CRC 21-09 - Authentication Services

The Canadian Red Cross (“CRC”) is soliciting information from industry so that it may select a service provider for personal authentication which includes both data and documents validation. CRC is looking at putting in place a 3 year term agreement with the option of 2 X 1 year extensions with the selected vendor.

CURRENT STATE
When providing financial assistance to emergency affected individuals, the Canadian Red Cross (CRC) undertakes a process to authenticate individual's identity prior providing any financial assistance to (a) validate eligibility and (b) as a fraud mitigation tool. This is currently performed in different ways:

• Automatic identity check. This is the default process. As soon as data is entered into the CRC system it is sent over to the existing service provider via API, who will check and send back the authentication results (whether there is a successful match, unsuccessful match, or when the API call failed).
• Batch authentication. When the automatic identity check is not available, CRC will decide whether to submit a batch or to perform in person identity check. If the decision is to proceed with batch authentication, CRC engages with a different service provider to perform such validation and provides a file containing multiple individuals information (same data used in the automatic identity check), and the service provider will inform CRC of the results.
• In person identity check (Documents check). For individuals CRC is not able to authenticate from the above processes, CRC will request documentation (e.g., driver’s licence or passport) to perform in person validation to match documentation with the information contained within the CRC system. When this is not possible, as an exception, we may proceed with a videoconference or electronic submission of files.

• Tier one (or simple authentication) - to be implemented by end of Q1-2022: requires verification of various data points via API using data entered in our Emergency Management Information System (EMIS). This is done as soon as data is entered, and once authentication results are sent back via API to CRC system, no data is to be kept with the service provider database / system.
  • When API is not available to perform the simple authentication process, CRC will provide a file so batch authentication can be performed by service provider based on the same data point.

• Tier two (or comprehensive authentication) - to be implemented by end of Q2-2022. This second tier would be for the registrants that couldn’t authenticate successfully through the API (tier 1). The individuals will upload documents (defined by CRC) directly into the service provider system in order to verify the validity of the accepted ID documents submitted (e.g., provincial driver’s license requirements; Canadian passport requirements; etc); and cross-reference the documents with matching data points from CRC system (e.g., address). Authentication results would be sent back via API to CRC system, no data and documents are to be kept with the service provider database / system.