Proof Of Address: The Invasive Species Of KYC

Today, proof of address is a requirement for accessing formal financial institutions in most places. For customers in Western countries, where addresses have long been formalized, this may not pose a problem. But what about a tribesman in Uganda seeking a loan?

For many in developing markets, including some 300 million people living in Sub-Saharan Africa, not having documentation confirming their address serves as an incredible impediment to accessing formal institutions. Proof of address was once a novel know-your-customer (KYC) method — 50 years ago. In the digital age, this paper-based verification mechanism has proven not only woefully inadequate as a robust identifier, but prone to fraud and overzealous “de-risking.”

Western Fears Drive Eastern Exclusion

In over 180 countries, banking institutions follow guidelines set by the Financial Action Task Force (FATF), an intergovernmental organization founded by the G7 in 1989 originally to curb money laundering and later to counter the financing of terrorism. Revised over the years to accommodate for changing financial dynamics and issues, these guidelines demand banking institutions properly identify potential customers to ensure they are not facilitating money laundering or terrorism financing.

The FATF guidelines are worded to allow interpretation and more flexible adaptation on a regional basis. But in this same period, proof of address requirements spread from Western nations to the greater world as one of several core KYC methods — despite the fact that FATF guidelines never mention them. Proof of address requirements originated with the U.S.’s 1970 Bank Secrecy Act, which sought to fight money laundering.

After 9/11, this focus expanded to include counter terrorism financing (CTF). Viewing partner institutions in developing countries that require fewer KYC requirements as potential conduits for illicit financial activities, Western financial institutions have increasingly imposed their regulatory will on countries and partner institutions in the developing world, threatening to sever relations with all financial institutions in high-risk countries if they do not adopt the same KYC requirements, including proof of address. Like an invasive species, proof of address came to dominate financial regimes in countries often ill-equipped to provide such documentation — leaving millions unable to access financial institutions.

Countries like DRC and Tanzania, where little more than 10 percent of the population have an ID and proof of address, have thus failed to bring large swaths of the unbanked within the sphere of formal institutions. And for countries and banks that fail to sufficiently adopt proof of address requirements, like Somalia, sanctions cut them off from Western financial institutions because they are deemed a risk.

According to the Centre for Financial Regulation and Inclusion (CENFRI), instances of “de-risking” client bases have largely occurred not at the high end of the financial scale, but among more marginal accounts that are easier to shed and may even help the bottom line. Proof of address requirements hit migrant laborers particularly hard; remittances through formal channels have plummeted in many countries, with DRC seeing formal remittances dropping from $100 million to only $5 million, for example. Unable to meet such requirements, migrants simply use informal channels — rendering such transactions less transparent, not more as needed. Proof of address requirements have also proved problematic for refugees who often have no form of identification or move on from the camps that they were originally registered in.

To deal with the lack of proof of address documents, many countries like Nigeria have adopted tiered levels of financial access, with applicants who cannot provide proof of address able to access very limited financial services. To aid the refugee conundrum, Jordan allows refugees with UNHCR-supported ID documents to open a basic bank account, though with few additional financial services available. Germany’s laws make clear that UNHCR identity documents are sufficient for refugees to open German bank accounts as well, but according to FSD Africa, the banks themselves, worried about facing sanctions for facilitating money laundering, have slow-walked allowing refugees to use financial services.

Deviate At Your Own Risk

Waves of “de-risking” – in which either partner institutions terminate relationships with all banks in certain countries deemed to have insufficient KYC processes such as proof of address or banks in developing countries apply a “zero-risk” criteria to potential applicants that exclude entire classes of applicants — have ebbed and flowed often with terrorism-related incidents. But with increasing recognition of the incredible financial exclusion of proof of address requirements, some voices, like CENFRI, are evangelizing against proof of address requirements as one of several traditional KYC methods and, in turn, the Western regulators and financial institutions threatening crippling sanctions on partner institutions that don’t fall in line.

Though “de-risking” is intended as an anti-money laundering (AML) and CTF measure, all the evidence — and frankly, common sense — suggests that such measures simply push illicit financial operations towards informal channels that can’t be monitored as easily. FSD Africa described how illicit organizations cross borders to countries where it’s easier to carry out transactions, or utilize digital methods or prepaid cards, as terrorists in France did in 2015.

“If you cut people out of the system, they don’t go in a corner and die somewhere,” said Barry Cooper, Technical Director at CENFRI. “They continue to transact, but in the informal system or in the formal system while undermining it. You either deal with people, or you start incentivizing a bad culture of non-compliance and circumvention.”

Working within this broken system, Suyo is one organization that seeks to secure property rights of families in Latin America, working to formalize property ownership especially among indigenous populations. Research in the region has shown that people who secure property rights experience a 12 percent increase in loan approval rates and a 150 percent increase in annual family income, so Suyo’s efforts clearly have its merits — but for those who lack such assistance, the structural barriers remain.

