Transform Digital Onboarding with VKYC Solutions

<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2022/10/e-KYC-2.0-in-Egypt-blog_1-02.webp" alt="M2P Fintech" title="" width="100%" height="236">The last 6 years have been the fintech era for Egypt. Its rather traditional financial system has been steadily progressing toward digitalization. Recent reports affirm that the country is turning into the entrepreneurial hotspot for burgeoning fintech startups in North Africa, and its financial services sector is expected to grow at 12% yearly until 2025. The growth can be attributed to the thriving fintech adoption in North Africa, the boost in internet usage in Egypt, and most importantly, the government's commitment to attaining its Vision 2030.<h2 class="heading-node" id="wpgeh9ggx">Financial Digitalization&nbsp;</h2> In light of the Vision, the Central Bank of Egypt (CBE) designed and developed numerous policies with the prime objective of improving the <a class="link" href="https://m2pfintech.com/blog/fintech-a-catalyst-for-financial-inclusion/">financial inclusion</a> of the country as well as transforming the nation into the regional hub for fintech innovations. One such approach is digitalization in the financial services industry. Digitalization is one of the three strategic pillars of Egypt's Vision 2030, which aligns with the country's allegiance to the <a class="link" href="https://www.undp.org/sustainable-development-goals">United Nations Sustainable Development Goals (SDGs).</a> The Vision's framework holistically fosters the transformation of Egypt into a digital or cash-free economy. With over 95 million young, unbanked/underbanked population, Egypt exhibits an extended appetite for digitalization, inclusion, and fintech innovations.According to <a class="link" href="https://www.mastercard.com/news/eemea/en/newsroom/press-releases/press-releases/en/2022/august/mastercard-new-payment-index-2022-consumers-in-egypt-embrace-digital-payments/">Mastercard's New Payment Index 2022 report</a>, 61% of Egyptian banking customers feel safe using mobile apps to send money to people or make payments to both online and offline merchants. In addition, 42% (i.e., four in ten) are keen to share their financial data to access payment tools/mobile applications that help them manage their finances.In 2021, Egypt's digital banking system witnessed an enormous upswing in mobile banking transactions. While the number of digital banking transactions increased by 107%, the value climbed by 159%. The number of internet banking users increased by 30% (y-o-y), and the value of transactions through digital channels increased by 60%. Further, the number of transactions over mobile wallets surged 108% reaching 212 million transactions, and e-commerce grew by 34% registering 60.3 million transactions. The value of electronic purchases using bank cards increased by 40% and climbed to EGP 23 billion from EGP 14 billion in the fiscal year 2019/2020. Overall, the banking system processed electronic transactions worth EGP 2.8 trillion during the fiscal year (FY) 2020/2021.<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2022/10/e-KYC-2.0-in-Egypt-blog_1-.webp" alt="M2P Fintech" title="" width="100%" height="236"> Mobile wallets covered a substantial fraction in the digitalization leap. Mobile wallet transactions rose to 268 billion EGP in 2021 from 88 billion EGP in 2020, attaining a 200 % increase. The number of banks providing electronic wallet services grew to 23, increasing the number of electronic wallets from 9 million in 2020 to 26 million in 2021. On the other hand, e-commerce transactions increased from 16 billion EGP to 30 billion EGP.Furthermore, the volume of government receipts through banking channels has reached more than 662 billion EGP. The volume of annual electronic transactions through electronic points of sale has witnessed a great leap from 110 billion EGP to 170 billion EGP. Such a mammoth uptick in digital adaption significantly scaled the financial ecosystem, calling for streamlined and robust Know Your Customer (<a class="link" href="https://m2pfintech.com/blog/know-your-customer-kyc-the-need-for-authentication/">KYC</a>) procedures that are crucial to detect risk factors and avert financial crimes such as identity theft, <a class="link" href="https://m2pfintech.com/blog/how-to-combat-money-laundering-2/">money laundering</a>, and terrorist financing.<h2 class="heading-node" id="weyytqtfu">Current KYC regime</h2> Egypt's KYC regime has the following tiers: Full KYC and Simplified KYC. To process a full KYC, FIs require<ul class="list-node" id="j6d4yly7a"><li>National ID&nbsp;</li><li>Customer ID number&nbsp;</li><li>Date of birth</li><li>Gender&nbsp;</li><li>Nationality&nbsp;</li><li>Religion&nbsp;</li><li>Legal form&nbsp;</li><li>Full address</li><li>Mobile and/or Telephone number</li></ul>When simplified KYC was first set up, it required FIs to validate only the National ID. However, when CBE released the second framework for its simplified KYC in 2016, it housed pioneering programs demanding minimum requirements for limited mobile money accounts as an alternative to the standard bank accounts with full KYC requirements. In both cases, bank personnel or a CBE licensed service provider conducts Customer Due Diligence (CDD) at customer premises and completes the KYC procedures. To perform <a class="link" href="https://m2pfintech.com/blog/crack-the-kyc-jigsaw-ease-onboarding-compliance/">KYC</a>, companies must obtain and verify customers' data, including name, address, and date of birth, using government-issued identification cards, passports, utility bills, and mobile bills. Additionally, the customer's credibility is also validated by verifying their job license and sports club membership/subscription (if any). If a person is found to be a Political Exposed Person (PEP), financial institutions must take extra steps to check out that person.<h2 class="heading-node" id="c8l4ipur3">Rise of e-KYC</h2> The government and the Central Bank of Egypt have been proactive and quick to recognize the importance of a digitized KYC system in enabling frictionless financial digitalization. Subsequently, the underpinning was laid in 2019 when the <a class="link" href="https://fintech.cbe.org.eg/home/sandboxCohorts?en">CBE's Regulatory Sandbox</a> rolled out the red carpet for its first cohort in "e-KYC."The regulatory sandbox allows fintechs to trial their new products, services, technologies, and business models. The sandbox approach encourages innovative fintech products and services, reduces time to market, and cuts the cost involved in developing the products and services. It also enables CBE to understand disruptive fintech products and services before deciding to regulate them and collect evidence that can be used to draft practical guidelines and robust regulations. After a successful testing phase, the CBE is ramping up to launch a pilot of the electronic Know Your Customer (e-KYC) service to enable citizens to access financial services online without the need to walk into a brick-and-mortar bank. Here's a quick overview of how the modern e-KYC compares to the current KYC regime.<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2022/10/e-KYC-2.0-in-Egypt-blog_4.webp" alt="M2P Fintech" title="" width="100%" height="236"><h2 class="heading-node" id="z3b0iamw8">Unlocking the potential of e-KYC</h2> Egypt is a disruption-ready market. Although over 75 million actively use the internet, as of April 2022, about 2/3 rd of the population is underbanked, and a significant portion is still unbanked. Further, in accordance with the Egyptian Money Laundering and Terrorist Financing Combating Unit (EMLCU), the CBE issued guidelines to all banks. It entails banks to draft new simplified procedures to open bank accounts for the self-employed and owners of micro-sized projects to encourage greater inclusion. Currently, 32 banks offer internet banking facilities, and 28 have obtained a license to render mobile-based banking services to their customers. In this unique landscape, leveraging e-KYC to streamline onboarding will boost financial reliability, stability, and growth. It will also augment market penetration and improve financial inclusion in the country. With the help of e-KYC, consumers will be able to verify themselves online in minimal steps, including document verification, data extraction, and face verification. They can see their verification status once these steps are completed. This would make the digital onboarding process simpler and secure, thereby helping customers trust financial entities more and making digital transactions easier and more accessible. On the other hand, it would assist FIs in extending services to a larger community of Egyptians living and working in the country and the Egyptian diaspora living abroad. In addition, e-KYC would help to lower risk and dramatically expand credit products like consumer lending as the process would speed up loan approvals. Even though the validation through e-KYC is still nascent, financial experts believe these approvals are likely to be high-value loans for houses and cars.