Nigeria has spent years grappling with a foundational problem of the digital economy: proving who people are. The country now counts 117.5 million people holding National Identification Numbers (NINs), but the latest World Bank assessment suggests the harder task may be converting that scale into a system that is accurate, trusted, and useful.

As of June 30, 2026, the National Identity Management Commission (NIMC) had issued NINs to 117.5 million people out of 134.6 million enrolments. The target, backed by the World Bank's Nigeria Digital Identification for Development (ID4D) project, is 180 million by December 2026.

That leaves Nigeria 62.5 million NINs short, with roughly six months to close the gap. NIMC is currently enrolling between 1.5 and 1.8 million people per month. Reaching 180 million by December would require the pace to rise to roughly 7.4 million per month — more than four times the current rate. NIMC did not respond to multiple requests for comment.

The numbers point to a problem that extends beyond the deadline itself. The World Bank's latest implementation report shows substantial progress in building Nigeria's foundational identity system, yet the project remains behind its most ambitious coverage target. At the same time, some of the infrastructure intended to make the NIN useful at scale is still under construction.

For Kelechi Ndieze, founder and CEO of Africa Tech Factory, the 180 million target is ambitious but necessary given Nigeria's population and the role a foundational identity system is expected to play.

"Nigeria is Africa's most populous country, and its population gives any foundational identity system enormous scale," Ndieze told TechCabal in an interview on Monday, August 31. "I would describe the 180 million target as ambitious, but necessary given Nigeria's population and the importance of having a functional foundational identity system."

Enrolment, however, is only the first measure of whether the system is working.

"A national identity programme cannot be judged only by the number of people captured. We also have to consider whether those identities are unique, accurate, secure and actually usable and verifiable," Ndieze said.

That distinction is becoming more consequential as the NIN evolves from a government database into a gateway to financial services, telecommunications, healthcare, social protection, and other digital services. The linkage is already a practical reality for many Nigerians: since December 2020, telecommunications regulators have required mobile subscribers to link their SIM cards to their NINs, making the identifier a precondition for phone service. The larger the system grows, the more costly errors, duplication, weak verification, or security failures can become.

The Race for Scale

The ID4D project, implemented by NIMC, is a $430 million digital identity programme formally approved in February 2020 and co-financed by the World Bank, the European Investment Bank and Agence Française de Développement. Its objective is not simply to increase the number of Nigerians with NINs, but to establish a robust, inclusive foundational identity system that facilitates access to services.

The project has made significant progress since its October 2019 baseline of 36.9 million NINs. It has licensed 362 front-end enrolment partners, trained nearly 34,000 people, and equipped 46 Nigerian government offices abroad to enrol citizens, according to the World Bank report.

It has also begun connecting NINs to government services. More than 13.4 million people were using digitally enabled services by June, well above the project's target of three million. NIN-linked services include social cash transfers and health-related programmes.

Still, reaching the remaining population will be harder than building the first 100 million records.

"Ambitious, but not inherently unrealistic," said Adeoye Abodunrin, an AI and cybersecurity expert, of the 180 million target. "The real question isn't whether Nigeria can produce 180 million NIN records — it's whether it can produce 180 million trustworthy digital identities."

The difference matters because people who remain outside the system are unlikely to be evenly distributed. Women, children, people in rural areas, the elderly, undocumented residents and Nigerians in the diaspora can be harder to reach than those already captured.

"The last 20-30 million may be substantially harder than the first 100 million," Abodunrin said.

That means simply adding more enrolment centres may not suffice. Nigeria will need distributed enrolment capacity, mobile and offline registration, robust biometric processing, and computing capacity to deduplicate records at scale.

The World Bank figures already reveal coverage gaps. Women and girls accounted for about 40.4 million of the NINs issued by June, against a target of 79 million. Children under 16 accounted for 26.3 million, against a target of 60.8 million.

NIMC is responding with ward-level enrolment campaigns, additional enrolment partners and plans to procure 7,000 MOSIP-certified devices. It is also offering a 20% premium on enrolment payments for women.

But the urgency to close the numerical gap creates another risk: that speed begins to take precedence over identity assurance.

Dengiyefa Angalapu, a research analyst at the Centre for Democracy and Development, said Nigeria should be more concerned with the quality of the system than with whether it meets the December deadline.

"I really wouldn't be worried if the target is not met," Angalapu said. "I would rather be very, very worried if we don't have an identity system that is usable."

The objective, he said, should be to build a system that reliably identifies Nigerians rather than simply hitting a predetermined number.

"It is better that you know 70 Nigerians or even 50,000 Nigerians very well and you can identify them to the core than to have a target of 180 million that you really cannot identify," he said.

