Our Head of Regulatory on the evolution of law in identity verification

Welcome to the Ferrit Voices Podcast. A collection of conversations with leaders from across the industry, sharing tips and valuable insight into shaping the future of online identity. This podcast is bought to you by the people of Ferrit, rebuilding trust in the digital world. Hello and welcome to this episode of Ferrit Voices. My name is Chris Hooper and I am a director of creative and content here at Ferrit. In the fast-moving ever-evolving world of digital businesses, it's vital for Ferrit to meet all of our regulatory obligations to ensure safety and security for all of our customers and users and that we are operating responsibly while fulfilling our mission to return trust to the online world. One of the people playing a key role in this is Alexander Summon. With nearly a decade of experience in law, Alexander is our head of regulatory and in this podcast we cover a number of topics including his key insights into regulatory developments in the IDV sector and what this means for businesses. So first of all welcome Alexander. Thank you for very much joining us. I appreciate it Greg Lee. Hi Chris and thank you for having me. I guess the first question really is sort of how do you create sort of and enforce this kind of accountability around any of the sort of compliance works, the compliance regulations that we have to sort of adhere to. Yeah I think that's a good question. I think in the end it kind of boils out to three elements. First is the culture, culture of the company. Second is kind of engagement and actually the third is kind of being in right place actually. To start off from culture it's kind of a top-down question right. So it's a question why is actually kind of valued in the company but it's also kind of very strong delivering the answer to the question you know why. Why do we have to do certain things right? And when the culture is there when it's kind of emphasized that certain actions you know have to be taken not for the sake of you know you know being compliant with with the law or just kind of doing a checkbox exercise but actually there's there's actually the why why this regulation for example exists that for example we kind of want to protect the privacy of our end users you know then it just kind of becomes much more you know clear and you know when the leadership is kind of you know also living the same values then it's kind of very easy for the for the company and the individual contributors to actually a live that culture. From from an engagement point of view yes you can kind of you know have this approach that yes we want to kind of embed compliance into our policy and procedures but you have to actually you know build those processes and trainings and communication channels in a way that those are engaging and they are kind of the most close to the actual ways of working off the organization and to the teams that are most affected by the process we take is that we are trying to be as close as possible and we're trying to understand like how do the teams except the product or engineering teams are actually working so that we can kind of you know embed the processes where they are most you know most makes sense for example for a software developer and I think the question is you know are you actually you know reachable are you are you open to just have to be approachable in that sense that the people you know have to have the opportunity to write to ask questions and you also you know question the frameworks that you have put in place and lastly the you know big and right place I don't use to kind of phrasing you know being directly the right time I think it's just kind of you know being in the right place all of the time and that very much means that there are certain you know for example in a product development life cycle there are certain stages where you can have quite a strong compliance impact for yourself and it's just important to write people are embedded into those processes you know that they are a natural part of that process actually so so that actually you know from our from example point of view is that we have you know product attorney or product councils or product lawyers actually in a very in my team and they are they're actually engaged throughout the regular you know sinks with the product managers regular revisions of you know work regular kind of planning cycles you know they're actually embedded into that life cycle that is the way that we ensure that you know in the most critical places we are always there yeah I like that what what some of the main regulatory challenges facing businesses around the issue of identity verification that you're seeing today yeah I think it's a big question right so it's a really big question we can kind of you know drop it into you know I'll say like three pieces first I would say it's kind of the challenge are very kind of use case specific secondly there are you know being called them kind of you know purely regulatory challenges and thirdly we can separate kind of your technological challenge so I'm going to go into each of them separately but I think the you know first of the you know the use case challenges are really very much related to the identification as such so in this kind of different shapes and forms I will say identification is definitely on the rise and we're seeing actually kind of new use cases popping up so you know those use cases are mainly connected to new laws and regulations being introduced and those laws and regulations actually require customers to know who is the person behind the screen and there are kind of different thresholds actually restore companies need the assurance of someone's identity but I think they're kind of very classical you know just kind of you know do the identification of a document that's probably you know that's still there but they kind of need for that I think it's it's declining also times because the new laws and regulations actually do require a kind of very limited set the number of personal data to actually verify it so we don't for example want or need to verify the whole document and for example EU there is a regulation a law called EIDAS and actually the EIDAS is being currently revised so there is going to be being what EIDAS 2.0 which actually kind of changes how you're being new in that European Union member states view centralized these to identity and also puts actually extra obligations on the member states just to change approach that they're currently taking with the distal identity so that will be very important for the for the EU market and among others it mostly requires the member states to watch actually a kind of a physical wallet solution which actually also will all quite a lot of personal data but it will actually give users control over that data and you know we can kind of take the UK for example as well first the UK is has actually put forward its trust services framework and instead of more and more being actually integrated into the the ecosystem of the UK as you know UK as you know unfortunately unfortunately they kind of departed the European you know family so to say so there is actually an opportunity for for UK to kind of you know build and and you know bring about this set of own those solutions and you know the it's all an ecosystem and they're actually and if you're changing your happening around that as well the second part of the challenge is I would just you know say that they're kind of career regulatory challenge and that's just what the sake of me simplifying it for myself right is is you know those actually concern not only the businesses that are involved in kind of identification or you know online businesses they're actually business you know laws and regulations that concern all the businesses and they you know prime example would be the you know the private cells they're existing private cells but they're also kind of you know changes to existing private cells and the emergence of new private cells a good example from a choreographic perspective for example the US the US doesn't actually have a kind of federal private cell but there's no kind of centralised approach to privacy but we're seeing actually new states regulating with a relatively high pace so this will not only affect the identification sector or the other businesses using identity verification it actually affects all of the businesses so thirdly the technological challenges those should definitely not be ignored and you know probably no one is really surprised when I'm saying that those actually concern the artificial intelligence and kind of machine learning technology and yes so this is where we see the regulation or the kind of the emerging regulation concerning those technologies is coming into play we see you know more and more regular regulators and legislators actually addressing the challenges of widespread adoption of artificial intelligence and I think the kind of best example and you know maybe the best no example is the European Union's artificial intelligence act although the EU is definitely not you know a lowly in this space in case we look at the kind of major economies for example the US and UK all of those have actually said that they are firstly all understood that they have to take some kind of an approach this is due to I would say firstly a trust issue in society where I would say the people actually coming in contact with artificial intelligence solutions are you know there is a question of you know whether they're I can be sure that I'm talking for example with a human or is the machine that I'm you know talking with is the content real or is the content generated by by an artificial intelligence solution I think you're right so dividing up into those three sections is a really good way of kind of understanding this and and I've thought just why you were talking about that last one actually around AI we've got we've got a lot of content coming up around this be such a hot topic at the moment and it's obviously a huge part of our business it did maybe think why you were talking the around that kind of almost game of cat and mouse that is played between sort of regulators and tech innovators if you like in that the tech is moving in a million miles an hour and and and sort of legal legislation can be quite slow to catch up I know that the verif has played quite a sort of sort of well quite a fundamental role I think in sort of providing some of the information for that legislation that has been over the last sort of a couple of years actually are you able to talk at all about that just just briefly just as all as you know just to just to let the listeners know kind of the role that we're playing in sort of helping regulation keep up with the pace of tech yeah to reflect it or first it's very hard for legislation or you know law be ahead of time and I think that's kind of you know a go into the theory of law maybe a bit law should kind of regulate or should reflect something that is already in the society or is kind of emerging right because in case you're going to regulate front then you don't really really see what are the actual kind of effects down the line right so to go into the AI act yeah sort of has been involved in in the kind of the policy level activities regarding the AI act we have submitted submitted feedback we have been involved in the kind of stakeholder conversations and actually engaging with the with digital trade associations who are actually also kind of key players in the European Union so first I think that there is a general understanding that we should regulate something and there's just a question you know what is a risk enough to be a regulator and I think here is definitely that very right industry is looking towards you know regulate very precisely the things that are very kind of high risk and and that actually pose risk for the society as a whole for example are visiting a doctor or I don't know in the worst case we're having surgery right and when there is some kind of an artificial intelligence you know solution embedded somewhere in the kind of medical process then probably you have me would like you know that to be kind of very quality checked and you know be kind of up to certain standards right and I think there are you know key places in the society where we want to technology and also you know existing technology to function in a very kind of high level so that being said I think this is the place where you know most of the in the sub players are and society kind of like we that yes we should regulate for example and then you know when we kind of move so to say lower from those use cases then the picture gets a more kind of you know hazy right because you want to we believe of course that you know the existing laws should be upheld for example being in the European Union we have very strong privacy framework you know the GDPR is probably of the newest newest anyone actually the GDPR actually had its kind of five year birthday you know just as the short while ago so I think that it's it's kind of a question you know how much should be should be kind of rely on existing laws while putting forward kind of new obligations and and I think all the industry players are understanding that in case those obligations are reasonable and they address the actual kind of your risks or the points where risk actually merges then that regulations actually very much acceptable and very much kind of fine but I think that there is the European Union is taking somewhat of a risk being the first one to actually regulate in a at least from the big economies and I think that's that that you know can be the situation where the for example UK you know US are actually adopting kind of a more rate than sea