3.2.1 French ecosystem

[mark-orz]

"In France, a trusted issuing certificate authorities list is maintained by the Finances Ministry in order to manage corporate identities Certificate authorities used to manage the face to face identity verification and deliver smartcards or USB tokens."
Change to
"In France, a list of trusted issuing certificate authorities is maintained by the Finance Ministry. The face-to-face verification of identity is managed by the certificate authorities, as is the delivery of smartcards or USB tokens."
(Not sure whether this applies to just corporate identities or to private individuals as well, please clarify.)

"And issuing authentication credential is not acceptable according to the existing risks they are facing in terms cyber attacks: combined social engineering, phishing, stolen TAN..."
Not sure what this is supposed to be saying, and I don't know what "stolen TAN" is. Perhaps:
"Issuing authentication credentials carries certain risks, such as social engineering and phishing."

"Banks are looking to cover the transaction risk by using the right credential to adapt the user experience to the risk, which includes also the strongest level for the highest risk."
Change to
"Banks are looking to cover the transaction risk by using the right credentials for the risk, with the strongest level of authentication being used for the highest risk scenarios."

"And now without the capability to rely upon Secure Elements in the browser, they currently facing a major issue to replace the existing identity scheme delegation which was providing a strong authentication and signature credential. "
Change to
"Without the capability to rely upon Secure Elements in the browser, banks currently face a major issue in being able to replace the existing identity scheme delegation which provides a strong authentication and signature credential. "

[sbahloul]

Not sure whether this applies to just corporate identities or to private individuals as well, please clarify.

FYI: it's about identifying individuals acting on behalf of the company.

[sbahloul]

Not sure what this is supposed to be saying, and I don't know what "stolen TAN" is.

TAN stands for Transaction Account Number which can be OTP sent by SMS or computed thanks to OATH or EMV/CAP tokens. I add it the explanation inline.