Adapting KYC (Know Your Customer) procedure to GDPR

Whenever a business goes through the process of onboarding a new user or client, a know-your-customer procedure is mandatory.

Companies ask for physical documents that prove the user’s identity, like passports or titles to residential property. This helps reduce the risk of fraud and other illegal intentions.

KYC procedures come at the expense of the user’s privacy, but the need for such procedures is at an all-time high. However, businesses onboarding new clients and users are now faced with a different kind of adversary, one that demands rigorous adjustments and threatens draconian fines to those who deviate from strict new rules.

We’re talking about the GDPR, of course.

As anticipated, the GDPR began causing turmoil in the business world almost immediately. Literally overnight, the legislation went from being a distant, down-the-line peril to a thing of harsh, everyday reality.

Business experts predicted that KYC procedures would be difficult to define and implement. Now that the legislation is enforceable, we can say with certainty that the hype concerning GDPR and KYC was warranted.

Organizations that carry out identity checks of any kind must now radically change their procedures.

Companies obviously still have the right (and the need) to be certain who they are dealing with, so KYC is not disappearing. However, GDPR rules mean that businesses must make major adjustments to the way they gather, store, and manage KYC data.

What GDPR means for KYC

KYC procedures are essential anti-money-laundering and risk management instruments when implemented well. The problem is that too many companies have grown accustomed to finding shortcuts and workarounds in how they collect, manage, and store KYC data.

Companies seeking GDPR compliance will have to make sure their onboarding processes now function differently in numerous regards. For starters, they will have to make sure of the following:

• Processes of obtaining, filing, and managing data must be completely transparent.
• Companies must clearly define which data they need from the user, and for what ends.
• Companies must keep a clear record of all the data in their possession.
• Users must be able to delete all or some of the data in corporate possession.
• Data must be portable, meaning that users can easily transport information from one organization to another.
• Users must be swiftly notified if their information is compromised in any way.

In addition to these relatively simple revisions, two major modifications must be made for a company to find itself in the GDPR-compliant column: drastically improved security and increased use of automation.

Improving security for KYC data

Raising the level of data security can be seen as the be-all, end-all of the GDPR, so it’s hardly surprising that the law places a strong emphasis on protecting KYC data.

While the GDPR does not lay down clear-cut instructions of what specific types of protection must be employed, environments that allow employees to inadvertently store data in a public cloud, use personal devices at work, or take sensitive data home must become a thing of the past.

Increased use of automation

In the old days, it was simple to toss a dozen photocopied passports into a file cabinet and consider KYC requirements met. The digital age requires considerably more. Companies store more data and the GDPR requires new ways of ensuring it isn’t inappropriately shared, maintained, stolen, or altered. This represents a heavy burden for those in charge of administering the data.

Automating data gathering, monitoring, storing, and managing processes will be crucial to achieving compliance with the new law.

Automation will not only bring a much-needed overhaul to everyday protocols, but it can lower the risk of data compromise and manipulation while minimizing damage caused by employee errors.

The solution for companies most dependent on KYC

Since KYC procedures are intended to guard against identity theft and money laundering, it’s hardly surprising that the companies that depend on these procedures the most are spread across the financial sector.

These companies manage and manipulate an astonishing amount of data on a daily basis, serving as the financial blood vessels of our society. They are the ones with the hardest job at hand when it comes to adapting KYC systems to meet GDPR requirements.

Wouldn’t it be nice if there were shortcut companies could take, one that scales up to banks and the greater obstacles they face?

What if there were a piece of software that is both completely GDPR-compliant and capable of enhancing KYC procedures — even able to take them to a whole new level?

That is what Blinking is all about.

Running on a Hyperledger Fabric blockchain framework, Blinking is a multi-factor identity-management system that empowers users to be the sole owners of their personal information and, in the process, gives companies a blueprint for an ideal KYC procedure.

Companies using Blinking’s KYC module can allow customers to create their own profiles of personal information, which are stored on a secure private blockchain. They are then free to use these profiles in a wide assortment of functions. Customers (or, better yet at this point, data owners) can edit and delete data, grant or revoke access to information, purchase services, move information from one data holder to another, and so on.

With Blinking, data owners are responsible for collecting and managing the information that is stored on the private blockchain, leaving companies without the risk of violating any privacy policy.

Raising the bar of KYC processes with Blinking

In an exemplary KYC scenario, a business would be able to know without a shred of the doubt precisely who the client or customer behind every transaction is. Well, with Blinking, that’s exactly what you get.

Companies using Blinking are granted sure knowledge of precisely who their customers are — without the risk of being wrong about their identities. That’s because Blinking goes beyond poorly secured username/password combinations. Instead, it’s based on biometrics.

A biometrics scan (a face or finger scan, for instance) is required for accessing and using a Blinking profile, so there’s no way an unauthorized individual can access a user’s information. In other words, organizations that use Blinking can rest assured that their clients are always who they say they are.

Biometrics is at the very core of why Blinking is such a valuable tool in improving KYC and aligning with the GDPR. With it, there’s no more need to ask for passports or other physical proof of identity, exposing your company to potential privacy violations. Instead, the organization knows who the user is because of Blinking verification.

Better yet, the blockchain system running Blinking can be custom-built around the organization’s specific KYC needs in order to meet whatever special requirements the company might have.

Rounding up the KYC benefits of implementing Blinking

Blinking solves the two biggest GDPR-related issues concerning KYC by enabling high-security levels and automating protocols previously managed manually. The latter is achieved by empowering users to handle and manage much of their own data.

Blinking solves many additional GDPR compliance issues as well. Users are able to move, edit, and delete their own data. They’re in charge of granting and revoking access to it. Processes related to using and storing information are totally transparent. Data owners are always notified when and why their data is being processed. And much more.

Plus, companies that implement Blinking will be part of the same blockchain. This means the companies enjoy the benefit of sharing the same customer information network, which is both completely GDPR-compliant and a notable KYC advantage.

Blinking, a GDPR-friendly KYC enabler

Blinking’s ability to upgrade KYC protocols is a game-changer in data security, especially when you consider the GDPR storm that’s currently engulfing businesses around the world.

Blinking’s KYC module is an opportunity to implement a GDPR-friendly KYC procedure designed in a way that protects users’ individual data, improves KYC protocols by minimizing risks and automating processes, and helps firms avoid potential GDPR lawsuits in the process.