<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2022/04/banner-1251-1.webp" alt="Account Aggregator" title="" id="9hxp4jacw" width="100%" height="479">Data is a gold mine that drives insights and efficiencies across industries. Gartner predicts that by 2023, companies that actively leverage shared data will outperform their peers in crucial metrics. With 180+ zettabytes of data estimated to be created by 2025, businesses across industries need to devise strategies to gain access to relevant consumer information. Such access will drive insight-driven decisions to boost revenue, <a class="link" href="https://m2pfintech.com/blog/why-is-risk-based-authentication-rba-critical-for-banks/">mitigate risks</a>, and reduce costs.<h2 class="heading-node" id="134f" style="text-align: justify">Consent-based digital access to data</h2>Account aggregators or financial data aggregators play a significant role in enabling data access to financial institutions, businesses, and individuals. Prioritizing fiduciary consumer relationships, account aggregators share digitally signed and encrypted data upon explicit consumer consent.<h2 class="heading-node" id="160d" style="text-align: justify">Financial data aggregation in India</h2>India launched its Account Aggregator (AA) network in September 2021, as the first step towards open banking. Built on the Data Empowerment and Protection Architecture (DEPA), the account aggregator framework is the world’s leading consensual data-sharing infrastructure.This digital data access structure serves as a substantial digital enablement initiative after the launch of public infrastructure for digital identification (Aadhaar) and <a class="link" href="https://m2pfintech.com/blog/the-rise-of-digital-payments/" target="">digital payments</a> (UPI). Millions of customers can now digitally access and share their financial data in a compliant manner.<h2 class="heading-node" id="019c" style="text-align: justify">Potential to transform efficiencies</h2>The AA framework holds the potential to transform the efficiencies and profitability of financial institutions and businesses in India. Banks, fintechs, and NBFCs can use consumer data to widen target-base, personalize services, lower risks, enhance customer experience, and future-proof their product portfolio. Collecting, cleansing, and synthesizing pertinent data helps enhance insight-driven decisions and executions.Democratization of data access via account aggregator networks has brought in a win-win scenario for businesses, consumers, and <a class="link" href="https://m2pfintech.com/blog/digital-lending-open-credit-enablement-network/">new-age digital lenders</a> with advanced underwriting algorithms and a larger risk appetite. They have broken the data monopoly of digital and financial services firms by transferring data sharing power to individuals.<h2 class="heading-node" id="a06c" style="text-align: justify">So, who are account aggregators in India?</h2>Account aggregators are NBFC-AA licensed entities that are regulated by the RBI. Contrary to the name, they cannot ‘aggregate’ data. They only enable consensual data sharing and access between consumers and financial institutions in the network. Account aggregators cannot read or resell data. They can carry data from one financial institution to another based on individual consent and direction. Consumers also have the choice to revoke data already shared.<h2 class="heading-node" id="b934" style="text-align: justify">How account aggregation happens?</h2>Data gathering, collation, and dissemination are enabled through open <a class="link" href="https://m2pfintech.com/blog/api-the-power-that-drives-new-age-banking-ecosystems/">Application Programming Interface (API</a>) connections.<h2 class="heading-node" id="e756" style="text-align: justify">Do account aggregators benefit individuals?</h2>The answer is yes.Account aggregators help consumers get rid of laborious paperwork, effort, and security issues involved in notarizing, stamping, signing and scanning physical copies of bank statements. Users need not have to expose themselves to vulnerabilities of sharing login credentials and financial history to a third party.With mobile-based digital data access and sharing process, account aggregators eliminate the conventional hassles of data access and sharing. People across demographics will get access to experiential, preference-based financial services and products. While the affluent will experience value through customized investment and insurance options, the popular masses will enjoy greater inclusiveness through friction-free access to formal credit.<h2 class="heading-node" id="0dd3" style="text-align: justify">Participants in the AA network</h2>While individuals and small businesses form the epicentre, the AA network comprises the three participants listed below.1. Financial Information Providers (FIP)&nbsp;— Data sources like banks, tax platforms &amp; insurance providers.2. Financial Information Users (FIU)&nbsp;— Data recipients such as banks, NBFCs, and <a class="link" href="https://m2pfintech.com/blog/fintech-a-catalyst-for-financial-inclusion/">fintech</a> firms.3. Account Aggregators (AA)&nbsp;— RBI-regulated entities that facilitate real-time data sharing.<img src="https://miro.medium.com/max/1400/1*UnkSCGfGWZf-YpOqny9J7w.jpeg" alt="M2P Fintech" title="" width="100%" height="384">Source: PIB Delhi<h2 class="heading-node" id="72d9" style="text-align: justify">Banks in the AA network</h2>The top eight banks (listed below) that cater to over 300 million consumers have joined the AA network.1. Axis Bank2. ICICI Bank3. IndusInd Bank4. HDFC Bank5. Kotak Mahindra Bank6. IDFC First Bank7. Federal Bank8. State Bank of India<h2 class="heading-node" id="d405" style="text-align: justify">What kind of data does AAs share? How are they different from Aadhar eKYC, credit bureau, and CKYC?</h2>Central Know Your Customer (<a class="link" href="https://m2pfintech.com/blog/know-your-customer-kyc-the-need-for-authentication/">CKYC</a>) registry and paperless Aadhar Electronic Know Your Customer (<a class="link" href="https://m2pfintech.com/blog/know-your-customer-kyc-the-need-for-authentication/">EKYC</a>) capture identity verification and only shares data such as name, address, and gender. And credit bureaus reveal only the credit score, loan, and repayment history of consumers.On the other hand, account aggregators facilitate transaction data sharing from savings, <a class="link" href="https://m2pfintech.com/blog/how-can-banks-and-nbfcs-leverage-the-potential-of-digital-fds/">deposits</a>, or current accounts. They share data pertaining to consumer bank transactions, tax, pension, securities, insurance, and much more.<h2 class="heading-node" id="5e7e" style="text-align: justify">Is data sharing via AA network secure?</h2>Data shared on the account aggregator network is completely secure. It is encrypted by the sender and can be decrypted only by the intended recipient. End-to-end encryptions and digital signatures remove vulnerabilities and secure the process.<h2 class="heading-node" id="42b2" style="text-align: justify">What if consumers choose not to share data?</h2>By all means, a consumer can choose not to share any data. Joining the AA network or registering for data sharing is completely voluntary. They can link the account of their choice, enable or revoke data access at any point in time.<h2 class="heading-node" id="b9c4" style="text-align: justify">Use cases for account aggregator network</h2>Here are use cases in which account aggregators can drive efficiencies and add value to consumers and financial institutions.Personal finance management&nbsp;— Consumers can analyze personal spends across accounts, which will help generate recommendations to streamline expenditure. This process will enable better personal finance goals and budgetary adherence for consumers.Cashflow-based lending&nbsp;— Consuming data from FIPs, FIUs can get better visibility into the cash flow of applicants. Cashflow-based lending will accelerate mainstream lending, especially in SME and MSME credit space.Alternate data for credit assessment&nbsp;— Evaluating a consumer’s creditworthiness is a true challenge if there is inadequate data on his income or payment history. If credit applicants who do not have formal credit access could share their telecom bill payment to the lender, this will generate an alternate data set to assess creditworthiness.Loan monitoring for predictive default analysis&nbsp;— Every lender will want visibility into the borrower’s financial behavior to ensure discipline in repayments. The income and outflow from a person’s bank account could reveal his financial behavior. And this could help lenders predict default patterns.Selling customized financial products&nbsp;— Accessing data concerning consumer behavior with financial products will help financial institutions involved in wealth management and insurance customize their products.Wealth management&nbsp;— Imagine a customer has invested in insurance from A, mutual fund from B, Gold deposits from C, and savings account from D. An account aggregator can unify all this data and help wealth managers handle customers' portfolios more efficiently.Accounts reconciliation for small businesses&nbsp;— With account aggregators, SMEs and MSMEs would not require to manually feed in Tally/ QuickBooks for their daily invoices. They can simply consent to platforms to consume data from FIPs and derisk manual errors.Unified nomination register&nbsp;— Nominations in financial products today are decentralized, hence have to be managed individually. A joint collaboration between the account aggregator and the unified nomination register can solve this.Now, these are not all. We have just scratched the surface of the use cases that account aggregators could have. When more pipelines get enabled on AA network, the use cases will grow exponentially. Then they will have to address concerns surrounding platform stability, data privacy, and grievance redressal mechanisms.M2P believes in democratizing credit by empowering lenders with alternate data/ surrogate channels. Should you be looking for a partner who could help you look beyond conventional credit applicants' data, write to us at&nbsp;<a class="link" href="mailto:business@m2pfintech.com">business@m2pfintech.com</a><a class="link" href="https://m2pfintech.com/newsletter/">Subscribe</a>&nbsp;to our newsletter and get the latest fintech news, views, and insights, directly to your inbox.Follow us on&nbsp;<a class="link" href="https://www.linkedin.com/company/m2pfintech/mycompany/">LinkedIn</a>&nbsp;and&nbsp;<a class="link" href="https://twitter.com/m2pfintech">Twitter</a>&nbsp;for insightful fintech tales curated for curious minds like you.

