Evidence submitted by Yoti (ECR0048)
Written Evidence Submitted by Yoti -Inquiry Response: Economic Crime for Treasury Committee
Introduction:
The UK is a major financial hub that it attracts many investors from across the world; however, for the same reason the UK is also very attractive to criminals who try to hide large volumes of money proceeding from criminal activities. Money laundering is a global problem that jeopardizes the integrity and stability of financial markets and institutions, it is a threat for the UK economy -costing an estimated of £24bn annually, and fuels the activities of terrorist groups and organised crime.
Yoti as a digital identity platform shares the concern of the Treasury Committee about the impact of the economic crime in the UK and supports the efforts they are making to tackle money laundering.
One of the ways ‘dirty money’ enters the system is by identity fraud. CIFAS revealed that almost 175k cases of identity frauds were reported in 2017, a 125% increased compared with 10 years ago; in 95% of the cases the fraudsters used the victim’s identity and in 4 out of 5 cases the victim’s real address was used. It is likely many low value frauds are not reported to CIFAS, Action Fraud or the Police.
There is strong potential for technology and innovation to assist those committing and combating economic crime and ten areas we would like to discuss, where we believe that digital identity can support the fight against money laundering.
1. Identity fraud fuelled by Lost & Stolen documents
2. Digital Age Verification - reduce documents lost in night-time economy
3. Low levels of Proof of Age Cards PASS Cards
4. Age verification the opportunity
5. Electronic Customer Due Diligence for KYC (Know Your Customer) Checks
6. Digital identity for Right to Work, Right to Rent
7. Digital Identity for property transactions
8. KYC for ICOs, Cryptocurrency exchanges and Crypto ATM machines.
9. Lack of access to DVLA & HMPO data
10. Money Mules
Yoti Background:
Yoti is a UK founded and funded identity checking system that allows organisations to verify who people are, online and in person. It is a team of 250 based in London and Chelmsford, with offices in Mumbai and due to open offices in the US and Canada later in 2018. Yoti launched in November 2017 and so far over 1 million people have downloaded the app. Yoti has been announced as the eID provider for the States of Jersey and recently secured India's leading dating site as a verification partner and are due to start working with the second largest peer to peer marketplace with 30m monthly users and one of India's biggest banks with 80m account holders..
For consumers, it’s an app that helps them prove who they are and confirm the identities of others. The company distinguishes itself with its approach to privacy and security - earning money from businesses when users voluntarily share verified attributes e.g. for KYC (see FAQs for technical detail). The app is available in the app stores and is free to download. The set-up involves a four-minute process, where you link your facial biometrics to your phone and verify your identity by scanning in a verified photo ID document. Identities are verified using NIST approved facial recognition technology, that matches individuals with their government issued identity documents and where possible, biometric passport chips. As well as using facial recognition technology a trained security team review the integrity of the documents and check the faces match. Once you've completed set-up, your Yoti securely holds verified attributes of your identity, such as name, date of birth, gender, nationality. You can then use the app to scan QR codes to pass specific attributes to other people or organisations or websites. This might be for age verification in the offline or online world or to populate verified data on an online form.
Yoti have been part of the UK Digital Policy Alliance steering group creating the 1296 Age Checking PAS, which is being made into a British Standards, chaired by Lord Erroll at Westminster ahead of the Digital Economy Act. Yoti serves as industry chair for the DPA Age Verification & Internet Safety Steering Group; is sponsor of the APPG Digital Identity and serves on the Home Office Identity Document Working Group and is a member of the newly formed Association of Document Validation Professionals. The Yoti team serve on several TechUK boards - for Justice & Emergency Services, Data Protection and Digital Identity. Yoti are a key partner of London Digital Security Centre, set up by City of London Police, Met Police and the London Mayor's Office to help businesses innovate, grow and prosper through operating in a secure digital environment and accredited by Met Police Secure by Design. Yoti are a registered BCorps and have set up a Guardians Council to hold them to account; as well as working with Responsible 100, Doteveryone Sustainable Tech Trust Mark Prototyping, EU Compass Responsible Innovation to assist in developing an ethics framework.
