Trust at National Scale

Nigeria's identity programme is among the largest supported by the World Bank's Identification for Development (ID4D) initiative. Reported enrolments passed 130 million by 2026; the register Carter reviewed in 2025 held more than 110 million records. The NIMC Act makes the National Identification Number the country's sole official identity credential.

At that scale, reported progress needs evidence that can withstand independent scrutiny. More than 180 accredited enrolment partners (Front-End Partners) delivered the service across every state and the Federal Capital Territory. NIMC and the World Bank needed to know how consistently they delivered it, how well the system caught duplicate identities, how secure the infrastructure was, and what citizens experienced when they enrolled.

Because disbursements depended on verified results, the evidence had to be strong enough to support funding decisions.

Carter began by reviewing partner guidelines and system documentation and interviewing the people responsible for running the enrolment system. That shaped a risk-ranked verification plan.

Field teams then surveyed citizens, enrolment partner staff and NIMC field officers in every state, with extra coverage in areas where enrolment was low. Mystery shoppers went through enrolment themselves. Every response was captured digitally with GPS stamps and back-checked daily, and at least 15% of respondents were re-interviewed.

A technical team tested the enrolment architecture, the identity verification interface and the system that detects duplicate identities, against international security standards (ISO/IEC 27001 and NIST SP 800-63) and the World Bank's own framework.

No independent estimate existed of how many duplicate identities the register held, so Carter built one, combining record matching, biometric re-checks and statistical modelling.

The World Bank Task Team accepted Carter's findings as the verification of record for the programme's disbursement-linked indicators, the results on which funding is released. This supported subsequent disbursement tranches, based on a nationally representative evidence base.

The final report set out more than 60 findings, each rated by severity and traced to its source. NIMC is using them to review how it accredits enrolment partners, to build a cybersecurity remediation roadmap aligned to ISO 27001, and to redesign its duplicate-detection system, which is already in pilot.

The independent evidence base gives NIMC and the World Bank a reference point for subsequent verification waves and for tracking how identified risks are addressed. The approach is also relevant to other results-based programmes where funding or implementation decisions depend on evidence that needs to be independently tested.