Account Aggregator 101- Democratizing data access and sharing

<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2022/05/Artboard-1-copy-8-1-1.webp" alt="M2P Fintech" title="" width="100%" height="253">This April, we are shining our spotlight on Uma Maheswari, our Senior Operations Engineer. She was kind enough to take time from her hectic schedule to share information about her responsibilities, interests, and her journey as an M2Peer.Hang in there, she also shares her secret mantra to stay positive always! 😊<h2 class="heading-node" id="267e">How do you usually start your workday?</h2>To start my day in peace, keeping my mind cool and observant is essential. It creates a perfect vibe to start out my workday with positive energy. Then comes the main part where I will schedule and align my tasks for an exciting day at work. This helps keep my tempo up and ensures that my mind is in sync with the assigned tasks.<h2 class="heading-node" id="ed8c">What are your main responsibilities as Senior Operations Engineer?</h2>My responsibilities include attending day-to-day operations such as query handling, coordinating with our partners, and dispute management for the partner banks. I also provide MIS support within the stipulated time ensuring that my TAT is met. I also coordinate with internal team members to ensure that all processes are aligned intact with the requirement and result in zero escalations.<h2 class="heading-node" id="20b2">How have you grown through the years as an M2Peer?</h2>M2P has offered nothing less than a wonderful experience for me. I’ve been part of this payment ecosystem since its initial days. I’ve learned a great deal here, especially to assert myself and multitask without losing focus. It’s been quite a fun journey to grow with M2P and all my peers over here.<h2 class="heading-node" id="cb6d">Is there a quote/saying that motivates you?</h2>YES!I have a mantra that keeps me focused and on track to be positive always. Few words can make a big difference, and here is mine, “Believe in yourself “.It’s a small affirmation that helps bring out the best in me. 😊<h2 class="heading-node" id="07e7">What inspires you the most about M2P?</h2>At M2P, there is great transparency and trust factor. The flat organization structure, professional approach, and work freedom top the list and help all M2Peers to be creative. All these aspects allow me to think out of the box and respond positively.Believe me, this positive energy makes me stronger and stronger every day to face challenges in life.<h2 class="heading-node" id="6b3d">What’s your idea of a perfect day?</h2>I would like to call a day perfect when I am focused and give my best for the day.<h2 class="heading-node" id="a677">What are your hobbies/interests?</h2>My hobbies include listening to music and having a hearty and fun-filled conversation with my friends. Most of the time, I love to have personal time where I do gardening and hang out with my family.<h2 class="heading-node" id="cf99">Anything else you want to share about M2P?</h2>M2P is an amazing fintech company that’s growing at a great pace. I’m proud to be part of this fast-growing fun ecosystem.So come on M2Peers, let’s have fun and grow together!<a class="link" href="https://m2pfintech.com/newsletter/">Subscribe</a>&nbsp;to our newsletter and get the latest fintech news, views, and insights, directly to your inbox.Follow us on&nbsp;<a class="link" href="https://www.linkedin.com/company/m2pfintech/mycompany/">LinkedIn</a>&nbsp;and&nbsp;<a class="link" href="https://twitter.com/m2pfintech">Twitter</a>&nbsp;for insightful fintech tales curated for curious minds like you.

