<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2022/07/Creative-AePS-Blog-03.webp" alt="M2P Fintech" title="" width="100%" height="253">Over 85% of bank accounts in India are inactive.Research shows that the inactive accounts can be attributed to the issues faced by the underserved populace across remote corners of the country.<blockquote class="block-node" id="vrcfnudss">Bringing the underbanked and unbanked population into mainstream financial services is crucial for&nbsp;<a class="link au lm" href="https://m2pfintech.com/blog/fintech-a-catalyst-for-financial-inclusion/" target="_blank" rel="noopener ugc nofollow">financial inclusion</a>, the foundation of economic growth.</blockquote>Digital payment modes such as mobile wallets,&nbsp;<a class="link au lm" href="https://m2pfintech.com/blog/upi-the-driver-of-economic-growth-and-inclusion/" target="_blank" rel="noopener ugc nofollow">UPI</a>, contactless, payment cards, and QR codes have enabled universal access to financial services. But they still leave a gap for senior citizens, underprivileged, and inerudite sections of the society. These sections find it challenging to buy a smartphone or a payment card or even remember a passcode or PIN. Thus it becomes harder for them to join the digital Indian ecosystem.To resolve these challenges and to enable people from all walks of life to benefit from digital financial services, Aadhaar enabled Payment System (AePS) was brought into existence.Before diving in to know more about AePS, let’s have a quick look at what Aadhaar is and how it helps financial inclusion.<h2 class="heading-node" id="0c61">Aadhaar, driving inclusivity, and benefits</h2>Aadhaar is a 12-digit individual identification number issued by the UIDAI (Unique Identification Authority of India) on behalf of the Indian Government. In India, the Aadhaar number serves as a proof of identity and address. Any citizen of India is eligible to apply for Aadhaar Card. They can receive it via India Post, and as an e-Aadhaar downloaded from the UIDAI website.Aadhaar, the world’s largest biometric ID system, has been a crucial enabler of inclusive financial services in India. It captures fingerprints, retinal scans, and facial identification as chief authentication factors for transactions. So, the bank customer need not carry a smartphone or a payment card, or remember PINs and passwords.<blockquote class="block-node" id="vqdwnw2pm">More than 131 crore adults registered with Aadhaar have seamless access to banking services, insurance, and direct benefit transfers from over 700 financial inclusion schemes announced by the central and state governments.India’s financial inclusion index stands at 53.9, which is an impressive display of inclusivity brought about by Aadhaar.</blockquote>Aadhaar leverages advanced technology for transparent and targeted delivery of financial services, benefits, and subsidies without the hassle of intermediaries. Aadhaar saved the Indian government ₹2.25 lakh crores in Direct Benefit Transfers (DBT) by getting rid of fake beneficiaries and routing benefits to deserving people.<h2 class="heading-node" id="aab1">What is AePS?</h2>Aadhaar enabled Payment System (AePS) is a payment system that facilitates interoperable digital financial transactions through Aadhaar card-based verification (quick eKYC). It uses a Unique Identification Number or the Aadhaar number to make transactions effortlessly. Serving as a simple, secure, and user-friendly platform, AePS helps blue-collared workers, senior citizens, and the underprivileged to benefit from cashless transactions.AePS is a bank-led model, and any Indian resident can utilize the service just with their Aadhaar number that is linked to their bank account — Aadhaar Enabled Bank Account (AEBA). The Aadhaar enabled Payment System allows online transactions to take place at PoS (Micro ATM)/Kiosk/mobile devices through the Business Correspondent (BC) of any bank using Aadhaar authentication.Leveraging AePS, banks can empower all segments of society by increasing user-friendly access to cash deposits, payments, money transfers, and withdrawals. AePS use cases are accessible at any biometric-enabled touchpoint, viz., all-in-one integrated devices, mobiles/PCs/tablets, or any accessories that meet the technical specifications defined by UIDAI. By enabling AePS solutions, banks can enable seed status checks for direct benefit transfers, social security pensions and government subsidies.<h2 class="heading-node" id="f55b">What are the requirements for AePS transactions?</h2>AePS does not need a smartphone, document, or payment card. It only requires the customer to link the Aadhaar card to the bank account to capture the following info.<ul class="list-node" id="3lglglm5z"><li>Aadhaar Number</li><li>Biometrics-fingerprint identification</li><li>Name or Bank Issuer Identification Number (IIN)</li></ul>If not, just remembering the last four digits of the Aadhaar number will do. The Business Correspondent with an AePS machine or Micro ATM on assisted mode should be able to do any transaction for the customer.