Xplan Configuration Guide for Electronic Identity & Verification

[john.gartland]

Contents                                               ­­­­­

Version Control 3

Configuration Required for Electronic Identity & Verification. 4

1.       Introduction. 4

XPLAN Functionality. 4

2.       Agreement with GBG.. 5
3.       Confirm service endpoint 6
4.       XPLAN Credentials to configure a site to use EIV&V. 6
5.       GBG Credentials. 6
6.       System Settings. 7
7.       Note Templates. 9
8.       Case Manager Benchmarks (Optional) 10
9.       Manual Identification & Verification (Optional) 13
10.      XMERGE syntax examples. 14
11.      XPORT. 14
12.      Alerts. 14
13.      Troubleshooting. 14
14.      Sample data for internal test sites. 16

Appendix 1: EID&V Set-Up Process Flow. 17

Version Control

Version	Date	Author	Comments	Sections
0.01	05 Nov 2015	CG	Draft	All
0.02	Jan 2016	CG	Draft due to changes to generic set-up	All
0.03	March 2016	CG	Updates due to changes to generic set-up	All
0.04	May 2016	CG	Minor update	All
0.05	November 2016	JG	Change to GBG contacts	2
0.08	June 2020	JG	Change to make External	All

IMPORTANT NOTE:  The GBG integration is only for use by firms who own their own Xplan site. The integration will not work on multi-tenanted sites

Configuration Required for Electronic Identity & Verification (EID&V)

1. Introduction

Within Xplan it is possible to carry out an Electronic ID & Verification check for a client using an integration with the GBG. This integration uses GBG's ID3 Global (id3global) service offering.

There are 2 possible methods for integrating with the GBG via Xplan:-

• Firms can use a generic Electronic ID & Verification profile supplied via Xplan. This single profile is based on the current Exchange Electronic ID & Verification profile which also uses a GBG integration. It is made up of the following “item checks”:-
  • UK Credit Header
  • Edited Electoral Roll
  • UK Land Telephone
  • UK National ID Register
  • UK Births
  • UK Driving Licence
  • UK Passport
  • UK Mortality
  • National Change of Address
  • International Sanctions & Enforcements
  • PEP Intelligence

The generic profile is charged on a per click basis by GBG. Iress do not charge for this service.

The following PowerPoint has been supplied by GBG to give an overview of how the generic profile works. This PowerPoint includes details of the decision bands used in the generic check

• Alternatively, if a “bespoke” profile or profiles are required then a direct agreement can be undertaken with GBG. Iress are not involved in the agreement or the set-up and administration of the bespoke profile on the GBG portal.

XPLAN Functionality

Once the site has been configured the Xplan EID&V integration allows the user to perform a number of functions: -

• Identify the individuals to run a check against
• Add further individuals to a check as and when required (provided the individuals are already set up in Xplan and you have access to them)
• If multiple profiles are available the system can either guide the user to which identity check is due to be run against each individual or allow the user to choose which check to select (this is subject to how the Xplan administrators have configured the site)
• The system will return the result from GBG in a single pdf document which is attached to a document note against the client file
• Results are brought back for each individual on the client record, and an overall result, representing the ‘worst’ result from within that group of individuals, is also determined
• Allows the user to demonstrate that they have performed an identity check by adding the result to a case manager
• The response from the identity check can be used, via case manager, to activate further benchmarks which may be required to complete the client / case file.
• A history of all checks run against an individual will be kept, regardless of which client record the individual is associated with.  For example, an individual may be associated with an individual client record for their personal advice, but also associated as a director or key person with a separate company client record.

This set up guide covers:-

• The Agreement with GBG
• Raising an RFC to configure the Xplan site to access the correct ID3 Global site 
• The user credentials required to run an Electronic ID & Verification check
• The system set up required before an Electronic ID & Verification can be run on the site
• Some optional set-up depending upon how a firm wishes to use Electronic ID & Verification
• Manual ID&V set-up
• Xmerge syntax examples
• Xport and Alert information
• Troubleshooting

A set-up process is also included in the Appendix

2.  Agreement with GBG

Generic Profile

Before contacting GBG to discuss the integration please ensure that the firm has its own site e.g. isn’t on a multi-tenanted site and they are on version 2.16.27 or 2.17.7 and above of Xplan

The Application form needs to be sent to the GBG. Contact details are on the Application:

Once they have been completed and returned a username and password to access the generic profile will be sent to the firm user set up on GBG.

This information will need to be configured into Xplan

Bespoke Profile

An introduction email will need to be sent to the GBG. Contact details are below:-

Laura Williams

Channel Account Manager – ID Verification

•         01244 657343
•         Laura.Williams1@gbgplc.com
•         www.gbgplc.com

GBG will negotiate terms and will set up the site, profiles (including decision bands) and user details on the GBG admin portal for id3global. This information will need to be supplied to you to enable you to configure Xplan.

Existing GBG users

Any firms who have existing profiles with GBG (either URU or Id3global) will need to contact GBG and Iress (Integrations Team) to ensure their profiles and user credentials can be used in the set-up on the GBG id3global system and Xplan integration.

NB So that uptake can be monitored please notify the Integrations Team via your account manager and email 'iressopenintegrations@iress.com' that an Electronic ID & Verification query has been sent to GBG in all cases.

3. Xplan Credentials to configure a site to use EIV&V

In order to fully configure a site to use EID&V the user will need the following capabilities:-

• Edit Field Definitions
• System Settings
• User Settings - Document Note
• Manage Case Benchmarks
• Manage Xmerge Templates

4. GBG Credentials

GBG Credentials are added at User Group level. To set these credentials:-

1. Go to User Functions > Administer Groups and select the group the user is a primary member of.
2. From the Group menu select Admin > Electronic ID Verification and enter the user credentials.

• Generic Profile: The credentials for a site using the generic profile will be sent by GBG to the firm and the firm will need to supply these to the Site Administrator
• Bespoke Profile: For a bespoke site these credentials will need to be supplied by GBG to the firm

5. System Settings

The GBG profile information needs to be entered in the system settings screen

To access System Settings, click on System Menu (Xplan) > Administration Functions > System Settings.  Select Electronic ID & Verification in the left hand menu.

A. Electronic ID&V Settings panel

Allow Check Type Selection: This field is available on sites from 2.15 onwards. It applies to sites which have multiple profiles and allows a user to either choose the profile they wish to use or have the site mandate which profile is used based on various settings including the check hierarchy and validity periods.

We would recommend that this field is left as being set to “Yes” for all type of profile.

Maximum Retries: This field controls how many retries that an adviser is allowed to make for each profile check during the validity period (see below) e.g. if this is set to ‘1’ it means that if a user requests a check on a client, they will only get one additional chance at sending a request through to GBG during the validity period.

NB: This setting does not affect how many times the check result can be re-used

Manual ID&V Doc Types: The “Manual ID&V Doc Type for Passport” and the “Manual ID&V Doc Type for Driver Licence” fields enable the user to set which manual identity documents on the Manual ID&V screen contain the correct reference numbers for Passport and for Driving Licence. 

If data has been entered in the selected field in the Manual ID&V screen then this will automatically pass to the corresponding field in the Electronic ID & Verification screen.

The format for capturing a UK Passport to be passed to GBG is '30 Chars' the long number from the bottom of the passport page minus the chevrons: 

 

Example: 9992119815GBR9501016F291127206

UK Driving License is:

Example: MORGA753116SM9IJ

European Passports (although not currently supported) follow the same format, although you include the full number all '44 chars' including chevrons.

B. Profiles panel

This panel contains the details of GBG profile

Click on Add and enter the following details: -

Check Name: An English descriptor for the profile name which is used in the Xplan UI. It does not get sent to GBG so any appropriate name can be entered.

ID: This is the profile GUID generated by GBG

• Generic Profile: For the generic profile this will be supplied to the firm by the GBG
• Bespoke Profile: For a bespoke profile this will be supplied to the firm by the GBG
• Internal test site: For internal test sites this will be provided by GBG if a Pilot Profile has been requested.

Version: This is the version number of the profile you wish to use.  It is used to version control any amendments to the same profile on the GB admin portal (e.g. if a dataset is added to or removed from the profile).

• Generic Profile For the generic profile this will be supplied to the firm by GBG
• Bespoke Profile For a bespoke profile this will be supplied to the firm by GBG
• Alternatively: Select v0 and this will get the latest version of a profile

Priority: For sites with multiple profiles this controls the priority order in which Xplan will look at the profiles set up on the site to determine which profile needs to be run.

• Generic Profile: For the generic profile this will be 1 as there is only one profile
• Bespoke Profile: For a bespoke profile this will be supplied by the firm
• Internal test sites: For internal test sites this will be 1 as there is only one profile

Validity Period (days): How long the profile should be valid (or in force) for.

Status: The status of the profile. This can be changed if the profile is no longer current, to Inactive.

NB The ID, versions and priority of the ‘Generic’ profile are managed by the Integrations Team. If these are changed a notification will be posted in ‘Community’.

C. Result Mappings Table

When an EID&V check is performed by a user, an overall score is returned for each check. This score is dependent on the numeric values that are configured by GBG within each item check (based on the result types that can be returned). These individual scores are added together for all of the items within the overall check and this overall score is used to define which “Decision Band” a check falls into.

