4 ms·

Smart. Banks haven't been allowed to monetize their KYC data, but this new non-bank class of payments companies have this opportunity. Interac has been trying t

Smart. Banks haven't been allowed to monetize their KYC data, but this new non-bank class of payments companies have this opportunity. Interac has been trying to do this for many years. Some years ago I worked on a system let banks do identity assertions with proofs via SAML attributes instead of sharing customer PII. It is now a federation of banks in wide use for govt services in Canada. The use cases were really limited because the federation partners were too conservative to extend the identity services to relying party consumer applications real people actually wanted to use, and institutional sales cycles meant product feedback was glacial, so it has existed for over a decade in this relative backwater of gov-tech. I think identity companies have mostly failed to get traction because of a terminal lack of consumer sexiness, whereas Stripe has the jelly. Other companies in the identity space have been working on protocols and platforms, but none of them had a user base to extend an identity federation services into, which means they have never been able to make a real or viable product, just interesting techs. An internet payment provider with young consumer traction getting into identity is a Very Big Deal. It's going to position Stripe to knock out a lot of retail banks who can't offer similar services. Imo, this could make them bigger than Apple.

cycop 5y ago
"Banks haven't been allowed to monetize their KYC data"? I work for a major US Bank and they are most definitely monetizing KYC data, in fact we have made several billion dollar acquisitions just to scoop peoples data.
- motohagiography 5y ago
  The convention in Canada was there were limits on how much customer PII banks and the payment networks could collect, use, and share or sell, and how. "Monetize," in my comment means "sell to others like a social platform / ad-tech company," whereas I would agree it could be monetized in other ways. What I see is that Stripe doing IAM for platforms and services that people use daily sets them up to dominate retail and small business banking services if they wanted to go there.
jsmith99 5y ago
Do banks want to monetise their KYC data? In the UK, the government launched a similar system in 2014 called Verify, a platform for banks and other firms with existing customer relationships to offer identity verification as a service to the government, and eventually, third party sites. Users would choose a participating bank they has a relationship with and login to their account as verification. But despite paying over £20 a user for each verification they only got one or two banks to join, and the scheme was a disaster.
- TheTrotters 5y ago
  In Poland I can use my bank login (a “Trusted Profile”) to sign in to government websites and access my data. E.g. when I registered for Covid vaccine I logged in using my bank login. There are other ways to do it too but since I already had an account in a participating bank I didn’t bother looking into them. I don’t know if banks earn anything from it. I’d be surprised if they did.
- rikroots 5y ago
  The scheme is still running - https://www.gov.uk/government/publications/introducing-govuk-verify/introducing-govuk-verify https://www.gov.uk/government/publications/introducing-govuk... - DWP pretty much forced me to use it when I applied for Universal Credit last year.
throwaway201606 5y ago
Actually, it seems that this did go into production - you can now verify identity using the service. For example, you can identify yourself for Govt. of Canada services (immigration, taxes) by logging into to your banking platform that then vouches for your identity using a service called SecureKeyConcierge / Verified.Me - note that ALL of Canada's major and quite a few minor banks are signed up to the service. See this page: https://services.securekeyconcierge.com/cbs/saml/login?l=1&lang=eng https://services.securekeyconcierge.com/cbs/saml/login?l=1&l... The way the service works by getting permission from you, the user, to share some part of your identity with the destination and you can chose what you share. You could pick for example just to share name and not DoB. The one reason I hate this otherwise superbly designed service and refused to use it is that is has a dark pattern where it creates a "SecureKey / Verified.Me Concierge Account" for "you" when you use it and starts proxying/pre-emptying the bank-login-as-verification process. WHICH IS STUPID AND SCAMMY IF YOU ARE READING THIS VERIFIED.ME, THIS IS DARK PATTERN BEHAVIOR AND IT IS NOT RIGHT OR FAIR /start rant From my perspective, the whole point is - inhale - "I sorta trust my bank because I have to so I will log on to them so that they can vouch for me but I definitely don't trust you so why are you being a dick and making me make an account with your service that I don't trust and will never trust" - exhale Just let the bank vouch for me each time, this is what I expect a reasonable and non-scammy service provider to do. Don't wait till you have my info then tell me, hey, I will make an verified.met / secureconcierge account for you so that <insert your preferred monetization rationale here> before you do what you promised to do. I get the idea that they want to consolidate a profile so that you can pick what to share without entering it each time but they way it is done right now feels really slimy. /end rant
- voidmain0001 5y ago
  I wrote an identity verification process with Verified.Me. I understand your concern regarding SecureKey's creation of a user account for its service built around identity verification sources such as the chartered banks. Your Verified.Me account is tied to your mobile device, and that it doesn't have any extra PII. You can delete your Verified.Me account from the app at any time. If you move to a new device and want to use Verified.Me, it will tell you that your account is already on another device and needs to be deleted from it before proceeding. The PII that is shared from the banks to the Verified.Me consumer is name, email, and phone number. At all times SecureKey said that it's the conduit and doesn't see that data. Similar to Stripe, SecureKey currently offers an analysis service for photo ID that looks for anomalies and calls them out. The next version of the service integrates with provincial records to concretely confirm validity.

