Nigeria Wants Banks and Telcos to Ask Before Checking Your NIN

Nigeria Wants NIN Verification to Ask Permission First. Here’s What NINAuth Actually Changes

Nigeria’s National Identification Number is increasingly used to open bank accounts, register SIMs, process government services and prove identity online. The privacy question is no longer simply whether an organisation can verify that a NIN is valid. It is what information the organisation receives when it does so, and whether the person whose identity is being checked gets a meaningful say in that exchange.That is the problem NIMC’s NIN Authentication service, NINAuth, is designed to address.

NINAuth itself is not brand new: NIMC formally announced it in May 2025 as its consent-based authentication platform. The current push puts renewed attention on how that model works as banks, fintechs, telecom operators and government services become increasingly dependent on digital identity checks. NIMC describes the service as supporting web, API and mobile verification while requiring explicit consent before personal information is shared for verification.

What you are supposed to see before saying yes

NIMC’s clearest explanation comes from a bank-account example in the NINAuth Wallet documentation. In that scenario, a bank asks for particular information such as a person’s name, date of birth and address, together with a KYC credential such as a driver’s licence. The customer receives a notification showing the data request and must review and approve the requested information before it is transmitted. NIMC says the user consents to share only the requested data.

That distinction matters. “Consent to NIN verification” should not mean an open-ended permission for a company to retrieve everything attached to a national identity record. Under the documented NINAuth model, the request is meant to identify what information the organisation wants before the person authorises the exchange.

This is the infrastructure version of a consent problem TechView Africa recently examined in the Lagos Truecaller privacy ruling: access to another person’s information is not automatically the same thing as that person having consented to its processing.

Organisations do not get unrestricted access simply by joining NINAuth

NIMC’s requirements for enterprises and verification partners impose more than a one-time consent screen.

Organisations are required to obtain informed consent for NINAuth matching, use the service only for the purposes for which access was granted, maintain information-security and access controls, log and monitor usage, provide compliance reports and accept independent audits of their NINAuth activity. Enterprises are also expected to connect through approved verification partners rather than directly treating the national identity database as a general-purpose lookup service.

That creates a potentially useful accountability chain: who requested the verification, why they requested it, whether the user approved it and what happened during the transaction.

The strength of that model will ultimately depend on enforcement. Consent screens are useful only if organisations cannot quietly request broader information than they need or repurpose verified data afterward.

Does NINAuth mean companies no longer need your raw NIN?

Not completely. NINAuth provides QR-code and time-limited Share Code flows that let people initiate verification without repeatedly typing or exposing their NIN. NIMC says these mechanisms are intended to enable identity checks while reducing unnecessary disclosure of detailed personal data.

But NIMC also documents a raw NIN verification route for organisations that already possess a person’s NIN. In that workflow, the organisation can compare an existing NIN against official records; NIMC says NINAuth itself does not collect the raw NIN directly from the user during that process.

So NINAuth should not be interpreted as eliminating raw NINs from every business workflow. It creates alternatives that can reduce repeated exposure, but organisations that already lawfully hold a NIN may still use it for verification.

You can withdraw consent but the history does not disappear

NINAuth’s retention policy says users can withdraw consent for future sharing or processing. That is meaningful, but it is not the same thing as erasing an earlier verification.

NIMC says verification requests, consent and Share Code records, technical logs and authentication events form part of the system’s audit trail. Transactional and consent-related records are archived after 90 days, while archived information remains under NIMC’s control for regulatory and auditing purposes. Its terms go further, saying verification transactions and consent activities are logged and retained unless law or regulatory instruction requires deletion.

That means withdrawal is best understood as prospective control, not a rewind button. It can stop future authorised sharing, while evidence that a past verification occurred may remain.

The timing makes the safeguards more important

The renewed focus on NINAuth comes while NIMC is investigating fresh allegations concerning exposure of Nigerians’ identity information. NIMC has denied that the National Identity Database itself was breached and said the investigation would examine whether verification agents or sub-licensees violated their agreements. The available evidence therefore does not establish a breach of NIMC’s central database.

That distinction matters because securing the database is only part of the problem. Identity information also moves through organisations, verification partners and user-facing applications.

For Nigerians, NINAuth’s most consequential promise is therefore not that NIM verification becomes digital. It is that the person being verified should be able to see the request, authorise the specific sharing, and leave behind a record that can later be audited.

That is a more useful standard than simply asking whether an organisation had access to a NIN. Readers concerned about what happens when personal information is exposed can also see TechView Africa’s comparison of data-breach rights across six African countries.

Our Recommendation

When an organisation offers NINAuth verification, check which information it is requesting, not merely whether the request carries NIMC branding. Prefer QR or Share Code verification where available rather than unnecessarily sending your raw NIN, and verify unfamiliar organisations against NINAuth’s approved-partner directory before consenting.

Treat withdrawal of consent as protection against future sharing, not an assumption that previous verification records have been deleted.