FOR OFFICIAL USE ONLY Report No: PAD3089 INTERNATIONAL DEVELOPMENT ASSOCIATION PROJECT APPRAISAL DOCUMENT ON A PROPOSED CREDIT IN THE AMOUNT OF SDR 84.4 MILLION (US$115.0 MILLION EQUIVALENT) TO THE FEDERAL REPUBLIC OF NIGERIA FOR THE DIGITAL IDENTIFICATION FOR DEVELOPMENT PROJECT January 30, 2020 Digital Development Global Practice Africa Region This document has a restricted distribution and may be used by recipients only in the performance of their official duties. Its contents may not otherwise be disclosed without World Bank authorization. The World Bank Nigeria Digital Identification for Development Project (P167183) CURRENCY EQUIVALENTS Exchange Rate Effective October 31, 2019 Currency Unit = Nigerian Naira (NGN) US$1 = NGN 305 US$1 = SDR 0.72495813 FISCAL YEAR January 1 – December 31 ABBREVIATIONS AND ACRONYMS ABIS Automated Biometric Identification System AFD French Development Agency (Agence Française de Développement) AFS Annual Financial Statement AML/CFT Anti-Money Laundering and Countering Financing of Terrorism APAI-CRVS African Programme for Accelerated Improvement of CRVS APIs Application Programming Interfaces BVN Bank Verification Number CBN Central Bank of Nigeria CNII Critical National Information Infrastructure CPF Country Partnership Framework CPS Country Partnership Strategy CR Civil Registration CRVS Civil Registration and Vital Statistics CSO Civil Society Organization DA Designated Account DRC Disaster Recovery Center ECOWAS Economic Community of West African States ECSU Ecosystem Coordination Strategic Unit EIB European Investment Bank ERGP Economic Recovery and Growth Plan ESMF Environmental and Social Management Framework FA Financing Agreement FEC Federal Executive Council FGN Federal Government of Nigeria FM Financial Management FMoJ Federal Ministry of Justice FPFMD Federal Project Financial Management Department FPM Financial Procedures Manual FTE Full-time Equivalent FY Fiscal Year G2P Government-to-Persons GDPR General Data Protection Regulation The World Bank Nigeria Digital Identification for Development Project (P167183) GMPC General Multi-purpose Card GRM Grievance Redress Mechanism GRS Grievance Redress Service ICD International Classification of Diseases ID Identification ID4D Identification for Development ID-CERT National Identification Sectorial Computer Emergency Response Team ID-SOC Security Operations Center IDP Internally Displaced Person IE Impact Evaluation IFR Interim Financial Report IFC International Finance Cooperation INEC Independent National Electoral Commission IPF Investment Project Financing IPPIS Integrated Payroll and Personnel Information System ISO International Organization for Standardization IT Information Technology KII Key Informant Interview KYC Know Your Customer M&E Monitoring and Evaluation MDAs Ministries, Departments, and Agencies MPA Multiphase Programmatic Approach NASSP National Social Safety Nets Project NGN Nigerian Naira NGO Nongovernmental Organization NIN National Identity Number NIMC National Identity Management Commission NIMS National Identity Management System NITDA National Information Technology Development Agency NPC National Population Council NPF New Procurement Framework NPopC National Population Commission OAGF Office of the Accountant General of the Federation OBD Output-based Disbursement ONSA Office of the National Security Adviser OVP Office of the Vice President PDO Project Development Objective PESC Project Ecosystem Steering Committee PIM Project Implementation Manual PIU Project Implementation Unit PKI Public Key Infrastructure PPA Project Preparation Advance PPSD Project Procurement Strategy for Development RPF Resettlement Policy Framework The World Bank Nigeria Digital Identification for Development Project (P167183) RSR Rapid Social Response SCD Systematic Country Diagnostic SDG Sustainable Development Goal SDR Special Drawing Rights SOP Standard Operating Procedure STEP Systematic Tracking of Exchanges in Procurement UNHCR United Nations High Commissioner for Refugees UNICEF United Nations Children's Fund WB World Bank WURI West Africa Unique Identification for Regional Integration and Inclusion Regional Vice President: Hafez Ghanem Country Director: Shubham Chaudhuri Global Practice Director: Boutheina Guermazi Practice Manager: Michel Rogy Task Team Leaders: Marc Jean Yves Lixi, Foluso Okunmadewa The World Bank Nigeria Digital Identification for Development Project (P167183) \ TABLE OF CONTENTS DATASHEET ........................................................................................................................... 1 I. STRATEGIC CONTEXT ...................................................................................................... 7 A. Country Context................................................................................................................................ 7 B. Sectoral and Institutional Context .................................................................................................... 7 C. Relevance to Higher Level Objectives............................................................................................. 