Nigeria moves to replace its National ID system. A misstep could lock out millions

When Nigeria’s National Identity Management Commission (NIMC) began migrating the country’s foundational identity system onto an open-source platform known as Modular Open Source Identity Platform (MOSIP) in July 2025, it marked one of the most consequential technology shifts in the country’s digital history. 

The move is central to the World Bank-backed Nigeria Digital Identity for Development (ID4D) programme, which has committed more than $430 million to reshaping identity infrastructure and recently issued an $83 million tender for a system integrator to deploy Nigeria’s next-generation National Identity Management System (NIMS 2.0) on MOSIP.

The stakes are immense. As of October 2025, NIMC had issued approximately 124 million National Identification Numbers (NINs) to eligible Nigerians and diaspora residents. That figure represents a near-ninefold increase over the past 25 years: from about 14 million in 2000, to 28 million in 2015, to 114 million in 2024, and now 124 million in 2025. 

Today, the NIN underpins banking, SIM registration, social services, pensions, education records, e-commerce, and digital payments. Rebuilding the underlying system is not a routine upgrade but a whole reconstruction of Nigeria’s digital identity system.

Who has Nigeria enrolled so far?

NIMC’s latest demographic breakdown shows that 69.7 million NINs (56.25%) have been issued to men, while 54.2 million (43.7%) have gone to women, revealing persistent gender gaps in national enrolment.

Geographically, enrollment is sharply uneven. Lagos State leads with 13.1 million issued NINs, split between 7.14 million men and 5.9 million women. Kano follows with 11.5 million, then Kaduna (7.3 million), Ogun (5.12 million), Oyo (4.7 million), Katsina (4.21 million), Abuja (4 million), Rivers (3.6 million), Delta (3.37 million), and Bauchi (3.22 million) complete the top ten.

At the other end of the scale, enrolment remains weakest in Bayelsa (803,874), Ebonyi (1.03 million), Ekiti (1.16 million), Cross River (1.42 million), Taraba (1.8 million), Kogi (1.95 million), Enugu (2.01 million), Yobe (2.09 million), Imo (2.1 million) and Kwara (2.1 million), underscoring the regional inequality Nigeria’s digital ID programme still struggles to overcome.

Diaspora enrolment has also expanded steadily, with 1.53 million NINs issued abroad, including 953,952 to men and 584,630 to women.

This human infrastructure—124 million unique digital identities and counting—is what Nigeria is now attempting to migrate onto a new technological foundation.

What exactly is being rebuilt

MOSIP is a modular, API-driven system made up of several core components. These include tools for citizens to pre-register, software for capturing demographic and biometric data during enrolment, and a biometric de-duplication system (ABIS) that prevents duplicate identities. 

It also generates unique ID numbers, stores identity records in a central database, and powers authentication services. MOSIP further supports digital credentials through the Inji app, which acts as a secure digital identity wallet where users can download, store, and manage their verified digital ID cards. It also enables QR codes and offline verification.

These modules make MOSIP function like a flexible digital identity toolbox that governments can adapt to their needs. It not only issues ID numbers but also makes them useful in everyday life. Through its authentication services, organisations can verify identities online or offline. At the same time, the Inji app on MOSIP allows people to present their digital ID, share QR codes, and authenticate themselves even without internet access. This ensures that citizens can conveniently use their identity credentials across services, anytime and anywhere.

Across Africa, around a dozen countries are either fully deploying MOSIP or actively piloting it. Public reports note that MOSIP has 26 global country engagements, with at least nine African nations, including Morocco, Ethiopia, Togo, and Uganda, already in pilot or implementation phases, while others like Guinea, Burkina Faso, Sierra Leone, Madagascar, and Niger are running pilot programmes as they work toward national adoption.

A MOSIP representative in Africa declined to comment on this story, citing contractual agreements with NIMC as constraints. 

Public procurement notices reveal the scale of the upgrade. NIMC is acquiring thousands of MOSIP-certified mobile enrolment devices to support mass registration. The $83 million system integrator contract covers deployment, data migration, Automated Biometric Identification System (ABIS) integration, and platform customisation for Nigeria’s environment.

