Commission notice pursuant to Article 19(3) of Council Regulation No 17 concerning case COMP/37.462 - Identrus (Text with EEA relevance)
Date: 2000-08-11
Institutions: European Commission
Subjects: EU control, European Commission, commercial transaction, electronics, exchange of information, joint venture

11.8.2000

EN

Official Journal of the European Communities

C 231/5

VII. Notice

The Commission intends to adopt a favorable position on
the notified agreements. Before doing so, the Commission
invites interested third parties to submit their comments
within one month of the date of publication of this notice
the European Communities.
in the Official

Journal

of

Comments can be sent by fax (32-2) 296 98 07 or by post,
quoting the reference COMP/37.557/D-1, to:

European Commission,
Directorate-General for Competition (DG COMP),
Directorate D (cid:151) Unit D1
Rue de la Loi/Wetstraat 200,
B-1049 Brussels.

Commission notice pursuant to Article 19(3) of Council Regulation No 17 concerning case
COMP/37.462 (cid:151) Identrus

(2000/C 231/03)

(Text with EEA relevance)

A. INTRODUCTION

On 6 April 1999 the Commission received a notification of a
set of agreements pursuant to Article 4 of Council Regulation
No 17 (1) concerning the establishment of a network of
institutions which will operate as certificate auth-
financial
orities of
trans-
actions, initially only in the business-to-business (B2B) context.

trusted electronic commerce (e-commerce)

Those participants will compete with each other in the relevant
markets described below.

B. THE PARTIES

The corporate groups to which the parties of the Notified
Agreeent belong may be described as follows:

The notifying parties are ABN-AMRO Services Company, Inc.,
BA Interactive Service Holdings,
Inc., Barclays Electronic
Commerce Holdings, Inc., Bayerische Hypo- und Vereinsbank
AG, The Chase Manhattan Bank, Citibank Strategic Technology,
Inc., Deutsche Bank AG and Pyramid Ventures, Inc. ((cid:145)Parties(cid:146)).

incorporated under US law as

For the purposes of establishing and managing the network,
the Parties have formed a joint venture company, Identrus LLC
(Identrus),
limited liability
company. Identrus will provide and manage the infrastructure
required for establishing a global, interoperable network among
financial institutions offering certificate authority servces (the
(cid:145)Identrus-system(cid:146)).

While Identrus will have a limited number of equity owners
(approx. 20) (2), no single shareholder will have control over
Identrus. Participation in the Identrus System will be open to
qualified financial institutions around the world ((cid:145)Participants(cid:146)).

(1) OJ 13, 21.2.1962, p. 204/62.
(2) Since the notification was filed the following additional institutions
have become equity investors in Identrus: Banco Santander Central
Hispanola, CIBC WMC Inc., HSBC Financial Services Corporation,
NatWest Group Holdings Corporation and Sanwa Technology
Services, Inc.

ABN AMRO Services Company, Inc., is an Illinois corporation.
Its ultimate parent is ABN AMRO Holding NV, the Netherlands.

BA Interactive Services Holding Company, Inc., is a Delaware
corporation. The ultimate parent is BankAmerica Corporation,
USA.

is a Delaware
Barclays Electronic Commerce Holdings Inc.,
corporation and an indirect subsidiary of Barclays Bank plc,
UK.

Bayerische Hypo- und Vereinsbank AG (Hypo Vereinsbank);
Bayerische Hypo- und Vereinsbank AG (Hypo Vereinsbank) is
a financial group resulting from the merger in 1998 of Baye-
rische Vereinsbank AG and Bayerische Hypotheken und
Wechsel Bank, AG.

The Chase Manhattan Bank (Chase)
subsidiary of the Chase Manhatten Corporation, USA.

is a wholly-owned

Citibank NA is a wholly-owned subsidiary of Citigroup Inc.,
Delaware.

C 231/6

EN

Official Journal of the European Communities

11.8.2000

Deutsche Bank AG, Germany, hols its equity investment in
Identrus directly.

Pyramid Ventures Inc., USA, is an indirect subsidiary of Bankers
Trust New York Corporation which in the meantime merged
with Deutsche Bank AG.

C. THE TRANSACTION

I. Purpose

The declared purpose of the parties for setting up the Identrus
system is the promotion, operation and management of an
infrastructure for securing electronic commerce transactions.
This infrastructure shall enable the participants of the system
to operate as individual and competing certification auth-
orities (1).