Ten areas where digital identity can support the fight against money laundering.
1.Identity fraud fuelled by Lost & Stolen documents
One of the contributors to identity theft is lost and stolen identity documents. Almost a million driving licences were lost by British drivers in the last year, according to latest figures released today by the DVLA. British motorists applied for 931,527 driving licence replacements in 2017. Substitute licenses cost £20, meaning drivers spent £18.6m on new ones
● The DVLA said that 8 in 10 drivers carry their licences with them every day
● It said this is not a legal requirement and motorists should keep it safe at home
● According to the most recent DVLA stats, there are around 37.5 million active licence holders in the UK
● That means around 3 percent of all drivers in the country either lost or snapped theirs last year. The total bill for this amounts to £18.6million
● Younger drivers are more likely to choose to carry their licence with them (87 per cent) compared to older motorists who tend to keep their ID somewhere safe at home.
● 16 to 24 year olds apply for the most replacements - 82 per cent of those surveyed.
A Freedom of Information request reveals that there were 303,881 lost or stolen passports (267,247 + 36,634) in 2010. So between passports and driving licenses over 1.3 million identity documents risk getting in the wrong hands each year.
2. Digital Age Verification - could reduce documents lost in night-time economy
The night-time economy is another area where identity documents are frequently lost. Immigration Minister Robert Goodwill is quoted as saying, “Young people face a higher risk of losing their passport as they often use it as a form of age verification. A passport is a highly valuable document. If it gets lost or stolen, not only does it cost the holder money to replace it, but it can fall into the hands of criminals unless it is handed in and cancelled. We are working with a number of stakeholders including retailers, licensed premises, police, local authorities and students, to communicate that there are better ways to prove your age, such as the PASS card.”
https://www.gov.uk/government/news/government-launches-new-crackdown-on-passport-fraud
3. Low levels of Proof of Age Cards (PASS Cards)
Many people do not have an alternative document to a Passport or Driving License. There is also a tranche of young people who have no identity document at all. Whilst Scotland issues PASS scheme documents to young people via the Young Scot card, free of charge; there is a very low penetration of PASS scheme documents in the rest of the UK. There are 0.7 million Young Scot cards in Scotland, versus circa just 0.6 million cards from other PASS providers across the rest of the UK.
Yoti has teamed with CitizenCard to create a co-branded Yoti-CitizenCard to begin to address this issue and will be actively seeking partners to enable more young people to access free or affordable documents to prove their age in person or online. Where Yoti can make a check via API to the relevant database, that document can serve as the anchor identity document to enable a young person to set up a digital identity in addition. This will give these young people an alternative document, so not to need to take a physical document with them on a night out; it also allows them to data minimise and share less information, for instance just an over 18 or under 18 attribute and to provide data for Know Your Customer checks digitally, rather than filling in long forms online thereby reducing the risk of phishing fraud.
4. Age verification is an opportunity
From the standpoint of the Treasury and the FCA; the introduction of mandatory age checks via the Digital Economy Act to access adult content, could lead to 20-25 million of the UK population voluntarily setting up a digital identity - which initially they may use to anonymously share an 18 plus attribute for the purpose of accessing adult content; which they can then use for Know Your Customer checks, or for use to verify themself as a seller on a classified site or set up a profile on an online dating site. If the digital identity could also be used in retail settings for age checks to purchase age restricted products and services such as alcohol, tobacco or lottery products, this would greatly assist in educating the public as to the wide utility of digital age and identity verification.
5. Electronic Customer Due Diligence for KYC (Know Your Customer) Checks
Yoti is working with the FCA RegTech sandbox to enable insurers such as Marsh and Worry & Peace to fulfill KYC checks. Yoti lets people prove their identity in seconds, without showing or photocopying paper documents. They can share specific identity attributes, such as their name and date of birth, rather than disclosing their full identity; helping to protect them from the ever-growing risk of identity theft. In turn, companies can benefit from fast and accurate KYC, as well as save time and money when verifying the identities of their customers. In addition to traditional insurers Yoti is also working with a number of ICOs (Initial Coin Offerings) to provide them KYC Solutions (including Coinfinity, NCloud, Vertpig, Chainstarter, Blockchain reserve) and is keen to support regulators developing regulation in this space. Yoti is also working with leading Bitcoin ATM providers to provide KYC solutions.
6. Digital identity for Right to Work, Right to Rent
The legislation and code of conduct surrounding Right to work and Right to rent checks are still mandating that physical checks be made of documents and copied made and stored. These traditional methods have fuelled the proliferation of copies of sensitive documents. In the light of GDPR; it would seem more sensible to enable a recruiter or a letting agent to make a check to a digital identity and record that a check has been made, in the same way that an electoral roll check is made.
7. Digital Identity for property transactions
The beneficial ownership of property is notoriously hard to unravel. UK Land Registry and indeed many Land Registries around the world do not have a unique identifier such as date of birth linked to title deeds. The Land Registry relies on conveyancers to perform KYC checks on property owners; however they have no way to check that the right Mr John Smith is laying claim to a certain property. Using digital identities such as Yoti - a title deed could be associated with a person’s biometric digital identity, linked to their Government issued identity document to establish securely ownership and strong authentication. It is possible to sign up for alerts if there are actions instigated to sell your property. Protective registration schemes using biometric digital identities would offer consumers much stronger security.
There is also no Government controlled UK Landlord Licensing Register, nor is there licensing of estate agents in the UK with associated required qualifications or standards of transparency. In both these instances digital identity could be a strong deterrent to fraud and crime.
8. KYC for ICOs, Cryptocurrency exchanges and Crypto ATM machines.
The lack of KYC and AML checks undertaken by cryptocurrency exchanges and ICOs has made cryptocurrencies and ICOs investments an attractive means in which to launder, semi anonymously, small or large sums of capital. As regulation has become more and more common and exchanges/ICOs and Crypto ATMs wish to become compliant, Yoti has gained heavy traction in the virtual currencies market with clients and active leads all over the world.
The ability for consumers or would be investors to share they verified identity attributes using via their Yoti app, securely and with ease, has led to Yoti being integrated as a KYC provider by multiple ICOs (Initial Coin Offerings) and cryptocurrency exchanges.
Yoti is currently working with a number of ICOs and ICO incubators to provide them KYC solutions (including NCloudSwiss, Globcoin, Chainstarter, Blockchain reserve) and is keen to support regulators developing regulation in this space. Yoti is also working with leading Bitcoin ATM providers; Trilliant.io (Germany), Chain Bytes (USA) and Cryptocurrency exchanges including Vertpig (UK), Digax (UK), Coinfinity (Austria), BTCX (Sweden/India) to provide KYC solutions and is in advanced discussion with some of the largest cryptocurrency exchanges globally.
9. Lack of access to DVLA & HMPO data
Despite the high volumes of lost and stolen passports and driving licenses, an identity company such as Yoti does not have a simple route to check via API to the HMPO or DVLA database. This could quite simply enable us to block stolen or fraudulently obtained genuine passports from entering the Yoti platform and then being used for criminal activities. In the past the DVLA Data Sharing team, have responded to information requests from non travel companies with the statement‘... we do not provide data for identity purposes.’ However recent DVLA data sharing strategy document indicates an awareness of growing demand, however no clear route as yet for private sector companies outside of Gov.UK Verify to access it.
Other government departments want driver data either to support their own enforcement functions or as part of initiatives that are looking for the public benefits that sharing data across government can bring. Demand for driver data is often linked to its use for identification and verification. It can be a valuable tool in helping to establish identity alongside other validation. It is already being used in this way for the GOV.UK Verify service which assures the identity of digital public service users. However, the Verify service is built on the idea of government-set standards for identity assurance with users choosing between certified companies who can meet these standards. In this way, the service has created a growing market that can assure identity not only for central but for wider government and private sector services. This could lead to wider demand for DVLA data. With an increasing focus on the potential value of government data to the wider economy, DVLA could also face future demands for driver data for research other than that related to road safety.
