believe that working with in-country experts is one ofthe best tools for companies needing to verify customer globally.

We’ve partnered with over 1,000 expert data partners in more than50 countries. Each one of our in-country expert partners has beencarefully vetted and collects, maintains, and distributesidentification data in their country and provides real-time access tothis data through GDC’s international eIDV platform.

STEPS TO ENSURING THEBEST MATCH AND PASSRATES IN NON-US MARKETS

By now, you should have a clear understanding of why eIDVworks differently outside of the U.S.

To recap, every country has its own, unique privacy regulationsthat limit access to certain data sources that may be commonlyavailable in the U.S. This makes it nearly impossible to apply aone size fits all approach to completing a 2+2 verificationcheck, which is required in order to meet certain globalcompliance regulations.

So what steps can you take to take to help ensure the bestmatch and pass rates?



The first step you can take toward optimizing your match rates is toimprove the inputs you use to achieve them. If you are unable toproduce input elements that will provide sufficient match rates inthe country your working in, then your verification check is doomedto fail from the start. This is why you need to optimize the quality ofyour input elements as much as possible.

For example, at GDC, we use address verification, standardizationand correction to enhance the quality of input address data, whichenables us to receive more accurate matching onstreet/thoroughfare, house number, postal code and locality/cityinput elements.

1. Improve the quality of input elementswith which to match upon.


Once you optimize the quality of your input elements, the next stepis to consider changing your definition of a match and a pass. Oneplace to think about making the rules less stringent is in namematching. In some countries, achieving a match on a given/firstname can be very difficult. In Brazil, for example, many women arenamed Maria but often use their second names in applications todifferentiate themselves.

2. Tighten or loosen the rules on yourmatching criteria.

To combat this and similar issues, some countries will allow forhigher match rates on first initial, sur/last name, full address andeven date of birth. Matching first initial + last name or even a fuzzymatch or distance match in place of the often-mandated exactmatch will sometimes drastically improve match rates.


The final thing you can do to optimize match rates is to consistentlyadd new data sources to your verification process. The more datasources you work with, the greater your chances of achieving a highmatch rate.

For example, if you are using just two data sources that each covers35 percent of a population, then the best possible result you can getis 70 percent, and in actuality, you will likely only get a match rate ofaround 30 percent.

3. Continuously add additional data sourcesto increase coverage and match rates

At GDC, our approach to achieving the highest match rates for 2+2verification checks involves using several non-duplicate sourcessuch as telco, government, credit, utility, postal, and consumer. Thisway, more of the adult population is covered, increasing the chanceof a match and pass.

IN CONCLUSION

The main takeaway is that when it comes to eIDV in non-U.S.markets, expectations and strategies need to be managed andadjusted. When your organization is interpreting and craftingglobal compliance rules, you must be aware of the unique privacyregulations that exist in each country and the data sources theyhave available, since it will likely vary from country to country.

Don’t get discouraged from working in a specific country becauseof their compliance rules or limit yourself to just two datasources, use all that are available to you to achieve a match.


Global Data Consortium offers one point of access to local, in-country reference data to instantly verify the identities of customers,partners or counterparties in over 50 countries around the world.We do this with the help of our strategic partners, who are localexperts with access to the best in-country sources of information.

GDC is constantly adding to our country coverage through theseconsortium partners so we can help organizations achieve the goalof knowing exactly who their customers are, regardless of theircountry of origin. To learn more about what we do or to request aproof of concept to test the functionality of our data for yourbusiness needs, visit us at globaldataconsortium.com.

http://globaldataconsortitm.com/

planning your identity verification strategy in global markets

Documents