cycop 5y ago

"Banks haven't been allowed to monetize their KYC data"? I work for a major US Bank and they are most definitely monetizing KYC data, in fact we have made several billion dollar acquisitions just to scoop peoples data.

motohagiography 5y ago
The convention in Canada was there were limits on how much customer PII banks and the payment networks could collect, use, and share or sell, and how. "Monetize," in my comment means "sell to others like a social platform / ad-tech company," whereas I would agree it could be monetized in other ways. What I see is that Stripe doing IAM for platforms and services that people use daily sets them up to dominate retail and small business banking services if they wanted to go there.

jsmith99 5y ago

Do banks want to monetise their KYC data? In the UK, the government launched a similar system in 2014 called Verify, a platform for banks and other firms with existing customer relationships to offer identity verification as a service to the government, and eventually, third party sites. Users would choose a participating bank they has a relationship with and login to their account as verification. But despite paying over £20 a user for each verification they only got one or two banks to join, and the scheme was a disaster.

TheTrotters 5y ago
In Poland I can use my bank login (a “Trusted Profile”) to sign in to government websites and access my data. E.g. when I registered for Covid vaccine I logged in using my bank login. There are other ways to do it too but since I already had an account in a participating bank I didn’t bother looking into them. I don’t know if banks earn anything from it. I’d be surprised if they did.
rikroots 5y ago
The scheme is still running - https://www.gov.uk/government/publications/introducing-govuk-verify/introducing-govuk-verify https://www.gov.uk/government/publications/introducing-govuk... - DWP pretty much forced me to use it when I applied for Universal Credit last year.

throwaway201606 5y ago

Actually, it seems that this did go into production - you can now verify identity using the service. For example, you can identify yourself for Govt. of Canada services (immigration, taxes) by logging into to your banking platform that then vouches for your identity using a service called SecureKeyConcierge / Verified.Me - note that ALL of Canada's major and quite a few minor banks are signed up to the service. See this page: https://services.securekeyconcierge.com/cbs/saml/login?l=1&lang=eng https://services.securekeyconcierge.com/cbs/saml/login?l=1&l... The way the service works by getting permission from you, the user, to share some part of your identity with the destination and you can chose what you share. You could pick for example just to share name and not DoB. The one reason I hate this otherwise superbly designed service and refused to use it is that is has a dark pattern where it creates a "SecureKey / Verified.Me Concierge Account" for "you" when you use it and starts proxying/pre-emptying the bank-login-as-verification process. WHICH IS STUPID AND SCAMMY IF YOU ARE READING THIS VERIFIED.ME, THIS IS DARK PATTERN BEHAVIOR AND IT IS NOT RIGHT OR FAIR /start rant From my perspective, the whole point is - inhale - "I sorta trust my bank because I have to so I will log on to them so that they can vouch for me but I definitely don't trust you so why are you being a dick and making me make an account with your service that I don't trust and will never trust" - exhale Just let the bank vouch for me each time, this is what I expect a reasonable and non-scammy service provider to do. Don't wait till you have my info then tell me, hey, I will make an verified.met / secureconcierge account for you so that <insert your preferred monetization rationale here> before you do what you promised to do. I get the idea that they want to consolidate a profile so that you can pick what to share without entering it each time but they way it is done right now feels really slimy. /end rant

voidmain0001 5y ago
I wrote an identity verification process with Verified.Me. I understand your concern regarding SecureKey's creation of a user account for its service built around identity verification sources such as the chartered banks. Your Verified.Me account is tied to your mobile device, and that it doesn't have any extra PII. You can delete your Verified.Me account from the app at any time. If you move to a new device and want to use Verified.Me, it will tell you that your account is already on another device and needs to be deleted from it before proceeding. The PII that is shared from the banks to the Verified.Me consumer is name, email, and phone number. At all times SecureKey said that it's the conduit and doesn't see that data. Similar to Stripe, SecureKey currently offers an analysis service for photo ID that looks for anomalies and calls them out. The next version of the service integrates with provincial records to concretely confirm validity.