SecureKey Technologies has partnered with Canada’s top banks and telcos to launch the country’s first federated digital identity network. The blockchain-based Verified.Me platform uses customer information from multiple databases to address a key problem in the digital world —
An advantage Canada has compared to more diverse markets such as the U.S. is the limited number of Canadian FIs, telcos and government agencies that digital ID ecosystems such as Verified.Me need to encompass. Canada is a highly consolidated market with just six big banks, three large telcos, and ten regional governments across its seven provinces and three territories.
Toronto-based
Verified.Me draws on Concierge, SecureKey’s single-sign-on system that enables Canadians to access their Revenue Canada taxpayer accounts and Canadian government benefits by logging into their FI instead of using government-issued credentials. Concierge doesn’t disclose users’ bank log-in credentials to government agencies. Around 60% of logins to Revenue Canada’s website use Concierge, according to SecureKey.
“We’re leveraging the strength of the secure login systems the banks have established,” said Greg Wolfond, SecureKey’s CEO. “We also draw on provincial government databases such as driver’s license systems.”
Initially launching with CIBC, Desjardins, Royal Bank of Canada, Scotiabank and TD, Verified.Me will soon be available for customers of BMO Bank of Montreal, National Bank of Canada and insurer Sun Life Financial. Verified.Me is supported by Equifax and Canada’s three largest telcos, Bell Mobility, Rogers Communications and Telus Communications.
“All our other partners will be following on soon,” said Wolfond. “We needed to get enough banks live with Verified.Me to achieve critical mass. Our vision is to expand Verified.Me beyond financial services use cases. In 2019, we will introduce non-financial use cases such as healthcare access, and widen our network to include other Canadian telcos.”
SecureKey’s roadmap includes a U.S. rollout for Verified.Me, Wolfond said.
Built on blockchain
Verified.Me uses permission-based blockchain technology to privately transfer users’ personal information to trusted network participants. It operates on the IBM Blockchain Platform and Linux Foundation’s open source Hyperledger Fabric v1.2.
“We don’t store users’ data on the blockchain, so there are no data honeypots to be hacked,” said Wolfond. “Verified.Me uses the blockchain as a secure data distribution mechanism and to record users’ consent to share data. When a Verified.Me user shares their data, which is held at RBC, for example, with a third party, RBC encrypts the data. It’s only decrypted when it gets to the third party, and it’s shared with the explicit consent of the user for a specific purpose, for example opening a new bank account.”
In 2016, the Canadian government amended its financial regulations to enable consumers to open bank accounts with electronic signatures.
Consumers participating in Verified.Me decide which digital ID attributes they want to share with service providers. When they apply for an account, the service provider sends a request to their smartphone asking for permission to access their credit record and other financial records held by their FI.
Data requestors are billed when they ask consumers for data, and SecureKey distributes the fees to the consumers’ data providers.
Verified.Me can be used on Android and iOS-based smartphones and Windows-based PCs. “It’s designed for digital and face-to-face interactions,” Wolfond said. “When you enter a branch, you scan a QR code and agree to provide your data to the agent you’re talking to.”
Consumers download the Verified.Me app onto their smartphones and use their bank login plus biometrics such as Face ID to validate their identity. Verified.Me also checks with the user’s telco to verify they are the registered user of the smartphone and that their SIM card hasn’t been swapped by a fraudster.
“With Verified.Me, you authenticate your identity in a fully digital manner without interjecting analogue processes,” said Katie Greenberg, Scotiabank’s vice president of digital products and retail payments. “We’re looking at using Verified.Me to onboard new Scotiabank customers and get an initial validation of who they are. We’ll also use Verified.Me for additional authentication for existing customers for higher-risk transactions and for when they enter branches or contact call centers.”
In addition to using Verified.Me to create initial identity profiles of its customers, Scotiabank will use the platform to generate additional data attributes in order to create more robust identity profiles. “We can then offer customers more tailored services,” said Greenberg.
