The Benefits of a True Risk-Based Approach to Digital Onboarding

First published by Digital Pound Foundation, written by Claire Conby

Striving to achieve a robust risk management framework without detriment to the user experience is at the forefront of Billon’s compliance mindset. In my role as Chief Risk Officer, I have to ensure that any new client solutions are developed in alignment with our risk appetite, but at the same time make for an innovative, efficient and unburdensome client experience. 

At Billon Financial Ltd, we offer regulated digital cash, on DLT, and our clients expect the cost and time efficiencies associated with blockchain platforms. It would therefore be nonsensical if we were to pair that up with a clunky onboarding process. Know Your Customer processes simply have to be proportionate to risk otherwise our model is destroyed.

With my Digital Pound Foundation hat on, where I am also Operations and Governance Lead, the concept and application of client onboarding, anti-money laundering and counter terrorist financing measures have to be thoroughly explored in order to enable a well-designed digital Pound that does not result in an increase in risk of being used for financial crime. Such an increase would destabilise and undermine confidence in the financial system as a result, which is most certainly not what a central bank is looking to achieve. Indeed, many might argue that introducing a new form of digital money could be a good opportunity to apply risk management measures that seek to reduce financial crime even further.

On the other hand, regulatory measures should not deter people from using a digital currency (for legitimate purposes) simply due to onboarding processes being overly burdensome. A sensible balance is paramount. We mustn’t forget that a digital Pound has the potential to be used as an alternative to cash, and day-to-day cash use is not usually subject to such regulatory measures, and so should onboarding and accessibility be seen as problematic, the take-up required to ensure Central Bank Digital Currencies (CBDCs) and other new forms of digital money’s success in this space will simply not be there. 

We also have to be mindful of privacy as well as user and commercial expectations regarding anonymity, data gathering and usage. It isn’t straightforward as there are so many considerations and conflicting views and needs, however a risk-based approach can simplify the information being collected which may help to alleviate any privacy concerns surrounding a CBDC. There are also benefits to help solve financial inclusion and support usage of a digital Pound; I will explore this in more detail a little later.

What are we trying to achieve?

All regulated financial institutions have to be able to evidence completion of a satisfactory level of anti-money laundering due diligence; to be able to demonstrate that they know their customers. This includes understanding expected activity and being able to produce relevant documentation and transactional information in the event of an internal suspicious activity investigation or law agency request.

In the past, such information gathering has been predominantly manual, particularly with regards to individual and corporate identification documentation. This of course has an associated cost financially for the institution in terms of resources required to complete the mandatory checks and to store the documentation collected. In addition, the time it has taken to onboard customers with the financial services provider, has tended to have a negative impact on user experience, and in some cases, is likely to have been seen as a deterrent to applications.

Over time, the ethos behind the regulatory AML requirements hasn’t changed, albeit the EU AML Directive has evolved (we are now on the 6th AML Directive) and broadened, to a degree, the requirements, but most significantly, the scope.

It therefore makes sense that risk management frameworks are aligned at a foundational level but are adaptable so as to be able to accommodate new requirements and also to allow firms to embrace technological developments, such as the use of online registers and digital ID&V checks. In essence, we are trying to replicate the former manual processes and adherence to requirements – whilst leveraging the increasing level of digitised solutions available.

Most of us will be familiar with digital identification and verification solutions requiring a photo of an ID document, such as a passport, supported by a ‘selfie’. This enables, for the lower risk customers at least, a verification process that can be completed remotely, quickly and with minimal inconvenience to the user. 

Taking this a step further, it is argued that identity management tools that use biometrics and artificial intelligence are essential to identity and provide an even more effective identification and verification solution. The potential for biometric based technologies, such as those provided by IDEMIA, to create and verify an identity, to enable organisations to better intercept and mitigate money laundering and terrorist financing is significant, particularly where the solution brings together governments and financial institutions. I’m thinking individual identity verification and PEP/sanctions checking in one hit. This is right up my street – enhanced and more effective risk management controls combined with a better user experience!

The benefits of digital client onboarding

Digital client onboarding processes allow for remote identification and verification, enabling a faster and more efficient process, typically lower in cost but especially faster and creating a better client experience. A digital approach also enhances accessibility and significantly reduces logistical challenges, particularly where people are unable to get to a branch or office.

From a financial institution’s perspective, the digitised nature of the information, and documentation gathered, makes record keeping simpler and again cheaper. Let’s think about the impact of new technologies such as blockchain – where documents and information can be securely stored, with access controls in place allowing the data subject to update the information held when needed, supported by immutable records and encryption capabilities. All of a sudden we aren’t too far off the concept of a sovereign digital identity which could ultimately be transferable which then could be beneficial to speeding up onboarding but that is another matter entirely and I am starting to digress!

The key point here is that a digital client onboarding process enhances the client experience. By virtue of its digital nature, the due diligence can be embedded into the financial services provider’s platform registration portals with the potential for alignment of client information, data and transaction activity. This creates a holistic approach to AML. Further to this, a digital approach allows for the setting of thresholds and triggers for different customer types, with differing risk profiles. This provides the perfect foundation for managing a risk-based approach.

A risk-based approach

As discussed, moving away from manual processes and focusing on digital solutions, allows greater flexibility, thresholds and controls. One size does not have to fit all. 

A risk-based approach allows firms to undertake a lower level of due diligence on lower risk clients than on high risk clients. Having undertaken a risk assessment, likely through the setting of criteria and conditions, the opportunity to tailor your AML regime to suit the specific risk context is presented. This then leads to better client experiences, where excessive and disproportionate identification and verification requirements are avoided. It must be stressed that having a robust risk assessment process is key here as an inaccurate risk assessment will increase the risk profile – and must be versatile enough that any changes to a customer’s risk classification are captured and further information obtained where necessary. Digital onboarding allows greater flexibility and unlocks many automated functions that make conducting KYC, KYB and AML checks faster. 

