The Financial Services Sector Opportunity François Lasnier VP Banking & Retail, NAM Schlumberger Smart Cards & Terminals 11/11/2018

Agenda Technical Overview – Three Models The Smart Card Advantage Type of Biometrics in the Financial Space Benefits Applications Users – Pilots Main Barriers to Adoption Some Stats Legislations & Regulations Industry Outlook – Trends & Opportunities 11/11/2018

Technical Overview (#1) Link to an individual / access rights One-to-one Database model ISSUES: Security Future liability (no legisl. yet) Privacy / Social acceptance Passive (no proof of transact.) Enrollment Potential for customer fear Database Service Provider Bio-authentication (user authentication) By Service Provider online 11/11/2018

Technical Overview (#2) Cert. Validation thru Chain of Trust Online & offline Many-to-many (distributed) Active (e.g., e-sign) Wider acceptance (multi-channel) Better privacy control PKI Authorization Server Service Provider User authentication 010011 001101 101101 Cert. embeds ID data Smart Card 010011 001101 101101 Public/Private Keys Digital Certificate Transfer of identity attributes Digital Certificate  Biometrics Biometrics to unlock the Smart Card 11/11/2018

Technical Overview (#3) Best privacy control Smart Card verifies Identity Service Provider authenticates Smart Card Identity only used to unlock SC Authorization Server Service Provider SC authentication SC linked to an account No Identity data beyond this point Card ID Card ID Public/Private Keys Card ID No transfer of identity attributes Identity linked to SC at issuance but never released Biometrics to unlock the Smart Card 11/11/2018

The smart card advantage Smart cards are secure identification portable devices Tamper resistant hardware Certified software access control Secure private key storage Cryptographic algorithms Digital ID storage Personal data Graphical personalization Universally accepted format Your virtual identity stays with you You can use your virtual identity where you are You provide your credentials only when you want, protecting your privacy

Type of Biometrics Fingerprint Most relevant to payment (esp. physical) Convenient, less obtrusive/invasive, stable, reliable Voice verification Relevant to login or phone identification (mono channel) Has to prove as reliable as fingerprint Iris or Facial recognition ATM transactions 11/11/2018

Benefits Biometrics only: Positive identification/identity verification Reduced risk of ID theft for consumers You always have your ID with you ! Biometrics + Smart Card: No centralized database (better privacy) – Consumer in control Active technology (encryption, signature, etc.) Decoupling of Identity and authentication attributes Card form factor allows for branding Multi-channel acceptance 11/11/2018

Applications Login (account access, SSO, ATMs, etc.) Secure online payment (authentication, confidentiality, non-repudiation) Self-service account administration (e.g., unlock PIN) Intranet/corporate security – Data protection & access control Account aggregation – Account referencing Check cashing or check payment (incl. ACH transactions) Branch automation / Teller window authentication Background checks 11/11/2018

Users - Pilots U.S. Grocery Stores for payment: Falley’s Food 4 Less in Kansas and Missouri, Thriftway Grocery in West Seattle, Kroger in Texas, etc. Check cashing and check payment at merchant locations in 31 states – Fast & Easy Stores, CA Bank Leumi Contact Center, Israel: Voice verification solution International Finance Corporation / World Bank – Feasibility analysis Wells Fargo / Innoventry: Facial recognition technology instead of PINs at ATMs Bank of America: Fingerprint access to online banking (w/ smart card) – Pilot in 1999 11/11/2018

Main Barriers to Adoption Fear of consumer backlash (social acceptance, inconvenience) Fear of low consumer adoption rate / low transactions CSR to support technology deployment Training & education Implementation costs (incl. integration w/ legacy) Standards Pain (fraud & legislation) is still bearable – Liability is still manageable For how long ? 11/11/2018

Some Stats U.S. consumers say the financial industry needs to do a better job of verifying the identity of customers who open bank account (66%) and credit card accounts (72%) 5.6% of consumers victim of ID theft (12m people) – 15.9% of consumers victim of credit/debit card fraud or ID theft Credit card fraud = $2.5B in 2003 – Total ID theft = $8B In 2003, 42% of large F.I.’s will spend between $500k and $2.5m on IT for risk management (= 9.2% of total IT spending) Biometric revenues in the Financial sector is projected to reach $672m by 2007 Source: Star Systems – Apr 2003 (survey of 2,000 people) Source: GartnerGroup Source: International Biometric Group 11/11/2018

Legislations & Regulations USA Patriot Act – Customer Identification Program (CIP) – Deadline = Oct 1st, 2003 – Risk based identification of all new customers SEC Rule 17a-4 – May 2003 - Logging and retention of electronic communications by financial services firms The Sarbanes-Oxley Act of 2002 – Deadline = June 2004 - Accuracy and integrity of corporate financial management California Senate bill 1386 (Civil Code 1798.82) – Operative July 1st, 2003 - Notifying California residents of security breaches to their non-encrypted information Basel II – Deadline 2006 – Capital charge associated with operational risk Gramm-Leach-Bliley Act (1999) - How banks can share a customer’s personal information with other companies Privacy Act of 2003 (Bill S. 228 & S. 745) introduced on March 31st, 2003 – Federal std regulating the use of sensitive information and establishing a comprehensive national system for privacy protection 11/11/2018

Industry Outlook – Trends & Opportunities State and Federal rules and regulations are putting pressure on Financial Institutions to improve customer identification, increase consumer data protection, restrict traditional ID models (e.g., SSN)  Increased liability exposure  Incentive to act & implement new security frameworks based on Identity Management Fight against Cyber-Terrorism – Need to strengthen the security of networks and applications Increased level of e-Transactions will call for better ways of authentication people online (2 and 3-factor auth) Username & Passwords are outdated, Pass-phrases are a short-term fix, remote access points are untrusted New security models require new policies + disruptive technologies, and will emerge as pain becomes less bearable 11/11/2018

Thank You François Lasnier VP Banking & Retail, NAM Schlumberger Smart Cards & Terminals Austin, TX Tel: 512-257-3890 Email: flasnier1@slb.com 11/11/2018