Nigeria Moves to Replace Its National ID System: A Misstep Could Lock Out Millions

Nigeria’s National Identity Management Commission (NIMC) began migrating the country’s foundational identity system onto the Modular Open Source Identity Platform (MOSIP) in July 2025. This shift represents one of the most consequential technological transformations in Nigeria’s digital history, with implications for banking, telecoms, social services, and national security.

The migration forms part of the World Bank-backed Nigeria Digital Identity for Development (ID4D) programme, which has committed over $430 million to reshaping identity infrastructure. Recently, NIMC issued an $83 million tender for a system integrator to deploy Nigeria’s next-generation National Identity Management System (NIMS 2.0) on MOSIP.

Current Enrolment: Who Holds a NIN?

As of October 2025, NIMC had issued approximately 124 million National Identification Numbers (NINs) — a near-ninefold increase over the past 25 years:

• 2000: ~14 million
• 2015: ~28 million
• 2024: 114 million
• 2025: 124 million

The NIN underpins banking, SIM registration, social services, pensions, education records, e-commerce, and digital payments.

Gender breakdown:

• Men: 69.7 million (56.25%)
• Women: 54.2 million (43.7%)

Top states by enrolment:

• Lagos: 13.1M
• Kano: 11.5M
• Kaduna: 7.3M
• Ogun: 5.12M
• Oyo: 4.7M

Lowest enrolment: Bayelsa (803,874), Ebonyi (1.03M), Ekiti (1.16M), and others.

Diaspora enrolment: 1.53 million NINs issued abroad.

This human infrastructure — 124 million unique digital identities — is now being migrated onto a new technological foundation.

What is Being Rebuilt with MOSIP?

MOSIP is a modular, API-driven system that includes:

• Pre-registration tools
• Demographic and biometric data capture
• Biometric de-duplication system (ABIS)
• Unique ID generation and central database storage
• Authentication services
• Digital credentials via the Inji app, supporting QR codes and offline verification

MOSIP functions as a flexible digital identity toolbox, allowing governments to issue IDs, verify users across platforms, and provide secure digital credentials even offline.

Across Africa, countries such as Morocco, Ethiopia, Togo, Uganda, Guinea, Burkina Faso, Sierra Leone, Madagascar, and Niger are piloting or implementing MOSIP nationally.

The Migration Challenge: 124 Million Identities

Transferring 124 million biometric identities — including fingerprints, facial images, and demographic data  is one of the riskiest digital government operations globally.

Risks include:

• Ghost identities
• Duplicate NINs
• Service exclusion
• Biometric corruption

A specialised system integrator will manage the process under international standards. NIMC confirmed that “the whole migration process is well thought out, with proper change-management procedures to ensure a seamless transition.”

Yet, even with careful planning, foundational ID systems centralise both power and failure. Errors can block millions from banking, SIM registration, or social services.

Vendor-Neutral in Theory, Political in Practice

MOSIP is vendor-neutral, avoiding proprietary lock-in. But true neutrality depends on governance, procurement discipline, and local political will.

Industry insiders have raised concerns:

“Founders built this industry, employing thousands of Nigerians. Nobody in NIMC has spoken to us about MOSIP. Now it feels like a system backed by global philanthropy is sidelining local stakeholders.”

MOSIP is supported by Bill & Melinda Gates Foundation funding, primarily for low- and middle-income countries. Advanced economies like the U.S. and U.K. do not deploy MOSIP nationally.

Data Sovereignty and Cloud Dependency

The most sensitive question: Will biometric data leave Nigeria?

• MOSIP can be hosted locally, but sovereignty depends on institutional control, not just software location.
• Heavy reliance on external vendors could weaken local operational control.
• Cloud alignment (e.g., AWS) introduces risks if data residency rules, IT governance, and audits are not rigorously enforced.

NIMC insists it complies with the Nigeria Data Protection Act (NDPA) and holds ISO 27001 certification.

Privacy Features and Implementation

MOSIP supports privacy-preserving features:

• Tokenised identifiers
• Minimal-data authentication
• Consent-based verification

If fully implemented, these could reduce identity theft risk by limiting the circulation of raw NINs across banks, telcos, and fintech. NIMC has pledged not to dilute these protections.

Lack of a Public Timeline

NIMC has not published a public migration roadmap, raising accountability concerns. Past authentication outages under the current system highlight the importance of clear timelines.

Potential friction points include:

• Temporary delays
• Regional outages
• Biometric mismatches
• Data synchronization conflicts

“Foundational ID rarely fails quietly,” warns experts.

Accountability and Governance

NIMC emphasizes:

“The commission is the sole body mandated by the constitution for identity management in Nigeria.”

Software (MOSIP), funding (World Bank), and integrators provide tools, but domestic accountability remains critical.

A High-Stakes Bet on Open Infrastructure

Nigeria’s MOSIP migration is both a technical upgrade and a political wager.

• Success: Establishes Nigeria as one of MOSIP’s largest deployments, strengthens digital infrastructure.
• Failure: Could destabilize banking, telecoms, social services, and national security.

Experts stress: local skills transfer and governance are essential. Without them, Nigeria risks replacing one dependency with another.

Key Takeaways

1. Scale matters: Migrating 124 million identities is among the most complex IT operations in Africa.
2. Governance over software: Execution, oversight, and accountability are more important than technology alone.
3. Stakeholder inclusion: Local verification industry and citizen engagement are critical to prevent exclusion.
4. Sovereignty is fragile: Cloud dependency and foreign vendors pose real operational and political risks.
5. Privacy and security: Proper MOSIP implementation could reduce identity-theft risk and improve authentication services.

Nigeria is rebuilding its identity layer not just as a registry but as core digital infrastructure. Whether this becomes a model of sovereignty or a new dependency depends on governance, transparency, and execution in the years ahead.