<h2 class="heading-node" id="ab00">Key objectives</h2>The main objective of AePS is to use Aadhaar number/ Virtual Identity to access AEBA for banking transactions through Business Correspondents (BC).It also aims to:<ul class="list-node" id="n7aofhjeh"><li>Securely facilitate&nbsp;<a class="link au lm" href="https://m2pfintech.com/blog/why-payments-interoperability-is-a-must-for-todays-generation/" target="_blank" rel="noopener ugc nofollow">interoperability</a></li><li>Enable quick eKYC services</li><li>Electronify retail payments as per RBI regulations</li><li>Build a full range of Aadhaar enabled Banking Services</li><li>Improve financial inclusion in India (According to the goals of GoI and RBI)</li><li>Enable intrabank and interbank transactions through a central switching &amp; clearing agency</li><li>Empower bank customers to use Aadhaar for banking transactions</li></ul>In addition, AePS helps deliver Government disbursements like NREGA, social security pension, and handicapped old age pension.<h2 class="heading-node" id="8be7">AEBA services</h2>With the help of AEBA (Aadhaar Enabled Bank Account), banks can offer the following services.<ul class="list-node" id="hakcr4xsc"><li>Cash Deposit</li><li>Balance Enquiry</li><li>Purchase</li><li>Cash Withdrawal</li><li>Mini Statement</li><li>Aadhaar to Aadhaar Fund Transfer</li><li>eKYC</li><li>Best Finger Detection</li><li>Demographic Authentication</li><li>Aadhaar Seeding Status</li><li>Self-Help Group (SHG) Transaction</li><li>BHIM Aadhaar Pay</li><li>Authentication</li></ul><h2 class="heading-node" id="7a75">How can customers use AePS?</h2>Customers can make AePS transactions in two ways.<ul class="list-node" id="uxpw6ofk8"><li>Through Business Correspondents&nbsp;— who usually represent the banks or entities. They are equipped with Micro ATM devices for facilitating customer transactions.</li><li>Through BHIM Aadhaar Pay at merchant locations&nbsp;— where the customer can make payments just by using Aadhaar number/VID and verify their identity using biometrics.</li></ul><h2 class="heading-node" id="614d">5 steps to perform an AePS transaction</h2>The steps below will guide customers to perform an AePS transaction easily.<ol class="list-node" id="9kqme9bxs"><li>Visit an ATM or contact a banking representative</li><li>Enter the 12-digit Aadhaar number and bank account number in the PoS machine</li><li>Choose a transaction type from the list- cash deposit, mini statement, withdrawal, balance enquiry, or fund transfer</li><li>Enter the transaction amount</li><li>Verify identity using biometrics (iris scan, fingerprint, or face recognition)</li></ol>Once all this is done properly, the transaction will be completed, and you can collect your receipt.<h2 class="heading-node" id="f14e">Why and how can banks and merchants offer AePS?</h2>For BanksBanks can reap the following benefits by offering AePS to their customers.<ul class="list-node" id="63zbggip1"><li>Reach more customers by engaging with Business Correspondent</li><li>Cut costs by leveraging digitization and reducing the printing of cheques and payment cards</li><li>Save time and money using a Business Correspondent instead of brick and mortar branches</li><li>Enable smooth interoperability among banks</li><li>Establish a quick and easy paperless KYC</li></ul>When banks wish to offer AePS to their customers, they just have to apply with NPCI / UIDAI. Then, they will be permitted to deliver AePS after the vetting and application process is completed.For MerchantsMerchants can accept AePS for cost-effective and inclusive payments. This will help them widen their customer base. Merchants can offer AePS by just applying to an authorized bank. After this, they can then receive digital payments for goods and services that are delivered from their customers.<h2 class="heading-node" id="1574">Greater security, trust, and inclusion</h2>When banks and merchants offer AePS, their customers can easily transact just with biometric authentication, either a face recognition, iris scan, or fingerprint identification. All these three aspects can never be forged, ensuring secure transactions.Banks and merchants can gain more customers through AePS as transactions can happen without the need of a physical card, passbook, smartphone or any other document. This will improve customer trust and confidence to make transactions in rural areas, especially among the underbanked segments. Banks across India are attributing enhanced revenue and cost-cutting to AePS offering.Want to add AePS to your payment ecosystem? Write to us at&nbsp;<a class="link au lm" href="mailto:business@m2pfintech.com" target="_blank" rel="noopener ugc nofollow">business@m2pfintech.com</a><a class="link" href="https://m2pfintech.com/newsletter/">Subscribe</a>&nbsp;to our newsletter and get the latest fintech news, views, and insights, directly to your inbox.Follow us on&nbsp;<a class="link" href="https://www.linkedin.com/company/m2pfintech/mycompany/">LinkedIn</a>&nbsp;and&nbsp;<a class="link" href="https://twitter.com/m2pfintech">Twitter</a>&nbsp;for insightful fintech tales curated for curious minds like you.

