How to Make Digital Identity a Success: Insights and Learnings from Seven Digital ID Schemes

Executive summary

This report from Mobey Forum’s Digital ID Expert Group presents a comparative overview of seven digital ID schemes across Europe and North America. It provides insights and comments on the evolution of the schemes, their varying models and management, technological underpinnings and the services they provide to users.

The report also takes a broader look into the future, exploring the potential for cross-border integration together with the challenges and opportunities this presents, and provides high level commentary and observations from the Expert Group.

The purpose of the report is to furnish stakeholders with a broader awareness of how digital ID is evolving across the world and to provide some key considerations on how to build sustainable frameworks for digital identity.

A new kind of Expert Group report

Given the nature of the subject matter, it is fitting that the mode of publication for this report adopts an all-digital format. The ‘raw’ findings of the study are presented here, in a categorised and tabulated format to enable the reader to perform detailed scheme-by-scheme comparisons. This approach is then complemented by category summaries, which take the form of ‘Commonalities and Differences’. Finally, in pursuit of an even broader view – one that reaches beyond the data and supports reasoned speculation on the likely future direction of digital ID – the Expert Group also offers a third, higher-level narrative, which is presented in the following ‘Viewpoint Analysis’.

By presenting the study findings across these three levels of content it is hoped that the data, the takeaways and with the Expert Group’s anticipated future direction for digital ID are all equally accessible to you, the reader, so you may be able to quickly zero-in on the kind information you need, according to your desired level of granularity.

Methodology

The ID scheme data referenced was sourced by the members of Mobey Forum’s Digital ID Expert Group in 2019. Data was collected via a combination of written surveys, email and verbal interviews conducted with established contacts at each of the represented schemes.

The schemes that are featured were selected from an original shortlist of fourteen targets, according to their willingness to collaborate and participate in the report.

The shortlist was compiled by Mobey Forum’s Digital ID Expert Group, with a view to exploring as broad a cross-section of schemes as possible, according to a variety of factors including scheme maturity, geography, structure, and commercial vs governmental origin.

Introduction

The effects of digitalisation are evident in almost every corner of our global economy.  As our collective reliance on technology continues to grow so too does our need to establish robust, secure and user-friendly ways of verifying our individual identities, digitally. The evolution of digital ID schemes around the world presents huge opportunities for a wide range of stakeholders from individual consumers, to technology and other service providers, banks and governments. As we enter 2020, it is fair to say that the field of digital ID is in varying stages of maturity. In a bid, therefore, to expand Mobey Forum’s knowledge and awareness of the various trends and opportunities in this important field, our Digital ID Expert Group has conducted an in-depth, collaborative study with seven of the most prominent Digital ID schemes across Europe and North America.

Understanding digital identity

For the purposes of this report, the term ‘digital identity’ is defined as a collection of information about an individual, organization or device that exists online (or in a network) and is the digital equivalent to ‘real’ identity documentation. In this report we focus specifically on digital identity schemes that cover individual, physical persons.

Viewpoint Analysis

Despite the globalising effects of digital technology, much of our digital existence remains geographically specific. As both individuals and as communities, we will always have a physical presence somewhere in the world, regardless of how ‘global’ our connected technologies enable us to become. To this end, we increasingly need digital services to support our local activities as well as enabling our borderless lives online.

From local to global

It is little surprise, then, to learn that most of the major digital ID schemes investigated in this report have developed distinctly localised approaches.

This inward focus has, until now, made a lot of sense. All of the schemes aim to deliver ID services that are legally recognised, which means they operate under the auspices of national governments and populations. Perhaps more fundamentally, the recruitment of a regular user base is also a necessary first priority for an ID scheme, and each has to start from somewhere.

That the seven also share common use-cases like digital authentication, digital signing and access to e-banking, is also no surprise. Indeed the provision of authentication to banking services is consistently represented across the board. These services represent the intersection of daily usefulness (and therefore likely rapid adoption by users) and ease-of-deployment, thanks to the existing depth of verified KYC data that banks and financial service providers already hold on their customers.

About the schemes

Commonalities & differences

• The schemes reveal a strong weighting toward private sector-led initiatives, with only one scheme, e-Estonia, being 100% government-led.
• All schemes aim to provide national ID services, with the exception of Verimi, which is planned to operate across borders.
• All schemes aim to deliver ID services that are legally recognised and enable secure digital transactions.
• While variations in use-cases are evident, all schemes typically focus on user authentication and digital signing services.