Meet M2P’S Operations Engineer

<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2022/05/Artboard-1-copy-8-7.webp" alt="M2P Fintech" title="" width="100%" height="253">The Reserve Bank of India (RBI) has promulgated new directives for credit and debit card issuance and conduct for 2022. The new guidelines are intended to protect the interests of retail customers. These norms are effective from July 1st, 2022.The directions on credit cards apply to all Scheduled Banks and all Non-Banking Financial Companies (NBFCs) operating in India. Yes, RBI has now opened a window for NBFCs to issue credit cards with prior approval from the regulator. Let us be clear here that the new regulations on credit cards do not apply to Payments Banks and State/District Central Cooperative Banks. On the other hand, the rules concerning debit cards apply to every bank operating in India.According to the new guidelines, commercial banks with a net worth of over Rs 100 crore can issue credit cards, either independently or by integrating with other card-issuing banks/NBFCs. Regional rural banks (RRBs) are now authorized to issue credit cards by partnering with their sponsor bank or other banks. Non-banking financial companies (NBFCs) can issue debit cards, credit cards, charge cards, or other similar products virtually or physically only after obtaining approval from the RBI.<h2 class="heading-node" id="0d03" style="text-align: justify">Key directives on credit cards</h2><ol class="list-node" id="3lsobeyqe"><li>RBI strictly prohibits banks from issuing unsolicited loans and cards or upgrading an existing loan/card without explicit consent from the customer/cardholder. Furthermore, upon nonadherence, banks or the card-issuers shall not only reverse charges but also pay a penalty of twice the value of the charges.</li><li>If the unsolicited cards are misused before reaching the customer, the card issuers shall be solely responsible for the losses incurred due to the misuse.</li><li>Written consent from the customer is required to issue or upgrade a credit card. Banks can accept digital consent if the customer cannot provide written consent; however, RBI must be notified.</li><li>When a cardholder raises a dispute on a transaction as ‘fraud,’ the card issuers must not charge on the transaction until the issue is settled.</li><li>Card issuers shall quote different Annualized Percentage Rates (APR) on credit cards for retail purchases, cash advances, balance transfers, and late payments or non-payment of the minimum amount due.</li><li>The card issuers should not impose any hidden charges while issuing credit cards. For example, EMI conversion with interest shall not be disguised as no-cost or zero-interest EMI.</li><li>For the closure of existing credit cards, the card issuers must honor the request within seven working days, subject to payment of all dues by the cardholder. If the issuer fails to complete the process within the given time frame, Rs.500/day penalty shall be imposed.</li><li>With respect to recovering debts, card issuers and their agents must not resort to intimidation or harassment. The lenders shall adhere to the fair practices code and avoid any verbal or physical harassment against any person, publicly humiliating and/or intruding upon the privacy of the customer’s family members and friends.</li><li>The card issuers shall limit the disclosure of customer information to the DSAs/DMAs/recovery agents. Card issuers must release only information that the agents require to discharge their duties and abstain from disclosing additional personal information. Also, the card issuers should ensure that customer information is not misused during credit card marketing.</li><li>Card issuers can report a credit card account as “past due” to CIBIL, CRIF, or others only if the amount remains unpaid for more than three days.</li></ol><h2 class="heading-node" id="e739" style="text-align: justify">Key directives on debit cards</h2><ol class="list-node" id="70pzbghi7"><li>Banks shall only issue debit cards to customers holding savings/current accounts. Issuance of debit cards to cash credit/loan account holders is prohibited.</li><li>Banks shall not force customers to avail the debit card. If a customer does not want a debit card, he/she cannot be denied other services from the bank. The debit card issuance should not be linked to the availment of other benefits from the bank.</li><li>Banks should develop a comprehensive debit card issuance policy and get approval from their boards and RBI. Subsequently, banks must roll out the debit cards per this policy.</li><li>Banks must provide options for disabling/blocking the form factor via internet/mobile banking, IVR, SMS, and/or other modes.</li><li>In place of plastic debit cards, Scheduled Commercial Banks can issue other form factors after obtaining explicit consent from the customer.</li></ol>In addition to the above regulations, RBI states, “It will not preclude the banks from linking the overdraft facility provided along with Pradhan Mantri Jan Dhan Yojana accounts with a debit card.”<h2 class="heading-node" id="b31d" style="text-align: justify">Directives for Co-branded cards</h2><ol class="list-node" id="9heafrx6i"><li>Co-branded debit/credit cards should indicate that they have been issued according to the co-branding arrangement.</li><li>A co-branding partner shall not market the card as its product. In addition, the card issuer’s name must be explicit on the cards.</li><li>The co-branding arrangement should be in accord with the card issuer’s board-approved policy.</li><li>Card issuers are accountable for the acts of the co-branding partner.</li></ol>For co-branding agreement between banks and NBFCs for credit cards, RBI states, “NBFCs, which desire to enter into a co-branding arrangement for issue of credit cards with a card-issuer, shall also be guided by the Guidelines on the issue of Co-Branded Credit Cards contained in the respective Master Directions applicable to NBFCs, as amended from time to time.”For more clarity on credit card and debit card issuance, write to us at&nbsp;<a class="link au mr" href="mailto:business@m2pfintech.com" target="_blank" rel="noopener ugc nofollow">business@m2pfintech.com</a>.<a class="link" href="https://m2pfintech.com/newsletter/">Subscribe</a>&nbsp;to our newsletter and get the latest fintech news, views, and insights, directly to your inbox.Follow us on&nbsp;<a class="link" href="https://www.linkedin.com/company/m2pfintech/mycompany/">LinkedIn</a>&nbsp;and&nbsp;<a class="link" href="https://twitter.com/m2pfintech">Twitter</a>&nbsp;for insightful fintech tales curated for curious minds like you.

RBI’s New Directives for Credit/Debit Card Issuance

<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2022/04/BNPLs-Risk-Mitigation-Strategies-Wordpress-02.webp" alt="Strategies to reduce credit risks in BNPL" title="" width="100%" height="317">Buy Now, Pay Later (BNPL) is a fascinating financing tool that presents incredible value potential to lenders, merchants, and consumers. Growing into a $100 billion industry globally with over 85% rise in user base (from 2020 to 2021), BNPL has evolved into an inevitable trend in the retail credit space.<h2 class="heading-node" id="zxstxjdpm" style="text-align: left">Win-Win-Win scenario</h2>There are no losers in the BNPL ecosystem. Whether it is consumers or merchants or lenders, all have clear winning potential. Consumers adore the <a class="link" href="https://m2pfintech.com/blog/factors-and-psychology-behind-the-great-bnpl-allure/">power BNPL gives them</a> to shop instantly and cost-efficiently, even if they have no cash at hand. And merchants prefer BNPL payments as its <a class="link" href="https://m2pfintech.com/blog/six-profitable-bnpl-business-models-to-unlock-infinite-value/">business models</a> provide them a great opportunity to drive sales. Sizeable BNPL players have attributed their 20% revenue increase to this consumer credit phenomenon. &nbsp;They’ve even reported that BNPL helped offset the generally higher transaction fees (appr. 4% to 7% per transaction) charged by service providers. Lending institutions love chiming into the BNPL tune, as it broadens and optimizes their credit issuance pipelines and drives scalable shorter-tenure small-ticket financing.<h2 class="heading-node" id="2spiqi6wu" style="text-align: left">Secret sauce to success</h2>Even though BNPL is one happy party, it still comes with some risk factors. Not just from external scamsters, but also from inherent vulnerabilities. Credit risks, chargeback scams, and Account Take Overs (ATOs) are typical issues that plague this consumer financing phenomenon. Managing and mitigating such risks is the secret sauce to successful BNPL operations. Implementing the right mitigation strategies can get rid of underlying risks without hampering customer experience.<h2 class="heading-node" id="kan5wsfe1" style="text-align: left">Mind your risk exposure</h2>A typical BNPL transaction value encompasses credit sanctioned to the customer and the amount reimbursed to the merchant. Usually, a consumer’s intent to pay, repayment capability, soft credit checks, and merchant recommendation are factored in before granting credit access. But this process doesn’t make the system immune to credit risks.Credit risk occurs when a consumer defaults on the repayment after the transaction. The tiniest exposure to default risk can put any lending institution in a vulnerable position. It could even snowball into insolvency and liquidity issues for the BNPL service provider.<h2 class="heading-node" id="gxknqrve8" style="text-align: left">Strategies to mitigate credit risk</h2>Evaluating creditworthiness plays a critical role in controlling credit risk. To make credit assessment as effective and secure as possible, best-in-class risk management parameters and credit profiling are required.As smooth and secure customer experiences are non-negotiable for successful BNPL transactions, customer-centric strategies and efforts need to be directed towards effective credit evaluation. &nbsp;State-of-the-art technologies such as Artificial Intelligence (AI), Machine Learning (ML), and Data Analytics are crucial tools to manage inherent and external risk factors. These technologies help in reducing fraud and default risks by analyzing data patterns across metrics, business performance, cash flows, and past payment track records derived from varied data sources.To mitigate credit risks effectively, the following strategies can be adopted.<h3 class="heading-node" id="zl6327vvl" style="text-align: left">1.Do a credit bureau check</h3>In Nov 2021, RBI amended the Credit Information Companies Regulation 2006, allowing fintechs to access individual consumer credit information from credit information bureaus like TransUnion Cibil, Equifax, Experian, and CRIF. With this amendment fintechs and ecommerce players can partner with lenders directly to issue BNPL on the platform, without acquiring an NBFC license. This enables first-level checks (parameters listed below) for each consumer to determine the risk associated with lending.<ul class="list-node" id="i7w0yj5i6"><li>Credit rating</li><li>Frequency of recent credit inquiries</li><li>Tracking pattern of Days Past Due (DPD) and settlements</li><li>Active credit lines</li><li>Past and active credit frauds</li></ul><h3 class="heading-node" id="rai5qc7qd" style="text-align: left">2.Interlink data points</h3>Interlinking data points associated with risk indicators such as invalid contact numbers, email addresses, or multiple card ownership will help detect irregularities. As per the privacy laws, the sensitive details of consumers need to be stored securely. So, without violating data breach and privacy laws, BNPL players can apply data analytics to gather valuable information on risk indicators, purchasing trends, and behavior.<h3 class="heading-node" id="mk9fouomh" style="text-align: left">3.Look for hidden linkages</h3>Processing BNPL transactions is not a simple task. It involves multiple steps that include linking IP, devices, email, phone numbers, and other details, in order to track and validate a customer. There is a high possibility of hidden linkages in cases that involve multiple names with common phone numbers or email addresses. Machine Learning plays a crucial role in establishing this linkage and sorting out disorders such as delivery address discrepancies and multiple account sign-ins from a single device.<h3 class="heading-node" id="biehsswov" style="text-align: left">4.Check for sudden changes in transaction velocity</h3>Credit risks and fraudulent transactions typically go hand-in-hand. Online frauds can be easily detected when there is a series of unusual high-value transactions taking place at consumer or merchant end. Cybercriminals indulge in this activity by using stolen card credentials to quickly spend the money or even create multiple accounts with fake user details.<h3 class="heading-node" id="sp618e1wg" style="text-align: left">5.Keep a lookout for shady delivery address patterns</h3>When it comes to ecommerce and BNPL, one must never underestimate the power of delivery address tracking in risk mitigation. Machine Learning tools check on delivery address patterns and take risk identification to the next level. With minimal human intervention, ML effectively detects mismatches and erratic patterns in shipping and billing addresses. This data plays a key role in detecting BNPL risks.<h3 class="heading-node" id="2ja7g15xs" style="text-align: left">6.Trust alternate data</h3>Asked to choose between the efficacy of traditional data and alternate data, most leading credit check houses will vouch for the latter. When a customer is credit-invisible, alternate data such as utility bills, rental bills, social media usage, travel history, employment record, and even property ownership come in handy to save the day.&nbsp; Alternate data supplies critical information for AI-based credit decisioning engines to determine a customer’s credit risk. Parameters such as income, nature of expenses, FOIR (Fixed Obligations to Income Ratio), location checks, negative list scrub (for PIN Code, credit check), and merchant data must be prioritized over other data points.<h2 class="heading-node" id="qwunst7q3" style="text-align: left">How we help lenders overcome BNPL risks</h2><a class="link" href="https://m2pfintech.com/blog/fintech-a-catalyst-for-financial-inclusion/">Fintech</a> companies and lenders today are vying to scale up their BNPL offering by investing in in-house technology capabilities and building risk modeling expertise directed toward the automation of credit decisions. A major hiccup here is the exorbitant cost and effort involved in technology upgrades.This is where a 3rd party partnership is required to curb costs and mitigate risks without compromising on customer experience. The collaboration will manage BNPL operations and risk management in totality while you can focus on the core business.Our BNPL Platform is a perfect example of the synergy scenario.&nbsp; We deliver the best risk management strategies for diverse consumer journeys via our loan management &amp; loan origination System. Our credit decision engine hunts and solves credit risks associated with each consumer. Using multiple cutting-edge APIs, we cover New to Bank, New to Credit, and of course existing credit data consumers at the quickest time possible.Our proprietary <a class="link" href="https://m2pfintech.com/blog/the-world-of-apis-how-they-power-fintech/">API</a> stack enables a secure and seamless shopping experience by pairing customer onboarding with a lender credit decision engine. We deliver risk management strategies that cater to Merchants, Lenders, and Fintechs across distribution channels such as card-based pay later, digital payment lines (multiple merchants), and closed-loop lending platforms.Want to know more about how your BNPL program can benefit from our credit decisioning engine?Write to us at business@m2pfintech.com. We’ll be glad to help.<a class="link" href="https://m2pfintech.com/newsletter/">Subscribe</a>&nbsp;to our newsletter and get the latest fintech news, views, and insights, directly to your inbox.Follow us on&nbsp;<a class="link" href="https://www.linkedin.com/company/m2pfintech/mycompany/">LinkedIn</a>&nbsp;and&nbsp;<a class="link" href="https://twitter.com/m2pfintech">Twitter</a>&nbsp;for insightful fintech tales curated for curious minds like you.

Mitigate Credit Risks in BNPL

<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2022/05/Infosec.webp" alt="M2P Fintech" title="" width="100%" height="253">Never tell tenacious youngsters that something is too challenging. They’ll cross mountains and oceans to come off with flying colors.Our spirited InfoSec rockstars are no exception to this rule.Surpassing all expectations, they ensured we earned the PCI DSS Ver 3.2.1 recertification this year. The gutsy hotshots at Information Protection, Governance, Risk &amp; Compliance (GRC), Middleware, Database Administration (DBA), Application Development, Security Operations Center (SOC), and HR teams played a crucial role in getting this global directive in place for M2P.<h2 class="heading-node" id="9473">Shoutout to our champs</h2>Our gratitude and a huge shoutout to InfoSec champs,&nbsp;<a class="link au lo" href="https://www.linkedin.com/in/uday-thubati-64897356" target="_blank" rel="noopener ugc nofollow">Uday Thubati</a>,&nbsp;<a class="link au lo" href="https://www.linkedin.com/in/krishna-kumar-115597129" target="_blank" rel="noopener ugc nofollow">Krishna Kumar</a>, Vijay Kumar GP,&nbsp;<a class="link au lo" href="https://www.linkedin.com/in/sharath-sankar-532bb7b" target="_blank" rel="noopener ugc nofollow">Sharath Shankar</a>,&nbsp;<a class="link au lo" href="https://www.linkedin.com/in/narasimman-a-79a19b126/" target="_blank" rel="noopener ugc nofollow">Narasimman</a>,&nbsp;<a class="link au lo" href="https://www.linkedin.com/in/ssvrnyl/" target="_blank" rel="noopener ugc nofollow">Sundaravenkataraman</a>, Surender Muruganatham, Girija K, Ragul Subramanian,&nbsp;<a class="link au lo" href="https://www.linkedin.com/in/maathavan-tr-vinayak-2ab153a3/" target="_blank" rel="noopener ugc nofollow">Maathavan Vinayak</a>,&nbsp;<a class="link au lo" href="https://www.linkedin.com/in/sai-prasad-kayarohanam-sivasubramanian-18076910/" target="_blank" rel="noopener ugc nofollow">Sai Prasad</a>, Raghavendharan, and&nbsp;<a class="link au lo" href="https://www.linkedin.com/in/sankara-jayanthi-rj-yogi-7b4759199/" target="_blank" rel="noopener ugc nofollow">Sankara Jayanthi</a>&nbsp;for the successful PCI DSS compliance.Right from conducting internal audit trails, business continuity flows, and incident management processes, to implementing external defense mechanisms such as access control, hardening, source code review, and Vulnerability Assessment &amp; Penetration Testing (VAPT), our vibrant whizzes did a commendable job. They took the lead in adhering to the 12-step PCI DSS requirements and protecting the cardholder environment physically and logically. And they were all game for continuous improvement in risk assessment and mitigation, adherence to global standards, and solutioning &amp; sizing virtual machines and embedded devices.<h2 class="heading-node" id="2a70">Commitments and milestones</h2>Assessed by a PCI Certified Qualified Security Assessor (QSA) from Panacea Infosec Private Limited, this recertification is a significant milestone for us. It validates our commitment to improving cardholder data security, enhancing payment protection, and preventing fraudulent transaction exposure.<blockquote class="block-node" id="avz3jc970">“Payment security and trust are paramount to us at M2P. The PCI DSS recertification stands as a testimony to our continual efforts and diligence in securing cardholder data and preventing card payment frauds of any kind. Hats off to our InfoSec rockstars for the successful compliance efforts! ”<a class="link au lo" href="https://www.linkedin.com/in/kannanrajus/" target="_blank" rel="noopener ugc nofollow">Kannan Raju S</a>&nbsp;— Vice President, IT Infrastructure</blockquote><a class="link" href="https://m2pfintech.com/newsletter/">Subscribe</a>&nbsp;to our newsletter and get the latest fintech news, views, and insights, directly to your inbox.Follow us on&nbsp;<a class="link" href="https://www.linkedin.com/company/m2pfintech/mycompany/">LinkedIn</a>&nbsp;and&nbsp;<a class="link" href="https://twitter.com/m2pfintech">Twitter</a>&nbsp;for insightful fintech tales curated for curious minds like you.

Meet our Young and Vibrant InfoSec Rockstars

<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2022/05/Artboard-1-copy-8-2-1.webp" alt="M2P Fintech" title="" width="100%" height="253">The star of the month series is back again this March, featuring VASANTHA KUMAR JAYACHANDRAN- our tech support hero. A cinephile and a techie, Vasanth is our system analyst who does incredible firefighting in the tech support team.As we spoke to him about what makes him the star he is, he took us along his amazing five-year-old journey, from being a rookie to becoming a fine fintech enthusiast at M2P.Curious to share a glimpse into what motivates him to give his best? Then, keep scrolling. You may even get lucky to find his secret mantra to success.Here you go.<h2 class="heading-node" id="9625">How do you usually start your workday?</h2>First of all, thank you, guys. Really grateful for the honor.I believe that daily habits set the tone for success or otherwise. So, I ensure my morning routine preps me for the exciting and challenging tasks ahead in the day. Then I kickstart my work mode by creating a to-do list and checking for critical alerts and messages from our internal teams and partners.My goal is to acknowledge client issues and smoothen out the process of issue identification and resolution. The next step would be to ensure that our team sorts out the issues in the shortest TAT possible and makes the client stress-free.Being customer-centric and time conscious are the mantras that keep me thriving throughout the day.What are your main responsibilities in tech support as a system analyst?Ensuring that our clients face zero issues in their journey with us is our ultimate responsibility. And in the event of any technical glitches, I help them resolve the issues without any hassle. To achieve complete efficiency in tech support, we have an unspoken golden rule which goes like this."Stick to the process of any live issue being reported and then resolve it as soon as possible."In our team, we have a practice. We ensure that all our observations, experiences, and outcomes of issue analysis are shared with our peers. Since everyone in the team is aware of all possible issues and the resolution breakthroughs, it helps us identify patterns and expedite issue resolution. I’m really proud of this collaborative knowledge-sharing initiative in our team.<h2 class="heading-node" id="f019">How have you grown through the years as an M2Peer?</h2>When I became an M2Peer, I was a payment industry rookie with just two years of experience. I had minimal understanding of payments and reconciliation.But my life as an M2Peer for the past five years has been an enormous learning curve. It has transformed my understanding of transaction life cycle, payments and made me love all things fintech.<h2 class="heading-node" id="17dd">Is there a quote/saying that motivates you?</h2>Yes, I believe that,"Whatever mess we create, we can and must always be the ones cleaning it up."<h2 class="heading-node" id="dc69">What’s that one thing your colleagues don’t know about you?</h2>Being almost five years as an M2Peer, I’m an open book. My colleagues know everything about me.<h2 class="heading-node" id="4cc9">What inspires you the most about M2P?</h2>The one thing that inspires me the most about M2P is the work culture and how people help each other learn new things here. Having started as someone with little experience, I have been able to gain knowledge on various aspects such as payments and more. M2P is the best place for all beginners to learn and shape their careers.<h2 class="heading-node" id="5166">What’s your idea of a perfect day?</h2>To be honest, finding a perfect day in tech support is tough.Delivering end-to-end tech support is a never-ending process. But there is lots of sunshine when we close out issues on time and receive a client appreciation for our toil.<h2 class="heading-node" id="9956">What was your career path before joining M2P, and how has it changed?</h2>When I graduated in 2015, I was unsure about my career. But growing with M2Peers in the past five years made me learn and appreciate fintech. I have changed my perspective from zero to being the one who likes to learn and explore fintech!<h2 class="heading-node" id="bd97">What are your hobbies/interests?</h2>Most of my hobbies include spending time with my family and doing fun chores. I also like to spend quality time with my nephews. However, my ‘me time’ is spent by watching movies and learning something new.<h2 class="heading-node" id="190e">Anything else you want to share about M2P?</h2>If you want to experience amazing people-centric work culture, kickass intellect, and collaborative knowledge sharing, M2P is the place.Hands down the best!So, adieu folks. Hope you enjoyed our interview with Vasanth Kumar.See you again in our next Star of the Month feature.<a class="link" href="https://m2pfintech.com/newsletter/">Subscribe</a>&nbsp;to our newsletter and get the latest fintech news, views, and insights, directly to your inbox.Follow us on&nbsp;<a class="link" href="https://www.linkedin.com/company/m2pfintech/mycompany/">LinkedIn</a>&nbsp;and&nbsp;<a class="link" href="https://twitter.com/m2pfintech">Twitter</a>&nbsp;for insightful fintech tales curated for curious minds like you.

Meet M2P’s Tech Support Hero

<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2022/05/Artboard-1-copy-8-2-2.webp" alt="M2P Fintech" title="" width="100%" height="529">Cybercrime is quickly evolving into an escalating issue across the physical and virtual universe. More than 80% of online businesses have reported an increase in cyberattacks since 2020.The digitization of finance has further widened avenues for hackers to create loopholes in financial infrastructure with sophisticated tools and techniques. Wherever there is a software application or a network involved, cybercriminals infiltrate the system to steal sensitive personal information and financial credentials. Vulnerable financial applications don’t stand a chance before the mushrooming attacks and give way to compromised data, loss of money, identity theft, and data breaches.<h2 class="heading-node" id="d923" style="text-align: justify">Nipping vulnerabilities in the bud</h2>As responsible facilitators of digital banking, payments, and lending services, fintech companies take cybersecurity very seriously. According to the Sixth Annual Bank Survey, more than 70% of fintechs vow to treat information security as their top concern in 2022. They adopt technologies, tools, and even philosophies that will help them nip vulnerabilities right in the bud.<h2 class="heading-node" id="d555" style="text-align: justify">Transition to DevSecOps</h2>Standing at the forefront of technological innovation, fintechs need to deliver secure deployments, application releases, and updates at supersonic speed. But as with every new-age technology, fintech <a class="link" href="https://m2pfintech.com/blog/the-world-of-apis-how-they-power-fintech/">APIs</a> are prone to security risks. These risks reduce go-to-market speed, delay update releases and impair code quality.Even though standard practices such as DevOps delivers tremendous deployment velocity with zero downtime, cloud readiness, robust security, and compliance management, it still fails to address security risks at the grass-root level. That’s why financial software developers mandate the need to integrate security into the DevOps process. They began transitioning towards the DevSecOps to build secure and efficient applications at top speed.DevSecOps quickly evolved as the future of financial software development, as it made cybersecurity a fundamental part of the production pipeline, which comprises architecture design, coding, and testing phases. Today, it is a crucial application development methodology for successfully developing fintech applications in regulated and unregulated domains.<h2 class="heading-node" id="dbbb" style="text-align: justify">What is DevSecOps?</h2>DevSecOps, a blend of development, security, and operations, refers to the adoption of security right at the beginning of the software development lifecycle (SDLC). It is more a philosophy than a tech approach that calls for increased collaboration between development, security, and operation teams.<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2022/05/DevSecOps-blog-banner-02.webp" alt="M2P Fintech" title="" id="hasokqmme" width="100%" height="529">It resonates deeply with the view of Cloud Security Alliance (CSA) which goes, “Security can be achieved only when it has been designed in. Applying security measures as an afterthought is a recipe for disaster.”This is exactly what DevSecOps solves for.<h2 class="heading-node" id="1b91" style="text-align: justify">Why DevSecOps?</h2>During the days of DevOps, security was included late in the lifecycle only after the development and operation phase. Technological advancements in cloud platforms, microservices, and containers could not move forward, as security turned out to be a major bottleneck. Catching security issues late in the cycle resulted in a lot of rework and late releases. These were some of the reasons why fintech application developers shifted to agile DevSecOps practices for quick and modern application development and deployment.By shifting security left, DevSecOps integrates testing checks between the development and operation functions of every sprint. It integrates security into DevOps by tackling issues within Continuous Integration (CI) and Continuous Delivery (CD) pipelines. In doing so, DevSecOps accelerates software delivery, reduces the duration between code change, production, deployment, and release while reducing security risks.<h2 class="heading-node" id="dbb0" style="text-align: justify">Resolving contentions</h2>The fundamental area of contention between development, security, and operation teams is their change implementation, security monitoring, and stability principles. They become a source of friction that often leads to lags in the software development cycle. DevSecOps serves as an effective tool to resolve this friction by providing a culture that empowers the teams to work in sync.<h2 class="heading-node" id="79ef" style="text-align: justify">Functions of DevSecOps</h2>DevSecOps aims at designing novel solutions that simplify complex processes within the agile framework. It ensures that customers suffer no technical glitches after deployment or release of any update, or application.Encompassing threat modeling and security testing processes in the pipelines saves time, effort, and cost. The automation in security testing helps test for vulnerabilities keeping futuristic risk possibilities in mind. Security reports can be easily generated to identify risk patterns in CI and CD. The continuous feedback process at every phase of development and code integration strengthens rectification and delivery infrastructure.<h2 class="heading-node" id="63bb" style="text-align: justify">4 simple steps to develop a DevSecOps culture</h2>For sustained focus on security and application effectiveness, companies need to build a DevSecOps culture. Developing a ‘Security as Code’ philosophy is a vital step towards creating this culture. It calls for consistent, compliant, and collaborative efforts between development, operations, and security teams.Follow the steps below to make DevSecOps culture a breeze.<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2022/05/DevSecOps-blog-banner-03-03.webp" alt="M2P Fintech" title="" id="wnvu7jjqw" width="100%" height="529"><ul class="list-node" id="l13bfyfvi"><li>Garner cooperation&nbsp;— Team silos and conflicts are key reasons why DevSecOps tends to fail in most companies. Garner cooperation through knowledge sharing and reward mechanisms that promote continuous improvement.</li><li>Grant authority and autonomy&nbsp;— Nobody likes dictatorships. Authorize your teams to identify and resolve issues on their own. This autonomy will boost their solidarity and collaboration.</li><li>Appoint strong leaders&nbsp;— Groom or bring in leaders who prioritize security. Make security a top-down mandate. This is a crucial step to building a DevSecOps culture.</li><li>Educate and align&nbsp;— Educate team members on the importance of security, and align the learnings towards DevSecOps tasks. Focus on risk training while also briefing security teams about DevOps methodology.</li></ul>The fundamental goal of the exercise is to make cybersecurity an organization-wide priority, with DevSecOps as a crucial tool.<h3 class="heading-node" id="0f3f" style="text-align: justify">Crucial imperative for fintech application development</h3>A common myth is that developing applications with security in mind impedes innovation. But the security left DevSecOps methodology steers innovation in the right direction and saves a lot of time, effort, and cost.If you are in the business of developing fintech applications, then it’s imperative&nbsp;that you deploy DevSecOps tools and processes as an organization-wide philosophy. As forerunners in implementing the DevSecOps philosophy, we deliver pre-built workflows and AI-powered automation capabilities to deliver secured risk-based authentication at every step. We redefine the software development lifecycle process to accelerate software deployment, product quality, and controlled release cycles and processes.Want to know more about how your business can benefit from the DevSecOps process?Ping us at&nbsp;business@m2pfintech.com.<a class="link" href="https://m2pfintech.com/newsletter/">Subscribe</a>&nbsp;to our newsletter and get the latest fintech news, views, and insights, directly to your inbox.Follow us on&nbsp;<a class="link" href="https://www.linkedin.com/company/m2pfintech/mycompany/">LinkedIn</a>&nbsp;and&nbsp;<a class="link" href="https://twitter.com/m2pfintech">Twitter</a>&nbsp;for insightful fintech tales curated for curious minds like you.