Revolutionizing Financial Inclusion- Aadhaar enabled Payment System (AePS)

<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2022/06/Artboard-1-1.webp" alt="M2P Fintech" title="" width="100%" height="253">Stumped with KYC implementation?You are not alone. Several Financial Institutions (FIs) are working out their way through KYC puzzle to oust financial crimes and ensure compliance.Now, KYC is critical for any financial institution. It is indeed the first step when you choose to use a financial product or service in India.So, what is KYC?For starters, Know Your Customer (KYC) is the process to confirm a customer’s identity while onboarding a financial institution. RBI has ensured the implementation of a robust KYC system to helps financial institutions understand their customers better while ensuring their legitimacy. Click&nbsp;<a class="link au lg" href="https://m2pfintech.com/blog/know-your-customer-kyc-the-need-for-authentication/" rel="noopener">here</a>&nbsp;to know more about KYC in India.<h2 class="heading-node" id="453f" style="text-align: justify">Digital Avatar</h2>With the rise in paperless onboarding, KYC has taken a digital avatar. The&nbsp;<a class="link" href="https://m2pfintech.com/blog/know-your-customer-kyc-the-need-for-authentication/">digital KYC&nbsp;</a>saves a lot of time and effort involved in the process and helps tackle onboarding issues in a quick and seamless manner. It also prevents money launderers/fraudsters from masking their true identities and manipulating stolen information for their personal gains.Though the benefits of the process are immense, implementing digital KYC is not simple. Financial institutions such as banks and fintechs need to overcome significant challenges in deployment.<h2 class="heading-node" id="22ab" style="text-align: justify">Key KYC Challenges</h2>The upswing in the recent money laundering, fraud, and tax evasion cases has brought KYC into a new light. Accordingly, RBI has enforced strict laws concerning non-compliance with the KYC directives. However, financial institutions are grappling to keep up with the legal framework for KYC compliance.Experience Vs ComplianceRight from onboarding and screening to monitoring customer data, they face complex challenges every step of the way. This puts banks and fintechs in a tricky spot because customers seek seamless experience and quick onboarding with minimal documentation, and FIs cannot compromise on the verification process. Ensuring compliance without compromising customer experience is a huge challenge for FIs.Connected Risk IdentificationKYC involves extensive paperwork and supporting documents. Often, customer data files are incomplete or lack critical pieces of information or documentation. This heightens the risk of fraud and lays down a cosmic emphasis on monitoring and screening individuals and entities against Politically Exposed Persons (PEPs), watchlists/sanctions, and other regulatory and law enforcement lists.In addition, the rise of new criminal typologies has inflicted the compliance team to assess an overarching list of compliance and fraud risks. This calls for an all-inclusive, connected risk identification approach for analyzing financial fraud activities, money laundering, and other offenses.Volatile Risk AppetiteFinancial institutions and customers exhibit dynamic risk appetite. For example, a customer might have a different risk profile or status during onboarding and drift into another risk profile over time. On the other hand, KYC regulations are updated periodically, which implies the regulations, risk indicators, and other indices used to determine the risk tolerance score will vary. Hence the outdated records become an impending hindrance to the customer due diligence process. The repercussions of such instances are far-reaching as there is only a fine line between a medium and high-risk customer but a momentous difference in due diligence efforts.Lack of TransparencyOne of the biggest challenges of KYC is the retrieval of corporate ownership documents from registries located across the globe. Successful KYC depends on several sources such as annual reports, financial statements, stock exchange information, third-party data, and regulator websites. However, due to the lack of transparency, KYC analysts bank on limited information on the directors, stakeholders, controllers, and beneficiaries. Additionally, there is a significant cost associated with accessing specific vital documents while others are available for free.<h2 class="heading-node" id="6f0c" style="text-align: justify">How Financial Institutions can crack KYC challenges</h2>Here’s our take on how financial institutions can tackle KYC challenges effectively.<ul class="list-node" id="bakrf8m7x"><li>Integrate with credit bureaus for seamless customer verification</li><li>Use data deduplication techniques to recognize and eliminate identical records. This is also known as Dedupe check-in.</li><li>Validate customer data against the regulation records to identify unscrupulous individuals/organizations prohibited from making business transactions.</li><li>Conduct rational checks to keep a tab on anonymous bank accounts or those opened with fictitious names.</li><li>Facilitate video KYC for quick onboarding and exceptional customer experience.</li><li>Use algorithms and techniques to categorize customers as low, medium, and high-risk categories, based on the assessment and risk perception.</li><li>Take necessary precautions with customers who come under high-risk segment.</li><li>Monitor customer transactions in a routine manner to keep an eye on any suspicious activities.</li><li>Partner with authorized 3rd party service providers for quick e-KYC checks and video KYC onboarding.</li></ul><h2 class="heading-node" id="4cad" style="text-align: justify">Is third-party KYC partnership a viable approach?