Commission notice pursuant to Article 19(3) of Council Regulation No 17 concerning case COMP/37.462 - Identrus

(2000/C 231/03)

(Text with EEA relevance)

A. INTRODUCTION

On 6 April 1999 the Commission received a notification of a set of agreements pursuant to Article 4 of Council Regulation No 17(1) concerning the establishment of a network of financial institutions which will operate as certificate authorities of trusted electronic commerce (e-commerce) transactions, initially only in the business-to-business (B2B) context.

The notifying parties are ABN-AMRO Services Company, Inc., BA Interactive Service Holdings, Inc., Barclays Electronic Commerce Holdings, Inc., Bayerische Hypo- und Vereinsbank AG, The Chase Manhattan Bank, Citibank Strategic Technology, Inc., Deutsche Bank AG and Pyramid Ventures, Inc. ("Parties").

For the purposes of establishing and managing the network, the Parties have formed a joint venture company, Identrus LLC (Identrus), incorporated under US law as limited liability company. Identrus will provide and manage the infrastructure required for establishing a global, interoperable network among financial institutions offering certificate authority servces (the "Identrus-system").

While Identrus will have a limited number of equity owners (approx. 20)(2), no single shareholder will have control over Identrus. Participation in the Identrus System will be open to qualified financial institutions around the world ("Participants"). Those participants will compete with each other in the relevant markets described below.

B. THE PARTIES

The corporate groups to which the parties of the Notified Agreeent belong may be described as follows:

ABN AMRO Services Company, Inc., is an Illinois corporation. Its ultimate parent is ABN AMRO Holding NV, the Netherlands.

BA Interactive Services Holding Company, Inc., is a Delaware corporation. The ultimate parent is BankAmerica Corporation, USA.

Barclays Electronic Commerce Holdings Inc., is a Delaware corporation and an indirect subsidiary of Barclays Bank plc, UK.

Bayerische Hypo- und Vereinsbank AG (Hypo Vereinsbank); Bayerische Hypo- und Vereinsbank AG (Hypo Vereinsbank) is a financial group resulting from the merger in 1998 of Bayerische Vereinsbank AG and Bayerische Hypotheken und Wechsel Bank, AG.

The Chase Manhattan Bank (Chase) is a wholly-owned subsidiary of the Chase Manhatten Corporation, USA.

Citibank NA is a wholly-owned subsidiary of Citigroup Inc., Delaware.

Deutsche Bank AG, Germany, hols its equity investment in Identrus directly.

Pyramid Ventures Inc., USA, is an indirect subsidiary of Bankers Trust New York Corporation which in the meantime merged with Deutsche Bank AG.

C. THE TRANSACTION

I. Purpose

The declared purpose of the parties for setting up the Identrus system is the promotion, operation and management of an infrastructure for securing electronic commerce transactions. This infrastructure shall enable the participants of the system to operate as individual and competing certification authorities(3).

(a) Identrus scope of activities

Identrus will provide the infrastructure (ultimately a data processing system designed to operate through digital networks) required to enable the financial institutions participating in the system to become certificate authorities for the purposes of secure e-commerce transactions and offer related services to their end users.

(b) The role of participants in the Identrus system

In the Identrus system, each participant will issue digital certificates certifying the identity of its participating end users. The participants will operate as individual and competing certifying authorities. Identrus system specifications provide interoperability in order to enable each participant to develop its own technology independently. Furthermore, each participant will offer their own, independently created applications, built upon the digital certificate authority services of the Identrus system infrastructure, in competition against each of the other participants. Each participant is free to set the prices it charges to its end users.

(c) Warranty requirements

Each participant that issues a particular certificate will be required to post a warranty to secure its obligations in respect of the third parties that accept and rely on that certificate for their e-commerce transactions.

Each participant will post a deposit (collatcral) to an account with an appointed financial institution, who will hold it for the benefit of relying third parties to secure warranties issued to them. The operating rules establish collateral requirements applicable to each participant, including the amount of collateral required to be posted, the frequency with which collateral requirements and participants' obligations will be calculated and the times at which collateral would be required to be posted.

(d) Non discrimination

The parties submit that the success of a certification system is based on its interoperability with other similar systems. The parties' business plan foresees up to 300 banks at worldwide level joining the Identrus system. All participants, irrespective of whether they are shareholders or not, are subject to the same rules and standards of the Identrus system that are set forth in the agreements notified and in particular in the operating rules. The LLC Agreement setting up Identrus establishes it as a for-profit, full function company, which after the initial starting-up period, none of the equity owners will have the possibility to control alone. The most important criteria for third parties to become shareholders in Identrus, are in compliance with certain capital requirements, as defined by the Basle Committee on Banking Regulations and Supervisory Practices and in compliance with certain financial rating requirements.

II. Participation in the system

Participants may join the system either as "level one participants", or as "level two participants". Level one participants may issue certificates to end users and will have the ability to issue certificates to level two participants. Level two participants may issue certificates only diretly to end users. In other respects, the two types of participants will operate within the system in the same manner and will thus compete with each other for end users.

(a) Level one participants

An entity will be eligible to act as a level one participant if it is primarily engaged in the business of providing financial services, is subject to governmental regulation and examination, and if it meets, inter alia, certain capital and credit requirements.

The notifying parties (i.e. the equity owners of Identrus) will participate in the system as level one participants, under the same terms and conditions applicable to any third party acting as a level one participants.

(b) Level two participants

The eligibility criteria for level two participants are parallel to those for level one, but the capital and credit requirements are less stringent, enabling smaller entities to participate in the Identrus system.

