Using social media to verify seen as gamble

The new requirement for customers to provide their social media handles before starting any business relationship with banks and financial institutions leaves many operators with uncertainty.

According to the Central Bank of Nigeria’s (CBN) Customer Due Diligence Regulation 2023, banks and other financial institutions are to obtain an individual’s legal name and any other names used; permanent address (full physical address); residential address (where the customer can be located); telephone number, email address and social media handle; date and place of birth; Bank Verification Number (BVN); Tax Identification Number; nationality; occupation, public position held and name of employer.

The individual will also need to provide an official identification number or other unique identifier, contained in an unexpected document issued by a government agency, that bears a name, photograph and signature of the customer such as a passport, national identification card, residence permit, social security or driver’s licence.

Experts who spoke to BusinessDay said it is a lot of requirements for an individual, millions of whom are currently out of the banking system and may just want to simply access financial services. The regulation does not make an exemption. Financial institutions are required to implement customer due diligence measures as early as when the customer wants to establish a business relationship.

“It’s still a bit clumsy why the CBN requires this; however, the banking industry in Nigeria is highly regulated and compliance with any CBN regulation is a must. So, industry players have no option but to comply. What we now need to watch out for is the practicability of this regulation; I don’t think it will be a mandatory requirement for any bank customer. So in that light, many people with social media handles might as well not disclose it,” said Johnson Ajani, a product manager and banking sector expert.

The integration of social media in financial services is not new. Many operators, especially in the credit industry, have increasingly utilised social media as a tool in assigning credit scores and ultimately deciding which customer deserves to get a loan and which does not.

According to a report on Global RADAR, it is possible to spotlight suspicious activity through social media activity; this includes an individual’s posts and even the basic information being added to their respective profiles.

“In locating each of these accounts, an institution can essentially create a web of personal information on an individual that can be checked against the information they have provided to a financial institution,” the report said. However, it may be difficult to establish a correlation between social media and antimony laundering/counter-terrorist financing campaigns at the initial glance.

The CBN regulation makes Nigeria one of the few countries where the central bank is actively pushing the integration of social media in customer due diligence. In most advanced countries, banks are not mandated to use social media for Know Your Customer (KYC). In Canada, for example, it is the revenue agency that uses social media posts, specifically those found on Facebook, to monitor potential tax evasion suspects.

The challenge with mandating social media as part of due diligence is the size of people actively using it. A report by Statista shows that out of a population of 220 million citizens, only approximately 34 million (about 15 percent) are connected to social media. Meanwhile, the number of BVN accounts in the country is 56.4 million. Mandating the regulation would mean that banks have no choice but cut off the customers who do not have social media accounts.

Bolaji Akinboro, CEO of Voriancorelli, an agritech company and a former CEO of Cellulant, a fintech company, said there is a privacy challenge with the regulation.

“CBN should face its core business of monetary policy and financial systems stability. It has done a fantastic job of introducing the BVN but demanding the social media handles of Nigerians is an invasion of the privacy rights of Nigerians,” Akinboro said.

It is a position that Socio-Economic Rights and Accountability Project (SERAP), a civil rights group, agrees with. Banks and other financial institutions already collect a lot of data from customers to provide financial services for them, adding social media to that collection means the banks would have access to personal and sometimes intimate information their customers may not want to release.

Digital lenders already demand social media accounts to enable them to have better knowledge of the customers they are giving loans to. For these operators, the regulation only provides a legal framework for a practice they are used to.

“We’re suing the Central Bank of Nigeria over the unlawful mandatory regulations demanding details of bank customers’ social media handles as a form of identification,” SERAP said in a Twitter post.

Apart from the privacy protection challenge, the regulation also means the country is now more dependent on social media companies. All the popular social media platforms hosting over 34 million Nigerians and their private information are mostly located outside the African continent.

Esigie Aguele, CEO of VerifyMe, said Nigeria should be pushing to be less dependent on these platforms so as to protect its national data. Facebook, Twitter and several social media platforms have experienced incidents of data breaches that left millions of users exposed.

For example, Facebook was fined $1.3 billion in May by EU data regulators, and ordered to stop transferring the Facebook data of EU citizens to the US. In January 2023, the email addresses tied to 235 million Twitter accounts were shared in an online hacking forum.

Read also: Nigerian politicians struggle to tame social media generation

A bigger headache for Aguele and operators in the identity industry is the existential crisis they face should the regulation be completely implemented. In the regulation, the CBN also requires banks and other financial institutions to establish internal processes and procedures for conducting customer due diligence measures for all potential and existing customers, including occasional customers.

These measures include customer identification and verification of identity; identification and verification of the identity of beneficial owners; understanding the nature, and purpose of business; understanding the sources of funds; and conducting ongoing due diligence on the business relationship and monitoring for suspicious activities. Prior to now, the banks relied on KYC and identity companies like VerifyMe to carry out this service.

“We should not manage an entire economy like it’s just one bank or one institution, this is a big economy with diverse kinds of stakeholders. Think of the farmer in Jalingo, he needs financial services and we want to bring him under the umbrella, how do we tell him to go and bring Twitter or Instagram?” Ajani said.