NIMC confirmed to TechCabal in a response to questions that the migration is total. 

“The whole migration process is well thought out, and proper change-management procedures are in place to ensure a seamless transition,” the commission said.

That statement masks one of the most critical phases of any national ID overhaul: planetary-scale data migration.

The risk at the core: migrating 124 million identities

Transferring approximately 124 million biometric identities, each with fingerprints, facial images, and demographic data, into a new architecture is among the riskiest operations in digital government. Errors can result in ghost identities, mass duplication, service exclusion, or irreversible biometric corruption.

NIMC said a specialised system integrator will manage the process, declining to name the company. 

“A competent knowledge system integrator is being engaged to handle the process, who will also work with the commission’s technical team to ensure transfer and capacity building for sustainability,” it said in the response, adding that the engagement is following “the highest international standards.” 

Yet the risks go beyond engineering. Foundational ID systems like the NIN centralise both power and failure. If the authentication layer falters, entire sectors, from banking to telecoms, can lock out millions overnight.

“NIMC’s antecedents (of data breaches) show an organisation that has demonstrated in the past that it has gaps that need to be filled, and which they have never acknowledged that it has,” said Adeboye Adegoke, a digital rights advocate and former senior manager at Paradigm Initiative, a digital rights and inclusion organisation.  

Vendor-neutral in theory, political in practice

MOSIP’s appeal lies partly in vendor neutrality: the ability to avoid proprietary lock-in. But genuine neutrality depends on governance, procurement discipline, and political will.

Nigeria’s identity verification industry is already raising alarm. Esigie Aguele, co-founder and CEO of VerifyMe Nigeria, one of the country’s largest private KYC players, says neither he nor other leading operators have been consulted on MOSIP’s implications for the domestic verification ecosystem.

“Founders built this industry, employing thousands of Nigerians,” he said. “Nobody in NIMC has spoken to us about MOSIP. Now it feels like a system backed by global philanthropy is being introduced in a way that sidelines an entire industry.”

Aguele argues that Nigeria risks sleepwalking into a new form of dependency. “Bill Gates’ organisations aren’t using MOSIP in the U.S. or the U.K., but it’s being pushed here. Why must Nigeria adopt what advanced economies don’t use? Vendor neutrality means nothing if local stakeholders are excluded.” 

In reality, the Gates-funded MOSIP is designed primarily for low- and middle-income countries and is not deployed as a national ID platform in high-income ones like the U.S. or U.K., where long-standing legacy systems already exist. The Bill and Melinda Gates Foundation frames its support for MOSIP as helping governments in Africa and Asia adopt open, vendor-neutral digital ID infrastructure, but Aguele sees that very positioning as reinforcing unequal power dynamics in how digital identity systems are built and governed.

Data sovereignty and auditing

For Nigerians, the most sensitive question remains whether biometric data will ever leave the country. MOSIP’s open-source nature theoretically allows full hosting in local data centres, but experts warn that sovereignty is not just about software location; it is about institutional control.

Policy lawyer Timi Olagunju argues that the real vulnerability lies inside NIMC: “The challenge with sovereignty is not MOSIP; it’s the problematic nature of NIMC. Downtime and verification failures cannot be solved by MOSIP alone.”

At the same time, NIMC faces a significant capacity challenge. A platform of this scale, if largely operated and maintained by external vendors—often non-Nigerian—can weaken sovereignty in practice, even if the underlying software is open. Without strong local technical ownership and in-house troubleshooting capacity, operational control can gradually drift away from the state.

Olagunju further warns about cloud dependency. MOSIP’s technical alignment with providers such as Amazon Web Services (AWS) introduces additional risk. In the absence of strict data residency rules, robust IT governance, and continuous independent audits—frameworks that remain underdeveloped in Nigeria, the cloud infrastructure itself can become the de facto sovereign over national identity data, even when the platform is formally open-source.

A second challenge is operational capacity. Large-scale identity platforms often rely heavily on external vendors to run critical components. Without deep local expertise, sovereignty becomes nominal rather than actual.

Aguele echoes this fear from an industry perspective: “Nigeria has the experts to manage its identity systems. Giving foreigners control of our national database is irresponsible, especially in a world where data is national security.”

