Skip to main content

'Payments architecture' set for major modernisation in the UK

As you may remember, in the UK, the Payment Systems Regulator (PSR) asked the Payment Strategy Forum (PSF) to come up with a strategy to increase competition and innovation. This strategy, published in November last year, has a number of different threads to it, but one is that of particular interest to us is the call for new guidelines on “identity verification, authentication and risk assessment”.

The Forum said: "We expect that the guideline would include requirements for improved identity assurance in a number of these areas: account opening, re-authentication of long-standing account holders, setting up payment mandates, confirming payer and payee when initiating payments, mutual authentication (e.g. bank identifying itself to customer), and incorporating identity assurance into existing risk assessment processes."

From 'Payments architecture' set for major modernisation in the UK

Now these are all quite different requirements, so it’s very intellectually interesting problem to come up with a solution that will work effectively in all of these cases. What it seems to imply to me is that we need some form of identity infrastructure for the financial sector. Given that the PSF also backed the creation of a shared KYC utility (for business customers), 

Now obviously I’m not privy to the deliberations of the Forum, so I couldn’t say what their vision for the new financial services identity infrastructure might be, but suppose we were to imagine some form of Financial Services Passport (FSP) with supporting infrastructure. 

Comments

Popular posts from this blog

We could fix mobile security, you know. We don't, but we could

Earlier in the week I blogged about mobile banking security , and I said that in design terms it is best to assume that the internet is in the hands of your enemies. In case you think I was exaggerating… The thieves also provided “free” wireless connections in public places to secretly mine users’ personal information. From Gone in minutes: Chinese cybertheft gangs mine smartphones for bank card data | South China Morning Post Personally, I always use an SSL VPN when connected by wifi (even at home!) but I doubt that most people would ever go to this trouble or take the time to configure a VPN and such like. Anyway, the point is that the internet isn’t secure. And actually SMS isn’t much better, which is why it shouldn’t really be used for securing anything as important as home banking. The report also described how gangs stole mobile security codes – which banks automatically send to card holders’ registered mobile phones to verify online transactions – by using either a Trojan...