Assurance-level mapping
National digital ID credentials are mapped to the identity assurance levels and due diligence requirements that financial onboarding needs, showing where reliance is possible and where further checks are required.
GRA · Fintech Nexus
Spatial financeWhere capital meets hazard, exposure and transition
Digital identity in finance
Digital identity is how people and firms prove who they are to financial services and how they authenticate each time they return. In this field it is studied for its effect on fraud, on the integrity of anti-money laundering controls and on inclusion, especially where national digital ID and public payment rails form digital public infrastructure.
01Register
Digital identity in finance on the record.
Method recordSTEM method
- MethodDigital identity and public digital systems
- Applied inFintech Nexus
- Data5 inputs
- Checks4 validation steps
- Canonical pageSTEM Commons
02Application
What digital identity and public digital systems does here.
Digital identity and public digital systems provide the means for people and organisations to prove who they are and access services online. They underpin social protection, financial inclusion and emergency assistance. In capital markets and investment, cyber and digital resilience and digital public infrastructure, digital identity systems determine how quickly aid and payments reach people after shocks. Their failure or misuse can amplify social and economic harm. The canonical description is on the STEM Commons.
Remote proofing attack testing
Document checks, face matching and liveness detection are tested against presentation and injection attacks, using independent evaluations and red-team samples, with error rates reported by group.
Exclusion analysis
Onboarding rules, document requirements and authentication methods are assessed against who lacks documents, phones or connectivity, so exclusion is measured alongside fraud prevention.
03Monitor
Security assessment.
The screen a team would use to follow this method: its measures, states and decisions. Names are examples and values are illustrative.
Security assessment
Fintech · Digital identity in finance · Run R-8326
Two high findingsGRA · Fintech Nexus
Findings
| Weak key rotation | Identity service | High | PR.AA | Open |
| Unpatched gateway | Edge | High | PR.PS | Fixing |
| Logging gap | Payments API | Medium | DE.CM | Open |
| Stale accounts | Directory | Low | PR.AA | Closed |
Method card
- Method
- Digital identity and public digital systems
- Framework
- CSF 2.0 functions
- Scope
- 37 assets
- Label
- MODELLED
Control coverage by function
04Data
What the method consumes.
Datasets and records used by digital identity and public digital systems on this platform, with the role each plays and the label its values carry. Sources are listed in the source register.
| Data | Role | Label |
|---|---|---|
| World Bank ID4D Global Dataset | Coverage of foundational ID systems | ESTIMATED |
| Global Findex | Barriers to account ownership | ESTIMATED |
| NIST biometric evaluations | Algorithm accuracy and attack detection | OBSERVED |
| Firm onboarding and fraud records | Fraud and abandonment by channel | OBSERVED |
| Identity authority audit reports | Privacy and security controls | Published statistics |
05Exposure, loss and capital
What digital identity in finance means for exposure, loss and capital.
The exposure, loss, scenario and capital views a risk officer, supervisor or ministry of finance would ask for, with the frameworks they report against. Structures follow supervisory and actuarial practice. Values are illustrative: never prices, ratings or advice.
Transmission channels
How a shock in digital identity in finance reaches credit, market, underwriting, liquidity and operational risk, and feeds back.
NGFS climate scenarios · Network for Greening the Financial SystemIFRS S2 Climate-related Disclosures · ISSBTCFD recommendations · Financial Stability Board TCFDPrinciples for the effective management of climate-related financial risks · Basel Committee on Banking Supervision
06Validation
How results are checked.
Systems are tested for accuracy of matching, resistance to fraud and accessibility. Independent audits review privacy and security controls.
| Check | How it is done |
|---|---|
| Error rates by group | False match and false non-match rates are reported for demographic groups, not only overall |
| Independent attack testing | Presentation and injection attack tests are run by parties independent of the vendor |
| Privacy impact assessment | Data flows, retention and purpose are reviewed before any reliance on a national ID |
| Fallback route | Every digital route has a tested alternative for people who cannot use it |
Exclusion errors can deny services to vulnerable groups. Centralised systems create attractive targets and single points of failure.
07Process
How the process runs.
Process explorer · Process
Digital identity in finance: Incident handling, CSF 2.0
8 steps·4 stages·1 gate
Process
Digital identity in finance: Incident handling, CSF 2.0
CSF 2.0 has six Functions to address concurrently, in no implied order; this walk-through picks outcomes from Detect, Respond, Recover, Identify and Govern.
01 Detect
- 01Detect: adverse event analysis (DE.AE)DatasetPotentially adverse events are analysed to detect cybersecurity incidents. Information is correlated from multiple sources.
- 02Declare and triage (DE.AE-08, RS.MA-02)GateIncidents are declared when adverse events meet the defined incident criteria. Incident reports are triaged and validated.
02 Respond
- 03Respond: incident analysis (RS.AN)ModelInvestigations establish what has taken place and the root cause. Records of the investigation keep their integrity and provenance.
- 04Respond: incident mitigation (RS.MI)Step · Consumer protection leadActivities prevent expansion of an event and mitigate its effects. Incidents are contained and eradicated.
- 05Respond: reporting and communication (RS.CO)StepResponse is coordinated with internal and external stakeholders as laws, regulations or policies require. Stakeholders are notified.
03 Recover
- 06Recover: incident recovery plan execution (RC.RP)StepRestoration is performed to restore availability. The integrity of backups and other restoration assets is verified before use.
04 Improve and govern
- 07Identify: improvement (ID.IM)StepImprovements come from evaluations, tests, exercises and operations. Incident response plans are set, shared, maintained and improved.
- 08Govern: oversight (GV.OV)Decision · Consumer protection leadRisk management results inform and adjust the risk strategy. Leadership is responsible and accountable for cybersecurity risk.
Neutral outline of a published external standard or method, from its issuing body. Not a record of operation. Nexus does not perform, certify or approve any step shown. A gate or decision belongs to the party the source names. The six Functions are Govern, Identify, Protect, Detect, Respond and Recover.
09Stewardship
Who maintains the method.
Digital Public Infrastructure stewards digital identity and public digital systems for the Consortium and reviews how it is applied across platforms.
10Connected
Where this page leads across the Consortium.
11Questions
Questions and answers.
What are the limits of digital identity and public digital systems in this field?
Exclusion errors can deny services to vulnerable groups. Centralised systems create attractive targets and single points of failure.
How are results checked?
Systems are tested for accuracy of matching, resistance to fraud and accessibility. Independent audits review privacy and security controls.
Are the values on this page real?
The data names, roles and checks are real descriptions of practice. The canvas shows a design of the method's use, not a run; no result is reported here.
Where else is this method applied?
The canonical method page lists every platform that applies it.
ReportsContribute
Contribute evidence from this page.
Reports is the Consortium's quarterly publication. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work.
Global Risks AllianceFintech NexusExponential TechnologyFinance and Insurance Readiness
- EmailGateway GW-GRASend it from this pageEvidence, a correction, a case, a method, a review, a translation or profile input. It arrives tagged with this page, so the editor who owns it receives it.
- ZenodoOpen depositDeposit it and submit to the communityPublish your own record on Zenodo with your ORCID iD, then submit it to the Reports community there. Curators review it; the DOI stays yours.
- ReportsGlobal Risks AllianceSee every way to contributeThe contribution types, how each is reviewed, what credit you receive, the licence and what is never accepted.
Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.
Fintech Nexus
Bring an exposure or capital question to the Alliance.
Information and enquiries are open today. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.
Legal
Legal documents.
Maps, data and figures on this site are shown for context and general information. They are not advice, forecasts or warnings; the limits of the information are set out in the Disclaimers and Data Notices.