DevSecOps, the future of financial software development

<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2022/05/Artboard-1-copy-8-1-2.webp" alt="M2P Fintech" title="" width="100%" height="284">Home to 61,400 startups (registered with DPIIT, Govt of India), India hosts the 3rd largest startup ecosystem, after US and China. These newbies drive the digital economy through their innovative technology adoption, mobile-first, and customer-centric strategies.Dedicated to supporting such fledglings with their digital transaction needs is Karbon, another fintech startup with best-in-class expertise in corporate banking.Founded by Pei-fu Hsieh and Amit Jangir in 2019, Karbon helps growing businesses issue cards, manage payouts and deliver loyalty programs for their customers. Their Unique Selling Proposition helps companies scale faster, as Karbon promises quick corporate cards issuance without any fixed deposits or personal guarantees.<h2 class="heading-node" id="28d5">Need for card issuance support</h2>Though Karbon delivers hassle-free banking solutions with terrific business models and expertise in managing new-age corporate banking, they needed support with card issuance. They were looking for a reliable card partner with a strong banking network, to facilitate seamless card issuance.<h2 class="heading-node" id="c08e">Co-creating solutions</h2>After evaluating several issuers, Karbon chose to partner with us. Our strong banking network proved to be a strong vantage point for Karbon to deliver its powerful banking solution. At present, we run Karbon card solution program on both Visa and MasterCard rails.We help Karbon by taking complete charge of end-to-end payments, operations, reconciliation, and market dynamics strategies. Our focus areas enable them to capture a significant share of the SME, MSME, and start-up market and to capitalize on the first-mover advantage.This is what Amit Jangir, the co-founder of Karbon had to say about our relationship.<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2022/05/Artboard-1-copy-10-4.webp" alt="M2P Fintech" title="" id="3965wgy0a" width="100%" height="284">Benefits achieved<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2022/05/Artboard-1-copy-9-4.webp" alt="M2P Fintech" title="" id="824iw670n" width="100%" height="284"><h2 class="heading-node" id="4cee">How we help Karbon achieve 30% increase in transaction volume</h2>We leverage our trusted bank partnerships and facilitate seamless onboarding, Know Your Customer (KYC), card design, and collateral finalization. By serving as a switch, we enable transaction authentication and authorization, in addition to reconciliation and settlement.Bank partnershipBank partnerships are a critical part of any card issuance program. We leverage our SBM Bank partnership and help Karbon with payment card issuance.Onboarding corporates and individualsSeamless onboarding, <a class="link" href="https://m2pfintech.com/blog/know-your-customer-kyc-the-need-for-authentication/">Know Your Customer (KYC), </a>and Know Your Bank (KYB) procedures form the perfect first impression for customers. We help Karbon smoothen KYB, KYC, and VKYC processes, as regulated and approved by SBM Bank protocol. This includes activities such as picking up KYB documents from corporates to onboarding and creating frictionless verification via Aadhaar, OTP, and PAN validation.Card design and collateral finalizationInitially, Karbon had a vanilla card design, which is a basic credit card with minimal to zero perks and fees. We recommended the need to&nbsp;<a class="link au ml" href="https://m2pfintech.com/blog/payment-cards-design-made-simple-heres-what-you-need-to-know/" rel="noopener">enhance card design</a>&nbsp;for their virtual and physical cards. Our card design team revamped and customized card designs by placing logos in the right places and we also obtained the necessary approvals from the card network and bank.Transaction authenticationWe act as a switch for transaction authentication and function as authorizers for transactions, as per the parameters defined by Karbon. When a transaction is initiated, the acquirer will send data to&nbsp;<a class="link au ml" href="https://m2pfintech.com/" target="_blank" rel="noopener ugc nofollow">M2P</a>, and we will take auth approval from Karbon to ensure that the right debit has taken place. No matter what, we ensure that the decision-making power always lies with Karbon.Reconciliation and settlementAs Karbon’s card program manager, we handle reconciliation and settlement. We manage card operations completely and share report dashboards with Karbon to drive data-driven decision-making.Now, this is not the end of the story. We hope to support startup ecosystems and established players across the globe with scalable, secure, and compliant card issuance and management solutions.Do you need help with card issuance?Get in touch with us at&nbsp;business@m2pfintech.com.<a class="link" href="https://m2pfintech.com/newsletter/">Subscribe</a>&nbsp;to our newsletter and get the latest fintech news, views, and insights, directly to your inbox. Follow us on&nbsp;<a class="link" href="https://www.linkedin.com/company/m2pfintech/mycompany/">LinkedIn</a>&nbsp;and&nbsp;<a class="link" href="https://twitter.com/m2pfintech">Twitter</a>&nbsp;for insightful fintech tales curated for curious minds like you.

How M2P helps Karbon increase its transaction volume by 30%?

