Nigeria has a new identity law on the books β but instead of clarifying how digital signatures work in the country, it may have quietly created a regulatory headache that could slow down the entire digital economy agenda.
The NIMC Act 2026, which replaced the 2007 legislation, designates the National Identity Management Commission (NIMC) as Nigeria's Root Certification Authority (Root CA). That is a significant move. It places NIMC at the heart of the country's digital trust infrastructure, giving it responsibility for issuing root digital certificates, verifying electronic identities, and overseeing the trust framework for digital signatures tied to the National Identification Number (NIN).
A digital signature, to be clear, is a mathematical method used to verify that a digital document, email, or message is authentic, has not been tampered with, and was signed by the right person. It is the backbone of paperless government, secure banking, and e-commerce.
Two Laws, One Problem
The complication arises from a separate piece of legislation still making its way through Nigeria's National Assembly β the National Digital Economy and E-Governance Bill. That bill also addresses digital signatures, specifically their legal validity: when an electronic signature can satisfy a legal requirement, what standards apply, and how identity verification should work.
Critically, the E-Governance Bill empowers the National Information Technology Development Agency (NITDA) β Nigeria's tech regulator β to regulate and accredit electronic signature Certification Authorities. NIMC, under the 2026 Act, already holds that ground as Root CA. The result is two agencies with potentially overlapping authority over the same infrastructure.
A NIMC spokesperson addressed the situation directly when contacted by TechCabal on Wednesday, August 13.
"The Act is operational at the moment; it has been passed by the President, and that is the law we have now. The other one, or any other bill coming up, the National Assembly will have to take a closer look and do the needful."
The Ministry of Communications, Innovation and Digital Economy did not respond to requests for comment.
Real Consequences for Businesses and Agencies
The stakes are not abstract. Policy experts warn that without clear alignment between the two frameworks, government agencies, banks, and technology companies could find themselves caught between overlapping compliance requirements β slowing the rollout of secure digital services while they wait for clearer guidance on which authority actually calls the shots.
Adeboye Adegoke, a digital rights and policy expert, did not mince words about how this situation came about.
"Ideally, this should have been spotted by the legal drafting unit at the National Assembly, but with what happened with the tax bill, I am not surprised. Bills are supposed to be reviewed to avoid clashes with existing laws. It is not normal for new laws to conflict or duplicate provisions in existing laws without first amending the existing one."
Adegoke's reference to the tax bill points to a pattern. Nigeria has seen legislative conflicts before, where new laws passed without properly reconciling them with existing frameworks β leaving regulators, businesses, and courts to figure out the gaps.
What Happens Next
The NIMC Act is already in force. The Digital Economy and E-Governance Bill still needs to pass the National Assembly. That creates a narrow window for lawmakers to resolve the overlap before the conflict becomes entrenched in two separate operational laws.
For Nigeria's digital identity and security infrastructure to function smoothly, it matters enormously which agency issues certification authority accreditations and which standards businesses must follow. NIMC's designation as Root CA under a presidential-assented law gives it significant standing β but NITDA's proposed role under the E-Governance Bill is not going away without a deliberate legislative fix.
Whether the National Assembly moves to harmonise the two frameworks before the Digital Economy Bill is passed remains the central question. For now, Nigeria's digital trust infrastructure sits at the intersection of two laws pulling in slightly different directions.