</h2>Although KYC is kept in-house traditionally, experts believe it is time to team up with third-party KYC-service providers.Why?First off, it is cost and time effective.Secondly, for high efficiency and accuracy.From dedicated subject matter expertise to cutting-edge technology access to faster go-to-market speed, third-party partners can provide all-inclusive services within an optimum budget.These partnerships can enable FIs to invest more effort and time in their core business, rather than focusing on the KYC procedures. Financial institutions that keep KYC in-house could end up with extensive duplication and redundancy across businesses and markets.On the other hand, third-party partners employ devoted professionals to carry out KYC procedures and documentation. This leaves no room for error, ensuring a smoother onboarding process and regulatory compliance, without compromising customer experience.With that being said, third-party service providers are the gateway to exceptional customer experience and successful KYC solutions. They enable financial organizations to improve speed and operational performance, minimize operational risks and boost efficiency by consolidating and centralizing functions.Financial institutions should take apposite measures to understand the complexities that could arise from digital transformation. They must embrace strategic partnerships to develop pioneering approaches to assess customer risks and monitor transactions.So, do you need solutions to any particular KYC issue? Or want to know more about implementing KYC?Write to us at&nbsp;<a class="link au lg" href="mailto:business@m2pfintech.com" target="_blank" rel="noopener ugc nofollow">business@m2pfintech.com</a>.<a class="link" href="https://m2pfintech.com/newsletter/">Subscribe</a>&nbsp;to our newsletter and get the latest fintech news, views, and insights, directly to your inbox.Follow us on&nbsp;<a class="link" href="https://www.linkedin.com/company/m2pfintech/mycompany/">LinkedIn</a>&nbsp;and&nbsp;<a class="link" href="https://twitter.com/m2pfintech">Twitter</a>&nbsp;for insightful fintech tales curated for curious minds like you.

Crack the KYC Jigsaw. Ease Onboarding Compliance

<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2022/05/Artboard-1-copy-8-8.webp" alt="M2P Fintech" title="" width="100%" height="284"> Over the last few years, e-commerce and <a class="link" href="https://m2pfintech.com/blog/the-rise-of-digital-payments-2/">digital payments</a> have become a comfortable cosmos for millions of shoppers worldwide. Card-Not-Present (CNP) transactions, in particular, constitute a major chunk of online payments.<h2 class="heading-node" id="cbf4">Card-not-present transactions</h2>Essential to both in-store and online businesses, CNP payments reduce the risk of customer churn and cart abandonment. Imagine a customer does not have a physical credit or has a visibly battered card that cannot be scanned. They can still pay for the purchase using the CNP facility across the counter or telephone or digital channels.But like most things in life, CNP payments are a double-edged sword. They are highly sophisticated yet so vulnerable to security breaches. When a scamster gets hold of the credit card number, name, three-digit security code (CVV), and expiration date, stealing cash and identity becomes a cakewalk.<blockquote class="block-node" id="o40ybrinh">As of 2021, CNP frauds were 81% more common than card-present scams, resulting in tremendous costs to banks and merchants.</blockquote><h2 class="heading-node" id="66f3">Cost of payment fraud</h2> The cost associated with payment fraud is immense for banks, merchants, and payment service providers. They’ll have to deal with customer refunds, additional chargeback fees, fines, and investigation charges. Though the amount is usually refunded to the victim, it still causes distress and mistrust.<h2 class="heading-node" id="b033">Best way to prevent CNP fraud — PCI 3DS</h2> The way to avert CNP fraud is to implement stringent controls that validate the identity of the cardholder. PCI 3D Secure plays a significant role in enabling identity validation and access control, thereby reducing the costs and inefficiencies associated with payment fraud in a CNP scenario. Banks and card payment service providers need to comply with PCI 3DS protocols to fortify transaction security.<h2 class="heading-node" id="deaa">What is PCI 3DS?</h2>PCI 3DS is an advanced EMV messaging procedure that authenticates cardholders when making online purchases. It facilitates seamless data exchange between merchants, cardholders, and card issuers, thereby providing an additional layer of security to avoid CNP fraud and make e-commerce secure.<h2 class="heading-node" id="f06c">Key components of PCI 3DS Core Security Standard</h2>The PCI 3DS Core Security Standard serves as a framework for EMV 3DS functions to execute security controls. It supports the integrity and confidentiality of 3DS transactions and pertains to institutions that leverage 3DSS, DS, and ACS, the key components of the PCI 3DS security standard.Here’s a quick peek into what each component means.•&nbsp;3DS Server (3DSS)&nbsp;contributes the functional interface between the 3DS requester environment and the DS.•&nbsp;3DS Directory Server (DS)&nbsp;holds the list of valid card ranges for which authentication may be available. Further, it also coordinates communication between the 3DSS and the ACS systems to ascertain whether authentication mechanisms are available for a particular card number and device type.•&nbsp;3DS Access Control Server (ACS)&nbsp;comprises the authentication rules and is managed within the issuer domain.The physical and logical security requirements for the PCI 3DS Core Security Standard are structured as follows.Baseline Security Requirements<ul class="list-node" id="qtc61d1ze"><li>These are technical and operational security requirements that reflect general information security principles and practices common to industry standards.