<h2 class="heading-node" id="3qe9qztw4">Benefits of e-KYC</h2> In such a cyberized environment, e-KYC procedures can immensely benefit both financial institutions and customers. Here are some of them: Simple, Instantaneous, Accessible&nbsp;&nbsp;Traditionally, paper-based KYC is a time-consuming process. It can take days or, in some cases, weeks to complete the verification process. On the other hand, e-KYC is a fully automated or digital process that almost eliminates manual intervention. This makes it convenient for individuals and businesses to fill out forms without needing to visit a physical branch or office. Further, as the KYC data is transferred in real-time, it takes just a few minutes to verify and issue when an individual is opting for a banking service or product. Since it can be performed 24/7, 365 days, it increases scalability and makes it more accessible to consumers. Boosts customer acquisition&nbsp;According to a recent report, most Egyptians prefer getting a loan from their friends and family instead of approaching a FI, owing to the extensive time and effort involved in the KYC procedure. E-KYC is one of the optimal solutions to overcome this limitation. The digitized system makes the onboarding process simple and quick and is highly accurate compared to the KYC procedure. As it drastically reduces the waiting time to complete the verification, e-KYC enhances the customer experience from the very first interaction with the bank. Therefore, it serves as a critical factor in attracting new customers and maintaining loyal customer engagement.<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2022/10/e-KYC-2.0-in-Egypt-blog_1-05.webp" alt="M2P Fintech" title="" width="100%" height="236">Mitigates fraud&nbsp;In Egypt, digitalization in the banking sector is in progress. Consequently, banks and non-banking financial companies have to work with the remnants of old legacy systems. However, with steadily growing online transactions, FIs ought to preemptively identify and address systematic digital fraud. The e-KYC system includes technologies such as OCR, facial recognition, liveness detection, and fraud detection to monitor accounts continuously for prohibited transactions or activities. This helps banks detect and eliminate falsified onboarding.&nbsp; Improves operational efficiency&nbsp;By integrating e-KYC, banks can augment profits, enhance regulatory compliance, and transmute customer experience. As it requires zero to minimal manual intervention, it eliminates the need to hire/train agents for KYC procedures. This helps FIs to devote their personnel to other core business functions. Additionally, e-KYC promotes a cloud-based online system to store customer information, thereby replacing the need for paper and document management. Such practice reduces the cost associated with regular KYC compliance. Safe and Secure&nbsp;First off, e-KYC is a consent-based system that enables an individual to share data only upon his or her own accord and consent. Secondly, it entails fewer human beings reviewing sensitive data. Third, the customer's account details, transaction data, and other financial information are secure as it is an online process. This protects the individual's right to privacy and minimizes identity theft, fraud, money laundering, loan scams, etc.<h2 class="heading-node" id="7fd6wjrq0">M2P - a leader in KYC services</h2>M2P's e-KYC suite facilitates businesses to get customer KYC from anywhere in the nation while adhering to all regulatory requirements. It enables financial institutions to control the user data necessary to be captured from the customer, which is collected through the user journeys built into the partner/bank's digital assets. The customer's KYC is performed using the bank's/authorized entity's KYC <a class="link" href="https://m2pfintech.com/blog/api-the-power-that-drives-new-age-banking-ecosystems/">APIs</a>, and the outcome of the activity is captured by M2P.&nbsp; Our e-KYC Gateway facilitates seamless customer onboarding for corporates &amp; to better the service delivery by governments. Further, <a class="link" href="https://m2pfintech.com/kyc-suite.php">M2P</a> ensures robust integration between the partner's/bank's digital assets and issuing bank's <a class="link" href="https://m2pfintech.com/blog/future-of-core-banking-systems/">core banking</a> solution.Our services do not stop with e-KYC. We are incumbents in rendering extensive e-KYB to lending businesses. Our Bank Statement Analyzer is powered by artificial intelligence and machine learning that processes statement data in real-time. The analyzer runs deep analytics to generate accurate reports that help financial institutions and lending businesses make quick credit assessments and decisions. We are launching soon in Egypt. If you are interested in partnering with us, write to us at <a class="link" href="mailto:business@m2pfintech.com">business@m2pfintech.com.</a> <a class="link" href="https://m2pfintech.com/newsletter/">Subscribe</a>&nbsp;to our newsletter and get the latest fintech news, views, and insights, directly to your inbox.Follow us on&nbsp;<a class="link" href="https://www.linkedin.com/company/m2pfintech/mycompany/">LinkedIn</a>&nbsp;and&nbsp;<a class="link" href="https://twitter.com/m2pfintech">Twitter</a>&nbsp;for insightful fintech tales curated for curious minds like you.

e-KYC 2.0 in Egypt - Enabling the Next Generation Fintech Adoption

<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2022/10/AML-Banner-01-3.webp" alt="M2P Fintech" title="" width="100%" height="236"> Money laundering costs the world nearly 5% of its GDP. The losses are estimated to be over $2 trillion per year.&nbsp;&nbsp;For starters, money laundering is not some harmless misdemeanor. It’s a serious financial crime with significant economic and social consequences. As 90% of money laundered is off the radar, criminals and terrorist financiers find it very easy to fund and monetize illegal activities.&nbsp;<h2 class="heading-node" id="2opmmtuxc">What is money laundering?</h2>Money laundering is an illegal process that conceals the origin of ill-gotten funds and makes them appear as if they are from a legitimate source.&nbsp;&nbsp;Here’s an example.    &nbsp;A could have gotten paid for organized criminal activities such as drug trafficking, corruption, embezzlement, or gambling. Now, to spend the gains without drawing attention, A uses shell corporations, high-cash businesses, and other naive financial companies to illegally clean the dirty money and let it out in circulation. Now money laundering doesn’t affect just a particular set of businesses. Its dystopian effect surpasses industries and nationalities.&nbsp;<h2 class="heading-node" id="c9ru60ga0">How does&nbsp;money laundering&nbsp;happen?</h2>Money launderers&nbsp;traverse&nbsp;three stages to&nbsp;stealthily&nbsp;release&nbsp;illicit funds into the financial ecosystem.&nbsp;<h3 class="heading-node" id="4qgmrotqs">3 stages of money laundering</h3><h4 class="heading-node" id="qbxu15oy4">1 Placement&nbsp;</h4>Here the laundered funds are shifted from criminal associations to be placed and positioned as a legitimate source. Usual techniques to mask the identity include false&nbsp;invoices,&nbsp;moving money to heavy cash flow businesses, foreign bank accounts, and offshore companies.&nbsp;&nbsp;&nbsp;<h4 class="heading-node" id="atsxwq39d">2 Layering</h4>Otherwise called the ‘structuring phase,’ layering divides a large sum of money into small transactions to cover up money laundering. It blankets the international money movement, making it difficult for law enforcement to track down launderers. Ultimately, the laundered money circulates globally and is exchanged in foreign markets.&nbsp;<h4 class="heading-node" id="wv3wdgeq0">3 Integration</h4>Also called the ‘extraction phase,’ integration is the final stage of money laundering. In this phase, the laundered money returns to the criminals and integrates with the regular financial stream. Masked to be from a legitimate source, criminals can now legally recover their laundered money and use it for any purpose.&nbsp;<h2 class="heading-node" id="0oubbqivk">Need&nbsp;to combat money&nbsp;laundering&nbsp;</h2>The impact of money laundering is severe. It decays financial health, income distribution, and tax revenues, in addition to promoting crime and slowing down economic growth. Institutions specializing in money movement, including banks, NBFCs, and other financial institutions, are more likely to be impacted by money laundering. Hence, they need to be highly vigilant.The September 11 attacks, popularly known as the 9/11 terrorist attack, had an intense effect on money laundering regulations, mainly focused on the banking sector. After this, the Patriot Act was introduced, which offered the US government power to fight against terrorism. It also directed the financial institutions to expand their Anti-Money Laundering (AML) programs and intensify due diligence on foreign bank accounts. Title III strengthened banking rules by improving communication between law enforcement and financial institutions. This resulted in the US enforcing a stricter AML regime, followed by other countries. In India, RBI imposes stringent anti-money laundering regulations. Banks must follow strict customer identification processes for account opening and transaction monitoring. Anything suspicious must be reported immediately to the appropriate authority. Strong Anti-Money Laundering (AML) regulations and compliance are critical in today’s modern landscape, where criminals are getting more sophisticated by the hour. Monitoring, assessing, and reporting vulnerabilities and suspected money laundering is crucial for financial institutions.&nbsp;&nbsp;<h2 class="heading-node" id="wkbd6qylf">What is Anti-Money Laundering?&nbsp;&nbsp;</h2>Anti-Money Laundering (AML) regulations&nbsp;comprise&nbsp;laws nullifying&nbsp;money laundering or any associated fraudulent activities. It saves banks and other financial institutions from terrorism&nbsp;financing,&nbsp;drug rackets, and&nbsp;other organized crimes.  