service agreements with dealers and the Data Center. These agreements define a baseline of service quality expectations that should be disclosed to investors, including for system requirements, availability, contingency plans, and schedules for maintenance and upgrades.

# **Reliance on third-party software**

Program applications will require regular maintenance to ensure their proper operation. As part of maintenance, source code must be provided to program participants. The source code for the Registry of Scripless Securities is owned and guarded by the Treasury. Source codes for the program application, Document Hub, and Gatekeeper software are held (in escrow) by the Data Center. All these applications run on Unix and are built on open platform conventions—ensuring maximum flexibility when choosing hardware and software to operate these systems. Participating dealers have varying proficiency in terms of their checking account systems, and not all possess the source codes.

There is a growing trend among software vendors to offer remote administration and maintenance. This option has been popular in the Philippines due to the perceived lower costs. But there have been several cases in the United States where systems have been hacked or manipulated while being remotely maintained. Remote administration is not available for the Registry of Scripless Securities and Smetrix software. Any required maintenance necessitates that the vendor’s support personnel visit the relevant office.

# **Identification, authentication, and authorization**

Unlike other retail trading systems where updates to investor holdings are executed on the systems of securities dealers, the Expanded Small Investors Program permits investors to directly acquire and register their holdings on the Registry of Scripless Securities. This approach has legal implications because full title to securities is granted upon registration. Thus strong efforts must be made to avoid erroneous registrations. For electronic purchases transferred to the registry on a straight-through processing basis, risks are concentrated in two areas. The first involves identifying and enrolling investors; the second occurs at the time of purchase.

# **Compliance with “know thy customer” rules**

The Treasury appoints participating dealers as agents to enroll retail investors. The account opening procedure follows standard bank account openings in that the applicant has to appear before the enrolling bank officer and bring suitable identification. The entire application process is done at a bank branch, with the information created and committed on an internal network.

Compliance with “know thy customer” rules is still rooted in physical identification. The Philippines does not have electronic identity databases that would allow banking or investment accounts to be created through electronic verification. Although physical identification may be tedious, it makes it harder to create phantom identities and accounts.

Electronic documents carry all the terms and conditions underpinning the program. These documents are digitally signed by the bank, and copies are stored with the Treasury and the bank. The Treasury needs copies because of its registrar functions, which include acting on ownership-related 41