Identity fraud: Thinking outside the box for our clients
When it comes to private clients and wealth management, compliance is paramount for safeguarding assets, maintaining trust, and protecting our reputation as a top-tier firm.
Due diligence in Guernsey
Each jurisdiction has specific requirements for certifying due diligence documents. In Guernsey, the Guernsey Financial Services Commission (GFSC) promotes exceptionally high standards, as evidenced by this area comprising of an entire chapter within their Handbook on Countering Financial Crime (AML/CFT/CPF).
While the GFSC does not prescribe specific wording for certifiers, it mandates that firms ensure certain factors are included in the certification. Omitting these can result in the document failing to meet acceptable standards. This would require any issues to be corrected, likely resulting in delays and additional charges. Certification can be done in ‘wet ink’ – where documents are physically certified by a deemed suitable person – or electronically. For electronic verification, the GFSC requires that the system used meets the same standard as a wet signature, and they may review systems anytime. If the GFSC identifies any shortfalls in their review, there can be significant consequences for the service provider, including fines.
Both methods require individuals to find a suitable certifier. While many high-net-worth individuals have access to lawyers and accountants who can perform this function, not all clients do, which can present additional challenges for them. As service providers increasingly seek to become paperless to support global sustainable development goals, there is a growing move in the financial technology (“FinTech”) and regulatory technology (“RegTech”) sectors towards electronic verification as an alternative to an in-person process with a suitable certifier.
However, these platforms introduce new risks, such as fraud and artificial intelligence/deepfake abuse. Guernsey-regulated firms must ensure the technology meets local regulatory standards and has robust controls.
Saffery Trust Guernsey is currently exploring service providers for electronic identity verification checks utilising online platforms, that will meet these high standards.
Client enquiry
Our Guernsey Digital Asset Team were approached by a potential client seeking a service provider to support them in issuing approximately 150 grant payments per month. Knowing that our current process would require individuals to seek out suitable certifiers to verify the identity documents of every grantee, who were located around the world, our team recognised that this presented a significant challenge for the client.
With the independence to partner with any service provider for the benefit of our clients, our team set out to find a platform that would allow identification documents to be verified online.
Testing process
The team’s search led to a promising option. Saffery Trust Associate Director Nicky Kendall explained: “After finding a provider who appeared to offer what we needed, we wanted to test their system’s robustness. We requested a test platform and initiated a thorough evaluation process, led by Officer Katie Latham, in which we actively tried to trick the system into accepted invalid documents.”
The team experimented with different types of documentation and varied their approach several times to test what the system would – or would not – pick up. Initially, the testing process revealed some areas for improvement, but nothing significant. However, as the team became more creative in their testing, they uncovered a key vulnerability.
Nicky continued: “We pushed the limit in our testing by uploading a genuine passport of Manager Rory Jones along with a selfie of Associate Director Simon Murphy. Although Rory and Simon look alike, they are not similar enough to be mistaken for the same person, but we wanted to be sure that the platform would pick this up.”
“The system flagged an error with the images, triggering a manual verification process. To our surprise, this stage approved the passport and selfie as belonging to the same individual. This indicated that we could not trust the system’s accuracy and decided not to proceed with this verification platform.”
Man vs machine
The testing process highlighted an interesting consequence for our team; the technology of the platform had worked accurately to flag an inconsistency between the images provided, while the human intervention resulted in the failure.
Nicky commented: “For decades, wet signatures have been considered the gold standard for reliability, as they provide a tangible and verifiable proof of authenticity by a professional. However, in our testing we found that the technology used was more reliable. As technologies continue to advance, it is likely that they will be deemed even more secure and efficient, ultimately surpassing traditional methods.”
E-passports
The testing process for this provider also alerted our team to the enhanced security provided by e-passports. First introduced in the early 2000s, e-passports contain an electronic chip that holds the same information that is printed and are now widely used globally.
In testing this platform, our team identified that the system was not utilising technology to read these electronic chips. “Some of the attempts we made to trick the system would have been easily identified if the chip was being read as part of the process. This has helped us in our search as we are now able to focus on providers who offer this service, which we deem to be an essential part of any verification platform,” said Nicky.
Compliance
We take our responsibility to ensure the integrity of our compliance processes seriously. Saffery Trust Compliance Manger, Sophie Walden, commented: “This requires being inquisitive and not taking anything at face value. The testing process of this system, and the collaborative working between our team members, showcases the lengths and breadths that we go to in maintaining the highest possible standards.”
“In this case, the system did not meet our internal standards and would have opened us up to unnecessary risks of things like fraud which may ultimately impact our clients as much as it may impact us. We remain committed to finding a suitable platform that will enhance our client journey, while ensuring we meet the standards expected of us as a regulated fiduciary.”