Comprehensive&nbsp;Anti-Money Laundering (AML) and Counter-Terrorist Financing (CTF) regulations enable&nbsp;financial institutions to comply&nbsp;with legal requirements and report suspicious financial activities.&nbsp;Technology innovation&nbsp;in&nbsp;&nbsp;<a class="link" href="https://m2pfintech.com/blog/how-is-ai-changing-the-financial-industry-top-6-use-cases-in-fintech-and-banking/">Artificial Intelligence (AI)</a>&nbsp;and Machine Learning (ML)&nbsp;prevents&nbsp;fraudulent activities without hindering&nbsp;customer experience. &nbsp;<h2 class="heading-node" id="3i7d0d4gq">4 Pillars of AML  &nbsp;</h2>For efficient anti-money laundering, businesses need to get the following pillars strong. &nbsp;<h3 class="heading-node" id="epyq8nxhc">Know Your Customer   &nbsp;</h3><a class="link" href="https://m2pfintech.com/blog/crack-the-kyc-jigsaw-ease-onboarding-compliance/">Know Your Customer (KYC)</a>&nbsp;is a critical process for financial institutions. It is a legal requirement for AML laws as it establishes and verifies identity, assesses risk factors, and monitors suspicious activities. &nbsp;<a class="link" href="https://m2pfintech.com/blog/know-your-customer-kyc-the-need-for-authentication/">KYC</a>&nbsp;helps banks and financial institutions understand their customers and their financial dealings to serve them better and manage risks prudently. In India, RBI has enunciated KYC guidelines in the context of recommendations made by the Financial Action Task Force (FATF) on AML.  FIs need to get KYC information, not just at the time of opening a new account.  They obtain additional data from time to time in accordance with account conduct or at periodic refresh cycles based on risk categorization.<h3 class="heading-node" id="6ykiuco81">Customer Due Diligence   &nbsp;</h3>Customer Due Diligence (CDD) is the control process where all the relevant information of the customers is collected and processed for any potential terrorist financing risks. CDD helps identify risks and provides a risk assessment to new customers&nbsp;(via online databases), politically exposed persons (PEPs), government records, watchlists, and sanctions screening.  CDD is an essential step in KYC that requires ongoing monitoring of money laundering risks posed by each customer. This&nbsp;<a class="link" href="https://m2pfintech.com/blog/why-is-risk-based-authentication-rba-critical-for-banks/">risk-based approach</a>&nbsp;will conduct a more profound due diligence process for those with higher non-compliance risks by identifying customers added to sanctions and other AML lists.  Customer due diligence detects money laundering techniques that include layering and structuring. Also known as smurfing, that is breaking up a huge sum of money into smaller transactions to evade reporting limits and avoid perusal. <h3 class="heading-node" id="i2h716qd4">Customer and Transaction Screening   &nbsp;</h3> Banks and other financial institutions are the leading players in the financial landscape with broad customer portfolios. They need to monitor and control the money transfers that&nbsp;take place. As transactions involve several other banks and entities, an average-sized bank mediates thousands of daily&nbsp;<a class="link" href="https://m2pfintech.com/blog/tale-of-money-transfers-from-hawala-to-one-click-remittances/">money transfers.</a>&nbsp;So even a minor crime can bring significant consequences and lead to severe administrative collapses, hefty fines, and loss of credibility. Hence screening of all customer deposits and other transactions must be treated seriously.<h3 class="heading-node" id="fabe0ux9m">Suspicious Activity Reporting   &nbsp;</h3> Examining bank records for any unusual behavior or irregularity is a common procedure for law enforcement organizations investigating money laundering. To aid law enforcement in locating perpetrators in the current regulatory framework, thorough records are kept on every single financial transaction. Banks must have an unchangeable audit trail that regulators can rely on. However, it’s also crucial that compliance experts at financial institutions rapidly and effectively examine issues and close them.<h2 class="heading-node" id="gu7wuxkmw">How do you respond to money laundering suspicions?</h2>Simple. Ask the client for more information. Then you can quickly determine if there is any chance of money laundering or not.And remember to tick off this checklist to avoid the risk of money laundering.&nbsp;<h3 class="heading-node" id="jddlhozk9">Tick off the&nbsp;AML checklist&nbsp;</h3>✅&nbsp;Ensure you run a deep check on your new clients. Revisit the purpose of the business partnership and try to understand why they chose your firm. Customer Due Diligence (CDD) helps in identifying the clients and helps assess/reduce the risk posed by them.&nbsp;&nbsp; ✅&nbsp;Keep track of the unusual transactions that take place at the client’s end.&nbsp;&nbsp;✅&nbsp;Unusual sources of funds are another crucial warning that you must consider. Regulation 28 of the Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017 (MLR 2017) helps in analyzing transactions if they are processed with the knowledge of the clients. In some cases, asking for any documentary evidence like bank statements, recently filed business accounts, or any documents that confirm the source of funds will help identify any trace of money laundering.&nbsp;&nbsp; ✅&nbsp;Consider the purpose of funds coming from third parties. It may seem like a regular feature, but it may act as criminal property sometimes. So, it is better to run a check on the funds from third parties and their source.✅&nbsp;If there is any change of instructions without prior warning from the client, ask for a reasonable explanation.✅&nbsp;Money launderers are most likely to misuse trust, company formation, operation of a client account, and so on. To avoid these risks, you must comply with anti-money laundering guidance for the legal sector and apply for appropriate levels of CDD and enhanced due diligence before providing these services.✅&nbsp;Pay attention to cash transactions, strictly follow your company’s cash policy, and don’t accept cash payments above the specified limit. There is always a high risk posed by cash.<h2 class="heading-node" id="4nrz33gno">Challenges in implementing AML  &nbsp;</h2>AML compliance is indispensable. But effective implementation is the key challenge for banks and financial institutions.  Increased governance, lack of skilled resources, requisite tools, technology, and in-depth knowledge are a few bottlenecks that impact AML deployments.Let’s take a brief look at some of the challenges below.Increased governance -&nbsp;These financial institutions and banks face difficulties managing cross-border and multi-jurisdictional AML compliance and customer due diligence requirements. The major challenge they face is identifying beneficial ownership and initiating remedial measures to address the prevailing AML gaps uncovered by regulatory reviews.  Lack of skilled personnel -&nbsp;Fetching professional resources with in-depth knowledge of AML is a tough challenge. Other issues include high onboarding timelines and costs, and attrition. With evolving regulatory requirements, organizations must invest considerable time and effort in keeping pace right.Complicated processes and technology -&nbsp;AML compliance requires banks to put in place a multiplicity of processes and technology solutions that will consolidate KYC data and systems in a single repository. They also need to create infrastructure for cross-channel detection of suspicious activities, improve data quality, and standardize data to enable a centralized analysis of fraud and financial crimes. The risk level assigned during onboarding varies according to the transactions undertaken by the customer. Banks must assess the risks dynamically for each customer and change risk levels accordingly to prevent false positives. This necessitates continual transaction monitoring for each customer, which is a daunting task.<h2 class="heading-node" id="9x7kxfrw4">In conclusion&nbsp;</h2>If you are a business looking to combat money laundering, you must invest in a robust AML platform focusing on the four critical aspects.&nbsp; Research and Technology&nbsp;– With state-of-the-art technologies like artificial intelligence, you can detect false positives and conduct in-depth research to eliminate wrongdoings.&nbsp;Constant Communication&nbsp;– Regular communication should be between the parties involved, including law enforcement, government, regulatory bodies, etc. Communication will keep all parties informed, analyze suspicions, and identify possible networks to tackle money launderers.&nbsp;&nbsp;Leverage Data Analytics&nbsp;– Analytics arms you with data and insights to identify and detect patterns concerning money laundering.&nbsp;&nbsp; System Standardization&nbsp;– Proper standardization helps to communicate and process data that hinder fraud detection.&nbsp;&nbsp; Want to know more about AML deployment?&nbsp;Write to us at <a class="link Hyperlink SCXW36320282 BCX8" href="mailto:business@m2pfintech.com" target="_blank" rel="noreferrer noopener">business@m2pfintech.com</a>.<a class="link" href="https://m2pfintech.com/newsletter/">Subscribe</a>&nbsp;to our newsletter and get the latest fintech news, views, and insights, directly to your inbox.Follow us on&nbsp;<a class="link" href="https://www.linkedin.com/company/m2pfintech/mycompany/">LinkedIn</a>&nbsp;and&nbsp;<a class="link" href="https://twitter.com/m2pfintech">Twitter</a>&nbsp;for insightful fintech tales curated for curious minds like you.

How to Combat Money Laundering?

<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2022/07/Creative-AePS-Blog-03.webp" alt="M2P Fintech" title="" width="100%" height="253">Over 85% of bank accounts in India are inactive.Research shows that the inactive accounts can be attributed to the issues faced by the underserved populace across remote corners of the country.<blockquote class="block-node" id="vrcfnudss">Bringing the underbanked and unbanked population into mainstream financial services is crucial for&nbsp;<a class="link au lm" href="https://m2pfintech.com/blog/fintech-a-catalyst-for-financial-inclusion/" target="_blank" rel="noopener ugc nofollow">financial inclusion</a>, the foundation of economic growth.</blockquote>Digital payment modes such as mobile wallets,&nbsp;<a class="link au lm" href="https://m2pfintech.com/blog/upi-the-driver-of-economic-growth-and-inclusion/" target="_blank" rel="noopener ugc nofollow">UPI</a>, contactless, payment cards, and QR codes have enabled universal access to financial services. But they still leave a gap for senior citizens, underprivileged, and inerudite sections of the society. These sections find it challenging to buy a smartphone or a payment card or even remember a passcode or PIN. Thus it becomes harder for them to join the digital Indian ecosystem.To resolve these challenges and to enable people from all walks of life to benefit from digital financial services, Aadhaar enabled Payment System (AePS) was brought into existence.Before diving in to know more about AePS, let’s have a quick look at what Aadhaar is and how it helps financial inclusion.<h2 class="heading-node" id="0c61">Aadhaar, driving inclusivity, and benefits</h2>Aadhaar is a 12-digit individual identification number issued by the UIDAI (Unique Identification Authority of India) on behalf of the Indian Government. In India, the Aadhaar number serves as a proof of identity and address. Any citizen of India is eligible to apply for Aadhaar Card. They can receive it via India Post, and as an e-Aadhaar downloaded from the UIDAI website.Aadhaar, the world’s largest biometric ID system, has been a crucial enabler of inclusive financial services in India. It captures fingerprints, retinal scans, and facial identification as chief authentication factors for transactions. So, the bank customer need not carry a smartphone or a payment card, or remember PINs and passwords.<blockquote class="block-node" id="vqdwnw2pm">More than 131 crore adults registered with Aadhaar have seamless access to banking services, insurance, and direct benefit transfers from over 700 financial inclusion schemes announced by the central and state governments.India’s financial inclusion index stands at 53.9, which is an impressive display of inclusivity brought about by Aadhaar.</blockquote>Aadhaar leverages advanced technology for transparent and targeted delivery of financial services, benefits, and subsidies without the hassle of intermediaries. Aadhaar saved the Indian government ₹2.25 lakh crores in Direct Benefit Transfers (DBT) by getting rid of fake beneficiaries and routing benefits to deserving people.<h2 class="heading-node" id="aab1">What is AePS?</h2>Aadhaar enabled Payment System (AePS) is a payment system that facilitates interoperable digital financial transactions through Aadhaar card-based verification (quick eKYC). It uses a Unique Identification Number or the Aadhaar number to make transactions effortlessly. Serving as a simple, secure, and user-friendly platform, AePS helps blue-collared workers, senior citizens, and the underprivileged to benefit from cashless transactions.AePS is a bank-led model, and any Indian resident can utilize the service just with their Aadhaar number that is linked to their bank account — Aadhaar Enabled Bank Account (AEBA). The Aadhaar enabled Payment System allows online transactions to take place at PoS (Micro ATM)/Kiosk/mobile devices through the Business Correspondent (BC) of any bank using Aadhaar authentication.Leveraging AePS, banks can empower all segments of society by increasing user-friendly access to cash deposits, payments, money transfers, and withdrawals. AePS use cases are accessible at any biometric-enabled touchpoint, viz., all-in-one integrated devices, mobiles/PCs/tablets, or any accessories that meet the technical specifications defined by UIDAI. By enabling AePS solutions, banks can enable seed status checks for direct benefit transfers, social security pensions and government subsidies.<h2 class="heading-node" id="f55b">What are the requirements for AePS transactions?</h2>AePS does not need a smartphone, document, or payment card. It only requires the customer to link the Aadhaar card to the bank account to capture the following info.<ul class="list-node" id="3lglglm5z"><li>Aadhaar Number</li><li>Biometrics-fingerprint identification</li><li>Name or Bank Issuer Identification Number (IIN)</li></ul>If not, just remembering the last four digits of the Aadhaar number will do. The Business Correspondent with an AePS machine or Micro ATM on assisted mode should be able to do any transaction for the customer.<h2 class="heading-node" id="ab00">Key objectives</h2>The main objective of AePS is to use Aadhaar number/ Virtual Identity to access AEBA for banking transactions through Business Correspondents (BC).It also aims to:<ul class="list-node" id="n7aofhjeh"><li>Securely facilitate&nbsp;<a class="link au lm" href="https://m2pfintech.com/blog/why-payments-interoperability-is-a-must-for-todays-generation/" target="_blank" rel="noopener ugc nofollow">interoperability</a></li><li>Enable quick eKYC services</li><li>Electronify retail payments as per RBI regulations</li><li>Build a full range of Aadhaar enabled Banking Services</li><li>Improve financial inclusion in India (According to the goals of GoI and RBI)</li><li>Enable intrabank and interbank transactions through a central switching &amp; clearing agency</li><li>Empower bank customers to use Aadhaar for banking transactions</li></ul>In addition, AePS helps deliver Government disbursements like NREGA, social security pension, and handicapped old age pension.<h2 class="heading-node" id="8be7">AEBA services</h2>With the help of AEBA (Aadhaar Enabled Bank Account), banks can offer the following services.<ul class="list-node" id="hakcr4xsc"><li>Cash Deposit</li><li>Balance Enquiry</li><li>Purchase</li><li>Cash Withdrawal</li><li>Mini Statement</li><li>Aadhaar to Aadhaar Fund Transfer</li><li>eKYC</li><li>Best Finger Detection</li><li>Demographic Authentication</li><li>Aadhaar Seeding Status</li><li>Self-Help Group (SHG) Transaction</li><li>BHIM Aadhaar Pay</li><li>Authentication</li></ul><h2 class="heading-node" id="7a75">How can customers use AePS?</h2>Customers can make AePS transactions in two ways.<ul class="list-node" id="uxpw6ofk8"><li>Through Business Correspondents&nbsp;— who usually represent the banks or entities. They are equipped with Micro ATM devices for facilitating customer transactions.</li><li>Through BHIM Aadhaar Pay at merchant locations&nbsp;— where the customer can make payments just by using Aadhaar number/VID and verify their identity using biometrics.</li></ul><h2 class="heading-node" id="614d">5 steps to perform an AePS transaction</h2>The steps below will guide customers to perform an AePS transaction easily.<ol class="list-node" id="9kqme9bxs"><li>Visit an ATM or contact a banking representative</li><li>Enter the 12-digit Aadhaar number and bank account number in the PoS machine</li><li>Choose a transaction type from the list- cash deposit, mini statement, withdrawal, balance enquiry, or fund transfer</li><li>Enter the transaction amount</li><li>Verify identity using biometrics (iris scan, fingerprint, or face recognition)</li></ol>Once all this is done properly, the transaction will be completed, and you can collect your receipt.<h2 class="heading-node" id="f14e">Why and how can banks and merchants offer AePS?</h2>For BanksBanks can reap the following benefits by offering AePS to their customers.<ul class="list-node" id="63zbggip1"><li>Reach more customers by engaging with Business Correspondent</li><li>Cut costs by leveraging digitization and reducing the printing of cheques and payment cards</li><li>Save time and money using a Business Correspondent instead of brick and mortar branches</li><li>Enable smooth interoperability among banks</li><li>Establish a quick and easy paperless KYC</li></ul>When banks wish to offer AePS to their customers, they just have to apply with NPCI / UIDAI. Then, they will be permitted to deliver AePS after the vetting and application process is completed.For MerchantsMerchants can accept AePS for cost-effective and inclusive payments. This will help them widen their customer base. Merchants can offer AePS by just applying to an authorized bank. After this, they can then receive digital payments for goods and services that are delivered from their customers.<h2 class="heading-node" id="1574">Greater security, trust, and inclusion</h2>When banks and merchants offer AePS, their customers can easily transact just with biometric authentication, either a face recognition, iris scan, or fingerprint identification. All these three aspects can never be forged, ensuring secure transactions.Banks and merchants can gain more customers through AePS as transactions can happen without the need of a physical card, passbook, smartphone or any other document. This will improve customer trust and confidence to make transactions in rural areas, especially among the underbanked segments. Banks across India are attributing enhanced revenue and cost-cutting to AePS offering.Want to add AePS to your payment ecosystem? Write to us at&nbsp;<a class="link au lm" href="mailto:business@m2pfintech.com" target="_blank" rel="noopener ugc nofollow">business@m2pfintech.com</a><a class="link" href="https://m2pfintech.com/newsletter/">Subscribe</a>&nbsp;to our newsletter and get the latest fintech news, views, and insights, directly to your inbox.Follow us on&nbsp;<a class="link" href="https://www.linkedin.com/company/m2pfintech/mycompany/">LinkedIn</a>&nbsp;and&nbsp;<a class="link" href="https://twitter.com/m2pfintech">Twitter</a>&nbsp;for insightful fintech tales curated for curious minds like you.

