Understanding Capture and Validate KYC Processes: Global Experiences, Challenges and Learnings May 2019 Copyright © 2019 GSM Association Understanding Capture and Validate KYC Processes: Global Experiences, Challenges and Learnings v Digital Identity The GSMA represents the interests of mobile operators The GSMA Digital Identity Programme is uniquely worldwide, uniting more than 750 operators with over positioned to play a key role in advocating and raising 350 companies in the broader mobile ecosystem, awareness of the opportunity of mobile-enabled digital including handset and device makers, software companies, identity and life-enhancing services. Our programme works equipment providers and internet companies, as well as with mobile operators, governments and the development organisations in adjacent industry sectors. The GSMA also community to demonstrate the opportunities, address the produces the industry-leading MWC events held annually in barriers and highlight the value of mobile as an enabler of Barcelona, Los Angeles and Shanghai, as well as the Mobile digital identification. 360 Series of regional conferences. For more information, please visit the GSMA Digital Identity For more information, please visit the GSMA corporate website at www.gsma.com/digitalidentity website at www.gsma.com Follow GSMA Mobile for Development on Twitter: Follow the GSMA on Twitter: @GSMA @GSMAm4d This document is an output of a project funded by UK aid from the Department for International Development (DFID), for the benefit of developing countries. The views expressed are not necessarily those of DFID. Author: Matt Wilson, Senior Insights Manager, GSMA Rob Waddington, Futuresight Understanding Capture and Validate KYC Processes: Global Experiences, Challenges and Learnings v Contents Executive Summary .................................................................................. 2 The Capture and Validate Landscape .............................................. 5 Establishing a ‘Capture & Validate’ System ................................... 11 Case Study 1: Pakistan ................................................................................ 14 Case Study 2: Bangladesh ......................................................................... 16 Case Study 3: Peru ..................................................................................... 18 Case Study 4: Uganda ................................................................................ 20 Case Study 5: Senegal ................................................................................ 22 Key Learnings: ............................................................................................ 24 Capture and Validate Implementation ...................................................... 24 Benefits to MNOs........................................................................................ 27 Economic Impacts on MNOs ..................................................................... 29 Current and Future Opportunities ............................................................ 31 Conclusion .................................................................................................... 34 Appendices .................................................................................................. 36 Additional Country Case Studies .............................................................. 36 Research Methodology .............................................................................. 42 Understanding Capture and Validate KYC Processes: Global Experiences, Challenges and Learnings Executive Summary As of December 2018, an estimated 150 governments impose Know-Your- Customer (KYC) regulations that require customers to present a valid proof of identity – often a government-issued or recognised credential, such as a national identity document or passport – before they can subscribe to mobile services. Governments take different approaches to implementing SIM registration policies, but these generally fall into one of the following three categories, as defined by the GSMA.1 Capture and Store Mobile network operators (MNOs) are required to capture and keep a record of a set of personal information about the SIM user. The required information varies from jurisdiction to jurisdiction. About 85 per cent of the countries mandating SIM registration follow this approach. Capture and Share MNOs are required to proactively capture and share the SIM user’s personal information with the government or regulator, rather than upon demand. Roughly four per cent of the countries mandating SIM registration follow this approach. Capture and Validate MNOs are required and enabled to validate their customers’ identification credentials against a central government database, usually maintained by a government authority or regulator. Only 16 countries (11 per cent) mandating SIM registration follow this approach, of which 11 countries (seven per cent) require MNOs to use biometric-authentication processes when registering their prepaid SIM customers. 1. GSMA (2019) ‘Access to Mobile Services and Proof of Identity 2019: Assessing the impact on digital and financial inclusion’ 2 Executive Summary Understanding Capture and Validate KYC Processes: Global Experiences, Challenges and Learnings Of these three categories, GSMA has asserted that Research Methodology ‘Capture and Validate’ processes give the highest Desk-based research was conducted to provide level of assurance that the registered individual a detailed overview of the key stakeholders, ‘is who they claim to be’. This can mitigate the institutions, regulations, legislation, systems and incidence of fraud and offers new opportunities processes in 11 countries understood to have for mobile to be used as a digital identity when implemented a Capture and Validate system in Latin accessing value added services.2 However, these America, Sub-Saharan Africa and South/Southeast benefits must be balanced against the risk of data Asia.4 This includes: Ecuador, Peru, Ghana, Senegal, misuse and mobile users’ rights and legitimate Uganda, Bangladesh, India, Indonesia, Malaysia, expectations, for example in the context of Pakistan and Thailand. To help validate the available privacy and data protection. Capture and validate published information, stakeholder interviews capabilities, therefore, do not tend to involve giving were conducted to collect the views and opinions MNOs access to personally identifiable information of subject matter experts and local stakeholders held by government; instead, they usually allow in each country. Short case studies on six of these MNOs to query a customer’s identification credential countries can be found in Appendix 1. against the database, and in turn the relevant authority confirms whether the credential matches In five of the 11 Capture and Validate countries – the one stored in their official records. Pakistan, Bangladesh, Peru, Uganda and Senegal – structured interviews were conducted in-country There is also anecdotal evidence to suggest that a with individuals who possess particular knowledge Capture and Validate approach – particularly when of, and experience with, the local Capture and identification systems have sufficient coverage – can Validate system. Where possible, this included bring direct benefits to MNOs and other private telecommunications regulators, national identity sector organisations by decreasing administrative authorities and MNO representatives from relevant costs, reducing fraud, increasing revenue and business functions: Policy or Regulatory Affairs, widening the customer base.3 However, to date Compliance, Commercial and others. A more there is little robust evidence to support these detailed summary of the stakeholders engaged in claims, nor assessments examining the impact each of these focus countries are found in Appendix of this approach on MNOs and the opportunities 2. The insights and recommendations found in that might arise from it. This report addresses this report reflect the anonymised perspectives of this knowledge gap and, in turn, provide shared these individual stakeholders, and caution has been learnings for other MNOs that might be required taken not to extrapolate the findings too broadly. to implement a Capture and Validate system in the Furthermore, precise data related to the cost of near future. these initiatives or their broader societal impacts (for instance, reduction in small-scale crime) was not always available and in many cases has been carefully estimated. Case studies documenting how MNOs in each of the five countries navigated the implementation of Capture and Validate systems are found on pages 11 to 13. A summary of lessons learned from all 11 countries – related to implementation, the benefits and costs to MNOs, and current and future opportunities – are found on pages 24 to 33. 2. GSMA (2016) ‘Mandatory registration of prepaid SIM cards: Addressing challenges through best practice’ 3. See for instance: World Bank (2018) ‘Private Sector Economic Impacts from Identification Systems’ 4. As identified in GSMA’s Access‘ to Mobile Services and Proof-of-Identity: Global policy trends, dependencies and risks’ (2018, Annex 8). There were five Capture and Validate coun- tries not included in this research project: Bahrain, China, Egypt, Hungary and Saudi Arabia. Executive Summary 3 Understanding Capture and Validate KYC Processes: Global Experiences, Challenges and Learnings Key insights highlighted in this report include: