For online identification, Circular 2016/7 "Video and online identification" requires the financial intermediary to confirm the address provided by the contracting party. The Circular provides three types of documents for address validation, including the most commonly used “utility bills”. Hereafter, it will be explained why the provided possibilities are neither useful nor practicable, especially for start-ups in the fields of fintech and blockchain applications. The prescribed alternatives complicate the processes that the Circular tries to simplify.
Purpose of the Revision of Circular 2016/7
The aim of the revision of Circular 2016/7 of the Swiss Financial Market Supervisory Authority FINMA (hereinafter "FINMA") was to examine whether the regulation is targeted and meets the needs of the financial market and the financial intermediaries. Furthermore, the revision focused on technological neutrality, i.e. the fact that regulation should be neutral with regard to technological developments and business models and should be principle-based.
Address Confirmation for Online Identification
The FINMA Circular provides the following three options for confirming addresses as part of the online identification:
- Address confirmation by means of a "utility bill" (tax or other official invoice or an energy, water or telephone bill);
- Confirmation of address by means of postal delivery;
- Address confirmation by means of a public register or a trustworthy, privately managed database/directory
Plausibility of the Address Confirmation
With regard to the question of conclusiveness or plausibility, a distinction must be made between the three possibilities for address confirmation provided in the Circular.
A confirmation of an address by means of a public register or a database maintained by a trustworthy private person can undoubtedly be considered to have increased plausibility. The reason for this is that there is only a limited number of such registers and their extracts are difficult to falsify. As can be seen later, however, this type of address confirmation is only practicable to a limited extent in practice.
In contrast to the public register, the other two methods - "utility bill" and postal delivery - have only very limited significance with regard to the address confirmation.
The idea of postal delivery is that the address is confirmed when a letter is sent to the indicated customer address. On the other hand, no confirmation of the actual delivery is required, so that the address confirmation by means of postal delivery only checks the plausibility of the address to a limited extent. Moreover, it would not be difficult for contracting parties to state an address with a domicile provider. In this way, a wrong address in a possibly even wrong country would be recorded as the correct address of the con-tracting party in the identification process and deemed correct according to the requirements of the Circular.
The third option is to confirm the address using the "utility bill". “Utility bill" means a tax or other government invoice or an energy, water or telephone bill. In practice, an unmanageable number of potentials "utility bills" are possible due to the various authorities or telephone providers, especially if foreign "utility bills" are included. Such a utility bill, especially when submitted as a scan, can be quickly and easily falsified. Thus, this type of address confirmation also has only a small plausibility value. Nevertheless, these methods of confirming addresses as part of the online identification are sufficient for FINMA.
From a practical point of view, the verification of a public register such as that of Swiss Post is certainly only practicable to a limited extent for financial intermediaries with Swiss customers. It is also possible that such a query can be carried out automatically with appropriate software. However, as soon as a financial intermediary with many international clients is involved, address confirmation via public registers reaches its limits, as each country has different public registers and different access requirements. An automatic query by corresponding software is rather unlikely here. This leads to the fact that an address confirmation must be carried out individually and manually by means of public registers.
Postal delivery is impracticable not only for a large number of foreign customers, but also for a large number of Swiss customers. On the one hand, postal delivery for many customers causes high costs, regardless if domestic or foreign. On the other hand, depending on the country, the slow postal delivery may delay the opening of a business relationship by months or postal deliveries may not arrive, even though the address details are correct. In conclusion, postal delivery not only has little plausibility but is also impracticable in practice.
The third possibility, "utility bills", are all designed so differently that they cannot usually be read and checked automatically by an appropriate identification software. This means that the submitted utility bills must be manually checked by one person and classified as sufficient. This is associated with correspondingly high effort and costs. Moreover, when checking such documents manually, the susceptibility to errors cannot be ignored.
Technically more advanced possibilities conceivable?
Various options are imaginable so that the intended address confirmation can be carried out according to the technical progress - and not with hard copies as stated in the Circular.
One possibility could be to confirm the address by means of the IP address used for the online identification process. Further possibilities would be the use of mobile phone number information (e.g. country and regional codes) and the screening of GPS data when logging into the major social media platforms. The place of issue of identification docu-ments such as passports, driver’s license etc. can also be seen as an indication for the address confirmation. With online identification, the customer must also submit or upload a photograph, e.g. in the form of a selfie, to the financial intermediary. With today's smartphones and cameras, images are often provided with location information. It is imaginable, for example, that online identification software would only accept photographs that include the location information. If this is not the case, the software could reject the photo with the message that a new image must be uploaded with location indication enabled. How all these alternatives must be designed from a data protection point of view would have to be determined in each individual case with the corresponding service provider.
The argument that, for example, an IP address is very susceptible to falsification is not valid. As already seen, utility bills are easy to falsify, and postal deliveries do not have sufficient plausibility. In order to make the address data even more reliable, a step-by-step address confirmation could be suggested or methods could be employed to detect the use of online anonymity services (e.g. VPN, proxy, TOR, etc.). For example, three details of the aforementioned technical possibilities would have to confirm the place of residence indicated by the customer. If one specification does not correspond to the other ones, the process could be considered a failure. In this case, recourse to the original possibilities listed in the FINMA Circular could still be envisaged.
One of the advantages of online and video identification is the standardization of identification processes via technical solutions, possibly by an appropriate partner. The purpose of the Circular is to adapt regulation to technological developments. If the three address confirmation options listed in the Circular are adhered to, however, the processes that should be simplified due to online identification are made more difficult.
Unfortunately, FINMA is of the opinion that these alternative measures, also in combination with various possibilities, allow only conclusions about the region or the country in which the contracting party is located (instead of the actual place of residence). However, the reason why postal deliveries or utility bills should offer higher certainty than IP addresses or GPS data, is not evident.
It remains to be seen how long FINMA will continue to insist on the exclusive validity of the current methods of address confirmation. It cannot be denied that there is a need for timely adaptation due to the constant technological progress and the global environment in which many companies operate in the field of fintech and blockchain applications.