Revolutionizing Financial Inclusion- Aadhaar enabled Payment System (AePS)

<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2022/06/Artboard-1-1.webp" alt="M2P Fintech" title="" width="100%" height="253">Stumped with KYC implementation?You are not alone. Several Financial Institutions (FIs) are working out their way through KYC puzzle to oust financial crimes and ensure compliance.Now, KYC is critical for any financial institution. It is indeed the first step when you choose to use a financial product or service in India.So, what is KYC?For starters, Know Your Customer (KYC) is the process to confirm a customer’s identity while onboarding a financial institution. RBI has ensured the implementation of a robust KYC system to helps financial institutions understand their customers better while ensuring their legitimacy. Click&nbsp;<a class="link au lg" href="https://m2pfintech.com/blog/know-your-customer-kyc-the-need-for-authentication/" rel="noopener">here</a>&nbsp;to know more about KYC in India.<h2 class="heading-node" id="453f" style="text-align: justify">Digital Avatar</h2>With the rise in paperless onboarding, KYC has taken a digital avatar. The&nbsp;<a class="link" href="https://m2pfintech.com/blog/know-your-customer-kyc-the-need-for-authentication/">digital KYC&nbsp;</a>saves a lot of time and effort involved in the process and helps tackle onboarding issues in a quick and seamless manner. It also prevents money launderers/fraudsters from masking their true identities and manipulating stolen information for their personal gains.Though the benefits of the process are immense, implementing digital KYC is not simple. Financial institutions such as banks and fintechs need to overcome significant challenges in deployment.<h2 class="heading-node" id="22ab" style="text-align: justify">Key KYC Challenges</h2>The upswing in the recent money laundering, fraud, and tax evasion cases has brought KYC into a new light. Accordingly, RBI has enforced strict laws concerning non-compliance with the KYC directives. However, financial institutions are grappling to keep up with the legal framework for KYC compliance.Experience Vs ComplianceRight from onboarding and screening to monitoring customer data, they face complex challenges every step of the way. This puts banks and fintechs in a tricky spot because customers seek seamless experience and quick onboarding with minimal documentation, and FIs cannot compromise on the verification process. Ensuring compliance without compromising customer experience is a huge challenge for FIs.Connected Risk IdentificationKYC involves extensive paperwork and supporting documents. Often, customer data files are incomplete or lack critical pieces of information or documentation. This heightens the risk of fraud and lays down a cosmic emphasis on monitoring and screening individuals and entities against Politically Exposed Persons (PEPs), watchlists/sanctions, and other regulatory and law enforcement lists.In addition, the rise of new criminal typologies has inflicted the compliance team to assess an overarching list of compliance and fraud risks. This calls for an all-inclusive, connected risk identification approach for analyzing financial fraud activities, money laundering, and other offenses.Volatile Risk AppetiteFinancial institutions and customers exhibit dynamic risk appetite. For example, a customer might have a different risk profile or status during onboarding and drift into another risk profile over time. On the other hand, KYC regulations are updated periodically, which implies the regulations, risk indicators, and other indices used to determine the risk tolerance score will vary. Hence the outdated records become an impending hindrance to the customer due diligence process. The repercussions of such instances are far-reaching as there is only a fine line between a medium and high-risk customer but a momentous difference in due diligence efforts.Lack of TransparencyOne of the biggest challenges of KYC is the retrieval of corporate ownership documents from registries located across the globe. Successful KYC depends on several sources such as annual reports, financial statements, stock exchange information, third-party data, and regulator websites. However, due to the lack of transparency, KYC analysts bank on limited information on the directors, stakeholders, controllers, and beneficiaries. Additionally, there is a significant cost associated with accessing specific vital documents while others are available for free.<h2 class="heading-node" id="6f0c" style="text-align: justify">How Financial Institutions can crack KYC challenges</h2>Here’s our take on how financial institutions can tackle KYC challenges effectively.<ul class="list-node" id="bakrf8m7x"><li>Integrate with credit bureaus for seamless customer verification</li><li>Use data deduplication techniques to recognize and eliminate identical records. This is also known as Dedupe check-in.</li><li>Validate customer data against the regulation records to identify unscrupulous individuals/organizations prohibited from making business transactions.</li><li>Conduct rational checks to keep a tab on anonymous bank accounts or those opened with fictitious names.</li><li>Facilitate video KYC for quick onboarding and exceptional customer experience.</li><li>Use algorithms and techniques to categorize customers as low, medium, and high-risk categories, based on the assessment and risk perception.</li><li>Take necessary precautions with customers who come under high-risk segment.</li><li>Monitor customer transactions in a routine manner to keep an eye on any suspicious activities.</li><li>Partner with authorized 3rd party service providers for quick e-KYC checks and video KYC onboarding.</li></ul><h2 class="heading-node" id="4cad" style="text-align: justify">Is third-party KYC partnership a viable approach?</h2>Although KYC is kept in-house traditionally, experts believe it is time to team up with third-party KYC-service providers.Why?First off, it is cost and time effective.Secondly, for high efficiency and accuracy.From dedicated subject matter expertise to cutting-edge technology access to faster go-to-market speed, third-party partners can provide all-inclusive services within an optimum budget.These partnerships can enable FIs to invest more effort and time in their core business, rather than focusing on the KYC procedures. Financial institutions that keep KYC in-house could end up with extensive duplication and redundancy across businesses and markets.On the other hand, third-party partners employ devoted professionals to carry out KYC procedures and documentation. This leaves no room for error, ensuring a smoother onboarding process and regulatory compliance, without compromising customer experience.With that being said, third-party service providers are the gateway to exceptional customer experience and successful KYC solutions. They enable financial organizations to improve speed and operational performance, minimize operational risks and boost efficiency by consolidating and centralizing functions.Financial institutions should take apposite measures to understand the complexities that could arise from digital transformation. They must embrace strategic partnerships to develop pioneering approaches to assess customer risks and monitor transactions.So, do you need solutions to any particular KYC issue? Or want to know more about implementing KYC?Write to us at&nbsp;<a class="link au lg" href="mailto:business@m2pfintech.com" target="_blank" rel="noopener ugc nofollow">business@m2pfintech.com</a>.<a class="link" href="https://m2pfintech.com/newsletter/">Subscribe</a>&nbsp;to our newsletter and get the latest fintech news, views, and insights, directly to your inbox.Follow us on&nbsp;<a class="link" href="https://www.linkedin.com/company/m2pfintech/mycompany/">LinkedIn</a>&nbsp;and&nbsp;<a class="link" href="https://twitter.com/m2pfintech">Twitter</a>&nbsp;for insightful fintech tales curated for curious minds like you.