(a) Identrus scope of activities

Identrus will provide the infrastructure (ultimately a data
processing system designed to operate through digital
networks)
institutions
required to enable the financial
participating in the system to become certificate authorities
for the purposes of secure e-commerce transactions and
offer related services to their end users.

(b) The role of participants in the Identrus system

In the Identrus system, each participant will issue digital
certificates certifying the identity of its participating end
users. The participants will operate as
individual and
competing certifying authorities.
Identrus system specifi-
cations provide interoperability in order to enable each
participant to develop its own technology independently.
inde-
Furthermore, each participant will offer their own,
pendently created applications, built upon the digital
certificate authority services of the Identrus system infra-
structure,
the other
participants. Each participant is free to set the prices it
charges to its end users.

in competition against

each of

(c) Warranty requirements

Each participant that issues a particular certificate will be
required to post a warranty to secure its obligations in
respect of the third parties that accept and rely on that
certificate for their e-commerce transactions.

(1) That is, an entity or a legal or natural person who issues digital

certificates for electronic commerce transactions.

(collatcral)

to an
Each participant will post a deposit
account with an appointed financial institution, who will
hold it for the benefit of relying third parties to secure
warranties issued to them. The operating rules establish
to each participant,
collateral
including the amount of collateral required to be posted,
the frequency with which collateral
requirements and
participants’ obligations will be calculated and the times
at which collateral would be required to be posted.

requirements applicable

(d) Non discrimination

the

level

joining

Identrus

The parties submit that the success of a certification system
is based on its interoperability with other similar systems.
The parties’ business plan foresees up to 300 banks at
system. All
worldwide
participants, irrespective of whether they are shareholders
or not, are subject to the same rules and standards of the
Identrus system that are set forth in the agreements notified
and in particular
in the operating rules. The LLC
Agreement setting up Identrus establishes it as a for-profit,
full function company, which after the initial starting-up
period, none of the equity owners will have the possibility
important criteria for third
to control alone. The most
in
shareholders
to become
parties
compliance with certain capital requirements, as defined
by the Basle Committee on Banking Regulations and Super-
visory Practices and in compliance with certain financial
rating requirements.

in Identrus,

are

II. Participation in the system

as

system either
as
two participants(cid:146).

(cid:145)level one
Participants may join the
participants(cid:146), or
Level one
(cid:145)level
participants may issue certificates to end users and will have
the ability to issue certificates to level two participants. Level
two participants may issue certificates only diretly to end users.
In other respects, the two types of participants will operate
within the system in the same manner and will
thus
compete with each other for end users.

(a) Level one participants

An entity will be eligible to act as a level one participant if
it is primarily engaged in the business of providing financial
services, is subject to governmental regulation and exam-
ination, and if it meets, inter alia, certain capital and credit
requirements.

The notifying parties (i.e. the equity owners of Identrus) will
participate in the system as level one participants, under
the same terms and conditions applicable to any third party
acting as a level one participants.

11.8.2000

EN

Official Journal of the European Communities

C 231/7

(b) Level two participants

(c) Pricing policy

The eligibility criteria for level two participants are parallel
to those
and credit
requirements are less stringent, enabling smaller entities
to participate in the Identrus system.

level one, but

capital

the

for

III. The Agreements

(a) The LLC Agreement (cid:151) Corporate organisation

Liability

to a
Identrus was established in March 1999 pursuant
Limited
(cid:145)LLC
Agreement(cid:146)), governed by US Delaware law. The initial
capitalisation of Identrus was contributed equally by the
parties.

Company Agreement

(the

The equity owners of Identrus have a voting right in the
shareholders’ meeting that is calculated on the basis of their
respective percentage ownership interest in Identrus. This
means that the founding shareholders will have less than
10 % of the voting rights each and that the newer share-
holders will have less than 5 % each. Most decisions of the
shareholders’ meeting are adopted by simple majority. No
single shareholder has control over Identrus.

Participants in the Identrus system will not be required,
however, to hold equity in Identrus; membership in the
system as a participant will be open to all entities that
satisfy the membership criteria outlined above and in the
system’s operating rules.

All shareholders and participants are free to join other
schemes offering certificate authority services.