approach where they have said that you know existing regulators are very much equipped and actually allow to enforce existing laws but we're not gonna put in place a kind of umperensive or overarching artificial traditions you know right now and although they although they might not you know say it out loud I think it's very much kind of you know let's wait and see what European Union is doing or how is it going and then we can adopt and and we can regulate yeah just maybe that that I think that the future of the of the identification industry is definitely you know more and more automation from a viewpoint that in case there's more automation then technology is also you know cheaper and it's actually kind of whites more whites where the adoptable so so I think that that you know it doesn't mean that the you know humans shouldn't be in the loop for kind of critical decisions for example and to review decisions when there is a kind of a level of doubt that something is going wrong but I think we want to in a certain sense democratize technology in a sense that we can provide the kind of you know services and the technology for actually kind of you know it reaching the trust online yeah absolutely I totally agree with you and I think it's um you know one of our missions obviously is to try and you know rebuild this this this feeling of trust online and I think we we're doing that a number of ways through our technology through contributing to these sort of you know these legal frameworks which are developing and everything else I think it's really encouraging to me that bear if it's taking a proactive role in that and kind of yeah kind of leading the way to a certain extent when when it comes to those kind of things back to what we were talking about earlier actually around sort of this sort of ever evolving and constantly changing sort of external picture especially when you factor in the different jurisdictions that you're working obviously the EU UK is one thing but the US and the various state legislations that are there is another thing altogether how do you as a sort of team or or as a company how do how does various kind of how do we stay on top of those sort of potential regulatory challenges and just sort of how do we prepare and know that they're coming and and and and what's the sort of the process there yeah so I think it's kind of question you know what where and when this changing actually right so you know firstly we do have a type of outside councils it's just that you know we you just kind of be an expert on every field of law and every jurisdiction around the world right so you have to have your cooperation partners and we have that they mean in the key jurisdictions secondly we also have the of in-house records and monitoring you know routines we have researchers and down analysts employed and we kind of have the kind of processes and systems around that where they go through certain updates using certain systems they kind of make the you know the first line analysis and then then they bring it back to the team and in the end yeah it's kind of the team right so when you have this information the team we have I think it's very kind of reliable and you need to apply the right kind of out-to-box thinking in certain cases but you just have to have a certain routine that you know it just works right because you're going to have a lot of information but you should don't do anything with the information then it's yeah absolutely absolutely and I think it's a real sort of differentiator for us actually as a as a company obviously we help yeah we help our customers remain compliant so it's important that we are compliant ourselves obviously to help the highest possible standards but we have to sort of provide that for others as well so kind of aware of regulatory changes in different industries and that kind of thing as well I think it's some it's amazing actually the the level of understanding and and work that your team does it really is remarkable what kind of advice would you give to other sort of companies operating in this digital world about how to kind of manage their their regulatory obligations would you say yeah I think it's a really hard question same time you know I think the general kind of approach is it's the I'll say the elephant three three RIs of model is you start you actually firstly for example when you're a very kind of early stage company and you know actually it doesn't matter you can be in a state but in case you ever feel interested in market for example then you you know you firstly have to figure out what to have to do to you know defend your core business or actually bigger core business and this you know means that you have to understand whether you're a current key regulatory concerns needs and you know where do their eyes for what kind of a process perspective it just means that you need to understand where those laws and regulations can actually have as much a great impact you know on the company and to the organization in the work that you're doing in the organization and you kind of have to you know embed yourselves into the key key places or they kind of key lifelines so actually nothing you know falls through the cracks where you know those kind of risky processes for example are being kind of conducted inside the company that's very much focusing actually what is currently at hand so the second kind of line is is that you have to focus on actually kind of nurturing emerging business and kind of understanding what really happened in the future but you know you know what that's going to happen at some point in time to you know put it simply is to just have an understanding of your future and certain kind of key regulatory concerns when do they arise where do they arise you know oftentimes the as the law is adopted but there for example is a period before it's actually applied right so just kind of understanding you know what are the key laws what are your timelines and thirdly it's focusing on what is not very clear but you know or quite like you to know that this will happen at some point in the future and that actually means staying up to date with the the policy developments it's staying up to date with you know national strategies white papers and just understanding the paint points of the industry side the and the policy makers in this that actually defines the direction that the future laws will take you know the timeline might not be very clear but it's clear that the cases are you know pressing concern that at some point you know something will actually begin either from the summarized it around a kind of a statement that you know yes laws are obligations but there are also opportunities especially in case you're operating you know more compliance to have a field is yes they put forward obligations but to actually give the opportunity to actually produce you know real value for the