Crack the KYC Jigsaw. Ease Onboarding Compliance

<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2022/05/Artboard-1-copy-8-8.webp" alt="M2P Fintech" title="" width="100%" height="383">Over the last few years, e-commerce and <a class="link" href="https://m2pfintech.com/blog/the-rise-of-digital-payments/" target="">digital payments</a> have become a comfortable cosmos for millions of shoppers worldwide. Card-Not-Present (CNP) transactions, in particular, constitute a major chunk of online payments.<h2 class="heading-node" id="cbf4">Card-not-present transactions</h2>Essential to both in-store and online businesses, CNP payments reduce the risk of customer churn and cart abandonment. Imagine a customer does not have a physical credit or has a visibly battered card that cannot be scanned. They can still pay for the purchase using the CNP facility across the counter or telephone or digital channels.But like most things in life, CNP payments are a double-edged sword. They are highly sophisticated yet so vulnerable to security breaches. When a scamster gets hold of the credit card number, name, three-digit security code (CVV), and expiration date, stealing cash and identity becomes a cakewalk.<blockquote class="block-node" id="o40ybrinh">As of 2021, CNP frauds were 81% more common than card-present scams, resulting in tremendous costs to banks and merchants.</blockquote><h2 class="heading-node" id="66f3">Cost of payment fraud</h2>The cost associated with payment fraud is immense for banks, merchants, and payment service providers. They’ll have to deal with customer refunds, additional chargeback fees, fines, and investigation charges. Though the amount is usually refunded to the victim, it still causes distress and mistrust.<h2 class="heading-node" id="b033">Best way to prevent CNP fraud — PCI 3DS</h2>The way to avert CNP fraud is to implement stringent controls that validate the identity of the cardholder. PCI 3D Secure plays a significant role in enabling identity validation and access control, thereby reducing the costs and inefficiencies associated with payment fraud in a CNP scenario. Banks and card payment service providers need to comply with PCI 3DS protocols to fortify transaction security.<h2 class="heading-node" id="deaa">What is PCI 3DS?</h2>PCI 3DS is an advanced EMV messaging procedure that authenticates cardholders when making online purchases. It facilitates seamless data exchange between merchants, cardholders, and card issuers, thereby providing an additional layer of security to avoid CNP fraud and make e-commerce secure.<h2 class="heading-node" id="f06c">Key components of PCI 3DS Core Security Standard</h2>The PCI 3DS Core Security Standard serves as a framework for EMV 3DS functions to execute security controls. It supports the integrity and confidentiality of 3DS transactions and pertains to institutions that leverage 3DSS, DS, and ACS, the key components of the PCI 3DS security standard.Here’s a quick peek into what each component means.•&nbsp;3DS Server (3DSS)&nbsp;contributes the functional interface between the 3DS requester environment and the DS.•&nbsp;3DS Directory Server (DS)&nbsp;holds the list of valid card ranges for which authentication may be available. Further, it also coordinates communication between the 3DSS and the ACS systems to ascertain whether authentication mechanisms are available for a particular card number and device type.•&nbsp;3DS Access Control Server (ACS)&nbsp;comprises the authentication rules and is managed within the issuer domain.The physical and logical security requirements for the PCI 3DS Core Security Standard are structured as follows.Baseline Security Requirements<ul class="list-node" id="qtc61d1ze"><li>These are technical and operational security requirements that reflect general information security principles and practices common to industry standards.</li><li>These requirements should be considered for all types of environments.</li></ul>3DS Security Requirements<ul class="list-node" id="qgbh7rkln"><li>They provide security controls specifically intended to protect 3DS data, technologies, and processes.</li></ul><h2 class="heading-node" id="1289">Difference between PCI 3DS and PCI DSS</h2>The PCI 3DS and PCI DSS are two separate standards intended for varying requirements and entities. The PCI 3DS applies to environments where 3DSS, ACS, and/or DS functions are performed, whereas PCI DSS applies wherever payment card account data is stored, processed, or transmitted.If you want to know more about PCI DSS, check out our blog on the&nbsp;<a class="link au nb" href="https://medium.com/m2p-yap-fintech/12-requirements-of-pci-dss-157747451888" rel="noopener">12 REQUIREMENTS OF PCI DSS.</a>Most 3D secure entities possess both PCI 3DS and PCI DSS responsibilities. In some cases, a 3DS entity does not store, process, or transmit any payment card account data. For instance, in the case of EMV payment tokens, the 3DS entity is involved ONLY in 3DS transactions. The 3DS entity may not be subject to PCI DSS in this scenario. In all other cases, entities should refer to their acquirer and/or the payment brand(s) to determine their compliance obligations to a PCI standard.So, are you looking to get PCI DSS certified and compliant? We can help.<a class="link au nb" href="https://m2pfintech.com/" target="_blank" rel="noopener ugc nofollow">M2P</a>&nbsp;has extensive experience in ensuring compliance for numerous players in the card payment industry. Write to us at&nbsp;<a class="link au nb" href="mailto:business@m2pfintech.com" target="_blank" rel="noopener ugc nofollow">business@m2pfintech.com</a>, and let’s get started!Here’s to more dynamically authenticated 3DS transactions!<a class="link" href="https://m2pfintech.com/newsletter/">Subscribe</a>&nbsp;to our newsletter and get the latest fintech news, views, and insights, directly to your inbox.Follow us on&nbsp;<a class="link" href="https://www.linkedin.com/company/m2pfintech/mycompany/">LinkedIn</a>&nbsp;and&nbsp;<a class="link" href="https://twitter.com/m2pfintech">Twitter</a>&nbsp;for insightful fintech tales curated for curious minds like you.

