issues such as title transfers, inheritance, and pledges. The use of digitally signed applications reduces paper handling and allows the Treasury to be centralized in one physical location.

Completed applications are printed for the applicant and the bank officer to sign, and each receives a copy. Although digital signatures are being used in the program, they are mainly used to facilitate the routing of application forms. There are few concerns about the robustness of digitally signed documents because parties can default to signed hard copies of applications.

This process experienced a disaster when the sole dealer for the original Small Investors Program went out of business in early 2001. Having investor information at the Treasury allowed uninterrupted servicing of investor transactions.

# **Identity theft**

Dealing directly with retail investors through a Web-based delivery channel forces the Treasury to address the possibility that investors’ electronic identities will be stolen—causing losses to cash and securities holdings. In response, Smetrix and the Treasury have developed process and workflow controls to augment software and hardware safeguards. The telex funds transfer system has been used as a model of an electronic system that relies on an open network to transmit high-value transactions. Because telex transfers are inherently unsafe, the banking industry has developed robust operating procedures to provide protection.

As noted, investor profiles are created over an intranet that securely links e-SIP platform with the Gatekeeper software at dealers and the Registry of Scripless Securities. The main motivation for this approach is that the intranet offers a “clean” environment with high confidence that malicious manipulations of identity data have been blocked.

Each investor selects a username and password for the system. Every time investors submit purchases, they only need to key in their usernames and passwords to identify themselves. The system then identifies the investor using a unique alphanumeric code based on the investor’s bank account and securities registration account. (These identifier codes are permanently set in the systems maintained by dealers and the Registry of Scripless Securities, and cannot be changed. Bank and registry accounts are never shown or required on the Web form.) This identifier code is then passed on to the gatekeepers (dealers or the Registry of Scripless Securities) along with the details of the purchase. The gatekeepers scan their records if see if there is a match for it. If there is, the transaction is translated into the data format required by the target system. Thus authorization of the transaction is performed onsite by the gatekeepers.

In the physical world, risks of collusion within financial institutions have been addressed by using internal audit teams to constantly monitor transactions and verify them with bank customers. Among the main tools used are independent tracers sent to customers asking them to acknowledge the accuracy and completeness of bank records. The dilemma for Web-based financial services is that email verifications of transactions could be compromised. In addition, the speed of electronic processing implies that criminals may be long gone by the time independent tracers are sent out.

42