The Results Mapping table is used to configure these decision bands within Xplan. This panel also controls what document notes are automatically created when an EID&V is created, this is based on the overall decision band for a profile.  The overall decision band is defined as the “worst” decision amongst a group of individuals.

For Generic profiles and Internal test sites the decision bands supplied by GBG are as follows:-

Decision band

ALERT: Check input data or fraud flags

REFER: Insufficient match for electronic ID

REFER: Partial Match, passport or driving license required

PASS: ID Verification successful

For a bespoke profile the decision bands would need to be gained from the GBG website by the firm.

Select to Add a new mapping and enter the following details: -

Hierarchy: if a check includes multiple clients then the worst decision band will be shown as the overall result. This Hierarchy field allows Xplan to determine which decision band is the “worst”.  The higher the number, the worse the decision.  The number needs to be an integer (whole number) value

Example: If “Alert” is deemed to be worse than “Refer” then “Alert” should have the higher number recorded in the results mapping table. If a check is carried out on a client and partner and the client is an “Alert” and the partner is a “Refer” then the overall decision would be “Alert”.

For Generic profiles and Internal test sites the decision band hierarchy can be set as follows:-

Hierarchy	Decision band
40	ALERT: Check input data or fraud flags
30	REFER: Insufficient match for electronic ID
20	REFER: Partial Match, passport or driving license required
10	PASS: ID Verification successful

N.B use additional hierarchy for multiple profile responses e.g. Profile 1 =  10, 20, 30 and 40 Profile 2 = 110, 120, 130 and 140.

Decision Band: This text field needs to match the decision band which has been configured on the GBG Admin Portal exactly case and space sensitive. (see table above for the decision band text for generic profiles and internal test sites)

Note that if the decision band on the GBG portal is changed before Xplan can handle it, a document note will not be generated when the response comes back.

Docnote Template: Select the document note template you wish the pdf response note to be linked to (see note template section below).

6. Note Templates

The Electronic ID & Verification functionality requires that a note template is created to attach a pdf of the ID check outcome to the client record. The doc note needs to be unique per decision band

A. Go to Administration Functions > Field definitions screen, set group to “Note” and press search

B. Click on [Note] Type

C. Create a Note Type of “EID&V”

D. In Field Definitions click on [Note] Subtype and create a new Note Sub type for each of the decision bands (see 6c above)

E. Link each one to the EID&V type created in C

F. In the Document Library screen under Templates add a document note for each decision band (see 6c above) with the type and sub type created in C and D above.

Now when an Electronic ID & Verification profile is generated for a client then a doc note with the corresponding type and sub type will be automatically displayed in the Admin > notes screen

7. Case Manager Benchmarks (Optional)

NB This section is optional and is only needed if the Electronic ID & Verification results should be attached to a case manager and trigger additional benchmark items depending upon the overall decision received.

If it is required, follow the steps below: -

A. Create a benchmark of type EID&V - this will allow you to compel an adviser to perform an eID&V check (regardless of result)

B. Create a note benchmark for each decision band which could come back from the GBG profile.  Each of these benchmarks will use the unique combination of note type and subtype set in section 6.

e.g.

C. Create a benchmark set for each of these eID&V response note benchmarks and link the note benchmark created in B 

For example for the internal test and training and demo sites:-

• Benchmark set “EID&V PASS” contains a note benchmark for the PASS response
• Benchmark set “EID&V REFER: Insufficient match” contains a note benchmark for the REFER: insufficient match response
• Benchmark set “EID&V REFER: Partial Match” contains a note benchmark for the REFER: Partial Match response
• Benchmark set “EID&V ALERT” contains a note benchmark for the ALERT response

D. Create any benchmark actions which need to appear in case manager to reflect the actions you want the adviser to take for each response.

For example:-

An ALERT could require a benchmark item to contact the Financial Crime team

A REFER: Insufficient match could require the adviser to a) contact the client for more information and b) do a manual ID&V check

So the following benchmark items will need to be created:-

• Contact the Financial Crime team
• Contact the client for more information
• Do a manual ID&V check (see below)

You may decide that you do not want any benchmarks to activate in the event of a PASS response

E. Create additional benchmark sets which contain the set of benchmarks you want to appear in the case manager for each response.  For example: -

Benchmark Set “Contact the Financial Crime team” contains the “Contact the Financial Crime team” benchmark check

Benchmark Set “Contact client and do manual ID&V” contains the “contact the client for more information” and “do a manual ID&V check” benchmark sets

F. Add a single dynamic benchmark set which includes all of the benchmark sets

Activating Benchmark (set)	Benchmark Set
EID&V Alert	Contact Financial Crime team
EID&V refer : Insufficient match	Contact client and do manual ID&V

