By Timileyin Ilesanmi.
Legislative Context and Repeal of the 2007 Framework
On June 26, 2026, President Bola Ahmed Tinubu assented to the National Identity Management Commission (NIMC) Act 2026, a transformative piece of legislation that marks the most significant overhaul of Nigeria’s identity architecture in nearly two decades. This Act effectively repeals and replaces the NIMC Act of 2007. By resetting the legal foundation for identity management, the new Act seeks to align Nigeria’s digital public infrastructure with the demands of a $1 trillion economy.
In his statement upon signing, President Tinubu underscored that the previous system was no longer fit for purpose, necessitating a robust framework capable of supporting modern digital transactions while imposing stricter sanctions to deter identity-related malfeasance.
From Physical Cards to Technology-Neutral Identity
A pivotal shift in the 2026 Act is the transition from a card-centric model to a “technology-neutral” identity framework. The legacy 2007 model relied heavily on the issuance of the physical General Multi-Purpose Card (GMPC), which frequently faced production bottlenecks and distribution delays. The new legislation decouples identity proofing from plastic, allowing credentials to be delivered via smartphone applications, dynamic QR codes, biometric authentication, and digital wallets.
While the GMPC remains a versatile credential under the theme “One Card, Multiple Possibilities,” the priority has moved toward digital accessibility. This alignment with international benchmarks—such as the World Bank’s Identification for Development (ID4D) initiative and the Principles on Identification for Sustainable Development—positions Nigeria alongside global leaders in digital ID. This shift mirrors successful transitions seen in India’s Aadhaar system, Singapore’s Singpass, and Kenya’s Maisha Namba. Furthermore, it replicates Togo’s Novissi model, which utilised a neutral biometric framework to bypass traditional distribution bottlenecks for social welfare.
NIMC as the Root Certification Authority for Digital Trust
The 2026 Act elevates NIMC to the technical-legal designation of the Root Certification Authority (RCA) for Nigeria’s National Public Key Infrastructure (PKI) and Digital Public Infrastructure (DPI). This goes beyond mere technical upgrade; it is a statutory delegation of trust. As the RCA, NIMC is now legally responsible for the nation’s highest level of cryptographic security, managing digital signatures and electronic trust services.
This infrastructure maintains the digital and identity integrity of the digital economy. By providing the cryptographic backbone for the state, NIMC ensures that digital interactions—whether signing a commercial contract or verifying a remote financial transaction—are encrypted, authentic, and tamper-proof. For businesses, this translates to a more secure environment for automated verification, effectively reducing the risk profile of remote customer onboarding.
The Expanded Mandatory Use of the National Identification Number (NIN)
Under the “One Person, One Identity, One Number” principle, the Act reinforces the National Identification Number (NIN) as the cornerstone of the Nigerian identity ecosystem. The statutory list of services for which the NIN is mandatory has been significantly expanded to ensure that the identity database speaks to every facet of the economy. Mandatory use cases now include:
- Financial Services: Opening and operating bank accounts, and accessing consumer credit or loans.
- Social Protection: Pensions, insurance services, and access to all government social intervention programs.
- Regulated Transactions: Land and real estate transactions, and tax payments/administration.
- Government Services: Passport applications, voter registration, and all other general government services.
- Telecommunications: SIM card registration and related services.
Data Protection, Privacy, and Strategic Regulatory Lacunae
The 2026 Act introduces strengthened safeguards for personal data, purportedly aligning NIMC’s operations with the Nigeria Data Protection Act (NDPA) and international best practices. It adopts a “consent-first” approach, mandating that personal records cannot be accessed or utilised beyond their stated purpose without the data subject’s permission, except under narrowly defined legal caveats such as High Court orders.
However, from a regulatory compliance perspective, a significant point of interest—and potential friction—is the omission of the Nigeria Data Protection Commission (NDPC) from the newly reconstituted governing board. Despite the Act’s emphasis on privacy, the primary data protection regulator has been sidelined. This represents a strategic lacuna that may invite future friction, especially given historical concerns regarding data racketeers and unauthorised access by licensed partners within the identity ecosystem.
Reconstitution of the Governing Board and Inter-Agency Harmonisation
To facilitate seamless data exchange and break down traditional data silos, the Act reconstitutes the NIMC Governing Board to include representatives from 14 federal institutions. This structure is intended to ensure that the identity database serves as a centralised node for national interoperability. Among these institutions is the Nigeria Revenue Service (NRS), which replaces the Federal Inland Revenue Service (FIRS).
Enhanced Enforcement Powers and Penalty Matrix
The 2026 Act grants NIMC robust investigative and enforcement powers, including court-authorised search, seizure, data decryption, and arrest. These powers are designed to combat the “data racketeering” that has plagued previous systems. The new penalty matrix serves as a significant deterrent, with fines for corporate entities now reaching figures that reflect the impact of exchange rate volatility on corporate liability. Offences range from unauthorised database access and impersonation to identity forgery/fraud, each with penalties ranging from a minimum of 5 years’ imprisonment or #10 million fines for individuals to at least #20 million for corporate bodies.
Provisions for Inclusivity and Vulnerable Populations
The Act addresses the “identity gap” through a specialised system designed for vulnerable and underserved Nigerians, such as those without permanent residences. By mandating initiatives to improve social and financial inclusion, the Act ensures that digital identity does not become a barrier to basic rights. Furthermore, the legislation extends its reach to Nigerians in the diaspora, facilitating more convenient enrolment and verification processes globally.
National Security and Economic Implications
The strategic linkage of databases has already demonstrated its efficacy in national security. The Minister of Interior notably cited the arrest of seven Boko Haram and ISWAP commanders at Katsina airport while they were returning from the Holy Pilgrimage (Mecca/Hajj). This arrest was made possible through real-time database synchronisation between NIMC, immigration systems, and Interpol.
Economically, the Act serves as a catalyst for investment. By automating trusted identity verification, the cost of doing business is significantly reduced. Fintech platforms and traditional financial institutions can now onboard customers with higher degrees of certainty, while the Nigerian Revenue Service (NRS) can utilise the NIN to minimise tax evasion and ghost registrations. The NIMC Act 2026 provides the stable legal foundation required for Nigeria to navigate the complexities of a modern, trust-based digital economy.
Conclusion
The NIMC Act 2026 evinces a transformative shift toward setting the digital identity framework for a $1 trillion economy and the development of the digital economy. By designating the NIMC as Nigeria’s Root Certification Authority, the law establishes the necessary digital trust infrastructure to support a fast-growing digital economy, facilitating seamless transactions across fintech, e-commerce, and government services. This modernisation replaces an obsolete two-decade-old framework, providing a legal framework for mandating the National Identification Number (NIN) for essential services ranging from banking to tax payments.
For individuals and corporate entities, the NIMC Act 2026 ushers in a new regime that will be characterised by new compliance obligations and more refined Customer Due Diligence (CDD)/Know-Your-Customer (KYC) systems. As digital interoperability facilitates more efficient enrolment and identity verification, faster KYC, increased access to credit, wider digital adoption, expanded digital market and increased investment growth become more realisable.
While the Act introduces robust enforcement powers and significantly stiffer penalties—including multimillion-naira fines and mandatory prison sentences—to deter identity fraud, its ultimate success rests on data security and integrity, proper implementation and public trust. To fulfil its promise of a secure and inclusive digital nation, the NIMC must balance its expanded authority with transparency, technical resilience, and a steadfast commitment to the privacy of all Nigerians.