<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2022/05/Artboard-1-copy-8-3-1.webp" alt="M2P Fintech" title="" width="100%" height="358">Did you know it takes just 6 seconds to hack any credit or debit card?As the number of Card-Not-Present (CNP) transaction increases, so do the associated risk factors. The 6-second hacking window is quite scary, especially when you are a bank or a card issuer.Even though the end-consumer faces losses, card issuers and banks are the ones who will have to bear the major brunt, including refunding the customer, dealing with chargeback fees/fines, and investigation charges which often lead to reputation loss.<h2 class="heading-node" id="cae2" style="text-align: justify">Modus operandi of fraudsters</h2>Card payment fraud happens in both card-present and card-not-present scenarios. Usually, the customer gets unsolicited calls, text messages, emails, or unauthorized software update requests under the pretense of KYC updates, or gift offers.Scamsters pretend to be genuine in these communications and ask consumers to share personal information, card credentials, PIN, or OTP details. Phishing, skimming, and mail intercepting are among the key modus operandi that criminals use to defraud consumers of their money, data, and identity.Other usual scenarios include:Stolen or lost card fraud-&nbsp;In this situation, the card either slips out of the cardholder’s hands or is stolen. The fraudsters then use the card to go on a shopping spree and then discard the card.Account takeover-&nbsp;One of the rising crime scenarios today is complete account takeover. Here the fraudsters shoulder surf or steal card details and get in touch with the card-issuing company. Pretending to be the cardholder, they would falsely report a stolen card and ask for a replacement with modified address details. The genuine cardholder will know about this scam only when the card is used.Page Jacking-&nbsp;Here, the scamster redirects an e-commerce store page and takes the user to their malicious portal. This page would contain links with the potential to crack network security.Now, this is only the tip of the iceberg. Each day, fraudsters develop more sophisticated methods to commit card payment fraud.<h2 class="heading-node" id="75ac" style="text-align: justify">Signs banks need to look out for to identify fraudulent activity</h2>Card issuing banks need to be vigilant and check for signs to nip card scams in the bud. They need to design systems to proactively identify suspected fraudulent activity in real-time and decline these attempts before the cardholder is affected.Suppose a bank notices anomalous spending patterns, erratic location changes, or unexplainable large ticket transfers, they need to notify the cardholder and investigate the matter immediately.<h2 class="heading-node" id="4a4f" style="text-align: justify">What can banks do?</h2>Delivering secure, smooth, and customer-friendly online payments is critical for banks and card issuing companies. Otherwise, customers will leave in hoards, shifting their loyalty to competitors. Choosing a suitable authentication method is crucial to eliminate security risks in card payments.Gone are the days when binary authentication such as static passwords and usernames were unbreakable. Today cyber criminals use advanced technology that can decode these credentials in seconds. Hence, banks need to adapt to a more robust, scalable form of authentication that can be adjusted according to different risk levels.<h2 class="heading-node" id="9cf8" style="text-align: justify">The solution: Risk-Based Authentication (RBA)</h2>When it comes to the standard credential-based authentication process, the user will have to undergo two-factor authentication (2FA) or Multi-Factor Authentication (MFA), which is a One-Time Password (OTP) or password every time a transaction happens.But with risk-based authentication, it is not necessary that the transaction must go through 2FA. Instead, every single transaction is monitored and assessed for risk. And a risk score is assigned to evaluate if the transaction can occur securely.In conjunction with a few other parameters, including business rules/logic, this risk score effectively decides if a transaction requires a challenge or if it can be allowed to go through frictionless (without an explicit 2FA).Case studies from different markets suggest that ~90% of transactions tend to be low risk and can thus be allowed to go through frictionless. Around 8% may require some form of 2FA, and ~2% tend to be high risk and can be declined.Risk-based authentication helps banks cut fraud losses, reduces transaction drop-offs, and ensures regulatory compliance. It plays a critical role in boosting e-commerce by balancing customer experience and controlling fraud. Dynamic RBA systems power card issuers to identify optimal risk levels and deliver quick, secure, and seamless payments.More info…Risk-based authentication is a real-time process that assesses underlying risks and applies appropriate levels of controls. Also known as adaptive authentication, the identification happens based on the user’s risk profile when they try to authenticate who they claim to be.An increase in the user’s risk profile leads to stricter and more restrictive methods of authentication. Risk-based authentication uses behavioral profiling to assess risk and protect customer data.Risk-based authentication ensures a protective guard against complex security breaches and hacking attempts. The authentication uses various parameters such as the user’s transaction history, merchant profile, IP &amp; location, device usage history, and other critical parameters to assess risk.Based on the evaluation, the Access Control Server (ACS) decides if the user can complete the transaction without any additional factor of authentication or if there is a need for an additional factor of authentication such as the following.<ul class="list-node" id="kzbf8joyr"><li>One time passcode</li><li>Permanent or temporary PIN</li><li>Security question (knowledge-based authentication)</li><li>Biometric data, such as a fingerprint</li><li>Mobile phone-based authentication such as Swipe to Pay</li></ul><h2 class="heading-node" id="39bb" style="text-align: justify">Setting up an RBA system</h2>Designing and deploying a quality risk-based authentication system involves implementing&nbsp;<a class="link au mv" href="https://m2pfintech.com/blog/3d-secure-your-barrier-against-cyber-attacks/" rel="noopener">3D Secure (3DS)</a>. Now, 3D Secure is a payments security protocol that adds a strong layer of security to CNP transactions by tying payment authorization to the online authentication process.To authenticate the cardholder, the transaction needs to be redirected to the Access Control Server (ACS). Issuers can define their risk profile and set up the ACS to control the customer authentication experience based on the risk analysis. After the customer completes the authentication, the response is sent back to the merchant and processing bank.<h2 class="heading-node" id="46cd" style="text-align: justify">What is the ACS?</h2>Access Control Server (ACS) is the server that enables bank customers to authenticate themselves and complete card-based online transactions securely. The ACS is built on the 3-D Secure rails defined and certified by global card networks, including Visa and Mastercard.While the initial version of the 3DS protocol (3DS 1.0) was designed to boost customer confidence, it did not provide the most optimal transaction experience and resulted in a high percentage of online drop-offs and cart abandonments in quite a few markets.The updated protocol version, EMV 3DS or 3DS 2.0, is designed by EMV, the consortium of global card networks. This protocol is optimized to support in-app payments, facilitate risk-based authentication via the exchange of richer data parameters, and encourage the use of dynamic out-of-band authentication techniques such as biometrics.<h2 class="heading-node" id="89f6" style="text-align: justify">Features of our ACS system</h2>Our ACS system guarantees top-class customer security while ensuring a seamless transaction journey. It is easily configurable and provides issuers the flexibility to design a custom authentication experience for their customers.Some of the key features of our ACS<ul class="list-node" id="tpiux2p6i"><li>3DS 2.0 certified with support for Visa, Mastercard</li><li>Cloud-ready system with the platform set up in India and the UAE</li><li>Highly scalable and configurable platform</li><li>Best-in-class success rates and performance</li><li>24*7 application monitoring and production/operations support</li><li>Support variety of issuer integration options — real-time API fetch, batch file upload via SFTP, and push API</li><li>Comprehensive risk-based authentication system with scope for advanced rule design using an external data feed</li><li>Multiple modes of step-up, including OTP (SMS/email), swipe to pay (push notification), biometrics, soft tokens, etc.</li><li>Role-defined access to comprehensive reports and dashboards</li></ul>Now, this is Risk-Based Authentication in a nutshell for you.Got questions on how to implement a dynamic ACS system? Ask us at&nbsp;<a class="link au mv" href="mailto:business@m2pfintech.com" target="_blank" rel="noopener ugc nofollow">business@m2pfintech.com</a>.<a class="link" href="https://m2pfintech.com/newsletter/">Subscribe</a>&nbsp;to our newsletter and get the latest fintech news, views, and insights, directly to your inbox. Follow us on&nbsp;<a class="link" href="https://www.linkedin.com/company/m2pfintech/mycompany/">LinkedIn</a>&nbsp;and&nbsp;<a class="link" href="https://twitter.com/m2pfintech">Twitter</a>&nbsp;for insightful fintech tales curated for curious minds like you.