business or for our case in case our clients are actually being introduced with a new regulation then it's obvious that you know we try to help our customers to stay compliant or when they meet us to be compliant and you know we could say yes we understand you you know this is or a roadmap this will happen and we you know our better partner in sound we are better informed absolutely yeah I think that's a really good point actually because I think quite often there is this sort of negative perception around the compliance thing as it kind of it stops us from doing things and it becomes you know there's something that we have to adhere to but I think that there's a really positive way of looking at it as well and I we've certainly had this with with conversation with our customers actually where you know a sort of a high level of robustness and around your compliance processes is something that will give peace of mind to your customers especially in sort of things like financial services example what as an example where you know that that goes where customers are looking for that they would they would rather have that sort of a slightly slower user experience or a slightly more you go through a couple of extra stages in the onboarding process if it means that they're they're sort of transactions are going to be secure and sort of just a better service in in the long run so I think that there is absolutely like I don't know what you'd call it really a commercial advantage I suppose to being highly compliant it really really is and I think it's it's a setting point in and of itself certainly within as I said some of those industries like financial services but but in others as well one thing I'd like to talk about if if you don't mind is kind of how you how your team I guess kind of collaborates with other teams within the business you kind of alluded to how you work quite closely with the product development team early on but but is there as just a way that you guys sort of will approach how you work with with other departments to ensure compliance yeah the stakeholder circle is actually very wide I think the first you know question is you know know your stakeholder right with key stakeholders we have you know we have regular sinks in place with aims are actually kind of state or geniuses on the loop actually what are they doing what are we doing and then very few are very much kind of focused on that of doing for example quarterly plans studies that obviously kind of a key you know time to actually you know to have those things to have those talks to we have those on our kind of leadership level but we also have those on a kind of individual contribute level meaning that actually kind of each team every responsible regarding their kind of part of that work and it's also their job to kind of you know being bring back that information to see so we can kind of understand okay what is the whole picture actually also you know there are some cross-company projects and those are kind of being run in a more centralized manner actually and you know there can be kind of a project manager there can be kind of unified life communication you know periodic sinks periodic meetings so that you you stay up to date you understand you know what each part of the company is actually doing so I think it's when you have kind of continuous ways to share information that just reduces the likelihood that you know you don't know certain things right and obviously when the company is growing you know they're going to be just a surge of information right and you know just being that I can touch with the people you know that you are your stakeholders then they are very likely to you know inform you of something that also happens with their stakeholders right because the stakeholder you know certain might not actually be the same so you actually kind of you know feed the information through the stakeholder circles and I think it's very much of what kind of communication you know question then you know a project manager automation or a software tooling question or something like that so just have to stay in touch with the people actually that was speaking as one of your stakeholders I think that I can I can say the your you know your team does this very well and I think creating those the sort of putting the structures in place that allow for those feedback loops because as you said there there's so much that you yeah your team needs to be abreast of in terms of down regulatory changes around the world and what the industry is well in the industry is saying if you like kind of the chatter within there you kind of hear that from yeah our revenue teams our sales teams you're having day to day conversations with these big customers who are you know in these spaces and the information we're getting kind of feed yet feed to filters back to us and hopefully back to you guys and then we can sort of build build policies around it and yeah our own sort of programs as it were as well so yeah I think that the communication is definitely the key to all of that I just like to sort of you know switch switch practice slightly I guess but but just talk about you more as an individual now I would like to know what your kind of main sort of couple of key learnings are that you could take away from your your role here as a sort of head of regulatory yeah but I'm you know kind of a really short sentence so I think it's first I think you know the working in an international company it just gives you the understanding that you know the world is a very diverse place where you know of course there are different laws and regulations but you know they're also going to be different people different cultures that's a very key point to the sense because the you know the way that this side is is built also actually has a very strong effect on the on the laws and regulations so you know the connection might not be very direct but it's still there and I think the second key learning is just to get up know your business and and know the space where the business operating and the better you know the business and the more you know the details around it and it can be actually you know down to very you know very a technical details for example I don't know how a certain certain I kind of check in the in the identification flow with actually kind of working which teams are actually involved this actually gives you a more in-depth and more diverse picture and it gives you more context so for us it's always you know you look kind of outside of what is happening in the outside world but you kind of make sense of it for the company so I kind of very much encourage you know to actually be engaged in in you know shadowing sessions with actually teams so you know you don't really work with daily bases but it actually gives you a better understanding what's the business actually go about yeah absolutely and I