D. Identity verification 5.14 There are risks in extending too far the concept of using DVLA data for confirming identity. Our databases were never intended to provide the basis for a national identity register. 5.15 We know that the driving licence is often used as a means to prove identity. We accept that services which allow individuals to share their own data can be used as part of this. However, the driving licence is not an identity document in itself and we will not develop services specifically to support it being used in this way. 5.16 We recognise though that where it is not used in isolation, the data we hold can be used to support identity assurance services, which can deliver public benefits.
The UK DVLA approach is in direct contrast to the US market, where Yoti, a young (4 year old) UK private sector company, after four months of application, review, due diligence and contract signing, is able to make an API call to the AAMVA database to check US Driver Licenses across 50 states. Hopefully this is an area which the DVLA will progress over the coming months. Similarly, the HMPO is gearing up to enable private sector companies to be able to check the HMPO database; however this is not as yet available.
10. Money Mules
The ‘money mule’ threat is still growing. Young people, between the ages of 14 and 24, are often targeted by criminals so that their bank accounts can be used to move money proceeding from criminal activities. Last year, 32,018 mule accounts were detected, an 11% more than in 2016.[1] People caught acting as ‘money mules’ will face prison and subsequently it will be harder for them to get a student loan or a mobile contract.
New technologies such as device identification software and the biometric authentication to set an account and to login will make it more difficult to mule networks to operate victims accounts. This forces them to be constantly recruiting other ‘mules’ to move their illicit funds. Another vulnerable group is the people over 60 years. Criminals tend to approach older victims by telephone pretending to be part of a trusted organisation to do a ‘security check’, at this moment they ask for personal data that can later be used for criminal acts.
A digital identity linked to a mobile phone makes it hard for a fraudster to speak to a potential victim without revealing their real name if requested by the potential victim.
Summary & Recommendations
In summary, it is clear that identity is at the heart of fraud. Current knowledge based self assertion of personal details, entered into web registration forms, is a deeply flawed approach. The BBFC has shared its regulatory guidance for electronic age verification stating Name, DoB and Address entry will not alone be acceptable for proof of age when AV is required by adult content sites later in 2018. Hence it is important to be open to and understand innovations in digital identity.
ID fraud is partly being fuelled by the requirement for people to carry around physical passport and driving license documents to prove their age in the night time economy, retail settings, for recruitment and rental checks. The updating of legislation to allow wider access to proof of age cards and digital age checks to be performed across a greater range of sectors could reduce the loss passports and driving licenses. Data sharing by UK Government departments such as HMPO and DVLA could greatly reduce the misuse of fraudulently obtained genuine documents, or lost and stolen documents and so enable private sector identity providers to assist in fighting money laundering, fraud and crime.
2018 is a landmark year in terms of the Digital Economy Act. Approximately 25 million UK adults are due to be required to age verify to to access adult content. There is an opportunity to broaden the appeal of digital identity to a wider sector of the population by allowing digital age checks across a range of age restricted goods and services (e.g. tobacco, alcohol, lottery, pharmacy products). We applaud the work of the FCA Regtech sandbox in terms of encouraging innovation in terms of electronic customer due diligence for Know Your Customer Checks. We would encourage HMT to support similar regtech innovation in retail tech to encourage more people to adopt a digital identity to prove their age in retail and travel settings.
Once consumers have set up a digital identity for age checks; they can then use the same digital identity to log into a protective registration service for their property, to perform Know Your Customer or AML checks for a range of financial services transactions, to check who they are interacting with at a company or via a classified site, or in the future to reduce the risk of electoral fraud.
Contact details
Julie Dawson
Director of Regulatory & Policy, Yoti
Email: julie.dawson@yoti.com
6
[1] https://www.cifas.org.uk/secure/contentPORT/uploads/documents/External-Fraudscape%202018-Final.pdf