Digital onboarding solutions are particularly well-suited to those customers who are eligible for being treated as lower risk. An important point here is that with all the efforts being made to enable smoother and faster transactions and payments, a risk-based approach allows certain users to benefit from a simpler onboarding process and to access the financial services more quickly. On this basis, one could rephrase the title of this presentation to read ‘the benefits of digital onboarding to a true risk-based approach’. Essentially the two go hand-in-hand. This brings us to the benefits for financial inclusion.

Financial inclusion

The main obstacle to accessing regulated financial services or products to unbanked customers is their lack of reliable identity documentation and data verification. Indeed, one of the reasons why cryptocurrencies have been so successful so quickly has been the ability to provide the unbanked or underbanked with access to ‘money’, without having to go through the usual account opening due diligence procedures. Of course, this has now changed since being brought into scope of the AML regime but it nonetheless highlighted a need that wasn’t being met. 

In terms of the concept of a well-designed digital Pound, financial inclusion is paramount. As the Bank of England explores the potential for a CBDC and other private institutions launch different new forms of digital money (e-money tokens, stablecoins etc.), it is clear that addressing financial inclusion is a key objective. 

The combination of a risk-based approach and digital onboarding sets the scene perfectly for this. Where low income individuals or displaced persons such as refugees do not possess the full identification documents required and are therefore unable to meet “traditional” due diligence requirements, being able to assess their risk to your business and to incorporate different approaches to AML is a positive way to enable your business to serve this customer type.

For example, Billon is currently collaborating with migrant worker agencies in order to explore the facilitation of low-cost remuneration and incentive payments into a ‘lite’ e-wallet, enabling prompt payment (enhances productivity and agency loyalty) and basic payment functionality for the recipient. This requires a risk-based approach to user onboarding and whilst documentation such as proof of address may prove problematic, as it may not be available, setting thresholds to limit activity and applying an appropriate level of monitoring can be just as effective as a financial crime mitigation tool.

The clear benefit of the risk-based approach here is that fintech companies can use their technology and platforms to meet a social need; to address financial inclusion. In return, previously excluded individuals can access safe, convenient and affordable financial services, at a reasonable cost. This last point is important – if financial service providers are spending money unnecessarily on overly burdensome procedures, they are unable to provide lower cost financial services to those that need them the most. A risk-based approach and digital onboarding solution can work well together to reduce these costs.

As we focus, at Billon, on mass payouts and solving clunky processes for flexible workers, loyalty, reward and incentive payments, it is quite likely that the transaction size will be quite small. This brings us back to proportionality of due diligence and the relevance of flexible approaches to risk management. We cannot sell our services and the cost savings that result from our payment platform if the costs of onboarding are unnecessarily high.

Use Case – Migrant workers in Ukraine

Since the war erupted in Ukraine, Poland has welcomed 3.6m Ukranians and whilst only 1.6m remain, this is still a huge influx of people seeking work, payment and payment facilities. It is true that an ID document should be available for those officially entering a country, but anything beyond that may be unlikely, particularly proof of address which is often required as a secondary document.  

A risk-based approach allows for a combination of other forms of verification (if available) or enhanced monitoring, supported by the application of limits both in terms of services available, transaction sizes and types. The important point is that the financial services that these people need become accessible (and quickly). 

Thinking ahead to what the migrants might need longer term beyond payment facilities (e.g. as they become residents) – lending for example. Having been able to onboard these individuals due to the risk-based approach, a profile can be built over time. The financial institution is getting to know their customer more and more and so might get to the point where they are willing to offer lending or more sophisticated services. This information capturing and profiling extends beyond the use of identification and verification – but without the risk-based approach the financial institution may not have been able to get to this point. Essentially the organisation can meet contingent worker needs straight away and also access a broader customer base for whom they can identify future opportunities. The same can be applied to any potential client who cannot fulfil traditional due diligence requirements.

What does this mean for CBDCs?

As mentioned, financial inclusion has to be a feature of a well-designed CBDC. For this new form of digital money that in many ways needs to be aligned with physical cash attributes (where possible) it needs to be accessible to all.

In the UK, 1.71m adults find themselves without a bank account, and therefore access to safe, secure and low cost financial services. This means that those who find themselves to be financially excluded do not have the ability to manage day-to-day financial transactions. As new forms of digital money are introduced, including CBDCs, there is the opportunity to review and redesign the underlying banking and payments architecture. New technologies allow funds to be held in wallets on smartphones and for peer-to-peer transfers and e-commerce transactions to be made from a mobile application or website. Providing the ability to make and receive payments is fundamental to addressing financial inclusion.

As alluded to previously, privacy and data sharing is also a significant consideration for digital currency adoption, particularly digital money that is being issued by a central bank. Fears of data being shared for unwanted commercial purposes or indeed excessive governmental oversight could be a distinct blocker to CBDC and other new forms of digital money adoption. It is therefore worth exploring the extent to which a risk-based approach to onboarding, which results in less personal information being gathered, could positively influence confidence in a new digital currency.

To that end, it might not be out of the question to reassess the basis upon which we seek to prevent money laundering. Again for another time, but what if a risk-based approach allowed for a greater emphasis on transaction monitoring or even a focus on the receiver of the funds rather than the sender? These are distinct changes that could significantly enhance digital onboarding and speed up even further access to market for consumers.