For nearly two decades, Nigeria's National Identity Number served one primary purpose: verifying who you are when opening a bank account, registering a SIM card, or accessing a government programme. That era is officially over.
President Bola Tinubu signed the National Identity Management Commission (NIMC) Act, 2026 on June 26, 2026, repealing the 2007 NIMC law and triggering the most sweeping overhaul of Nigeria's identity management system since the commission was founded. The legislation, exclusively obtained by TechCabal, introduces nine major reforms that transform NIMC from a card-issuing body into the country's central digital trust authority.
What the Law Actually Does
The new act formally assigns NIMC legal responsibility for digital identity management, Public Key Infrastructure (PKI), and Digital Public Infrastructure (DPI) — three pillars that underpin virtually every secure online transaction in a modern economy. PKI is the cryptographic security system that verifies identities, encrypts data, and protects online transactions. DPI is the broader digital backbone connecting individuals, businesses, and government agencies through trusted identity, payment rails, and security infrastructure.
In plain terms, these systems are what make it possible to open a bank account remotely, sign documents digitally, or transfer money securely within seconds. NIMC now has statutory authority over all of it.
"It establishes a modern, forward-looking legal framework that aligns Nigeria's identity ecosystem with global best practices, emerging technologies and the demands of a rapidly evolving digital economy," — Kayode Adegoke, NIMC Head of Corporate Communications
The law also cites international alignment explicitly, noting that its inclusion of "digital identity" as a statutory objective places Nigerian law in line with frameworks such as the World Bank's Identification for Development (ID4D) initiative and the Principles on Identification for Sustainable Development.
From Physical Cards to Technology-Neutral Identity
One of the most practical shifts in the new law is the move away from the General Multi-Purpose Card (GMPC) — the physical identity card that was the cornerstone of the 2007 framework. That model had serious problems. Printing delays, supply chain disruptions, and rising production costs left millions of Nigerians waiting years for their identity cards even after successfully completing NIN enrolment.
The 2026 act replaces that card-centric approach with a technology-neutral identity framework. Nigerians can now prove their identity through smartphone apps, QR codes, and biometric authentication — not just a plastic card. It is a shift that reflects where digital identity is heading globally, and it removes a bottleneck that frustrated both citizens and service providers for years.
A Two-Year Legislative Journey
The bill's path to becoming law was not short. It was first introduced at the National Assembly on March 19, 2024, meaning it took roughly 27 months to move from legislative proposal to presidential assent. The June 26 signing date marks the conclusion of that process.
Nigeria's digital infrastructure ambitions have been growing rapidly, but the legal architecture supporting them lagged behind. The old 2007 law simply was not built to accommodate digital credentials, cryptographic infrastructure, or the kind of interoperable identity systems that modern fintech and e-government services require. The 2026 act directly closes that gap.
Implications for Nigerians and Businesses
With NIMC now holding statutory authority over PKI, the commission becomes the anchor institution for verifying digital signatures and encrypting sensitive data across sectors. That has direct implications for online safety and data protection in financial services, healthcare, and government platforms.
For everyday Nigerians, the most visible change will likely be how they interact with identity verification — less reliance on physical cards, more options through digital channels. For businesses, especially fintechs and banks building remote onboarding and KYC systems, NIMC's expanded mandate provides a clearer legal foundation for the identity infrastructure they have already been building on.
Whether NIMC has the institutional capacity to execute all nine mandates effectively remains a question the market will be watching closely. The law sets an ambitious scope. Delivery is the next test.