Know Your Employees

It has been clear for years that the Know-Your-Customer (KYC) and anti-money laundering (AML) regulations system is broken in many ways, but it is not only broken when it comes to dealing with customers, it is also broken when it comes to dealing with employees.

KYC

If you are involved in moving money in any way at all, you will be aware of the Financial Crimes Enforcement Network (FINCEN). In many ways, compliance is a moat that protects incumbents from competitors. As any fintech entrepreneur knows, it is a headache to deal with compliance and the costs continue to escalate. Digital identity must be one of the keys to getting these costs under control and indeed last year FinCEN's acting Deputy Director Jimmy Kirby spoke about the need for digital identity, stating that FinCEN is “pragmatically focused” on protecting the U.S. financial system from illicit finance threats. According to Kirby, financial institutions must establish with confidence who their customers are on the front end and throughout the customer relationship (my emphasis). 

(This is why what Laura Spiekerman from Alloy calls the "perpetual KYC approach” is so important. Automated recurring checks based on specific triggers that might include an update to a customer’s personal data or a transaction that sets off a risk alert).

But it appears that some companies do not apply the same rigour when it comes to figuring out who employees are or onboarding new business partners. The key point is that digital identity isn’t only needed to support due diligence around customers: Know Your Employee (KYE) is just as important an opportunity as KYC, Know Your Customer’s Customers (KYCC) and Know Your Business (KYB) and so on. All of these need to be established with continuing confidence and all of them are currently a mishmash of scans of utility bills, pictures of driving licences and pointless box ticking.

When it comes to employees, for example, some of those new hires might not only be exaggerating on their resumes, they might be acting on behalf of foreign powers.

KYE would clearly benefit from digital infrastructure. The last time I was asked for documents for an employment check — to tick a box confirming that I had the right to work in the U.K. despite having been born in the U.K., having more than one paid employment in the U.K. and paying tax in the U.K. (don’t ask) — about a month ago, I was required to send a picture of my passport by email to an HR department. Now, while HR departments are famed for their strong cybersecurity practices, I was a little concerned about my personally identifiable information (PII) being exposed, especially when digital alternatives have been demonstrated!

Digital identity hopefully provides a way forward here even though as Jelena Hoffart points out in a recent piece about employee identity management, KYE is very different from KYC because of risk tolerance. While advances in digital identity management around customer identification, authentication and authorisation add to the corporate toolbox, there is a fundamental difference in deployment because the tolerance for consumer fraud is non-zero, the optimal tolerance for internal corporate crime is zero. Companies can reuse KYC technology (eg, digital onboarding) for employees but in a more rigorous process.

KYE

It is interesting to see how KYE is moving forward though. Last summer, I took part in a digital identity design sprint day hosted by NAB in Melbourne and it seemed to me that the most attractive of the use cases explored (in the context of commercial opportunities that might arise from using bank-issued digital identities) was indeed KYE. There were some startups there already delivering services in this space and looking to improve their offerings by integrating digital credentials of some kind and we know that the approach works. Meeco.me , for example, worked with a digital identity exchange, state government and an engineering and technical services company, in a pilot to demonstrate the commercial benefits of digital identity and verifiable credentials in workplace onboarding. Instead of presenting originals of physical documents, or digitised copies of physical documents, the employees digitally asserted their identity and provided a digital driver licence, in the form of a verifiable credential, all from a wallet application on their phone. 

Given the scale of the KYE problem it is a clear that a shift to verifiable credentials for employee onboarding is a win-win and it makes sense to provide candidates and employers with the necessary infrastructure to provide specific characteristics (eg, this person has a valid welding certificate) without giving away personally-identifiable information. The European Union right now has four large scale EU Digital Identity Wallet pilot projects running and intends to launch such a wallet to 450m European citizens this year. Hopefully, with new energy going into digital identity wallets, verifiable credentials and (custodial) self-sovereign identity this specific problem of KYE can be tackled quickly, efficiently and to the mutual benefit of all stakeholders and serve as a vanguard for mass market digital identity solutions.

Book Dave

Are you looking for:

• A speaker/moderator for your online or in person event?
• Written content or contribution for your publication?
• A trusted advisor for your company’s board?
• Some comment on the latest digital financial services news/media?