Q&A: HooYu on the challenges of ID verification

With the recent changes to the Licensing Conditions and Codes of Practice (LCCP) for UK operators eliminating the long-standing 72-hour rule, gambling operators are now faced with changing their customer onboarding process into one which places verification front and centre. As a result of these changes, existing procedures will have to absorb faster methods of customer verification technology.

HooYu specialises in helping gaming operators to verify customer identity, conduct Know Your Customer (KYC) checks, Enhanced Due Diligence (EDD) and customer investigations. Having started 20 years ago as 192.com, the firm offers both a KYC onboarding platform, HooYu Identify, and an EDD platform, HooYu Investigate. These services are currently being used by banks, government departments, online gambling operators, retailers and many other organisations to verify or investigate thousands of individuals every day.

Counting Ladbrokes Coral among its list of gaming clients, HooYu marketing director David Pope chats to EGR Compliance about all things verification and how technology can open the door to greater understanding of customers.

EGR Compliance: How will the forthcoming changes to the LCCP in the areas of age and identity verification affect the way HooYu conducts business?

David Pope (DP): The changes won’t really affect how HooYu does business. It affects how the operators onboard their customers, in terms of more KYC being performed and the timing of the KYC being performed much earlier in the process. From our perspective there will be more call for services like HooYu, far earlier in the process, as the LCCP is really moving KYC from the middle of the customer journey to near the beginning.

Obviously, beforehand operators had a window of 72 hours in which they could conduct KYC on customers and accept new deposits, but now it must be immediately at the point of first deposit. In respect of free-to-play games, verification must be conducted even before the customer can use free-to-play gambling services. So, in all instances, whether it’s pay-to-play or free-to-play, the KYC must be conducted before the actual gambling can commence. I think the rationale is that the Gambling Commission looked at the regulatory return data from operators and they saw this data was showing as many as 60,000 customers a year were unable to prove their age. This illustrates that there is a substantial amount of underage gaming going on and policy objective number one here is preventing underage gambling.

The new LCCP targets a secondary policy objective which is keeping crime out of gambling. In a recent Gambling Commission enforcement report published in 2018, the UKGC said it still saw operators having insufficient knowledge of the customer identity which further down the line could lead to AML and social responsibility problems. The new LCCP also targets a third policy objective, treating customers fairly. The UK Competition and Markets Authority had already called for remote operators to make it fairer for customers to withdraw winnings by performing some KYC activities earlier in the customer lifecycle, so that KYC requirements do not delay payment of winnings.

EGR Compliance: Do you think the new LCCP could have an adverse impact on operators’ onboarding funnels?

DP: It can do but it shouldn’t. The reason is that the technology exists to allow operators to have a seamless well-designed customer journey. The 72-hour rule is something of a relic of the past. It assumed that operators would need the full 72 hours to check customer information and it dates back to when the Commission first regulated gambling in 2005.

Companies like HooYu have two jobs, the first job is to help the operators meet the compliance requirements. Our second job is to help operators maximise the number of customers that can successfully get through KYC, so whenever we work with our clients we don’t just give our technology and say off you go. We work with them to help implement the best customer journey that they can curate. This enables them to both satisfy the objectives of complying with regulations, while having a really good-looking acquisition funnel making sure that as many customers as possible can get over the finishing line to go on and gamble (responsibly).

Using current on-boarding methods, operators perform an initial database check and if that fails then they flash a message up onto the screen saying, “Oh sorry we can’t verify your identity, but you’ll receive an e-mail shortly telling how you can still become a customer of casino XYZ.” By that point when the customer sees the e-mail they’ve already gone and they’re trying to register somewhere else. Poor KYC processes like this create a body blow to successful customer onboarding. Of course, what HooYu is designed to do is to sit snugly inside the operator’s website or app to initially do the database check. If the customer can’t be verified, then the HooYu API and UI enables the customer to submit proof of ID and address documents (inside the site or app) which are then checked and cross-referenced and an immediate decision provided.

EGR Compliance: How often is your identity verification database updated and which national databases are the HooYu platforms connected to?

DP: HooYu isn’t just about database verification. Our background is that we built a successful database verification company called 192business, which most of the major operators used before we sold it to Experian in 2012. When we started HooYu we wanted to go beyond traditional database methods.  Firstly, they only successfully match name, address and date of birth 75% of the time in the UK and in many countries such as Spain, France, Italy and most other countries around the world there are no verification databases.  Secondly, you could argue that in today’s age of data breach, a database check is no longer the defence it used to be because fraudsters now have their hands on so much data.

HooYu goes beyond the database check to verify the identity of the person behind the transaction as opposed to just following a tick box approach to database verification. Our clients use our database verification for initial checks and results are delivered in real-time and use multiple sources. It combines the positive name, address and date of birth checks along with PEPs, sanctions and adverse media checks and is updated in real-time.

EGR Compliance: What is the biggest lesson in ID verification that the online gambling industry can learn from the financial services industry?

DP: Our KYC and onboarding solutions are used by established retail banks, challenger banks and lots of FinTechs. To be honest, we see that gaming operators share the same customer onboarding problems as banks. The biggest lesson that operators can learn is that they need to curate the customer onboarding journey, they need to really obsess about the customer’s digital journey and think about the best onboarding process at every stage. The best thing to do is to avoid that crappy two stage process whereby the customer can’t be verified and so they get an email telling them what to do next.

EGR Compliance: Many online gambling operators have encountered delays in their enhanced due diligence processes, which have affected their revenue streams. How does HooYu deal with enhanced due diligence?

DP: Several gambling operators including Ladbrokes use our EDD service. To explain, we have two parts to HooYu. HooYu Identify is our client on-boarding and KYC service used by the big banks and gambling operators and then we have HooYu Investigate, which is our EDD service.

The problem that operators have had historically in terms of EDD is they’ve had to go to lots of different places to get all their EDD materials to assess that customer’s overall affordability. Compliance teams often do open source investigations using Google to see what they can find out about the player, go to the Land Registry to find specific information about property customers might own, or go to Companies House to review company shareholdings. Consulting these multiple sources is time-consuming.

What HooYu Investigate does is bring all those data sources into one interface, generating a visual network graph of that player and to show what addresses, what property ownership is linked to that player, to show any negative financial indicators associated with that player or perhaps with their spouse or co-habitants. It also shows whether that customer has historically applied for any short-term loans and gives insight about the potential rental income or rental cost of the property that’s associated with that player.

EGR Compliance: How do the HooYu Investigate and Identify platforms take regulatory changes into account?

DP: We have always worked hard to try to sit and consult with the regulators as frequently as possible and to show them the extent of what KYC technology is capable of now. I’ve been making pilgrimages up to Birmingham to see the Gambling Commission since 2005 and have always maintained a relationship with the Remote Gambling Association. We always want to show them what the technology is capable of, but also to understand what is coming down the line from them in terms of consultation and in terms of revision to the LCCP.

EGR Compliance: Where do you see the next big areas of expansion in ID verification software?

DP: The next two areas are that operators will increasingly use multiple identity technologies in the same process as opposed to just checking a database or just checking identity documents. They’ll start to see KYC technologies working together as a more holistic process and to blend those technologies all into one seamless customer journey. We’ve seen that’s how our clients like to use HooYu and they use multiple identity technologies from us, not just because it means they have less vendors to integrate, but also because it means they can drive much more insight by combining the results of the identity technologies all at once. Finally, I think the next step in ID verification and EDD is going to be shared data between operators of fraudsters and of problem gamblers.