Differences in Risk Between Dealflo and Traditional esign Providers

Transcription

1 Differences in Risk Between Dealflo and Traditional esign Providers

2 Glossary of Terms Term Meaning EAP Electronic Agreement Processing DEALFLO DEALFLO Ltd ID&V Electronic Identity Verification Contents Reference:... 3 DRITEP Date /12/ Version Introduction Inability to prove it was the actual customer who signed the contract Inability to prove which documents a customer signed Integrity Connection... 4 Non-compliant Configuration... 5 Compliant Configuration Inability to prove the customer actually saw the contract prior to signing Inability to show what the customer did during signing Conclusion Appendix A - Regulatory Context re. ID&V for esigned Agreements UK Governmental Guidelines Sept Expert Legal Opinion: Lorna Brazell Expert Legal Opinion: Jonathan Guest Case Law: Shogun Finance vs. Husdson Appendix B - DEALFLO ID&V Services DEALFLO Verification Hub ID&V Evidence Types: Workflow Client Benefits

3 Document History Reference: DRITEP Date 15/12/15 Version 1.2 3

4 1. Introduction The purpose of this document is to identify and explain the main differences in risk between the leading traditional esign provider offerings and the DEALFLO service. It is specifically aimed at clients within the banking, finance and insurance sectors. There are three main risks for consideration: 1. Inability to prove it was the actual customer who signed the contract 2. Inability to prove which documents a customer signed 3. Inability to prove the customer actually saw the contract prior to signing 4. Inability to show what the customer did during signing Any one or combination of these risks could result in an agreement being rendered unenforceable. The wider risk, should this prove to be the case, is that all other agreements executed in the same way, could then be open to repudiation. 1.1 Inability to prove it was the actual customer who signed the contract In the case of a click-to-sign agreement, steps must be taken to establish that it was the customer who signed (and not, for example, a salesperson). In order to do this, some kind of authentication mechanism such as knowledge-based-authentication (KBA), must be built into the actual contract signing workflow. In the case where the esign provider does not provide such authentication and the KBA occurs outside of the contract signing (eg. prior or post), then the lender is unable to prove that it was the customer themselves who signed and not, for example, the salesperson. The DEALFLO service is able to embed customer authentication (eg. KBA) within the contract signing process establishing the customer as the signing party. 1.2 Inability to prove which documents a customer signed In order to prove which documents a customer signed, the lender must be able to do effectively demonstrate two things: 1. That the supporting ID evidence could not have changed, by accident or design (ie. that it has integrity) 2. That the signed agreement has a unique and provable connection to the customer s authenticated ID and no other ID Integrity Data integrity in a legal sense can only be achieved through use of a digital signature (a tamper evident seal). If at any point the ID evidential data were accessible by an interested party to the contract (either lender or borrower) before being digitally-signed, the integrity of that data cannot subsequently be proven in a court Connection Proving the connection between the signed agreement and the customer s ID can only be achieved if the ID evidence and the signed agreement form part of a single, digitally-signed package. Traditional esign companies do not produce or digitally sign ID authentication data, nor do they embed it into the agreement to form a single, digitally signed evidential package. The approach has been to 4

5 receive ID data from a third party (often the lender), then to link it to the agreement by means of a reference number. This does not, however, conclusively prove a unique connection since (a) there could be other types of evidence with the same reference number, and (b) the ID evidence has not been digitally signed Consider the two following scenarios: Non-compliant Configuration In this configuration ID&V evidential data is accessible by the Lender before it has been digitally-signed (rendered tamper evident) within DEALFLO. This means that unlike the other evidence pertaining to the contract, the ID&V data is repudiable. Compliant Configuration In this configuration ID&V evidential data is not accessible by any interested party (ie. lender or customer), until after it has been digitally-signed (rendered tamper evident) within DEALFLO. This means 5

6 that like all the other evidence pertaining to the contract, the ID&V data now has pervasive integrity and is non-repudiable 1.3 Inability to prove the customer actually saw the contract prior to signing Both DEALFLO and the traditional esign providers display the contract to be signed within the browser. The contract is rendered in two distinct components: 1. The agreement itself 2. The signing blocks The file size of the agreement tends to be considerably larger than that of the signing block. The implication is that the signing block loads faster. With a fast internet connection, this distinction is not visible the two load virtually simultaneously. Where connections are slower however, the signing block may be visible before the agreement. In the case of the traditional esign providers, under these circumstances, the signing block can be clicked (and the agreement signed), before the agreement downloads and is visible on the screen. As the customer connection speeds are typically not in the control of the lender or esign provider and are not recorded, it is technically impossible to prove that a customer saw the agreement prior to signing. The DEALFLO service, by contrast, has been designed to prevent the signing block from appearing until the agreement is fully downloaded meaning the lender can always prove a customer actually saw the agreement they signed. 1.4 Inability to show what the customer did during signing Traditional esign providers offer a written record of the key actions undertaken by the signing parties to a contract. Whilst this is useful evidence, it does not enable a lender to replay everything the signing parties saw and did during the agreement process. In addition to provision of the written record, the DEALFLO service records the screens and key actions undertaken by signing parties such they can be replayed in the event of dispute. Such visual evidence is much less open to interpretation by a customer or a court and serves as a highly efficient mechanism by which the lender can establish correct procedural adherence to both customers and regulators alike. Note DEALFLO Replayer evidence is the most often requested evidence type by our clients. 6