</li><li>These requirements should be considered for all types of environments.</li></ul>3DS Security Requirements<ul class="list-node" id="qgbh7rkln"><li>They provide security controls specifically intended to protect 3DS data, technologies, and processes.</li></ul><h2 class="heading-node" id="1289">Difference between PCI 3DS and PCI DSS</h2>The PCI 3DS and PCI DSS are two separate standards intended for varying requirements and entities. The PCI 3DS applies to environments where 3DSS, ACS, and/or DS functions are performed, whereas PCI DSS applies wherever payment card account data is stored, processed, or transmitted.If you want to know more about PCI DSS, check out our blog on the&nbsp;<a class="link au nb" href="https://medium.com/m2p-yap-fintech/12-requirements-of-pci-dss-157747451888" rel="noopener">12 REQUIREMENTS OF PCI DSS.</a>Most 3D secure entities possess both PCI 3DS and PCI DSS responsibilities. In some cases, a 3DS entity does not store, process, or transmit any payment card account data. For instance, in the case of EMV payment tokens, the 3DS entity is involved ONLY in 3DS transactions. The 3DS entity may not be subject to PCI DSS in this scenario. In all other cases, entities should refer to their acquirer and/or the payment brand(s) to determine their compliance obligations to a PCI standard.So, are you looking to get PCI DSS certified and compliant? We can help.<a class="link au nb" href="https://m2pfintech.com/" target="_blank" rel="noopener ugc nofollow">M2P</a>&nbsp;has extensive experience in ensuring compliance for numerous players in the card payment industry. Write to us at&nbsp;<a class="link au nb" href="mailto:business@m2pfintech.com" target="_blank" rel="noopener ugc nofollow">business@m2pfintech.com</a>, and let’s get started!Here’s to more dynamically authenticated 3DS transactions!<a class="link" href="https://m2pfintech.com/newsletter/">Subscribe</a>&nbsp;to our newsletter and get the latest fintech news, views, and insights, directly to your inbox. Follow us on&nbsp;<a class="link" href="https://www.linkedin.com/company/m2pfintech/mycompany/">LinkedIn</a>&nbsp;and&nbsp;<a class="link" href="https://twitter.com/m2pfintech">Twitter</a>&nbsp;for insightful fintech tales curated for curious minds like you.

Prevent CNP Frauds with PCI 3DS

3D Secure: Your Barrier against Cyber Attacks

<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2022/04/pci-dss.webp" alt="M2P Fintech" title="" width="100%" height="253">The payment industry is constantly growing where every upgrade plays an important role in developing trust among users by protecting their sensitive data. So, every business that is an active participator needs to meet few security standards that act as Armour.One such globally recognized standard is PCI DSS.The PCI Security Standards Council came up with a Payment Card Industry Data Security Standard (PCI DSS) framework to protect credit and debit card transactions and card holders’ data from breaches. It is a mandate for every merchant and service provider to abide by this protocol for a smooth customer experience.<h2 class="heading-node" id="e2ee" style="text-align: justify">How was PCI DSS created?</h2>It all began during the internet boom in the late 1990s, when the initial stage of e-commerce brought in many fraudsters and excitement. When the retailers, merchants, card networks, consumers widely accepted the emerging web-driven transactions, they witnessed a steady increase in credit card fraud and scams. That is when the card networks like American Express, MasterCard, and Visa started to dig deep into the issue to create standards for payment processing systems.With Visa taking the lead in 2001 “Cardholder Information Security Program” standard was introduced, followed by the other companies implementing their security standards. But it did not meet the expectations of the merchants and POS terminals as they need to comply individually with the company-specific standards. This resulted in great difficulty for merchants as they have to comply with different standards when they are approaching multiple card networks. So, the collaboration of the major card networks such as American Express, Discover, JCB, Mastercard, and Visa birthed PCI DSS version 1.0 in December 2004.Later in 2006, the Payment Card Industry Security Standards Council (PCI SSC) was formed by a joint venture of MasterCard, American Express, Visa, JCB International, and Discover Financial Services to manage PCI development and alignment of policies to PCI DSS. PCI SSC ensures that the entities are committed to secure credit card data.PCI DSS is now a globally recognized directive where every merchant who accepts card payments must comply with the latest version, PCI DSS 3.2.1, which was released in May 2018.<h2 class="heading-node" id="edca" style="text-align: justify">Why do merchants need to comply with PCI DSS?</h2>Since there are over multiple card transactions taking place in the market, a safe business environment becomes the prime concern for the merchants to lead a long haul. A business compliant with PCI DSS always earns customers’ trust for their sensitive card information and helps boost the sale and customer confidence. As every business relies on partners, acquirers, or fellow industry mates, being a PCI DSS Compliant helps improve one’s reputation and strategies.Data breaches, payment card data theft, can be avoided as it is stored securely and monitored on a regular basis. In addition, PCI DSS even helps in improving IT infrastructure efficiency with its compliance levels and requirements.