Identrus LLC has just become the first of the financial industry's three digital certificate programs to go live. Bank of America Corp., one of the now 36 member banks in the Identrus alliance, began providing guaranteed identification of businesses to other businesses trading online early last month.
Three other banks, ABN Amro Corp., Deutsche Bank and Hypovereins Bank, were scheduled to go live later in the month, as Bank Technology News went to press.
Noting these developments, Khaja Ahmed, Identrus' new chief technology officer, explained what being live really means. "The difference is not in the technology; it's in the liability and risk management. We're saying, 'This is for real. We're going to stand behind this transaction and cough up money if something goes wrong.'"
In assuming legal liability for its mistakes and in being global in scope, Identrus is distinguished among the United States' financial providers of business-to-business authentication for ecommerce. The American Bankers Association has another digital certificates program, as does the Financial Services Technology Consortium (see subsequent stories in this section, and accompanying explanation of digital certificates).
Identrus essentially has an insurance fund to cover any bad calls it might make in vouching for businesses, those being the business customers of the participating banks. All banks contribute capital to that pool, although in different amounts depending on their status.
There are owners of the venture, there are "level one" members, and smaller "level two" members, which the level ones sponsor in. There are as yet no level two members, though the Identrus banks plan to invite their thousands of correspondent banks to participate. Of today's 36 level one members, half are also shareholders in Identrus, says Laura Rime, acting vice president of marketing. (Paul Donfried, the venture's well-known former marketing director, recently left to pursue a career outside finance.) Technology leader Wells Fargo & Co. just increased its involvement by taking an equity stake in Identrus.
The group is well off spring estimates that it would have 300 level one members by year's end, but thriving nonetheless. A recent alliance with SWIFT will give Identrus access to SWIFT's 3,500 member banks (see cover story, "Not So SWIFT Transition").
Identrus, a New York-based for-profit firm, won't say how much it charges banks for any level of participation. Some indication came from Australia's ANZ Bank, which reported earlier this year that it paid $2 million to be an equity member.
The venture now has members worldwide, although its biggest single base is in Europe. When founded two years ago (as the Global Trust Organization, in Oct. 1998), its eight members were split equally between the United States and Europe. "Now," says Rime, "we're very much focused on extending our base in the Americas."
David Medeiros, group research director at TowerGroup, Needham, MA, remarks, "Identrus is certainly the most ambitious effort to position banks to be certificate authorities, in that it's international in scope." Even when its membership base was a fraction of what it is now Identrus represented more than 10 million business customers in 133 countries.
That's a great position considering TowerGroup's assertion that the burgeoning B-to-B ecommerce is already worth $294 billion this year. Tower's estimate that the market will be worth $1.5 trillion in 2004 is relatively conservative.
And Identrus isn't stopping at B-to-B; that's just the immediate priority, explains Ahmed. Nor is identity authentication the only service Identrus will provide. "Identity is the core on which other services are built," says Ahmed, who has been with Identrus since late August. "Basically, it's an e-commerce framework Identrus is trying to put together. Identity happens to be the kernel of that process, but it is by no means the only service Identrus will provide."
Applications to be built around identity verification include trade finance (letters of credit, leasing, bill of lading, etc.) payment offers and acceptances. There will be two types of Identrus applications, he adds, one "a set Identrus will standardize and build," the other applications created independently by member banks, individually or collectively. Canadian Imperial Bank of Commerce, for example, told BTN that it hopes to go live with such applications next year.
Jim Parker, the Identrus point man at Chase Manhattan Corp., recently opined that there will be four key applications for Identrus: trade finance, e-procurement, data access and leasing. Chase is also a participant in the FSTC identification program.
Asked about the prospects for a unified digital certificate effort by the financial sector, Ahmed said, "Ultimately, the market wants interoperability. There will be one dominant standard and it's not necessarily going to be the product of one company or organization. It could be a joint effort."
Rime, asked to contrast ABA's program with Identrus', said that its technology is "proprietary" and its program "focused on the Americas." ABA is a part-owner of the company providing digital certificates to its members, the Digital Signature Trust Corp.
As for the best way to authenticate e-commerce participants, Ahmed says, "If you're asking 'Is PKI the best way of doing digital or electronic signatures?' the answer is an unqualified yes. How many other types do we see deployed?"
On supposed shortcomings of public key infrastructure, he adds, "You can do multiple signatures and time stamps, which you build on top. PKI isn't a solution, it's an infrastructure."