Nearly two years ago, Symphony Communications Services announced its decision to expand into know-your-customer (KYC) solutions. The move was part of a rebrand that would aim to serve the full client and trade lifecycles.

Now the vendor is experimenting with a new ID service that would create personal digital identities that would be owned and controlled by their makers and would be able to be transported between entities, such as from one bank to another.

Gone are the days of customer profiles, filed away in servicers’ cabinet drawers in back rooms and created with paper forms and inked signatures. As the internet operates today—known as Web2—tech giants like Google, Facebook, and Microsoft have assumed the roles of identity arbiters, offering consumers the ability to use their log-in credentials for the companies’ own services for many other applications across the web in a federated system. But while usernames and passwords are created by consumers, they’re still authorized, owned, and controlled by the corporations—a dynamic that Symphony, in line with a global trudge toward the next version of the internet, Web3, expects will change as web technology evolves.

“I’m absolutely convinced there’s a very big thing coming to society as a whole,” says Dietmar Fauser, Symphony’s chief information officer. “In a world where everyone owns his or her own identity, you will carry it around in a digital wallet, and when you go into a system, you will say, ‘Here’s my identity. Here are my credentials.’ And you join [an organization] when you need to, rather than having your personal information permanently stored by an external system.”

Symphony has not yet given the service an official name, but the vendor’s internal engineering team is using FsIDaaS—or financial services identity-as-a-service—as the guiding term for the company’s entire strategy in the identity management space, says Michael Lynch, Symphony’s chief product officer.

The subset of identity management that would include Symphony’s transportable ID service—should it go into production—is called self-sovereign identity, a staple of the growing Web3 and decentralized finance (DeFi) movements, which both seek to remove authority from large, centralized corporations and return it to users, who will own and maintain the next generation of internet applications (as well as their personal data) through a decentralized ecosystem built on the blockchain. However, Symphony’s ID service currently does not use blockchain technology.

The service utilizes OpenID Connect, an open-source identity layer built on top of OAuth, an open-source standard that allows unrelated applications and websites to permit authenticated access to users without their having to expose their passwords. Symphony is working with an unnamed partner on the open-source technologies, while working on its own to build a further intelligence layer on top of the core authentication flows, Lynch says.

The identity data would be encrypted and stored in the cloud, and users would own their own keys to unlock it, decrypt it, and store it on-premises or in other third-party cloud key management solutions. But a future system in which these credentials are stored on-chain, rather than in the cloud, is not off the table for Lynch.

Ying Cao, co-founder of Work in Fintech, which develops blockchain and Web3 pilots with the aim of enticing young professionals to work in fintech and incorporate such emerging technologies, says KYC and identity management create some of the biggest hurdles in financial services. Having worked at Barclays for 10 years prior to her latest venture, she’s familiar with the technology that heavily-regulated banks are allowed to use to conduct compliance processes—it’s “pretty Stone Age,” she says.

However, Symphony isn’t the first, and likely won’t be the last, to attempt to solve the industry-wide KYC headache. In 2014, an effort by Citi, HSBC, Deutsche Bank, and Morgan Stanley—known as the Markit–Genpact deal—sought to standardize KYC data for financial institutions by creating a centralized public utility, but it was unsuccessful due to a lack of regulatory standards. And in 2018, Singapore halted its own attempt to create the first government-backed KYC utility in the world for similar reasons.

But creating non-mandatory utilities that would make KYC a little easier is a lot different than transforming the way KYC is done altogether, says Cao, who while at Barclays, was a member of Symphony’s board. And Symphony may be uniquely placed to kick off such a transformation, she adds.

“Almost every single Wall Street bank is an investor in Symphony. That basically means they have connections to every single bank and to say, ‘If we build something, we wanted to incentivize everyone to come and use it because it’s either free or it’s a fractional cost compared to if you have to build it yourself,’” she says.

Symphony’s Lynch says the service’s potential extends beyond KYC to other manual processes that rely on identity establishment, such as employee onboarding and transaction reporting. For example, when Mifid II was signed into law, two entities on either side of a derivatives trade had to report their corporate identities as well as the personal identity of the trader or traders involved in a trade.

“Symphony is very interested in the concepts of Web3 and decentralized finance, and how, when it comes to self-sovereign identity, [they’re] going to shape the way users in the market think about their identity and their relationships with their employers, their counterparties, and the control they have over the pieces of their identity that inherently transfer financial market workflows and transactions,” Lynch says. “We think there are opportunities for how this technology will change the way markets operate.”