think it's interesting too because there's quite often a perception I guess of you know legal in general but with a regulatory piece being almost like a bit of a back office function but in some some respect you're doing a lot of conversations with customers is as I said there's a selling point toward this in a sense too in that it's a real business driver I think and a real sort of potential revenue driver for our customers what would you say has been kind of the biggest success of your team if you had to sort of if there is a way of sort of crystallising that at all and I think yeah I guess what you know I would like to get to as well is maybe your approach to sort of leadership and how you've lead them as well but I think that maybe let's talk about the successes person get to that in a moment yeah it's a hard question a hard from the sense that it was a case where we you know we just recently had to do kind of a retro or kind of look back chewing two eight three two chewing two eight two right then I had to somewhat kind of summarise certain kind of key projects you know we used GRI in house like kind of you know open GRA war that's just kind of you know I have my ideas but I wanted to kind of have a more objective look right and I think it all comes down to whatever the project there has been it's kind of a team success there are of course kind of key individual contributors but there we think we have we have done and I think it's kind of key and winning in the end two kind of key categories came out one is that we have implemented quite a lot of important changes for the company to you know keeping keep compliance in mind to enable the company actually to scale and act as a reliable bark to the biggest company in the world who you know are various clients actually so I think that's a that's a very important achievement in a sense that we don't stay put but we try to get a move together with industry and with the clients and I think secondly we have worked more more and more towards say enhanced transparency from point of view that will that be you know great more online resources we put more of information online that will actually you know be there for our end users but also for our clients so we are actually more transparent with what we do you know how we do it one for example our security commitments you know how does our privacy notice look like and you know we just kind of you know great more of those resources for us to be you know less of a kind of a black box and actually kind of efficient yeah and as I said we've said covered before I think that is you know that's that's the the role of a legal team within a sort of a tech company I think is is a say not that to be that sort of almost invisible black you know back office kind of function is to be really at the front of things driving things forward and and being a value add I think and I think it's a huge value add for our customers actually I think we we hear this all the time in conversations that I have with them I do you know do lots of sort of case study calls and testimonials and things like that and one of the things that often comes up is is how great various people are and how helpful they are and everything else and all of this is kind of a free service effectively that there's sort of wrapped in there's no additional cost for this this expertise it's a it's a really great offer that we have as some as you know it in this is disrespect I think so just just to wrap up quickly and just as I talk about leadership I know you you're quite keen to sort of spread the the credit that your team gets and I'm a you know amongst them all but I think there must be it it does take a real leadership to run it all what is it is there any particular sort of processes or tips you've got there to sort of get you get the best out of these individuals I suppose yeah it's true that I have to kind of balance the balanced individual effort little leadership role and I think it's very much first that I'm acknowledging that you know you are not the you know you're not the expert that everything right so actually you know have members in team for a reason and when you hire great experts it's it's actually kind of giving them the opportunity once with it the but you know it should kind of grow and the whole situation so I think we're very much centered around you know individual freedom and individual execution and it's you know you just have to kind of avoid the micromanaging this this will actually when you have very talented individuals employed and I think you know all all of my team are very talented is that you you know you don't want to kind of you know bring them down you're actually kind of you want to you know take yourself out from the places where you don't actually add by deal but it then is that you have to you know be there for the team so you cannot you know just kind of you know stand and you know not be there to actually have to eat the open rinds of communication and you you have to build that trustful trustful relationship and I think it's it's from an individual contribution perspective definitely you know do we have interesting work that's of course like a key question and I think in a growing tech tech company you know we do have very interesting work and we do have very interesting challenges but on the other hand you know do we have great people to actually you know handle those challenges and I think that's very much of a kind of building also the team wide building the good environment that you know you can do open and you're giving the opportunity to actually you know do your best but I think that's kind of what fighting the balance and you know yes of course it's nice and kind of abstract way of saying it you know everything is perfect but you know they're often you're very those kind of teeny tiny challenge you step down you and love you know solve solved correctly and have a have a very negative effect but of course we try to stay as together as possible and it's just kind of based on challenges so ourselves together yeah absolutely and as I said earlier on so speaking as one of your stakeholders I've seen your your team in action and and you can do it yeah they all do an incredible job there really is you know we kind of covered the breadth of it earlier on in terms of the scope of of what you need to sort of stay on top of and just to do so is absolutely remarkable so so credit to you and and thank you for joining us this has been an amazingly interesting episode actually and a very very sort of insightful conversation I suspect that we're going to have to come back to you at some point in the near future to talk a little bit in more depth about AI and it's impact to that kind of thing but but for now we can say thanks for joining us thank you Chris I've brought this podcast is brought to you by Verif identity verification may symbol learn more at Verif.com