<h2 class="heading-node" id="de60" style="text-align: justify">PCI DSS Compliance levels</h2>There are four levels of PCI DSS Compliance based on the number of annual payment card transactions a business handle.Level 1:&nbsp;over 6 million TXNLevel 2:&nbsp;1 to 6 million TXNLevel 3:&nbsp;20,000 to 1 million TXNLevel 4:&nbsp;fewer than 20,000 TXNCheck out our guide to the&nbsp;<a class="link au mj" href="https://m2pfintech.com/blog/pci-dss-a-quick-guide-to-its-levels/" rel="noopener">PCI DSS Levels</a>&nbsp;and their impact on compliance.<h2 class="heading-node" id="a8f1" style="text-align: justify">Requirements for PCI DSS Compliance</h2>Every system entity and component associated with Cardholder Data Environment (CDE) must comply with the PCI DSS mandate. It includes requirements for security management, policies, procedures, network architecture, software design, and other critical protective measures.PCI DSS sets forth 12 requirements for every PCI DSS complaint established by the PCI Security Standards Council:<h3 class="heading-node" id="757b" style="text-align: justify">1. Firewall Configuration</h3>Firewalls are installed and configured to protect card holders’ data from any malware. It helps the prevention systems effectively to defend the hackers from unauthorized access to private data.<h3 class="heading-node" id="625d" style="text-align: justify">2. Password Security</h3>Businesses should not use vendor-supplied defaults for system passwords and other security parameters in their routers, modems, point of sale (POS) systems, and other third-party products. Instead, basic precautions and configurations like changing the password should be followed as the public can easily access the generic passwords and security measures.<h3 class="heading-node" id="ad5f" style="text-align: justify">3. Protection of Cardholder Data</h3>The stored cardholders’ data must be encrypted with two-fold protection and certain algorithms. Also, the primary account numbers (PAN) must be regularly scanned and monitored to avoid any unencrypted data.<h3 class="heading-node" id="1dad" style="text-align: justify">4. Encryption of Transmitted Data</h3>The cardholders’ data should be encrypted when transmitted across open, public networks like payment processors, home offices from local stores, etc. Sharing the account numbers to unknown locations must be avoided.<h3 class="heading-node" id="9653" style="text-align: justify">5. Antivirus Software</h3>All the systems used for interacting, sharing, storing PAN must be protected against malware by regularly using and updating antivirus software or programs. Also, POS providers must employ anti-virus measures and maintain up-to-date antivirus programs to prevent systems from malware.<h3 class="heading-node" id="f58e" style="text-align: justify">6. Secure Systems and Applications</h3>To add another layer of protection to the data, the providers must develop and maintain secure systems and applications. These systems and applications that are used as the storage of data for interaction must be updated regularly.<h3 class="heading-node" id="f835" style="text-align: justify">7. Restriction of Access</h3>The cardholders’ data are restricted to access by business need-to-know, and the sensitive data must be accurately documented and updated regularly.<h3 class="heading-node" id="bffa" style="text-align: justify">8. Unique Access ID</h3>Individual credentials and ID are assigned to each person with computer access to card holders’ data. Single access ID and password should not be used as it results in more vulnerability and slow response time.<h3 class="heading-node" id="57e9" style="text-align: justify">9. Restriction of Physical Access</h3>Card holders’ data must be physically stored in a secured location where any physical access is restricted. Physically written, typed, or digitally stored data must be secured in the room, and in case of any access, it should be added to the access logs.<h3 class="heading-node" id="7c0d" style="text-align: justify">10. Maintain Access Logs</h3>As mentioned in the previous requirement, all access to network resources and cardholder data must be tracked and monitored in the access logs. This proper record keeping and documentation must be maintained with utmost accuracy as it is related to sensitive data.<h3 class="heading-node" id="aecf" style="text-align: justify">11. Testing Security Systems and Processes</h3>Regularly testing/scanning security systems and processes result in less vulnerability as it involves many digital data, software programs/products, physical locations, etc.<h3 class="heading-node" id="625c" style="text-align: justify">12. Document Policies</h3>Document policies that address information security for all personnel must be maintained right from storing to transmitting/using data after POS.So, with these twelve requirements, PCI DSS comprises six objectives to ensure optimal security for merchants who accept, process, transmit, or store payment card information.<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2022/06/image-1.webp" alt="M2P Fintech" title="" id="jxi8l3syj" width="100%" height="253">With PCI DSS’s strong objectives and compliance requirements, the security of the payment industry is strengthened. These measures help and encourage data security and facilitate the adoption globally. So, hereby businesses that handle card payments need to be a part of this global payment card data security solution and focus on increasing the intensity to move forward by becoming ‘PCI DSS Complaint.’Look forward to our upcoming blogs as we uncover PCI SSC’s other standards such as PCI 3 DS, PA DSS, PCI PIN Security, and PCI SSF.<a class="link" href="https://m2pfintech.com/newsletter/">Subscribe</a>&nbsp;to our newsletter and get the latest fintech news, views, and insights, directly to your inbox.Follow us on&nbsp;<a class="link" href="https://www.linkedin.com/company/m2pfintech/mycompany/">LinkedIn</a>&nbsp;and&nbsp;<a class="link" href="https://twitter.com/m2pfintech">Twitter</a>&nbsp;for insightful fintech tales curated for curious minds like you.