Use drop down navigation below to adjust the best view for your device. 

The qualified Know Your Customer (KYC) processes that enable banks to verify individual identities have, so far, served the banks well. This is the source of ‘trust’ for most schemes, and remains rooted in the user’s existing bank credentials, which are most commonly established via physical visits to branches and nowadays also via digital onboarding solutions that banks, for example, have started to deploy.

The confidence established in bank credentials also plays well to banks potential future role as guardians of their customers’ digital identities beyond financial services. The depth of their KYC processes should continue to be a priority focus for banks looking to position – and differentiate – themselves in this space in the future. Unlike other stakeholder groups that are challenged either to develop ID services that will attract users, or to recruit sufficient users to their scheme in order to reach critical mass, banks already have both a ready-made userbase and an ID service (e-banking access) that is in popular demand. This puts the banks in a uniquely a strong position to facilitate the launch of national ID schemes together with supporting their wider development over time.

Identity schemes in focus

For these reasons (with the exception of e-Estonia, which is a 100% government-led scheme with mandatory citizen adoption), banks and financial institutions have enjoyed significant roles in all of the digital ID schemes reviewed. Some, indeed (including NemID, BankID, ITSME for example) are either partly or wholly operated by private sector financial organisations. At the same time it is important to note that also e-Estonia has very strong participation from the financial sector and online banking is one of its most used digital ID services.

Finding the right starting point

Just because authentication to e-banking has been the most prominent service across the seven schemes in this study, does not necessarily make it the default starting point for any scheme. More important is to find a compelling use case that requires everyday engagement by users, and focus on using digital ID to enhance that process. This could be e-banking authentication, it could equally be something else specific to the individual market in question.

How are the schemes used?

Use drop down navigation below to adjust the best view for your device. 

Commonalities & differences

• Authentication to e-banking is the by far most prominent service.
• Enrolment is, for the most part, performed online with e-Estonia being the notable exception; this is also only scheme providing physical token (identity card) to represent digital identity.
• Existing banking credentials are being widely used as the principal means of initial identification.
• The inclusion of access to health records, together with other governmental services like taxes and benefits, is notably supported in the Nordic markets of Denmark and Norway, unlike elsewhere.
• Approaches to managing costs vary. Norway’s BankID used cost savings as an initial jumping off point, whereas the government-led e-Estonia scheme mandates that users pay €25 charge at a police station in order to obtain the validation required to enrol. It is also important to note, however, that in Estonia’s case the physical identity card provided is also a valid travel document.

E-Estonia is the exception, being government-led (although strongly supported by financial and other private sectors). It is important for banks to recognise, however, that when the government services demand that consumers validate their ID using another authority (and even require them to pay for the privilege), this does not form a barrier to adoption: 95% of Estonia’s population participate in e-Estonia.

Is branding needed for digital identity?

There appears to be consensus that creating a brand for each digital ID scheme is important, certainly in the early stages as adoption is building to critical mass. Whether separate brands are required to address consumer and service providers remains an open question, the answer to which is likely to depend on the unique specificities of each audience group in each market. While the importance of marketing is recognised, it is not fully applied universally, and different strategies exist for raising awareness and establishing the schemes’ brands. Certainly, for consumer-facing services a marketing focus on convenience and security is paramount.

Marketing

Commonalities & differences

• With the exception of Alastria, all schemes see the value in branding the scheme as an individual entity. e-Estonia has established both local and international brand names which it says has assisted in raising awareness of the scheme.
• Broad variations in the schemes approaches to marketing are apparent, ranging from no requirement at all (due to participating stakeholders managing the communication) to fulsome marketing designed to drive adoption.

Use drop down navigation below to adjust the best view for your device. 

Collaborate to succeed

As well as the enabling role that banks play, it is also important to recognise that six of the seven schemes are based on models of collaboration (with e-Estonia also strongly emphasizing its cooperative approach), comprising a combination of government, banking and telco organisations. This collaborative model is here to stay. With it, many of the schemes have already achieved significant success, both in terms of user enrolment and service provider acceptance.

And as the schemes mature, new services will be introduced that will require greater collaboration with a wider range of stakeholders. This is already evident in the Nordic and Belgian markets, where the ITSME, NemID and BankID schemes are well established, the domestic populations enjoy a high level of digital literacy and the major stakeholder groups such as government, transport and healthcare are equally advanced.