G. If a case is created with:-

•         a case benchmark that includes an EID&V check and
•         the dynamic benchmark created in F set as the dynamic benchmark

Then when an EID&V check is carried out within that case and a response is returned this will trigger different subsequent benchmarks depending upon the response

In our example:-

An ALERT will trigger a task to contact the Financial Crime team

A REFER: Insufficient match will trigger items to a) contact the client for more information and b) do a manual ID&V check

8. Manual Identification & Verification (Optional)

NB This section is optional and is only needed if a manual ID&V check also needs to be created and added to a case manager

If there is a requirement to compel advisers to complete a manual ID&V check and then to add this to a case manager, a new note template with a unique type and subtype combination can be created. 

A merge document can be customised (syntax is included to pull through images as well) and attached to this note template automatically (existing functionality).

Finally, so that Xplan knows which merge document to generate when the Print Documents button is clicked on the Manual ID&V screen, there is an interface setting against the Identity Check element where the template can be specified: -

A case manager note benchmark (of the same type) can then be created as described above.  For example, you could add in a note benchmark of this type/subtype which is activated in a dynamic benchmark set in the event of a REFER response (see above).

9. Xmerge syntax examples

A. Manual ID&V screen: -

<:for check  in $client.manual_id_verification_list:>

<:=check.description:>

<:if check.has_attachments():>

<:for pic in check.get_attached_pictures():>

<:=pic:>

<:end:>

<:end:>

<:end:>

B. Electronic ID&V: -

IDVHistory Xmerge Test

<:let history_list = $client.eidv_history_list:>

<:if history_list:>

<:let first_history = history_list[0]:>

Name of Individual:                           <:=$client.entity_name:>

Latest decision band:                       <:=first_history.check_result_text:>

Date last check run:                          <:=first_history.check_result_timestamp:>

Check last run:                                   <:=first_history.check_rule_profile_name:>

Check version last run:                    <:=first_history.check_rule_profile_version:>

<:end:>

Client Record

Client Type

Relation

Check ID

Check Version

Result Date

Decision Band

Details

<:for history in history_list:>

<:=$client.entity_name:>

<:=history.entity_type:>

<:=history.relation:>

<:= history.check_rule_profile_name:>

<:= history.check_rule_profile_version:>

<:=history.check_result_timestamp:>

<:=history.check_result_text:>

<:=history.check_result_comments:>

<:end:>

END

10. Xport

If XPORTs need to be created including Electronic ID & Verification information then there is an eID&V datasource against the client, called EID Verification.

11.  Alerts

If an alert needs to be created then there is a New Field Group option for alert criteria which is based on the field group “Electronic ID & V”.

12. Troubleshooting

Occasionally the following errors may appear when trying to run an Electronic ID & Verification check.

An unsecured or incorrectly secured fault was received from the other party.

In most case this will mean that either:-

1. The site isn’t pointing to the correct riskservice. To confirm this please speak to Iress customer Support.

2. The user isn’t a primary member of a group with a valid GBG username and password entered. If this has definitely been entered correctly then:-

3. The user group password is invalid, has expired or the account has been locked out. If this occurs:-

• Generic Profile: For the generic profile the firm will need to contact GBG or their internal GBG administrator to reset the password
• Bespoke Profile: For the generic profile the firm will need to contact GBG or their internal GBG administrator to reset the password

Primary user group does not have EI&V credentials

In most cases this means that

1. The user isn’t a primary member of a group with a valid GBG username and password entered. If this has definitely been entered correctly then:-
2. The user group password is invalid, has expired or the account has been locked out. If this occurs:-

• Generic Profile: For the generic profile the firm will need to contact GBG or their internal GBG administrator to reset the password
• Bespoke Profile: For the generic profile the firm will need to contact GBG or their internal GBG administrator to reset the password

User does not have permission to perform this operation

 

In most cases this means that either

1. The user isn’t a primary member of a group with a valid GBG username and password entered OR
2. The wrong check GUID or version is being used

If this has definitely been entered correctly then:-

• Generic Profile: For the generic profile the firm will need to contact GBG or their internal GBG administrator to confirm the details provided are correct
• Bespoke Profile: For a bespoke profile the firm will need to contact GBG or their internal GBG administrator to confirm the details provided are correct

No eIDV document template found for : - 1

In most cases this means that either

1. The doc notes have not been set up with text that exactly matches the text returned by GBG. Please ensure the text matches section C above.
2. The Mappings do not match correctly to the text for the docnotes
3. 'User Preferences' For template and docnote visibility are limited to 50. This will prevent the user seeing the mappings and returning the docnote error. Set Preferences to 'unlimited'  

Appendix 1: EID&V Set-Up Process Flow