7 2. Conclusion The DEALFLO service has been designed specifically for higher risk financial transactions with an increased focus on security, compliance and enforceability. It is, as such, uniquely able to mitigate against the risks identified here, amongst others. Risk Risk mitigation Provision of risk mitigation Dealflo Systems Traditional esign Providers Inability to prove it was the actual customer who signed the contract Inability to prove which documents a customer signed Inability to prove the customer actually saw the contract prior to signing ID authentication checks (eg. KBA) available and embedded into signing process ID evidence embedded into document to form single, digitallysigned, tamper-evident evidence pack Customer forced to see before they sign Inability to show what the customer did during signing Customer screens / key actions recorded and re-playable. 7

8 3. Appendix A - Regulatory Context re. ID&V for esigned Agreements 3.1 UK Governmental Guidelines Sept 2014 High value or more important transactions need better quality electronic signatures - signatures used for these transactions need to be more securely linked to the owner in order to provide the level of assurance needed and to ensure trust in the underlying system. Better quality electronic signatures can offer: - Authentication linking the originator to the information - Integrity allowing any changes to the information provided to be detected more easily - Non-repudiation ensuring satisfaction (in a legal sense) about where the electronic signature has come from 3.2 Expert Legal Opinion: Lorna Brazell Lorna Brazell, Partner, Osbourne Clarke: the UK s leading expert on e-signature law and e-contract enforceability. Author: Electronic Signatures, and Identities Bird & Bird, 2008; Evidential Pit-Traps in Electronic Transactions, Bird & Bird, 2007; Analysis of a Proposed Online Contracting Process Possible Evidential Shortcomings, Bird & Bird, 2008; Electronic Identity Verification Legal issues surrounding the identity of a contracting party, Bird & Bird, 2008 The stored [ID&V] record should also be as obsolescence-proof as possible, such that it can be both retained and retrieved over a potentially lengthy period of time. Digital signature will enable the integrity of the stored material to be proved, since it is all but impossible to alter a digitally signed record without the fact of alteration being detectable, but this will be of limited use if it is no longer capable of being read. Finally independence of the [ID&V] transaction records from the party subsequently relying upon the signature may further support the credibility of the evidence by removing any realistic possibility of tampering after the event, since the party holding the record would have no personal interest in influencing the outcome of a dispute. 1 Provided that the records have been captured accurately, which could be established by for instance ensuring that all parties had identical copies while the transaction was still fresh in the mind, a digitally signed copy incorporating all of the information needed to verify the content of the transaction and the intent of the parties in entering it - agreement, signature and surrounding context - should only very exceptionally be open to future challenge. The closer such a record appears to the paper based equivalent long familiar to the courts, the higher its chances of acceptance. Where electronic documents are concerned, the best that can be done is to provide an audit trail of records as to what was done to the document to create it, to retain it as a permanent record, and how any document has subsequently been accessed, when and by whom. To minimise the complexity of 1 Evidential Pit-Traps in Electronic Transactions, Bird & Bird 8

9 the resulting evidence, the complete set of information comprising the signature process should be retained as a single document, preferably digitally signed, so that only a single audit trail is required. Lorna Brazell, Electronic Identity Verification Legal issues surrounding the identity of a contracting party Bird & Bird 3.3 Expert Legal Opinion: Jonathan Guest It is imperative to be able to link the customer ID data to the customer s application in a form which cannot be tampered with (whether by Company or customer) so that there can be no doubt as to the identity of the person engaging with Company online. Jonathan Guest, E-Signature Solution Analysis Eversheds 3.4 Case Law: Shogun Finance vs. Husdson Whilst not a case involving electronic evidence, the Hudson case highlights for lenders, the increased importance of robust and appropriate ID&V processes. Shogun Finance vs Hudson, 2003, House of Lords established the following principal: If lender is unable to retrospectively establish the identity of the contracting party, then the contract is at risk of being deemed not to exist 9

10 4. Appendix B - DEALFLO ID&V Services 4.1 DEALFLO Verification Hub DEALFLO Verification Hub gives clients access to the widest range of ID&V services available. From bureaus to specialist providers all through the existing DEALFLO integration ID&V Evidence Types: Bureau DEALFLO Verification Hub has access to multiple UK bureaus, giving our clients the ability to choose who they want to use, and when to use them. Typically, the more traditional bureau based data verification includes: - Name, Address, Date of Birth Identity Verification - AML and sanctions file checks - Bank Ownership checks - Bank Fraud checks - Non consented Bank checks - Knowledge-based authentication 10

11 Alternate data sources Alternate data sources for electronic ID&V are increasingly available. DEALFLO is regularly updating our service with access to new data sources to improve our clients ability to check end customers identities. Examples include: - Device fingerprinting - Geo-location - IP-piercing - Device location - Document verification - Card verification - Traded identities - Social media data - Behavioural biometrics - Compromised data - Counts and normality Workflow ID checks can incorporate multiple data elements all managed through a configurable workflow module. Clients can specify and automate ID&V workflows at a transaction level and optimise over time Client Benefits - Increased enforceability (see Section 1.1 and 1.2 of this document) - Improved ability to demonstrate compliance - Increased conversion rate o Second look (ability to check in more than one bureau to find a customer ID) o Ability to automate referral processes - Increased resilience (automatic failover from one bureau to another) - Lower fraud risk 11