Level of collaboration

Commonalities & differences

• Most schemes operate a collaborative model
• Typically, schemes are driven and coordinated by a single stakeholder.
• Top management has been consistently involved in both policy creation and steering of development.

Use drop down navigation below to adjust the best view for your device. 

The business side: management & monetisation

While pricing for some business models was unavailable, it is interesting to note that more mature schemes have taken the step to publish their price lists. Typically, a per-transaction fee or an annual per-user fee (or a combination) is charged to the service provider using the scheme. Notably, having trialled a structure that charged users per-transaction, one scheme discovered that this was inhibiting usage so transitioned to a service provider fee model that is tailored to the number of users.

European regulation prohibits the majority of schemes from collecting and using data for commercial gain. Many of the schemes have also taken policy decisions in this regard, to respect the privacy of their users (and to guard against the risk of reputational damage that can occur from monetising user data). That said, there may be scope for this revenue stream to be developed, depending on the body, as anonymised data collected with informed user consent becomes more plentiful.

The broader question over who pays for the service – the user or the service provider –will be determined by those that organise and administrate the scheme. Results of the survey indicate however that service providers benefit from digital identity and are, therefore, also willing to pay for it.

Monetisation

Commonalities & differences

• All schemes rely on service provider fees for commercial support.
• None directly monetise user data, however, some provide identity data to merchants to enable ID verification.

Use drop down navigation below to adjust the best view for your device. 

In Norway, via BankID, a wholly digitised solution is in the pipeline which would entirely remove the lifecycle management costs of physical cards from the model, reducing the overhead required to maintain the scheme. This would, however, require every user to have digital access and have the skills to manage their identity digitally. New business contingencies would also need also to be put in place to support a 100% digital system.

From a management perspective, the notion of digital identity has largely been assessed from internal point of view, perhaps due to the seniority of decisionmakers – i.e. How to engage parties? Who pays and who earns? How to position competitively in the market for digital identity solutions? Conversely, little focus appears to have been applied to questions relating to the end-user: What does an optimal user experience look like? What are the most relevant services for the population? This is an area that will require increasing attention as the schemes develop, particularly since user-centricity has become a defining force in digital service design.

What’s next?

Beyond delivering basic services, more advanced digital identity models, such as self-sovereign identity and multi-identity management, are much less widely represented. These have been introduced by more mature schemes, in Nordics and Belgium for example, which suggests that adoption elsewhere will follow, as the other schemes become more sophisticated over time.

While all schemes have a mobile variant, some can be described as ‘mobile dominant’, reflecting that mobile devices are becoming the default environment to use and manage digital identity. The services provided by collaborative, multi-stakeholder schemes are popular, particularly when user-access to services is easily accessible via mobile devices.

The cross-border conundrum

Collaboration across national borders is what many consider to be the natural next step for Digital ID. The digital or online world is rarely constrained by borders; we routinely trade goods and services internationally using digital systems, and data available on the internet (with a few exceptions) is freely accessible, globally. Why shouldn’t a German digital ID be useable in France, Norway or Canada? Now that all the schemes operate through the mobile channel (with some clearly championing a ‘mobile first’ strategy) the market pressure to deliver on this simple premise continues to grow year on year. Unlike the idea, however, the reality is fraught with complexity.

It is clear that all the schemes are bound by some form of regulatory standard, both for electronic identity and data privacy. These regulations, which provide restrictions over the actions of the schemes, act principally to help them establish legitimacy – a key factor for successful adoption, both by service providers and users.

Given that all of the schemes have developed from their local market, legal harmonisation will be crucial in enabling cross-border and domestic (cross-market) interoperability.

From a technical and regulatory perspective, Europe is playing an active role. The recent introduction of the eIDAS regulation which promotes cross-border consistency provides a foundation for wider adoption of digital identity. This EU regulation mandates that ID schemes must comply to a standard framework for electronic signatures which, in theory, will make it usable across the whole of the EU. As a result, participating governments will be able to accept a foreign digital identity to provide access to its services as needed.

Cross border potential & regulatory considerations

Commonalities & differences

• All schemes based in Europe must abide by EU regulations including GDPR, eIDAS, PSD2 SCA, AML5 and others. Verified.Me operates according to Canada’s Privacy Act and the Personal Information Protection and Electronic Documents Act (PIPEDA).
• All schemes must also operate in compliance to domestic regulations.
• Nordic schemes have been specifically designed to be domestic-only services. Others have either been designed to be open to cross border integration, or are exploring their potential.

