Regulatory Compliance
Credentis helps financial institutions demonstrate that a specific transaction was validly authorized, supported by evidence, and defensible under scrutiny. Proving that a customer accessed a digital banking channel does not, by itself, demonstrate authorization.
Identity, Intent, and Context
Authentication
Authentication determines whether the institution allows a person to access an account, session, or digital banking channel. It remains a formal requirement, with risk-appropriate controls including two-factor authentication for customer access.
Authorization
Authorization is the assessment of whether a specific transaction or account-service instruction is validly approved. Within the Credentis framework, transaction initiation does not equate to authorization, and approval must be explicit, transaction-specific, channel-independent, and bound to the original transaction context.
Validity
Validity is the institution’s capacity to demonstrate that a transaction was genuinely authorized, compliant, and supported by evidence during disputes, audits, or supervisory reviews.
Regulatory position
Credentis does not authorize a transaction merely by asking the customer to return a secret, displaying another approval prompt inside the banking application, or repeating authentication when payment occurs. Credentis performs transaction-specific authorization independently of the channel in which the transaction was initiated. This independent authorization control requires Identity, Intent, and Context to align; credential possession alone does not establish validity.
Credentis is built on two core principles: the customer’s authorization must be obtained independently of the channel where the transaction was initiated, and each authorization event must be single-use and strictly bound to a unique transaction context. Compromising a banking session therefore does not give an attacker authority to authorize the transaction.
Authorization Evidence
The institution must be able to demonstrate that a disputed electronic fund transfer was genuinely authorized, not merely initiated during an authenticated session.
Credentis establishes tokenized identity and authority through biometric verification, then validates the authoritative token for each transaction. The Super Token combines a cryptographic vault-key, network identifier, mobile number, and optional device identifier. Accessing digital banking and authorizing a transaction remain distinct.
The centralized authorization model produces auditable evidence for every authorization. Structured authorization records link the decision to the transaction, so the decision and its evidence can be reviewed together during audit.
Leadership perspective
Credentis reinforces authentication, preserves subscriber continuity (the continuity of the relevant subscriber and mobile identity relationship), and keeps accessing digital banking distinct from authorizing a transaction. These controls give financial institutions a stronger basis for compliance in digital banking.