KYC mechanisms for enterprise clients

[dkkapur]

As part of thinking through the enterprise client's path to DataCap, @MegTei and I volunteered to kick off some thinking on ways in which we can come up with mechanisms for clients to do KYC.

Specifically, the goal is for a client to have a path to prove that they are who they claim to be, and that they are not an organization that we specifically should not be supporting in the Fil community.

Ideally, this happens via an automated, min-effort mechanism that clients use as part of filing their application to receive DataCap. Results would need to be shared either with all notaries, or a subset of notaries that are willing to support this client.

[dkkapur]

On 2022-05-05, we talked about different solutions that exist today, both in the Web2 and Web3 space, that we could learn from or look to utilize in the application process for clients. Starting off a list of some of the ones that we'd like to learn more about:

• https://diro.io/
• https://www.chainalysis.com/
• https://streambird.io/
• https://feedzai.com/

[dkkapur]

@MegTei there were a few you mentioned as well that I don't have the right links for, mind adding them here?

[MegTei]

@dkkapur if you have any contacts with these, send an intro email and loop me in

[dkkapur]

@MegTei there's MinervaAI as well. forwarding you a sample from them right now!

[kevzak]

@MegTei @dkkapur I spoke with:
Trulioo - they offer both KYC and KYB but require much larger use cases
Veriff - does KYC, they would offer a starter plan for us https://www.veriff.com/plans#starter-plans
MinervaAI - I have a call tomorrow
Streambird - reached out, haven't heard yet
Diro - Looks like a good KYB option, open source API

[dkkapur]

4 flags we want to test for:

1. who's this person?
2. who's the organization?
3. are they actually linked / is this a real representative?
4. are they sanctioned?

[kevzak]

5. email verified (github handle, linkedin, slack)

[kevzak]

From Trulioo:
Personally identifiable information (PII) when they can be used to identify a specific person:
name, date of birth, phone number, IP address, email address, or ID number.

Businesses are likewise identified by data points, including business name, business address, and business
registration number. Businesses also have owners who can be identified with personal data

[kevzak]

@dkkapur We can do separate KYC and KYB but linking them is not a normal check. You cannot definitely confirm someone works somewhere. Any other thoughts?

[AlexxNica]

We gotta figure out how to uniquely identify companies. That'd be needed to check against public databases/registries (e.g., phishing, privacy-related lists).

[kevzak]

Hi @AlexxNica have you done any other research?

[AlexxNica]

@kevzak Yup! I'll share more on that soon!

[kevzak]

Any updates here @AlexxNica

[jnthnvctr]

It occurs to me that there might be a (simple?) ish answer for us- effectively what we're solving for is an identity problem (something that can provide sybil resistance. Without requiring something that is naturally sybil resistant (like a payment mechanism) we need something else).

Note there are solutions that folks have been working on in other ecosystems to solve for this problem - and I'm excited for us to think broadly about what we could do with the FVM:

• You could imagine using web of trusts to allow miners to "stake" capital on behalf of clients (similar to proof of humanity)
  --> You could imagine this on chain reputation then allowing for miners to be slashed alongside clients if the client / miner are found to be acting inappropriately (punish -> slash collateral at stake in the web of trust, deny for future allocations).

In the short term, one answer might be something much simpler:

• Get the company to tweet out a specific phrase (public key? link to their application?) - to associate them and a "sponsoring" miner address.
• If the company violates whatever terms we set out, the miner is unable to sponsor folks for some period of time.

The miner id obv can't be swapped out easily so we can anchor that way?

[jnthnvctr]

side benefit of tweeting: public association / marketing

[kevzak]

@jnthnvctr if you have any more intel or ideas please share here. I'm actively researching KYC/KYB options for an upcoming pilot of Enterprise, private data, clients starting in Oct 2022. Thanks!

[kevzak]

Update on KYC/KYB: We've found a strong product in MinervaAI. We will be able to perform identity check of the applicant (data owner) and also do a business check and risk review.

The one piece missing will be connecting the applicant directly to the organization. @raghavrmadya @Sunnyiscoming I'd like to connect with you to learn about the current KYC email check process. Thanks