Service description

iDIN offers various details that can be requested individually or in combinations. The flowchart below presents
the types of communication that take place between CM.com, the customer, and the (end) user.
The additional communication between the Issuing and the Acquiring bank is represented by a dotted line.

Section Available details provides a more detailed explanation of the available details.

1. Bank selection
   On your website, the (end) user selects the bank through which the (end) user wishes to identify themselves.
2. Transaction
   The transaction is started, and the desired consumer data is requested from the issuing bank selected.
3. Banking environment
   The (end) user leaves your website and is sent to the internet banking environment of their bank.
4. User approval
   In the banking environment, the (end) user approves the provision of the requested data.
5. Status
   The iDIN transaction is assigned a status based on the (end) user's response in the internet banking environment. This status with approved data attributes is sent to CM.com via the Issuer and the Acquirer.
6. Customer's web page
   CM.com ensures that the (end) user is returned to your website and that you receive the approved details. See below for an example of a successful status with approved data attributes.

Available details

Unique log-in number
Each iDIN transaction is assigned a unique number. There are two different options:

• BIN is short for Bank Identification Number and comprises three features: the Issuer, the Customer, and the (end) user. BIN is suitable for repeated log-ins, as this is how (end) users uniquely identify themselves to the Customer.
• Transient_ID; Transitive transactions are used if details only need to be requested once. This is a unique number that the Issuer assigns to the relevant iDIN message.

Verified details of (end) user:
Originating from an independent source, the statutory proof of identity:

• Name: initial(s), prefixes, surname (family name/legal last name)
• Age indication: 18 or over; or
• Date of birth
• Gender

Details provided to the Issuer by the (end) user:

• Surname preferred by the (end) user, such as preferred name/partner's surname.
• Home address: street, house number (appendix), postcode, town/city
• E-mail address
• Telephone number

End users may decide not to send the "e-mail address" and "telephone number"; at some banks, they can have them overwritten by the preferred details.

Quality of the details provided

Based on specific requirements, it is determined what criteria an Issuer's electronic means of identification must meet to be permitted to enter the iDIN Scheme. These requirements are based on eIDAS regulations. Within iDIN, Issuers must offer at least one electronic means of identification that meets the reliability level "Substantial". This has the following main characteristics:

• The identity of the (end) user has been verified based on a valid proof of identity; and
• Use is made of a two-factor authentication.

In addition to the above main characteristics stemming from eIDAS, requirements have been set for the quality of the details provided by Issuers. The iDIN user target group must meet the following preconditions:

• Natural persons.
• With access to the internet and/or mobile banking.
• Have been identified by the bank as complying with the Money Laundering and Terrorist Financing (Prevention) Act (Wwft).

The quality assessment of details is based on the following measurement criteria and related standards:

Diversity of the details provided

The section below describes the diversity of details, which we advise you to take into account during implementation.

Non-Latin characters may be used for the name, address, and e-mail address attributes. ‘A Żaiŀenoŕ’, for example, is a valid name that may be provided via iDIN.

Name

• It is possible that the legal surname is not provided, but a preferred surname is provided instead.
• A surname prefix can be abbreviated (e.g. 'vd' or 'v.d.' instead of 'van de').
• In some cases, the legal surname may comprise the legal surname preceded or followed by the partner's surname.
• If the (end) user has a double-barreled surname with two prefixes (e.g. ‘de Vries van Dijk’), only the first prefix is provided in the surname prefix field, the rest of the name is provided in the surname field.
• In exceptional cases, the initials of the (end) user may be missing.

Date of birth

• In exceptional cases, the month or day of the (end) user's date of birth may be unknown, because the country of birth has not registered the exact date of birth. In such cases, the value ' 00' is used for the unknown day or month. If, for example, the day is unknown, the date of birth could be '1995-01-00'; or if both the day and month are unknown, the date of birth could be '1995-00-00'.

Address

There are four scenarios to take into account when providing an address:

• You may receive the postal code and the house number only, or the street name, house number, and town/city. Both can be traced to a unique address.
• Some (end) users may have no house number (for instance when they live on a houseboat); in such cases, the field address extra is used to specify the address in more detail.
• Some (end) users may have an international address, which consists of different fields to those of an address in the Netherlands. In such cases, a separate field is provided for the international address.
• Street names may be abbreviated (e.g. 'Mr. J.F. Vietorstraat' or 'Kerkstr').

Telephone number

There are two potential scenarios to take into account:

• The telephone number starts with a + followed by the country code and the rest of the telephone number. E.g. +31612345678 for mobile numbers and +31203051900 for landline numbers.
• The telephone number has a format that includes brackets, spaces, +, and/or -. E.g. 06-12345678 for mobile numbers and (020)3051900 for landline numbers.