The Gap Inside the Numbers

That concern also applies to another figure in the World Bank report: the 17.1 million difference between the 134.6 million people enrolled and the 117.5 million with issued NINs.

The gap does not necessarily mean millions of people have been excluded. Enrolment captures demographic and biometric information; issuance follows after the record has undergone processing, validation, and deduplication.

Ndieze said the distinction is important.

"Enrolment is the process of capturing an individual's demographic and biometric information. Issuance comes after the necessary processing, validation and checks have been completed, while verification happens when issued data can be recognised across multiple systems and sectors," he said.

Abodunrin similarly cautioned against treating the gap as an automatic sign of failure.

"Enrolment is capturing someone's data. Issuance happens only after that data clears deduplication against the national database," he said.

Some friction in the process can actually indicate that controls are working. If every enrolment automatically became a NIN, the system could be more vulnerable to duplicate or poor-quality records.

What matters is what makes up the gap. How many records are awaiting biometric reprocessing? How many have been flagged as possible duplicates? How many require demographic corrections? And how long does it take to move from enrolment to issuance? NIMC has not published that breakdown.

Angalapu believes the gap could have several causes, from the quality of equipment and training among enrolment agents to deliberate attempts to manipulate the registration process.

NIMC's decision to expand enrolment beyond its own offices has increased access, but it also places greater responsibility on the quality of the people and equipment used to collect biometric information.

"What's the quality of the thumbprint that has been taken? What's the quality of their equipment and all that?" Angalapu said. "All of those can create the gaps that we've seen."

The issue, he said, can also involve deliberate attempts to create false or incomplete identities. That makes the final stretch of the NIN campaign less about simply increasing the number of registration points and more about maintaining consistent identity-proofing standards across them.

For Abodunrin, success should ultimately be measured on five fronts: coverage, uniqueness, accuracy, inclusion and usability. The question is not only whether NIMC can reach rural communities, children, older people and Nigerians abroad. It is whether each person can be represented by a single reliable identity and use that identity consistently across services.

Building the System Behind the Number

Nigeria is trying to solve that problem while simultaneously rebuilding the technology underneath its identity system.

NIMC's next-generation National Identity Management System, NIMS 2.0, is being developed around MOSIP, the Modular Open Source Identity Platform. The open-source, modular architecture is intended to provide a more scalable alternative to a system tied closely to proprietary technology.

But the transition is not complete. The World Bank's August 2026 assessment says the system integrator contract was being finalised, with implementation expected to take about 18 months. That means the new architecture is likely to extend beyond the ID4D project's current December 2026 closing date.

NINAuth, NIMC's digital identity authentication service launched in 2025, is also still being refined, with its full integration dependent on the rollout of NIMS 2.0.

The timing creates a difficult situation. Nigeria is trying to dramatically expand the number of identities in the system while the next-generation infrastructure intended to manage and authenticate them is still under construction.

The distinction matters because the economic value of a national ID system does not derive solely from the number of records. It comes from the ability to reliably authenticate those identities across banks, telecom operators, government agencies and digital services. A database can be large without being useful; the infrastructure behind it has to make the identity portable, verifiable and trusted.

MOSIP and the Sovereignty Question

The choice of MOSIP also raises a broader question about digital sovereignty.

MOSIP was developed by the International Institute of Information Technology Bangalore (IIIT-B) in India as an open-source alternative to proprietary digital identity systems. The Bill & Melinda Gates Foundation is a key strategic partner and funder of the project, supporting its development and global expansion. Its design draws on lessons from India's Aadhaar, the world's largest biometric identity programme, which has enrolled more than a billion people and is a frequent reference point — for both its reach and its controversies over privacy and exclusion — in debates about foundational ID.

The platform is designed to give governments greater control over the technology underpinning their national ID programmes and reduce dependence on a single proprietary vendor.

It has been adopted, piloted, or is being explored in 31 countries across Africa, Asia, and Latin America, including national ID programmes in the Philippines and Ethiopia, and a population registry system in Morocco. Togo, Uganda, Zambia and Nigeria are also at various stages of implementation.

At its core, MOSIP provides software for functions including enrolment, biometric and demographic data management, identity issuance and authentication.

But open source does not automatically mean technological independence.

Abodunrin separates three issues that are often conflated in discussions about sovereignty: financing, technology provenance and control.

"Taking World Bank money doesn't mean surrendering control of the data. Using a foreign-built platform doesn't automatically mean losing control of the infrastructure," he said.

The real sovereignty test, he said, is technical.