(b) Rights and obligations of shareholders and participants

agreements with Identrus
their operational

The Identrus shareholders have the same rights and obli-
gations as all other participants in the system and will enter
to
into similar participant
establish the
relationship.
terms of
However, all equity holders must be active participants in
the Identrus system, and the LLC Agreement requires that
each shareholder operate a certificate authority, registration
and risk management system under the Identrus system.
Accordingly, each shareholder’s
in Identrus
will not be a passive investment, as each is required to
deploy its own certification services based on the Identrus
system.

investment

Identrus has been set up as a for-profit organisation and
will establish its pricing policy accordingly. The same
pricing policy will be applied to all participants on the
irres-
basis of objective and non-discriminatory criteria,
they are parties or participants of
pective of whether
Identrus plans to charge
whatever category in Identrus.
fees only to participants, not
the
to the customers of
latter. Participants will be free to charge their customers
their own prices.

D. THE RELEVANT MARKET

1. Product market

trust services, which would include:

The parties submit that Identrus will ultimately serve for the
provision of root
(1)
services for the identification of the sender of a message over
a digital network, (2) the authentication of such message via
electronic signatures, (3) the validation by the issuer that the
keys used to create and authenticate the signature have not
been revoked,
the provision of services to manage the
risk that the signatory may claim the signature was unauth-
orised, and (5) the establishment and administration of rules,
technical specifications and agreements
policies, procedures,
governing the operation of the system.

(4)

transactions

to end users

By the intermediate of such services, participants in the system
should be able to provide authentication and connected elec-
tronic
(trust
security services
services). Those may utilise the Identrus services in a variety
of transactions (cid:151) i.e. essentially any transaction, conducted
in which one or both parties
over an electronic network,
require a high degree of certainty as to the identity of the
other party. These transactions may be financial or commercial
transactions, such as purchases and sales of goods or trading in
financial instrument, potentially all over the world.

Consequently, in the Commission’s preliminary assessment, the
notified agreements will address at least two separate markets:
(a) the market for the provision of root trust services to certifi-
cation authorities, and (b)
for the
provision of trust services by certification authorities to end
users in the corporate sector.

the downstream market

(a) Provision of root trust services

financial

institutions

Identrus will be active in the design and operation of the
infrastucture for
to manage risks
inherent in relying on the identity of authors and the auth-
enticity of electronic messages. It will perform its role as a
root certificate authority and will establish a set of business
rules defining the identity certificates issued by participant
certificate authorities and their use. Identrus’ role will be
that of a root certificate authority with respect
to the
participant certificate authorities. Identrus will not directly
offer services to the end users.

C 231/8

EN

Official Journal of the European Communities

11.8.2000

(b) Authentication services

E. THE PARTIES’ EXPECTATIONS

The participants of the Identrus system will provide digital
certificate services directly to their corporate end users
enabling them to conduct commercial
transactions over
open electronic networks. The use of technical applications
that enable this kind of electronic transactions cannot
provide assurances about a user’s identity. Therefore, certifi-
cation authorities are needed to issue digital certificates that
can be used to bind the specific identity of a user to a
particular application.

However, as recognised in the recent Directive on electronic
signatures (1), electronic signatures will be used in a large
variety of circumstances and these services should not be
limited to the issuance and management of certificates, but
should also encompass any other service and product using,
or ancillary to, electronic signatures, such as registration
services,
services,
computing services or consulting services related to elec-
tronic signatures.

time-standing

directory

services,

The Identrus
approximately 300 financial
participants
together covering all important business areas of the world.

system is expected ultimately to comprise
institutions acting as level one
two participants,

and hundreds more

level

The Identrus system will act in the same market as a number of
competitors that are currently developing systems to offer their
own certificate
important
competitive initiatives come from financial industry ventures,
technology vendors, postal authorities, industry specific vertical
initiatives and telecommunications carriers who have estab-
lished themselves as commercial certificate authorities.

services. The most

authority

F. THE COMMISSION’S INTENTIONS

On the basis of the foregoing, the Commission intends to take
a favourable view on the notified transaction. Before doing so,
it invites interested third parties to submit their comments,
within one month of the date of publication of this notice,
quoting the reference COMP/37.462 (cid:151) Identrus, to:

2. Geographic market

The Identrus system will offer its services on a global basis
enabling international business-to-business transactions.
is
hence submitted that the relevant geographic market is the
worldwide market for the services in question.

It

European Commission,
Directorate-General for Competition,
Directorate C,
Rue de la Loi/Wetstraat 200,
B-1049 Brussels.
Fax (32-2) 296 70 81.

(1) Directive 1999/93/EC of

the
Council of 13 December 1999 on a Community framework for
electronic signatures (OJ L 13, 19.1.2000, p. 12).

the European Parliament and of