In a recent assignment, I was tasked with conducting an initial technical assessment of five financial platforms under consideration for acquisition. My responsibilities included engaging with representatives from these investment platforms to evaluate the overall functionality and health of their systems.
Armed with an extensive questionnaire aimed at gauging the quality and thoughtfulness of these platforms, my attention was particularly captivated by the challenge of automating user document verification. Adhering to Know Your Customer (KYC) requirements, financial platforms are obligated to validate user-uploaded documents for accuracy and authenticity, with a focus on detecting theft or expired validity. Those immersed in the development and support of such platforms often comprehend the intricacies of this process.
A significant aspect of my evaluation centered on the matter of automating document verification through an undisclosed third-party service provider. This service provider, operating on a service offer basis, proposed to verify user passport details and ascertain whether the passport had been reported as stolen or lost. To conduct this analysis, comprehensive user passport details were mandated in an open format through API access.
The core issue stems from the fact that platforms lack authorization to transmit personal data to third parties. Even if attempts are made to secure user consent for data transfer to this service provider through a checkbox or a concealed consent clause in the financial platform's user agreement, the legitimacy of such actions remains dubious.
At the very least, users should have the ability to review the privacy policy of the API service employed for KYC verification on the financial platform. This information should be transparent, and users must distinctly understand that their data is being accessed by a third-party organization for specific purposes under predetermined conditions. Would I be comfortable with my passport data sent to this non-specialized service provider? Most likely not.
A specialized service provider relies on its reputation as a KYC service. In contrast, a non-specialized service provider may not fully comprehend the level of responsibility when handling such sensitive information, given its myriad of other (non-KYC) services provided through APIs, including document verification.
Securing the process for such a service provider involves seeking an alternative provider offering similar KYC services via API. They do not receive any personal data from the financial platform but still conduct verification. The mechanism involves transforming all user personal data into SHA512 hashes before being transmitted via API. Passport data at this service provider is stored in the database as hashes, akin to modern services securing user passwords to prevent leaks. The service provider then compares the received API hashes with the hashes of lost passports in its database and provides the verification result.
This distinctive solution from the service provider effectively eliminated the risk of potential data leaks, encompassing both API-supplied data and personal data of invalid passports in the service provider's database. Encrypted data intercepted during transmission would be futile to hackers due to the employed algorithm. Notably, even the owners and developers of the KYC service provider lack the capability to decrypt the data, as it solely consists of unique hashes.
I intentionally refrain from specifying brands to uphold impartiality.
What are your thoughts on this approach? Feel free to share your preferences for KYC service providers and articulate the reasons behind your choices.
Michael Piskunov
CEO at FinMV.com
