introduction
Know-Your-Customer (KYC) is an industry standard practice of trying to verify the identity of users in a system. KYC is so popular in the financial sector because of how sensitive handling money could be. Banks for example want to make sure that customer funds and transactions are safe. So each time a transaction is initiated by a customer, some aspects of KYC is performed in order to establish that the right person is authorizing a transaction.
While the idea of proving ones identity to secure a transaction is not wrong, a lot could go wrong with how personal data is collected and stored. With privacy a big issue in the digital space today, one needs to be sure that KYC procedures in traditional finance is not endangering their privacy.
Before we look at some of the privacy issues that are associated with KYC procedures, below are some of the standard protocols of KYC in traditional financial institutions.
Standard KYC procedures in traditional finance
So James is ready to open a bank account to start making savings and other transactions. He lives in a developing economy like Nigeria. James stepped into a bank branch in his city and meets bank representatives to let them know he wants to open a bank account.
Below are some KYC procedures he would be put through:
Fill a form providing personal data including official names, address, email, phone numbers, next-of-kin, state of origin, signature and other data.
Provide a recent passport-size photograph
Provides a utility bill for verification of address
Provide official identification documents like a government issued ID card
Provide his biometrics through a finger print scanner.
After providing the personal data above in paper and other forms, a bank official gets to work with them. He inputs data from the account opening form into the system. He scans the passport, ID card, utility bill and uploads them into the bank server. Once everything is processed, the customer now has a bank account and is happy.
While the customer leaves the bank, he has effectively handed over his personal data to the bank and complied with KYC. At the point, the bank remains in full control of it. A lot could go wrong from here.
KYC endangers user privacy
While the KYC procedure described above looks harmless, it can lead to loss of personal data - and even loss of assets. Consider the various ways it could all go wrong.
How does the bank handle registration forms?
Remember James our friend filled the bank account opening form with sensitive personal data like phone numbers and address. No the form has served its purpose of data collection. Perhaps, thousands of other new customers filled the form too. The important question is: How does the bank do with these forms once the job is done? How are these forms disposed? consider a few possibilities.
1. Paper Recycling:
Many banks have standard ways of handling the forms. But what if a bank simply disposes such papers in waste dumps, or sends them to a paper recycling company which is the banks partner? Well the guy operating the paper shredding machine might suddenly be in possession of sensitive bank customer data from the forms supplied by the bank. He could decide to take some of the papers home, share them with friends, or even make electronic copies. Now someone's personal data has ended up in the wrong hands.
2. Public paper dumps
Or if the bank simply sends the paper to the city dump site. Well, this is even more dangerous. There are professional dumpsters that specialize in roaming deep inside paper dumps, looking for sensitive personal data to steal. If such criminals come across such bank papers, a customers personal data would have been exposed to criminals.
The point is clear from the above scenarios that how financial institutions handle paper forms containing sensitive personal data could be the first step towards endangering privacy of data and could end up in massive loss.
Impersonation could result from improperly disposing financial records in paper. Dumpsters and other criminals look for a way to lay hands on such personal data. They could use it to try to hack into a bank account, or use the data stolen to commit fraud or other crimes.
Customers of traditional financial institutions have the right to enquire how their institution handles sensitive data and ensure they have a robust policy for data protection and document disposal. This way, they are confident that their personal data is not being handled in a way that endangers privacy.
How does the bank store your data
After James filled the forms and provided the other KYC documents, they were all reproduced in soft copies and uploaded into the bank server. While this has been a standard way for most institutions to store user data, it could also come with risks. Consider what could go wrong there:
Centralized storage is prone to hacking
Hackers are becoming more sophisticated with each passing day. Even the most secure systems have been breached. The number of technology hacks continue to increase. So having customer sensitive data sit on servers maintained by these financial institutions or other third-party might pose risks to privacy.
Hackers could break into such a centralized data store and steal data of users. When this happen, the customer privacy which was supposed to be guaranteed by KYC has now been endangered by it. This happens a lot and so users need to understand the risks and ask for a better handling from their financial institution.
Sharing data with third-parties
Financial institutions often provide other services that are not money-related. Hence, they have lots of partners. For example, a bank might sell airtime, cinema tickets, data and other services. These third-party service providers often ask for user data from the bank. While sharing of data with third-parties might enhance the services enjoyed by the user, it could pose risks too.
The third-party might not have a secure data management policy and user data could thus end up in the wrong hands. Such third parties might equally share the data with their own business partners and as such, privacy continues to be risked.
The worst is that user data might be sold to digital marketing platforms for targeted advertising. This is often the case even when such organizations promise that they are not exposing your data to third-parties, they actually do so directly or indirectly. The huge amount of unsolicited mail and SMS marketing campaigns received by many users is no thanks to loose data management policies and KYC procedures by some finance institutions.
Finally
For now, we seem not to be able to completely avoid KYC in traditional finance. But as a user, you need to be aware of situations or procedures that could endanger your privacy. Everyone has the right to demand better handling of their data by financial institutions.
The best yet is to adopt web3 if it provides alternative services that are offered by traditional finance. Web3 ensures full data ownership and security. KYC procedures are important for fighting crime. But if care is not taken, they could end up making someone a crime victim with poor data management procedures.