ASA Auth: Passwordless Connection Between Fintech and Finance.

In an era where digital security is paramount, the traditional username and password model is failing both institutions and consumers. ASA Auth replaces friction with flow, using existing bank-verified data to create a secure, permanent bridge between Financial Institutions (FIs) and the fintech applications users love.

what is ASA Auth?

ASA Auth is a proprietary, low-friction authentication framework within ASA Vault. It allows account holders to verify their identity and link their financial accounts using the Know Your Customer (KYC) data already stored by their bank.

By leveraging a direct "Core" connection to the bank’s operational system, ASA Auth eliminates the need for users to share sensitive online banking credentials with third parties.

Why use ASA Auth?

Traditional "screen-scraping" or credential-based aggregators are plagued by two major issues: security risks and connection fatigue.

  • Zero Credential Risk: Because ASA Auth is passwordless, users never share their mobile banking login. This significantly reduces the surface area for mobile banking access fraud.

  • Persistent Connectivity: Unlike other solutions that require users to re-authenticate every 3 to 30 days, ASA Auth creates a permanent connection. Once a user is authenticated, they stay connected.

  • Institution Control: FIs can finally control the authentication experience, choosing which Knowledge-Based Authentication (KBA) questions to ask and how many "matches" are required to verify a user.

  • Reduced Abandonment: By removing the need for users to remember complex passwords or hunt for forgotten usernames, ASA Auth streamlines the signup process for new fintech services.

How It Works: The Implementation

The ASA Auth journey is designed to be intuitive for the user while maintaining rigorous backend security.

  • The process begins in ASA Vault. When a user selects a partner Financial Institution, ASA Vault establishes a direct link to the bank’s "Core" (its internal operating system).

  • To locate the correct account without a password, ASA Auth utilizes a configurable KBA framework:

    • Smart Matching: The system attempts to find the user based on combinations of their first and last name.

    • Configurable Hurdles: If a unique match isn’t found, the system presents additional questions (e.g., last 4 of SSN). FIs can customize these questions based on the data their specific Core supports.

    • Final Verification: As a final step, users may be asked for the last 4 digits of their account number to ensure an exact match.

  • Once a match is identified, the platform accesses the KYC data already on file at the bank:

    • A 6-digit PIN is sent simultaneously to the phone number and email address registered with the bank.

    • Impersonation Protection: Because the PIN is sent to the bank’s records—not data provided by the user at that moment—impersonators cannot intercept the code.

    • Short-Lived Security: PINs are only valid for a 5-minute window. Any request for a new PIN immediately invalidates previous ones.

  • Once the user enters the PIN, the account information is returned to the ASA Vault.

    • Categorization: Accounts are automatically mapped (e.g., Savings, Credit Card) using platform logic.

    • User Validation: The user reviews and accepts the account mapping.

    • Permanent Link: The connection is now active and permanent, requiring no future logins to maintain the data stream.

Security Layers: Auth vs. Verify

To maintain the highest level of security, ASA distinguishes between Information Access and Movement:

ASA Auth

  • Purpose: Authenticate identity to view/link data.

  • Method: Passwordless KBA + Bank KYC PIN.

  • Capability: View balances and send data to Fintechs.

ASA Verify

  • Purpose: Authenticate identity for transactions.

  • Method: Government ID + Biometric Matching.

  • Capability: Execute transfers and FI transactions.

“ASA Auth is designed specifically for data transparency and sharing. By separating data access from transaction capability, we ensure that even an authenticated session remains safe from unauthorized fund movements.”

Troy Maas

Co-Founder & Chief Technology Officer

The ASA Advantage

Launched in April 2021, ASA Auth is the only solution on the market offering passwordless, persistent, and FI-controlled authentication. We provide a fully audited data trail for the Financial Institution, including timestamps, device details, and geolocation/IP tracking—giving banks total visibility into how and when their data is being used.

Experience the first persistent solution. Experience ASA Auth.

Book a demo