III. The Agreements

(a) The LLC Agreement - Corporate organisation

Identrus was established in March 1999 pursuant to a Limited Liability Company Agreement (the "LLC Agreement"), governed by US Delaware law. The initial capitalisation of Identrus was contributed equally by the parties.

The equity owners of Identrus have a voting right in the shareholders' meeting that is calculated on the basis of their respective percentage ownership interest in Identrus. This means that the founding shareholders will have less than 10 % of the voting rights each and that the newer shareholders will have less than 5 % each. Most decisions of the shareholders' meeting are adopted by simple majority. No single shareholder has control over Identrus.

Participants in the Identrus system will not be required, however, to hold equity in Identrus; membership in the system as a participant will be open to all entities that satisfy the membership criteria outlined above and in the system's operating rules.

All shareholders and participants are free to join other schemes offering certificate authority services.

(b) Rights and obligations of shareholders and participants

The Identrus shareholders have the same rights and obligations as all other participants in the system and will enter into similar participant agreements with Identrus to establish the terms of their operational relationship. However, all equity holders must be active participants in the Identrus system, and the LLC Agreement requires that each shareholder operate a certificate authority, registration and risk management system under the Identrus system. Accordingly, each shareholder's investment in Identrus will not be a passive investment, as each is required to deploy its own certification services based on the Identrus system.

(c) Pricing policy

Identrus has been set up as a for-profit organisation and will establish its pricing policy accordingly. The same pricing policy will be applied to all participants on the basis of objective and non-discriminatory criteria, irrespective of whether they are parties or participants of whatever category in Identrus. Identrus plans to charge fees only to participants, not to the customers of the latter. Participants will be free to charge their customers their own prices.

D. THE RELEVANT MARKET

1. Product market

The parties submit that Identrus will ultimately serve for the provision of root trust services, which would include: (1) services for the identification of the sender of a message over a digital network, (2) the authentication of such message via electronic signatures, (3) the validation by the issuer that the keys used to create and authenticate the signature have not been revoked, (4) the provision of services to manage the risk that the signatory may claim the signature was unauthorised, and (5) the establishment and administration of rules, policies, procedures, technical specifications and agreements governing the operation of the system.

By the intermediate of such services, participants in the system should be able to provide authentication and connected electronic transactions security services to end users (trust services). Those may utilise the Identrus services in a variety of transactions - i.e. essentially any transaction, conducted over an electronic network, in which one or both parties require a high degree of certainty as to the identity of the other party. These transactions may be financial or commercial transactions, such as purchases and sales of goods or trading in financial instrument, potentially all over the world.

Consequently, in the Commission's preliminary assessment, the notified agreements will address at least two separate markets: (a) the market for the provision of root trust services to certification authorities, and (b) the downstream market for the provision of trust services by certification authorities to end users in the corporate sector.

(a) Provision of root trust services

Identrus will be active in the design and operation of the infrastucture for financial institutions to manage risks inherent in relying on the identity of authors and the authenticity of electronic messages. It will perform its role as a root certificate authority and will establish a set of business rules defining the identity certificates issued by participant certificate authorities and their use. Identrus' role will be that of a root certificate authority with respect to the participant certificate authorities. Identrus will not directly offer services to the end users.

(b) Authentication services

The participants of the Identrus system will provide digital certificate services directly to their corporate end users enabling them to conduct commercial transactions over open electronic networks. The use of technical applications that enable this kind of electronic transactions cannot provide assurances about a user's identity. Therefore, certification authorities are needed to issue digital certificates that can be used to bind the specific identity of a user to a particular application.

However, as recognised in the recent Directive on electronic signatures(4), electronic signatures will be used in a large variety of circumstances and these services should not be limited to the issuance and management of certificates, but should also encompass any other service and product using, or ancillary to, electronic signatures, such as registration services, time-standing services, directory services, computing services or consulting services related to electronic signatures.

2. Geographic market

The Identrus system will offer its services on a global basis enabling international business-to-business transactions. It is hence submitted that the relevant geographic market is the worldwide market for the services in question.

E. THE PARTIES' EXPECTATIONS

The Identrus system is expected ultimately to comprise approximately 300 financial institutions acting as level one participants and hundreds more level two participants, together covering all important business areas of the world.

The Identrus system will act in the same market as a number of competitors that are currently developing systems to offer their own certificate authority services. The most important competitive initiatives come from financial industry ventures, technology vendors, postal authorities, industry specific vertical initiatives and telecommunications carriers who have established themselves as commercial certificate authorities.

F. THE COMMISSION'S INTENTIONS

On the basis of the foregoing, the Commission intends to take a favourable view on the notified transaction. Before doing so, it invites interested third parties to submit their comments, within one month of the date of publication of this notice, quoting the reference COMP/37.462 - Identrus, to: European Commission , Directorate-General for Competition,

Directorate C,

Rue de la Loi/Wetstraat 200 , B - 1049 Brussels . Fax (32-2) 296 70 81 .

(1) OJ 13, 21.2.1962, p. 204/62.

(2) Since the notification was filed the following additional institutions have become equity investors in Identrus: Banco Santander Central Hispanola, CIBC WMC Inc., HSBC Financial Services Corporation, NatWest Group Holdings Corporation and Sanwa Technology Services, Inc.

(3) That is, an entity or a legal or natural person who issues digital certificates for electronic commerce transactions.

(4) Directive 1999/93/EC of the European Parliament and of the Council of 13 December 1999 on a Community framework for electronic signatures (OJ L 13, 19.1.2000, p. 12).