Prevent CNP Frauds with PCI 3DS

3D Secure: Your Barrier against Cyber Attacks

<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2022/04/pci-dss.webp" alt="M2P Fintech" title="" width="100%" height="253">The payment industry is constantly growing where every upgrade plays an important role in developing trust among users by protecting their sensitive data. So, every business that is an active participator needs to meet few security standards that act as Armour.One such globally recognized standard is PCI DSS.The PCI Security Standards Council came up with a Payment Card Industry Data Security Standard (PCI DSS) framework to protect credit and debit card transactions and card holders’ data from breaches. It is a mandate for every merchant and service provider to abide by this protocol for a smooth customer experience.<h2 class="heading-node" id="e2ee" style="text-align: justify">How was PCI DSS created?</h2>It all began during the internet boom in the late 1990s, when the initial stage of e-commerce brought in many fraudsters and excitement. When the retailers, merchants, card networks, consumers widely accepted the emerging web-driven transactions, they witnessed a steady increase in credit card fraud and scams. That is when the card networks like American Express, MasterCard, and Visa started to dig deep into the issue to create standards for payment processing systems.With Visa taking the lead in 2001 “Cardholder Information Security Program” standard was introduced, followed by the other companies implementing their security standards. But it did not meet the expectations of the merchants and POS terminals as they need to comply individually with the company-specific standards. This resulted in great difficulty for merchants as they have to comply with different standards when they are approaching multiple card networks. So, the collaboration of the major card networks such as American Express, Discover, JCB, Mastercard, and Visa birthed PCI DSS version 1.0 in December 2004.Later in 2006, the Payment Card Industry Security Standards Council (PCI SSC) was formed by a joint venture of MasterCard, American Express, Visa, JCB International, and Discover Financial Services to manage PCI development and alignment of policies to PCI DSS. PCI SSC ensures that the entities are committed to secure credit card data.PCI DSS is now a globally recognized directive where every merchant who accepts card payments must comply with the latest version, PCI DSS 3.2.1, which was released in May 2018.<h2 class="heading-node" id="edca" style="text-align: justify">Why do merchants need to comply with PCI DSS?</h2>Since there are over multiple card transactions taking place in the market, a safe business environment becomes the prime concern for the merchants to lead a long haul. A business compliant with PCI DSS always earns customers’ trust for their sensitive card information and helps boost the sale and customer confidence. As every business relies on partners, acquirers, or fellow industry mates, being a PCI DSS Compliant helps improve one’s reputation and strategies.Data breaches, payment card data theft, can be avoided as it is stored securely and monitored on a regular basis. In addition, PCI DSS even helps in improving IT infrastructure efficiency with its compliance levels and requirements.<h2 class="heading-node" id="de60" style="text-align: justify">PCI DSS Compliance levels</h2>There are four levels of PCI DSS Compliance based on the number of annual payment card transactions a business handle.Level 1:&nbsp;over 6 million TXNLevel 2:&nbsp;1 to 6 million TXNLevel 3:&nbsp;20,000 to 1 million TXNLevel 4:&nbsp;fewer than 20,000 TXNCheck out our guide to the&nbsp;<a class="link au mj" href="https://m2pfintech.com/blog/pci-dss-a-quick-guide-to-its-levels/" rel="noopener">PCI DSS Levels</a>&nbsp;and their impact on compliance.<h2 class="heading-node" id="a8f1" style="text-align: justify">Requirements for PCI DSS Compliance</h2>Every system entity and component associated with Cardholder Data Environment (CDE) must comply with the PCI DSS mandate. It includes requirements for security management, policies, procedures, network architecture, software design, and other critical protective measures.PCI DSS sets forth 12 requirements for every PCI DSS complaint established by the PCI Security Standards Council:<h3 class="heading-node" id="757b" style="text-align: justify">1. Firewall Configuration</h3>Firewalls are installed and configured to protect card holders’ data from any malware. It helps the prevention systems effectively to defend the hackers from unauthorized access to private data.<h3 class="heading-node" id="625d" style="text-align: justify">2. Password Security</h3>Businesses should not use vendor-supplied defaults for system passwords and other security parameters in their routers, modems, point of sale (POS) systems, and other third-party products. Instead, basic precautions and configurations like changing the password should be followed as the public can easily access the generic passwords and security measures.<h3 class="heading-node" id="ad5f" style="text-align: justify">3. Protection of Cardholder Data</h3>The stored cardholders’ data must be encrypted with two-fold protection and certain algorithms. Also, the primary account numbers (PAN) must be regularly scanned and monitored to avoid any unencrypted data.<h3 class="heading-node" id="1dad" style="text-align: justify">4. Encryption of Transmitted Data</h3>The cardholders’ data should be encrypted when transmitted across open, public networks like payment processors, home offices from local stores, etc. Sharing the account numbers to unknown locations must be avoided.<h3 class="heading-node" id="9653" style="text-align: justify">5. Antivirus Software</h3>All the systems used for interacting, sharing, storing PAN must be protected against malware by regularly using and updating antivirus software or programs. Also, POS providers must employ anti-virus measures and maintain up-to-date antivirus programs to prevent systems from malware.<h3 class="heading-node" id="f58e" style="text-align: justify">6. Secure Systems and Applications</h3>To add another layer of protection to the data, the providers must develop and maintain secure systems and applications. These systems and applications that are used as the storage of data for interaction must be updated regularly.<h3 class="heading-node" id="f835" style="text-align: justify">7. Restriction of Access</h3>The cardholders’ data are restricted to access by business need-to-know, and the sensitive data must be accurately documented and updated regularly.<h3 class="heading-node" id="bffa" style="text-align: justify">8. Unique Access ID</h3>Individual credentials and ID are assigned to each person with computer access to card holders’ data. Single access ID and password should not be used as it results in more vulnerability and slow response time.<h3 class="heading-node" id="57e9" style="text-align: justify">9. Restriction of Physical Access</h3>Card holders’ data must be physically stored in a secured location where any physical access is restricted. Physically written, typed, or digitally stored data must be secured in the room, and in case of any access, it should be added to the access logs.<h3 class="heading-node" id="7c0d" style="text-align: justify">10. Maintain Access Logs</h3>As mentioned in the previous requirement, all access to network resources and cardholder data must be tracked and monitored in the access logs. This proper record keeping and documentation must be maintained with utmost accuracy as it is related to sensitive data.<h3 class="heading-node" id="aecf" style="text-align: justify">11. Testing Security Systems and Processes</h3>Regularly testing/scanning security systems and processes result in less vulnerability as it involves many digital data, software programs/products, physical locations, etc.<h3 class="heading-node" id="625c" style="text-align: justify">12. Document Policies</h3>Document policies that address information security for all personnel must be maintained right from storing to transmitting/using data after POS.So, with these twelve requirements, PCI DSS comprises six objectives to ensure optimal security for merchants who accept, process, transmit, or store payment card information.<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2022/06/image-1.webp" alt="M2P Fintech" title="" id="jxi8l3syj" width="100%" height="253">With PCI DSS’s strong objectives and compliance requirements, the security of the payment industry is strengthened. These measures help and encourage data security and facilitate the adoption globally. So, hereby businesses that handle card payments need to be a part of this global payment card data security solution and focus on increasing the intensity to move forward by becoming ‘PCI DSS Complaint.’Look forward to our upcoming blogs as we uncover PCI SSC’s other standards such as PCI 3 DS, PA DSS, PCI PIN Security, and PCI SSF.<a class="link" href="https://m2pfintech.com/newsletter/">Subscribe</a>&nbsp;to our newsletter and get the latest fintech news, views, and insights, directly to your inbox.Follow us on&nbsp;<a class="link" href="https://www.linkedin.com/company/m2pfintech/mycompany/">LinkedIn</a>&nbsp;and&nbsp;<a class="link" href="https://twitter.com/m2pfintech">Twitter</a>&nbsp;for insightful fintech tales curated for curious minds like you.

