9

Most countries require people to provide a significant amount of personal data to providers of financial services before you are able to make use of them. This is know as Know Your Customer (KYC) rules. This provides an benefit in the form of increased financial scrutiny and compliance. This provides a cost in terms of data security to the individual. This cost directly impacts the benefit, in that the more your personal data is distributed the less use it has to identify an individual. Has any government published analysis of this effect, and the conditions that must be true for this to overall be a positive thing?

The one time I have had to do the KYC process was recently when I signed up for an online financial service. This involved sending high resolution images of my passport, driving licence and face. Ten days after this process the company informed me that they had been hacked and lost all that data. At that point being able to produce these images would have been no actual use in identifying if a company was dealing with me or a hacker.

Thinking further, it would seem fairly simple to model society in terms of the number of accounts individuals have, the incidence of data loss and the length of time documents are valid for and come up with an expectation of the proportion of people who have their data in the hands of hackers. I know it is extreme, but to illustrate my point if the actual expected incidence of hacking of a set of KYC data had a poisson distribution with a λ of 10 days, then there would be far more instances of any personal data submitted for KYC in the hands of hackers than "real" people, so would be therefore of no use in financial monitoring.

Has any government published such an analysis, or otherwise explained how KYC rules function under significant rates of corporate data loss?

Improve this question
7
  • 7
    Why would they?
    – Fizz
    Nov 4 at 15:43
  • 1
    Governments usually don’t publish cost benefit analyses on legislation because otherwise they’d have to scrape most legislation altogether. I.e. we’d probably have zero Covid rules if a proper cost benefit analysis was undertaken in Feb 2020.
    – JonathanReez
    Nov 4 at 20:11
  • 1
    How would you even monetize the different in kind costs and benefits? KYC is in part designed to prevent terrorism - what is that worth? What is privacy worth? The probabilities of a breach which would drive the privacy side would likewise be hard to quantify.
    – ohwilleke ♦
    Nov 7 at 0:26
  • @ohwilleke You would not need to monetize either side. The cost benefit analysis could be restricted purely to the predictive power of personal identity documents. Every time the KYC data is leaded it reduces the value of the KYC data in providing a link between an individual and an central identity record. If the average time to leak is actually 10 days then this requirement to store KYC info would seem to reduce the value of the KYC more than any possible gain. Identifying that threshold would seem valuable to a state that really cared about its citizens.
    – User65535
    Nov 7 at 6:35
  • 1
    @User65535 You can't do cost-benefit analysis without quantifying the costs and the benefits in some manner that can be compared.
    – ohwilleke ♦
    Nov 7 at 12:33

2 Answers 2

Reset to default
8

I haven't seen such an analysis, but certainly information security is on the radar of states.

However it's worth correcting a wrong assumption in the question.

The purpose of accepting copies of documents is not to definitively prove that the bank is liaising with a genuine customer, but to unambiguously identify a particular centrally-held record about the person who an application or transaction ostensibly concerns.

The data provided on any one occasion can also be retained and ultimately supplement those central records.

A hacker's seizure of this data doesn't massively increase the overall risk of fraud, because the banks broadly assume already that someone other than the customer may have possession of the information they ask for.

At some threshold of risk or doubt, the bank will either conduct more routine checks (such as telling you to show the ID in person), or it will apply a fraud investigator to review the situation.

But for customers with an ample central record, and whose latest application or transaction is consistent with past information or behaviour, there may be a great deal of information on file that can be used to discern fraudulent from genuine.

What will set alarm bells going is if, for example, a fraudster applies for a loan, but provides different contact details than those on file. Obviously, a fraudster does not want to apply for a loan in your name, only to then send the funds to your account. He wants to abstract the funds for himself.

So in certain respects the fraudster has to provide different details than would a genuine customer - it's not enough to provide all the customer's own genuine details.

This is why the banks place importance on identifying the central record, because it is that record against which everything in the latest interaction will be compared. And they don't want to either be comparing it to the wrong record (for better or worse), or be putting too many genuine customers through the mill of proving themselves unnecessarily because no central record could be identified.

Improve this answer
14
  • 1
    I am quite willing to accept that this is why the banks want your PII. The question really is about the legal requirement. As I understand it the requirement to provide documents is a legal requirement, and if the requirement was not there many organisations would not require it. The further analysis you describe is very much in the banks interest, and they would do it in the absence of the legal requirement to do it. Therefore it seems to me like this is kind of answering a different question, one perhaps that had "bank" instead of "government" in it.
    – User65535
    Nov 5 at 6:38
  • @User65535, indeed part of what you're seeing is a modernisation of processes that banks have always run. For example, branch staff often used to recognise their customers, and the need for physical presence (and to correspond to the age, sex, and class of the account holder), as well as the presentation of physical tokens like bank cards and passbooks, limited fraud in different ways. This is one aspect of what might be said to fall under a KYC process, which is really about fraud and loss prevention, and is in the bank's interest. (1/3)
    – Steve
    Nov 5 at 9:22
  • The reason the state enforces KYC however (rather than leaving it to bank self-interest), is to catch circumstances where banks may be making a lot of money by facilitating criminality and anonymous flows of money. However, I think you're starting from the assumption that your data would not have been collected but for the state-enforced KYC rules. I disagree, and I've explained how the data demanded is used for the bank's own self-interest to facilitate fraud prevention. (2/3)
    – Steve
    Nov 5 at 9:23
  • "you're starting from the assumption that your data would not have been collected but for the state-enforced KYC rules. I disagree". The financial institution was kraken, a crypto exchange. They did not ask for any ID until various governments started cracking down.
    – User65535
    Nov 5 at 9:25
  • I've also explained how the loss of your data does not necessarily increase the fraud risk, by explaining how that data is actually used by the bank, which was another claim in your question. Indeed your whole question is built around the idea that providing your documents which are then hacked, has a "cost" in terms of allowing hackers to then identify themselves as you. As I've explained, that isn't how it works. The documents are not collected to prove you are you by demonstrating your possession of them. They are simply used to identify your relevant central record. (3/3)
    – Steve
    Nov 5 at 9:25
5

Know Your Customer rules are not about identifying the individual. If that was the goal, the customer presenting their Passport (or other national ID) would fully do that.

The knowing of the customer is more deep, it relates to things like knowing the source of their money, to avoid money laundering or financing terrorism. This puts the banks in a conundrum, as they are both expected to know their customer, almost to vouch for them, and at the same time have no business to know about the life of their customer (and in fact they don't care, other than they are required to do this).

An ideal of knowing the customer would be the typical small town, decades ago, where the bank employee would have known everyone living there for years. Nowadays, usually there is no close relationship between the bank and the customer (and moreso with the trends banks closing offices, sometimes they won't even meet the customer in person).

So, as the KYC is not for identifying the individual, that shouldn't be considered a goal. Another point is that the bank is expected not to be hacked. While the bank sector is quite heavily regulated, this doesn't mean there aren't lousy practises going on (or perhaps, as the banks would prefer to phrase it, "attackers sophisticated enough to bypass their defenses").

Not that such expectation helps the customer too much. The only way for the customer to ensure such data is not lost by the bank would be not to provide it to begin with.

Note that depending on the applicable laws, you may be entitled to receive certain compensation for the loss of your personal data. And no, I'm not referring to simply "we will give your credit monitoring". To begin with, I would require the bank to pay for getting a new passport and driving license, different to the current ones they "lost" and are now in the hands of malicious actors. This also has an immaterial cost on you that should be compensated, and so on.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .