VFS Global

Indian businessman Zubin Karkaria founded VFS Global in 2001 after he had purportedly "persuaded the U.S. government to pilot a scheme for Indian visa applicants to the US at its Mumbai embassy."[8] According to Karkaria, the U.S. government was initially resistant to his proposal and convincing them "to allow us to run the purely administrative part of a visa application process" proved to be an arduous process.[8] Following protracted negotiations, the company opened its first visa processing center in Mumbai that same year.[8] Within half-a-decade, VFS Global acquired lucrative contracts with eleven governments including the United Kingdom, Australia, and Canada.

The phenomenal growth of the company was largely due to its revenues from service fees paid directly by visa applicants. In 2009, financial records indicated that VFS Global's parent company at the time, VF Worldwide Holdings, was an offshore corporation which had been "incorporated in the African tax haven of Mauritius."[5][6]

By 2007, the company had obtained its first global account from UK Visas and Immigration for operations across 33 countries. Within one year of gaining its account with the UK government, the company's image was tarnished by a data breach which exposed the sensitive information of UK visa applicants.[9] Despite this breach, the outsourcing company nevertheless obtained a major contract with the United Kingdom in 2014 to administer the majority of the UK's visa applications.[7] Critics allege "this contract was a crucial step-change in how [British] visa applicants could be squeezed for more money."[7]

In August 2017, the outsourcing company acquired the UK-based visa service provider TT Services (TTS) for an undisclosed amount.[10] At the time of the acquisition, TTS operated 51 visa application centres in over 35 countries with 216 employees.[10] Later that year, in November 2017, VFS Global expanded its visa services in Cyprus with new centres launched in the additional cities of Thiruvananthapuram, Goa, Gurugram, and Jaipur. These expansion increased the amount of visa centres where applicants were offered additional services, such as SMS updates, courier services, and online tracking services.[11]

In June 2018, Kuoni Group, also known as Kuoni Travel Holding, after selling all the travel agency businesses and licensed the brand "Kuoni Travel" to the new owners of the former subsidiaries, had merged with VFS Global, its major business at that time.[12] By December of that year, VFS had over 2,800 application centers with operations in 141 countries.[8]

In January 2019, the parent company of VFS Global, EQT Partners, declared their intention to sell the company.[13] In August 2019, an in-depth financial investigation by the British newspaper The Independent revealed that VFS Global had experienced exponential growth in recent years and its shareholders had "extracted about £567m via 'distribution to owner' payments and writing off intercompany loans in the past two years."[7] The newspaper attributed this growth to the outsourcing company's "exploitative" business practices.[7]

Between 2005 and 2007, a critical security flaw in the VFS Global application website for the British Foreign & Commonwealth Office resulted in many visa applications from India, Nigeria and Russia being publicly accessible.[18] Sensitive data stored in VFS's online service could be accessed by simply "making changes" to the VFS website's URL address.[18] By doing so, any viewer could access the company's "database of visa applicants, which stored passport numbers, names, addresses, and travel details."[18] The security flaw had been known since December 2005,[18] but the issue was addressed only in May 2007 following media reports.[18][19] The security breach had been first reported in December 2005 by an Indian national, Sanjib Mitra,[20][18] after which no effective remedial action was taken by VFS. The same applicant went public in May 2007 after he noticed that his earlier warnings were ignored.[18]

Following this data breach and media outcry,[21] the UK Secretary of State for Foreign and Commonwealth Affairs appointed an independent investigator to uncover the reasons for the breach of security in the VFS online visa application website.[20] The subsequent report, released in July 2007, highlighted "organisational failures" by VFS.[20][22][21] VFS had purportedly underestimated what was necessary in order to protect personal data to the levels expected by the UK Data Protections Act.[20] The report also recommended that the VFS online visa applications not be resumed for applications from India.[20]

In November 2007, the UK Information Commissioner's Office announced that it had found the Foreign Office's contractual relationship with VFS Global to be in breach of its obligations under the Data Protection Act 1998. The Information Commissioner's Office required the Foreign Office to sign a statement that it would comply with the Data Protection Act and would not reopen the VFS UK visa online facility.[23] As a result of this ruling, the Foreign Office reviewed its relationship with VFS and briefly sought to significantly reduce its outsourced work, especially in the area of IT.[24] After the report was issued, VFS spent "$2 million on online security in the next year,"[25] and introduced various measures to ensure safe and secure business environment. One of them was to make all its centres ISO compliant.[26]

Following this incident, several governments were critical of VFS Global's abilities and raised concerns over its lackluster security protocols.[25] "There's the accountability issue, the privacy issue and why are we outsourcing to a for-profit entity something that belongs in the security mandate?" asked Victor Wong, executive director of the Chinese Canadian National Council.[25] Likewise, Liam Clifford, an immigration expert working for Global Visas, raised security concerns associated with VFS Global's operations: "Once you put this work in the hands of private companies overseas, you no longer have the same protection."[25][27]

VFS Global's online security again came under scrutiny in July 2015 when its online visa forms for Italy allowed any user to access the personal information of other applicants—including their date of birth, passport details and addresses—if they input the ID number of another person when logging into the system.[28]

Following the discovery of 2015 security issues, the outsourcing company stated in 2016 that they had instituted new security protocols.[29] VFS Global claims to annually renew its ISO 27001 audit and certification.[29]

VFS Global has been alleged to be a monopolistic enterprise operating in the visa outsourcing sector.[30][31][32] Its alleged monopoly has led to issues related to prohibitive visa application prices and also sparked concerns in the areas of centralised document handling and content security, though VFS claims a streamlined application submission process in all its centres.[33] For example, VFS staff at its collection offices in Southeast Asia were accused of abusing its dominant market status by creating their own extemporaneous rules for visa applicants.[34] This included entry criteria to the VFS centres and also level of assistance offered to applicants.[34]

Three years later, in June 2014, the outsourcing company was investigated by the South African Competition Commission regarding allegations of market dominance by VFS Global in the visa support services market to foreign embassies.[35] The Commission's spokesperson Themba Mathebula stated that the commission's screening unit had completed its preliminary investigation and submitted its report, recommending further formal investigations into the outsourcing company.[35]

In a statement to European Union parliament in July 2018, VFS Global denied that their outsourcing company is operating as a monopoly,[36] though its prepared statement did not cite any outsourcing companies with whom they are in competition for winning contracts.[36]

The outsourcing company has been accused of "extorting" and "mistreating" vulnerable visa applicants in developing countries such as Nigeria.[6][37] Additionally, the company was also reported to be under investigation for "allegations of abusive market dominance and unlawful tender procedures, resulting in excessive visa application prices and hidden fees."[30]

In September 2019, VFS Global had a score of 1.5 out of 5 stars on Trustpilot.[38] Of the 2,608 submitted reviews by customers, approximately 76% awarded the service 1 star.[38] Frequent complaints reported included disrespectful behaviour of the company's staff towards customers, failure to follow-up on applications in a timely fashion, and extended delays in returning passports to applicants, as well as reports of lost passports.[38] Former VFS employees have purportedly alleged the outsourcing company is systematically deceitful to visa applicants and that passports have been occasionally mishandled or lost due to poor organization.[39] Within the next year, a sudden deluge of five-star reviews—over ten thousand posts by newly-created accounts—greatly boosted the Trustpilot score to 4.5 out of 5 stars by October 2020.[40]