PCI DSS: The Payments’ Armour

<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2022/05/Wordpress-main-.webp" alt="M2P Fintech" title="" width="100%" height="356">Know Your Customer/Know Your Client (KYC) is a mandatory process that verifies and authenticates a customer’s identity. All legal and financial institutions must validate their customers to prevent any illegal or fraudulent activities as per Reserve Bank of India’s norms.&nbsp; Under the guidance of the Prevention of Money Laundering Act, 2002 (PMLA), the RBI mandates that all banks and financial institutions implement KYC procedures.&nbsp; KYC starts with verifying Proof of Identity (POI) and the Proof of Address (POA) and by which banks, insurance companies, and other organizations obtain information and better understand their customers. It is applicable for both new and existing customers and is the first step in account creation or even to allow a transaction.&nbsp;<h2 class="heading-node" id="9083">Why is KYC mandatory?</h2>As per the Reserve Bank of India’s mandatory regulation, KYC came into legal effect in 2002. The RBI mandates that all financial and legal institutions should assess their customers.&nbsp; KYC’s objective is to help banks and other financial institutions to assess and validate their customers. An effective KYC alleviates and combats all illicit activities. A financial institution can identify potential threats, criminal, and other illegal activities while verifying the KYC required documents. In a nutshell, a financial institution or a business/corporate uses KYC for,&nbsp;<ul class="list-node" id="32oq3a921"><li>Building and Verifying a Customer’s Identity&nbsp;</li><li>Understanding Customer’s Activities&nbsp;</li><li>Evaluating the risks involved with the Customer’s Activities</li></ul><h2 class="heading-node" id="2ff5">How does KYC work?</h2>The KYC process is carried out seamlessly with the following simple steps:&nbsp;<ul class="list-node" id="pce88galo"><li>First, the applicant’s PAN/ AADHAR details are collected and validated.&nbsp;</li><li>The applicant further supports the information provided by entering the required details on the website.&nbsp;</li><li>The applicant’s document goes through various checks and authentication processes by the financial entity.&nbsp;</li><li>Once the documents are verified, and once named eligible, then the applicants are onboarded.&nbsp;&nbsp;</li></ul><h2 class="heading-node" id="23fe">Evolution of KYC</h2>Back in 2002, the Reserve Bank of India (RBI) made KYC a legal and mandatory procedure for all financial institutions, preventing misuse of the sensitive information held by banks and restricting money laundering activities. Evolving from a Paper-based physical attestation method to video adoption, KYC has come a long way. The paper-based KYC demands more physical input because of various document requirements. In contrast, the e-KYC makes the verification procedure less complicated by reducing the physical work of businesses and clients where the data is stored and verified entirely online.&nbsp;&nbsp; The e-KYC or paperless KYC verification procedure became more preferred by customers once the internet boomed. Now doing e-KYC is made even more accessible as the Government of India has launched Digi Locker under its Digital India initiative. It is a digital document wallet that helps its users to store authentic documents virtually and is highly secured by Aadhaar/OTP authentication.<h2 class="heading-node" id="5fbe">Types of KYC</h2><img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2022/05/Wordpress-03.webp" alt="M2P Fintech" title="" width="100%" height="284"><h3 class="heading-node" id="ympukq7zn">1. Aadhaar-based KYC</h3>Aadhaar-based KYC verification follows the regulations of The Unique Identification Authority of India (UIDAI) and verifies proof of identity and residence through one’s Aadhaar number. In addition, the UIDAI provides information to service providers to activate customer services such as bank accounts, mobile connections, etc.&nbsp; Every Aadhaar cardholder can quickly and easily complete their KYC process. Aadhaar based KYC is an efficient, paperless process that adheres with government standards.&nbsp; The Aadhaar based KYC authenticates data in two different ways:&nbsp; OTP-based  - The financial institution verifies the customers’ identity by triggering an OTP to their Aadhaar linked mobile number.&nbsp;&nbsp; Biometric-based  - For Identification and Verification, the financial institution uses the biometrics of the customer by using UIDAI (Unique Identification Authority of India) approved scanners.<h3 class="heading-node" id="ebxjgryx3">2. In-Person Verification (IPV) KYC</h3>The In-person KYC procedure was used by the Security and Exchange Board of India (SEBI) for mutual fund investors. Unlike the other prevalent methods, in-person verification requires the individual to undergo the process offline in an institution, KYC kiosk, or at an AMC. IPV has now upgraded their process via OTP mechanism.<h3 class="heading-node" id="31fd">3. Digital KYC</h3>It is a paperless process where a live photo of the client and their Aadhaar is verified and processed online. It also involves submitting the Official Valid Documents (OVD’s) such as Aadhaar, Pan Card, Passport or a Driver’s license.&nbsp; The digital KYC techniques have many advantages such as,&nbsp;<ul class="list-node" id="pewatsdgk"><li>The customer’s identity verification happens in real-time,&nbsp;</li><li>The process is flexible because the customer can use any of the OVDs,&nbsp;</li><li>The process is highly secure and efficient due to privacy laws and the usage of AI technology.&nbsp;</li></ul><h3 class="heading-node" id="0da4">4. Video KYC</h3>RBI allowed the usage of Video KYC in 2020 due to the pandemic constraints. Video KYC is a procedure that verifies details of the client in a video-based process. This process involves an auditor and an agent for authentication and audit. Before establishing an account-based relationship, the agent collects the details using video-audio features and AI technology. The process is smoothened by usage of a number placard that helps authenticating the customer.&nbsp;&nbsp; Video KYC is available as:&nbsp;<ul class="list-node" id="dd9lh3yyz"><li>VCIP - Video-based Customer Identification Process&nbsp;</li><li>VIPV - Video-based In-Person Verification&nbsp;</li><li>VBIP - Video-based Identification Process&nbsp;</li></ul>&nbsp;It employs a trained individual’s audio-video interaction and automated verification methods such as geo-tagging and facial matching.&nbsp;<h3 class="heading-node" id="4d8e">5.&nbsp;Central KYC (CKYC)</h3>CKYC is a customer or financial institution submitting a Central KYC form and proof of identity and proof of address that relies on the central repository of customer records for CERSAI (Central Registry of Securitization Asset Reconstruction and Security Interest of India). The process detects any duplicate accounts and mitigates other risks.&nbsp; The C-KYC identifier is a 14-digit unique identifier assigned to a client when they upload their details for KYC. When a client opens an account without C-KYC, it may require them to repeat the whole process. But this 14-digit identifier removes that need, and the customer can use this number to update their information throughout all their accounts uniformly.<h3 class="heading-node" id="4feb">6. In-app KYC&nbsp;</h3>This KYC process brings out easy and hassle-free experiences to the customers. All the verification process happens with the help of a smartphone, where the clients can conveniently carry out bank transactions, open bank accounts, and other banking operations.&nbsp; The clients need to use their smartphones to verify their IDs or passport and begin the KYC process. The KYC also involves real-time scanning of IDs to prevent identity forgeries. It is highly secure due to the deployment of secure technologies.<h3 class="heading-node" id="a37c">7. Offline KYC</h3>Offline KYC requires the submission of all the necessary physical documents for verification. It requires filling in all the required details like Aadhaar and PAN. After this, the client must visit a nearby KRA to complete the process and receive an official application number to identify and continue the verification process. Or an agent is sent to the customer’s place to collect documents for KYC verification.<h2 class="heading-node" id="649c">So, what is KRA?</h2>KRAs are KYC Registration Agencies that maintain the SEBI (Security and Exchange Board of India) registered companies records under the KYC regulations Act, 2011. To bring uniformity and avoid duplicate KYC processes, this KRAs help regulate the KYC process that allows a company to authenticate its clients and offer better customer service.&nbsp; Five different agencies that work as KRAs in India are:&nbsp;&nbsp;<ul class="list-node" id="83rt2nv4f"><li>CVL KRA&nbsp;</li><li>CAMS KRA (Computer Age Management Services Pvt Ltd.)&nbsp;</li><li>NSDL KRA (National Securities Depository Ltd)&nbsp;</li><li>Karvy KRA (Karvy Data Management Services)&nbsp;</li><li>NSE KRA (National Stock Exchange)&nbsp;</li></ul>To conclude, KYC has evolved over the years from physical forms to real-time AI technology verification methods. KYC satisfies and provides a hassle-free experience to the customers and helps financial service providers establish a smooth relationship. If you wish to implement a robust KYC system, check out our blog on <a class="link" href="https://m2pfintech.com/blog/crack-the-kyc-jigsaw-ease-onboarding-compliance/">How to Crack the KYC Implementation.</a><a class="link" href="https://m2pfintech.com/newsletter/">Subscribe</a>&nbsp;to our newsletter and get the latest fintech news, views, and insights, directly to your inbox. Follow us on&nbsp;<a class="link" href="https://www.linkedin.com/company/m2pfintech/mycompany/">LinkedIn</a>&nbsp;and&nbsp;<a class="link" href="https://twitter.com/m2pfintech">Twitter</a>&nbsp;for insightful fintech tales curated for curious minds like you.