PCI DSS: The Payments’ Armour

<img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2022/05/Wordpress-main-.webp" alt="M2P Fintech" title="" width="100%" height="356">Know Your Customer/Know Your Client (KYC) is a mandatory process that verifies and authenticates a customer’s identity. All legal and financial institutions must validate their customers to prevent any illegal or fraudulent activities as per Reserve Bank of India’s norms.&nbsp; Under the guidance of the Prevention of Money Laundering Act, 2002 (PMLA), the RBI mandates that all banks and financial institutions implement KYC procedures.&nbsp; KYC starts with verifying Proof of Identity (POI) and the Proof of Address (POA) and by which banks, insurance companies, and other organizations obtain information and better understand their customers. It is applicable for both new and existing customers and is the first step in account creation or even to allow a transaction.&nbsp;<h2 class="heading-node" id="9083">Why is KYC mandatory?</h2>As per the Reserve Bank of India’s mandatory regulation, KYC came into legal effect in 2002. The RBI mandates that all financial and legal institutions should assess their customers.&nbsp; KYC’s objective is to help banks and other financial institutions to assess and validate their customers. An effective KYC alleviates and combats all illicit activities. A financial institution can identify potential threats, criminal, and other illegal activities while verifying the KYC required documents. In a nutshell, a financial institution or a business/corporate uses KYC for,&nbsp;<ul class="list-node" id="32oq3a921"><li>Building and Verifying a Customer’s Identity&nbsp;</li><li>Understanding Customer’s Activities&nbsp;</li><li>Evaluating the risks involved with the Customer’s Activities</li></ul><h2 class="heading-node" id="2ff5">How does KYC work?</h2>The KYC process is carried out seamlessly with the following simple steps:&nbsp;<ul class="list-node" id="pce88galo"><li>First, the applicant’s PAN/ AADHAR details are collected and validated.&nbsp;</li><li>The applicant further supports the information provided by entering the required details on the website.&nbsp;</li><li>The applicant’s document goes through various checks and authentication processes by the financial entity.&nbsp;</li><li>Once the documents are verified, and once named eligible, then the applicants are onboarded.&nbsp;&nbsp;</li></ul><h2 class="heading-node" id="23fe">Evolution of KYC</h2>Back in 2002, the Reserve Bank of India (RBI) made KYC a legal and mandatory procedure for all financial institutions, preventing misuse of the sensitive information held by banks and restricting money laundering activities. Evolving from a Paper-based physical attestation method to video adoption, KYC has come a long way. The paper-based KYC demands more physical input because of various document requirements. In contrast, the e-KYC makes the verification procedure less complicated by reducing the physical work of businesses and clients where the data is stored and verified entirely online.&nbsp;&nbsp; The e-KYC or paperless KYC verification procedure became more preferred by customers once the internet boomed. Now doing e-KYC is made even more accessible as the Government of India has launched Digi Locker under its Digital India initiative. It is a digital document wallet that helps its users to store authentic documents virtually and is highly secured by Aadhaar/OTP authentication.<h2 class="heading-node" id="5fbe">Types of KYC</h2><img src="https://m2p-website-file.s3.ap-south-1.amazonaws.com/m2p-website-file/marketing-cms/m2p-blog/2022/05/Wordpress-03.webp" alt="M2P Fintech" title="" width="100%" height="284"><h3 class="heading-node" id="ympukq7zn">1. Aadhaar-based KYC</h3>Aadhaar-based KYC verification follows the regulations of The Unique Identification Authority of India (UIDAI) and verifies proof of identity and residence through one’s Aadhaar number. In addition, the UIDAI provides information to service providers to activate customer services such as bank accounts, mobile connections, etc.&nbsp; Every Aadhaar cardholder can quickly and easily complete their KYC process. Aadhaar based KYC is an efficient, paperless process that adheres with government standards.&nbsp; The Aadhaar based KYC authenticates data in two different ways:&nbsp; OTP-based  - The financial institution verifies the customers’ identity by triggering an OTP to their Aadhaar linked mobile number.&nbsp;&nbsp; Biometric-based  - For Identification and Verification, the financial institution uses the biometrics of the customer by using UIDAI (Unique Identification Authority of India) approved scanners.<h3 class="heading-node" id="ebxjgryx3">2. In-Person Verification (IPV) KYC</h3>The In-person KYC procedure was used by the Security and Exchange Board of India (SEBI) for mutual fund investors. Unlike the other prevalent methods, in-person verification requires the individual to undergo the process offline in an institution, KYC kiosk, or at an AMC. IPV has now upgraded their process via OTP mechanism.