Even in developing countries where proof of address laws are not in place, Western banks sometimes force individual financial institutions to adopt the ill-fitting requirements. In the West Bank, where terrorism financing poses a large risk, regulators closely implemented the 40 recommendations FATF gave in 2012 (such as ongoing customer due diligence and rigrous record-keeping) which simply omitted onerous proof of address requirements as they had little value add as a KYC tool. Instead, by observing Recommendation 10 of the FATF guidelines which mandates customer due-diligence and record-keeping under a risk-based approach, Palestinian regulators endeavor to identify and verify customer’s identity — which can be done simply with their government-issued “green IDs” — and flag any large or suspicious transactions made by their clients.

But the picture on the ground tells a slightly different story. Last year, a U.S court overthrew a previous verdict holding Arab Bank liable for facilitating terrorism financing through Hamas. In conversations with Mondato, employees at an Arab Bank branch in Ramallah said the bank has instituted proof of address requirements in the past six months after international partner institutions threatened to cut ties because of the case. This has caused issues for Bedouins seeking financial services in the area that lack formal addresses. The bank in turn has accepted handwritten letters from tribal leaders as sufficient.

“What often happens is that in developed markets, where proof of address is potentially a valid identifier, there’s a contagion from developed markets to undeveloped markets. The contagion is a knee jerk reaction found in the bank compliance environment particularly, where they just de-risk wholesale.” - Barry Cooper, Technical Director at CENFRI

What results is confusion from clients and even bank employees regarding where these proof of address requirements are coming from. Arab Bank employees mistakenly believed such proof of address requirements came from the Palestinian Authority, not the demands of outside partner institutions. Cooper said in South Africa, where CENFRI’s efforts have contributed to the government greatly easing proof of address requirements, “if you go to any branch in South Africa and tell them you don’t need proof of address, they will throw you out of the branch. They will be convinced it is part of the regulation.” The internal decision-making of banks, essentially, is obscuring not only the harmful exclusionary effects of these requirements, but where they are even coming from.

Reprioritizing Effectiveness Over Compliance

Though done ostensibly in the spirit of fighting money-laundering and terrorism financing, de-risking has been condemned by the FATF several times. To counter this, in 2012, the FATF’s guidelines were amended to emphasize a risk-based approach (RBA) as an “essential foundation” of a country’s anti-money laundering (AML) and counter terrorism financing (CTF) framework. A RBA, according to the FATF, “allows countries, within the framework of the FATF requirements, to adopt a more flexible set of measures in order to target their resources more effectively and apply preventive measures that are commensurate to the nature of risks, in order to focus their efforts in the most effective way.”

The FATF’s RBA approach empowers countries to tailor their AML and CFT rules to reflect the particular nature and maturity of their financial sector and to better mirror its risk profile. It isn’t a matter of ticking off boxes of standardized compliance, as some Western institutions are demanding of partners, but seeking to both minimize risk — though accepting that some risk will remain — and expand financial access. RBA offers a sea change in regulatory philosophy from compliance to effectiveness.

Under a risk-based approach, more innovative, locally tailored solutions, often utilizing emerging technology, can be deployed to verify client identity in a far more robust manner than paper-based documentation ever could. Regulations allowing basic financial access even without proof of address in a tiered system are in the spirt of RBA, but they still severely limit wide swaths of people from most financial services. Instead, many industry insiders see biometric verification as the trend to watch that will bring the unbanked out of the shadows in the years to come, addressing the issues of fraud and exclusion that came with traditional forms of ID or proof of address via paper documents.

Though heralded with promise, biometric verification has been implemented to varying degrees of success, according to FSD Africa’s April 2017 report. In India, the national digital identity card, Aadhaar, has registered over one billion Indians, enabling the provision of financial services to be “a commercial decision, not one driven by questions of identity.” While it has delayed implementation, the Indian government is also seeking to use Aadhaar to extend inclusive KYC oversight over digital payment companies — the next great challenge in AML and CTF efforts — as well.

Nigeria, by contrast, has so far failed to implement a biometric digital identity card that’s reached the masses, with only 3 or 4 percent of the population having a valid NIMC card nine years after it was established, leading many of the unbanked to rely on identity services of lesser quality or seek letters from community leaders. Replicating more successful examples of biometric implementation, like in India or Kenya, will be critical if the promise is to become reality.

But striving to include the previously unbanked — including by forgoing antiquated proof of address requirements — allows banks to incorporate technology like artificial intelligence to monitor clients and financial transactions and detect abnormal behavior suggestive of money laundering or terrorism financing. Fintech and Regtech innovations are taking the thinking out of it and are refusing to espouse the 'cut and paste' approach found in de-risking.

De-risking efforts essentially portray financial inclusion and financial integrity (i.e. that transactions facilitated are legitimate and above board) as at odds with each other. But if Western financial institutions can overcome misplaced fears and both eliminate proof of address and embrace biometrics and artificial technology that better detect transactional abnormalities, it will soon become apparent to them that financial inclusion and financial integrity are, in fact, one and the same.