Use drop down navigation below to adjust the best view for your device. 

More work needs to be done before the various European schemes can converge. Each scheme is bound by domestic regulations which, by definition, vary from market to market, and sometimes also contradict legislation defined at the EU level. Legal harmonisation is also just part of the integration picture. The schemes are also challenged by their different business models, and by not sharing a common underlying infrastructure. With these factors in mind, interoperability remains distant, and long-term collaboration will be needed to achieve it. Thanks to the consolidation of financial systems that has already taken place in the Nordic countries, however, cross border interoperability restricted to that specific region may be a nearer term possibility.

Technology choices

Commonalities & differences

• All schemes have based their solutions on either Public Key Infrastructure, or blockchain technology.

Use drop down navigation below to adjust the best view for your device. 

Where there’s a will, there’s a way

Ultimately it is up to those stakeholders that organise and administrate the schemes to work to establish trust between them. If this can be accomplished, then a meaningful level of co-operation could well be possible without forfeiting compliance to each scheme’s domestic regulations. Just as important is the shared will of decision makers influencing the management and direction of the schemes. Close collaboration between relevant parties, and the strong endorsement from the top management of each participating entity, are vitally important factors for success. These conditions create interoperability almost by default, because the motivations of contributing stakeholders are aligned, as is the collective will to contribute and drive the scheme towards common targets.

Conclusions

The results and observations presented in this report indicate a clear and widespread need to establish secure and user-friendly digital identity. How to reach such a position varies, but is always rooted in the trust that the identity issuer is able to establish with each individual. This is where the banks still reign supreme. They have mastered the ability to operate at scale in highly regulated environments, under conditions that require rigorous and stringent security and identity verification procedures. This makes the banks prime candidates to be future guardians of their customers’ digital identities, potentially supporting services that stretch beyond their traditional banking and finance territory, generating new revenues as a result. It also means that, in today’s age of the data breach, they have rightfully earned the trust of their customers to perform these services.

Also clear is that schemes are successful when they provide relevant and frequently used services that are delivered in an accessible manner via good user-experience. The scheme’s ability to scale quickly, both in terms of enrolled users and number of service providers is just as important. Again, banks have a strong position, since they have multiple assets like existing KYC processes and services like banking login that users frequently access.

Unsurprisingly, mobile devices have established themselves as the preferred channel for managing digital identity. Here, it is important for banks and other stakeholders to develop an in-depth understanding of the whole mobile ecosystem, including the roles of device manufacturers and device platform vendors. This knowledge will aid their creation of strategies that will help them to secure long-term and pivotal roles as the digital identity industry continues to evolve.

The study also reveals that close collaboration between relevant parties, and the strong endorsement from the top management of each participating entity whether private or governmental, are also important factors for success. These conditions create interoperability almost by default, because the motivations of contributing stakeholders are aligned, as is the collective will to contribute and drive the scheme towards common targets.

As digital ID schemes continue to mature, the issue of cross-border interoperability will gather momentum. While EU regulation has provided the framework for interoperability, much work remains before the schemes can be harmonised to enable a seamless flow of digital identity usage over the borders. Here again banks can have important role to play.

No mention of digital services (ID-related or otherwise) is complete without mention of the ‘GAFAs’ Google, Amazon, Facebook, Alibaba/Alipay etc., together with other global, networked firms like Mastercard and Visa. Like so many other industries, these hugely powerful players have serious potential to upend the global market for digital ID. With millions of subscribed customers, no cross-border interoperability challenges to overcome, and a wealth of knowledge and expertise in the digital space, they have the potential to disintermediate other parties like banks from the digital ID value chain. Already they have stakes in some forms of digital ID, most commonly in user authentication for lower-security cloud services. Should they opt to collaborate with governments on new solutions, they could represent an instant, scalable and friction-free route to market for new ID services. How long it will take the GAFAs to reduce this lead is hard to predict; they can certainly move quickly but, equally, are unlikely to be afforded bank-beating collaborative relationships with governments any time soon.

Most importantly, banks must be cognisant of the opportunities they have to adopt critical roles in enabling and facilitating digital ID schemes, and realise that this advantageous position is likely to change soon. Perhaps sooner than they think.

Engage with us

If you would like to learn more about the Mobey Forum Digital Expert Group, or talk to us about membership to Mobey Forum please contact us.