Why robust KYC procedures are crucial for all SaaS companies [Q&A]

For banks, know-your-customer (KYC) measures amount to 40 percent of all anti money laundering (AML) compliance costs, totaling $5.7 million each year. This sum is tiny, however, compared to what is paid for non-compliance. In 2022, global fines for inadequate AML grew by 50 percent, almost reaching $5 billion.

We spoke to Vaidotas Šedys, head of risk management at web intelligence platform Oxylabs, to discover that KYC-related challenges are not just faced by banks but are an issue for proxy and web scraping service providers too.

BN: AML and KYC are usually associated with banks and financial institutions. What makes such measures important when providing proxy and data scraping services?

VS: Dealing with data and information technologies can be just as sensitive as having a direct link to people's finances. Proxies are intermediary servers between a client’s device and the internet. As such, they provide increased anonymity for the client and open their hands to various kinds of automation. This includes automated public web data collection, which is a useful asset for businesses, governmental and non-governmental agencies, as well as researchers.

By providing both proxy infrastructure and web scraping solutions, we put a powerful tool in our client’s hands. Naturally, we want to know who we are entrusting with this tool and how they are going to use it. It is necessary for protecting both our infrastructure and the general public from potentially harmful activity.

BN: How can the public be sure that advertised ideals of ethical SaaS services are pursued in practice?

VS: Even putting aside ethical concerns, implementing robust KYC standards is in the interest of business. In the case of proxies, you are putting your own infrastructure on the line when giving someone access to it, so you want to be able to trust them as much as possible. For example, having your servers used for illegitimate or harmful activity might get your IP addresses banned across commonly used online platforms and search engines. One badly checked client can make your product useless for the entire base of legitimate customers.

Additionally, reputational damage for companies that are revealed to enable criminal or malicious activity can be harmful even when no monetary fines are issued, especially in such a young and developing industry as data scraping, which is already ridden with misconceptions. Hopefully, these cases where KYC measures were less than ideal will clearly show that slacking in this area is, simply put, bad business.

For us, it is important to not only ensure KYC compliance in our own firm, but promote it across the industry. Because cases of KYC failures hurt not only the reputation of the company involved but also perpetuate negative beliefs about the entire industry. That is why we have the self-imposed mandate to lead the industry in having top KYC measures akin to those used in the highest-risk fields like banking.

BN: Compliance in proxy services must differ from that in finance, how is this reflected in your approach to risk management?

VS: In both cases, you have to know who you are dealing with. So, you need to verify that the person is who they say they are or have the authority to represent the institution they say they do. Here, we use the same highest-standard practices of checking all relevant public information and documentation as well as communicating with the customers as much as we deem necessary to manage risks.

The main difference is in use cases. In finance, they mainly look for transactions that assist in money laundering, organized crime, and terrorist financing.

As for us, we have to ask each client what exactly they want to do with our tools. There are many known ways how someone can use these tools, from price aggregation to market monitoring. Additionally, with constant development in the IT sector, there is always room for discovering new use cases and workflow improvements with the help of proxies and web scrapers.
We have to make sure that these improvements are going to be made to non-harmful, legitimate tasks. With some types of data gathering, we will help researchers looking to advance knowledge but not, for example, companies that want to launch spam marketing campaigns. Then, there are applications that have no known legitimate use cases -- they are rejected by default.

For example, using bots to buy event tickets on a large scale in order to resell them for profit is explicitly banned by the US's Better Online Ticket Sales Act of 2016. So, we put a lot of effort into preventing our tools from being used to profit from automated ticketing.

Gaming might be an interesting example. Although it seems like a perfectly innocent activity, there are hardly any legitimate use cases for using proxies on gaming platforms. Usually, they are used by hackers aiming to steal player accounts by combining brute force and previously obtained data. The accounts or in-game items can then be sold for profit.

So, the burden of proof would be on the client to explain how exactly they could use proxies for gaming legitimately and in accordance with the platform’s rules. Without such explanation, using our tools on gaming platforms would not be approved.

After verifying the client and approving the use case, the third stage is ongoing due diligence. We have to check in to see that our tools are used for agreed-on purposes and nothing else.

BN: Isn't KYC itself one of the uses for web scraping? Do you use your own tools for this purpose?

VS: Given our focused scope and an in-house team dedicated to understanding our risks, it would be an overkill. However, large firms providing KYC services to many clients across different industries can certainly benefit from web scraping. Their scope is very large and varied, so automated public data collection might be the only way to cover everything efficiently.

This is another example of how risk assessment matches the client with the use case. A well-known KYC firm wanting to boost their procedures with our scrapers should not have much trouble getting through our approval process. But we would have more questions for a small firm that only onboards a few new clients per month if they told us they want to scrape for KYC purposes.

BN: In the finance sector user experience is one of the crucial concerns when it comes to KYC. Is it the same for you, and how do you address it?

VS: Absolutely. We reject about 25 percent of cases submitted to us. That means that three times out of four, we are dealing with a legitimate customer who can really make use of our proxies and tools. Naturally, we want to find ways to streamline them through the process without compromising security.

The way forward is automation. We want to enhance the scope of our automated procedures so that trusted customers less often need to wait for a person to react to an issue or move them to another step of the process. So, the goal for the near future is to improve speed while retaining the same security standards.

BN: Looking to the future, how is the always-evolving regulation going to affect compliance in your industry?

VS: I think the effect is going to be positive. For example, the European Union is going for a new stage of digital verification with the European digital identity or eID framework. This new regulation will make it easier for EU citizens and companies to identify themselves and share only necessary information.

Things like that make our work easier. Generally, additional authority providing standards and guidance for compliance is good for our industry. It helps assure our customers and equalize the competitive conditions. We welcome it.

Photo credit: Alexander Supertramp / Shutterstock