Cloud dependency intensifies the concern. MOSIP’s alignment with Amazon Web Services (AWS) means that, without strict data-residency mandates, strong IT governance, and regular independent audits—areas in which Nigeria has historically struggled—the cloud provider itself becomes a de facto authority over national identity data.

NIMC insists this will not be the case. 

“The commission is fully committed to protecting the security and integrity of the National Identity Database,” it said, adding that its operations comply with the Nigeria Data Protection Act (NDPA).

The agency also cites its ISO 27001 certification, held since 2014 and now upgraded to the 2022 standard. Still, MOSIP’s global developer ecosystem, cloud-deployment options, and donor financing raise a profound oversight question: who audits the auditors when identity becomes transnational infrastructure?

Will Nigerians get MOSIP’s privacy features?

MOSIP is marketed as privacy-preserving by design, supporting tokenised identifiers, minimal-data authentication, and consent-based verification. But many countries adopt only partial implementations because legacy systems, limited technical and financial capacity, weak or incomplete data‑protection frameworks, and political risk concerns make a phased, minimal rollout more feasible than deploying all of its advanced privacy‑preserving features at once.

NIMC said Nigeria will not dilute those protections. “The features mentioned already exist in our various services, and the commission will not be downgrading or deploying weak versions of any solution whatsoever.”

If fully implemented, tokenised IDs could significantly reduce the frequency with which raw NINs circulate across banks, telcos, and fintech platforms, thereby reducing identity-theft risks at the source.

The missing public timeline

Despite the scale of the transformation, NIMC has not published a public migration roadmap. “These will be communicated in due course,” the commission said when asked about pilots, national rollout timelines, and public milestones.

That opacity creates accountability risk. With Nigeria already experiencing periodic authentication outages under the current system, citizens, banks, and telecom operators have little visibility into whether the country is months or years away from running dual identity stacks in parallel.

“If NIMC wants to be proactive, they need to come out and say exactly what process they went through to arrive at this juncture (choosing MOSIP), and what safeguards are in place,” Adegoke, the digital rights activist, said. 

In theory, very little should change, except speed. MOSIP is expected to operate behind familiar services like NIN enrolment, NIN updates, SIM registration, e-KYC, and social-service authentication. NIMC said the platform will be combined with its existing NIN Authentication Service to “improve the customer journey and enhance integration for service delivery across the board.”

In practice, transitions of this scale almost always produce friction: temporary delays, regional outages, biometric mismatches, and data-synchronisation conflicts between old and new systems.

Foundational ID rarely fails quietly.

Perhaps the most consequential question is liability. When a national identity system fails—blocking a loan application, invalidating a SIM card, or excluding a citizen from welfare—who answers?

NIMC’s response is direct: “The National Identity Management Commission is the sole body mandated by the constitution for identity management in Nigeria. The commission will not shift her responsibilities to any other body.”

That clarity matters. MOSIP supplies software. The World Bank supplies money. The integrator supplies engineering. But accountability will remain domestic and political.

A high-stakes bet on open infrastructure

Nigeria’s MOSIP migration is both a technical upgrade and a political wager: that open digital public infrastructure can scale more sustainably than proprietary alternatives. If successful, Nigeria would become one of MOSIP’s largest real-world deployments.

Failure would be destabilising. No other system, tax, telecoms, banking, education, or elections, touches more Nigerians daily than the NIN.

Olagunju sees opportunity in the challenge, if governance and skills transfer are prioritised: “If there’s no local data and skills transfer, NIMC has simply swapped one sovereign system for another.”

For Aguele, the issue is even more fundamental: national identity should never be outsourced.  “Giving away your identity infrastructure is not an alternative—ever,” he said.

For now, the transition continues largely out of public view. What is clear is the direction of travel: Nigeria is rebuilding its identity layer not just as a registry, but as core digital infrastructure. Whether MOSIP becomes an instrument of sovereignty or a new dependency will depend less on software and more on governance, transparency, and execution in the years ahead.

This report is produced under the DPI Africa Journalism Fellowship Programme of the Media Foundation for West Africa and Co-Develop.