<h3 class="heading-node" id="31fd">3. Digital KYC</h3>It is a paperless process where a live photo of the client and their Aadhaar is verified and processed online. It also involves submitting the Official Valid Documents (OVD’s) such as Aadhaar, Pan Card, Passport or a Driver’s license.&nbsp; The digital KYC techniques have many advantages such as,&nbsp;<ul class="list-node" id="pewatsdgk"><li>The customer’s identity verification happens in real-time,&nbsp;</li><li>The process is flexible because the customer can use any of the OVDs,&nbsp;</li><li>The process is highly secure and efficient due to privacy laws and the usage of AI technology.&nbsp;</li></ul><h3 class="heading-node" id="0da4">4. Video KYC</h3>RBI allowed the usage of Video KYC in 2020 due to the pandemic constraints. Video KYC is a procedure that verifies details of the client in a video-based process. This process involves an auditor and an agent for authentication and audit. Before establishing an account-based relationship, the agent collects the details using video-audio features and AI technology. The process is smoothened by usage of a number placard that helps authenticating the customer.&nbsp;&nbsp; Video KYC is available as:&nbsp;<ul class="list-node" id="dd9lh3yyz"><li>VCIP - Video-based Customer Identification Process&nbsp;</li><li>VIPV - Video-based In-Person Verification&nbsp;</li><li>VBIP - Video-based Identification Process&nbsp;</li></ul>&nbsp;It employs a trained individual’s audio-video interaction and automated verification methods such as geo-tagging and facial matching.&nbsp;<h3 class="heading-node" id="4d8e">5.&nbsp;Central KYC (CKYC)</h3>CKYC is a customer or financial institution submitting a Central KYC form and proof of identity and proof of address that relies on the central repository of customer records for CERSAI (Central Registry of Securitization Asset Reconstruction and Security Interest of India). The process detects any duplicate accounts and mitigates other risks.&nbsp; The C-KYC identifier is a 14-digit unique identifier assigned to a client when they upload their details for KYC. When a client opens an account without C-KYC, it may require them to repeat the whole process. But this 14-digit identifier removes that need, and the customer can use this number to update their information throughout all their accounts uniformly.<h3 class="heading-node" id="4feb">6. In-app KYC&nbsp;</h3>This KYC process brings out easy and hassle-free experiences to the customers. All the verification process happens with the help of a smartphone, where the clients can conveniently carry out bank transactions, open bank accounts, and other banking operations.&nbsp; The clients need to use their smartphones to verify their IDs or passport and begin the KYC process. The KYC also involves real-time scanning of IDs to prevent identity forgeries. It is highly secure due to the deployment of secure technologies.<h3 class="heading-node" id="a37c">7. Offline KYC</h3>Offline KYC requires the submission of all the necessary physical documents for verification. It requires filling in all the required details like Aadhaar and PAN. After this, the client must visit a nearby KRA to complete the process and receive an official application number to identify and continue the verification process. Or an agent is sent to the customer’s place to collect documents for KYC verification.<h2 class="heading-node" id="649c">So, what is KRA?</h2>KRAs are KYC Registration Agencies that maintain the SEBI (Security and Exchange Board of India) registered companies records under the KYC regulations Act, 2011. To bring uniformity and avoid duplicate KYC processes, this KRAs help regulate the KYC process that allows a company to authenticate its clients and offer better customer service.&nbsp; Five different agencies that work as KRAs in India are:&nbsp;&nbsp;<ul class="list-node" id="83rt2nv4f"><li>CVL KRA&nbsp;</li><li>CAMS KRA (Computer Age Management Services Pvt Ltd.)&nbsp;</li><li>NSDL KRA (National Securities Depository Ltd)&nbsp;</li><li>Karvy KRA (Karvy Data Management Services)&nbsp;</li><li>NSE KRA (National Stock Exchange)&nbsp;</li></ul>To conclude, KYC has evolved over the years from physical forms to real-time AI technology verification methods. KYC satisfies and provides a hassle-free experience to the customers and helps financial service providers establish a smooth relationship. If you wish to implement a robust KYC system, check out our blog on <a class="link" href="https://m2pfintech.com/blog/crack-the-kyc-jigsaw-ease-onboarding-compliance/">How to Crack the KYC Implementation.</a><a class="link" href="https://m2pfintech.com/newsletter/">Subscribe</a>&nbsp;to our newsletter and get the latest fintech news, views, and insights, directly to your inbox. Follow us on&nbsp;<a class="link" href="https://www.linkedin.com/company/m2pfintech/mycompany/">LinkedIn</a>&nbsp;and&nbsp;<a class="link" href="https://twitter.com/m2pfintech">Twitter</a>&nbsp;for insightful fintech tales curated for curious minds like you.

Product

About

Resources