"Who holds the data? Where does it sit? Who holds the cryptographic keys? Who has admin access?" he said. "Can Nigeria audit, modify, and run this system if every foreign contractor left tomorrow?"

MOSIP can reduce one traditional sovereignty risk — vendor lock-in — because governments can inspect and adapt an open-source platform. But a country can still become dependent on foreign companies for implementation, maintenance, specialised biometric technology and technical expertise.

"My preferred model is sovereignty by capability rather than sovereignty by geography," Abodunrin said.

For Nigeria, that would mean retaining domestic control over production data, encryption keys, policy and security operations while building the local expertise required to maintain and eventually extend the system.

Angalapu is less comfortable with the dependence on foreign infrastructure, but sees it as a reflection of Nigeria's broader technological position.

"As an African, as a Nigerian, I am definitely worried about Nigerian data being hosted somewhere," he said.

But he also argued that Nigeria cannot simply reject foreign technology without developing viable domestic alternatives.

"This is the Nigerian situation," he said. "If we say we are worried about that every day, what else can we do?"

His preference is for Nigeria to use the current partnership while building the capability to eventually exert greater control over its data and infrastructure.

Ndieze takes a similar view, arguing that sovereignty is fundamentally about control rather than where a technology originates.

"Data sovereignty is fundamentally about control, governance and jurisdiction, not simply where the money or technology comes from," he said.

For him, the important questions are who owns the data, who controls access, where it is stored, who controls the encryption and security infrastructure, who can administer or modify the system and whether Nigeria has the technical capacity to operate it independently.

Nigeria, therefore, does not necessarily need to build every component of the technology itself. But it needs enough technical capability to avoid becoming permanently dependent on the organisations that built or implemented it.

The Security Problem

That distinction also applies to the security of the identity database. Moving to a new platform may strengthen the underlying architecture, but it cannot, by itself, eliminate the risk of personal data exposure.

Identity systems have multiple points of vulnerability: enrolment agents, APIs, authentication services, government institutions, private-sector users, contractors and administrators.

"Technology is only one part of data security," Ndieze said. "Identity systems are ecosystems."

Abodunrin makes the same point from a cybersecurity perspective.

"A newer architecture removes legacy vulnerabilities and adds stronger monitoring — real gains," he said. "But breaches rarely happen inside the core database; they happen across the ecosystem around it."

That means Nigeria will need more than a modern platform. It will need strong privileged-access controls, encryption, audit trails, API security, continuous vulnerability testing, vendor oversight, insider-threat controls and independent security audits.

Data minimisation is another important safeguard. The less information an identity system collects, the less information is available to steal if one part of the ecosystem is compromised.

NIMC has previously faced allegations and concerns about the handling and exposure of personal information, while maintaining that its core database has not been breached. For citizens, however, the distinction between a breach of the core database and exposure through an API, an agent, or a third party may matter little.

"They care that their personal information is no longer safe," Ndieze said.

Angalapu argues that Nigeria should also rethink how it communicates security incidents. A secure database, he said, should not be defined as one that is never attacked. Large identity systems in the United States, Europe and elsewhere have faced attacks and breaches. The more important question is whether institutions can detect attacks, limit damage and be transparent about what happened.

"It's actually one that detects these attacks very heavily," Angalapu said. "But if it happens, you are accountable for how it happened and how you are correcting it."

That accountability is particularly important as more services begin to depend on NIN. The more valuable the identity layer becomes, the more attractive it becomes to attackers. A weakness in a single connected agency or service can expose citizens, even if NIMC's central infrastructure remains secure.

"The real test isn't whether NIMC says the new system is secure — it's whether Nigeria can continuously prove it, through independent assurance and transparent governance, especially when something goes wrong," Abodunrin said.

From Database to Digital Infrastructure

This is what makes the 180 million target more consequential than a simple enrolment milestone.

The ID4D project has already exceeded its target for people using digitally enabled services. NINs are increasingly being linked to banking, telecommunications, social protection and healthcare systems. Nigeria is therefore moving from building an identity database toward building an identity layer for the digital economy.

The potential benefits are substantial. A reliable foundational ID can reduce duplication, simplify customer verification, improve the targeting of government programmes, and provide financial institutions and public agencies with a common way to establish identity.

But that interconnectedness also raises the cost of failure. The more services depend on NIN, the greater the consequences of inaccurate records, weak authentication, poor interoperability or a security breach.

That is why the race to 180 million should not be judged solely by whether NIMC closes the 62.5 million gap. Nigeria will need to show that the identities being added are unique, accurate, and secure; that they can be authenticated across systems; and that citizens can actually use them. True scale demands moving beyond surface-level integrations to robust execution.