11 II. PROJECT DESCRIPTION.................................................................................................. 12 A. Project Development Objective ..................................................................................................... 12 B. Project Components ....................................................................................................................... 13 C. Project Beneficiaries ....................................................................................................................... 26 D. Results Chain .................................................................................................................................. 27 E. Rationale for World Bank Involvement and Role of Partners......................................................... 28 F. Lessons Learned and Reflected in the Project Design .................................................................... 29 III. IMPLEMENTATION ARRANGEMENTS ............................................................................ 30 A. Institutional and Implementation Arrangements .......................................................................... 30 B. Results Monitoring and Evaluation Arrangements......................................................................... 31 C. Sustainability................................................................................................................................... 32 IV. PROJECT APPRAISAL SUMMARY ................................................................................... 34 A. Technical, Economic and Financial Analysis ................................................................................... 34 B. Development Impact ...................................................................................................................... 34 C. Fiduciary.......................................................................................................................................... 41 D. Safeguards ...................................................................................................................................... 43 V. KEY RISKS ..................................................................................................................... 45 VI. RESULTS FRAMEWORK AND MONITORING ................................................................... 49 ANNEX 1: Implementation Arrangements and Support Plan ................................................. 60 ANNEX 2: Technical Design and Component Descriptions ..................................................... 73 ANNEX 3: Effective Inclusion and Beneficiary Engagement ................................................. 108 ANNEX 4: Effectiveness and Disbursement Conditions ....................................................... 112 The World Bank Nigeria Digital Identification for Development Project (P167183) DATASHEET BASIC INFORMATION BASIC_INFO_TABLE Country(ies) Project Name Nigeria Nigeria Digital Identification for Development Project Project ID Financing Instrument Environmental Assessment Category Investment Project P167183 B-Partial Assessment Financing Financing & Implementation Modalities [ ] Multiphase Programmatic Approach (MPA) [ ] Contingent Emergency Response Component (CERC) [ ] Series of Projects (SOP) [ ] Fragile State(s) [ ] Disbursement-linked Indicators (DLIs) [ ] Small State(s) [ ] Financial Intermediaries (FI) [ ] Fragile within a non-fragile Country [ ] Project-Based Guarantee [ ] Conflict [ ] Deferred Drawdown [ ] Responding to Natural or Man-made Disaster [ ] Alternate Procurement Arrangements (APA) Expected Approval Date Expected Closing Date 18-Feb-2020 30-Jun-2024 Bank/IFC Collaboration No Proposed Development Objective(s) The Development Objective of the project is to increase the number of persons with a national ID number, issued by a robust and inclusive foundational ID system, that facilitates their access to services. Components Component Name Cost (US$, millions) Page 1 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) Component 1: Strengthening the Legal and Institutional Framework 17.00 Component 2: Establishing a Robust and Inclusive Foundational ID System 306.00 Component 3: Enabling Access to Services through IDs 66.00 Component 4: Project Management and Stakeholder Engagement 41.00 Organizations Borrower: Federal Republic of Nigeria Implementing Agency: National Identity Management Commission PROJECT FINANCING DATA (US$, Millions) SUMMARY -NewFin1 Total Project Cost 430.00 Total Financing 430.00 of which IBRD/IDA 115.00 Financing Gap 0.00 DETAILS -NewFinEnh1 World Bank Group Financing International Development Association (IDA) 115.00 IDA Credit 115.00 Non-World Bank Group Financing Other Sources 315.00 EC: European Investment Bank 215.00 FRANCE: French Agency for Development 100.00 IDA Resources (in US$, Millions) Credit Amount Grant Amount Guarantee Amount Total Amount Nigeria 115.00 0.00 0.00 115.00 Page 2 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) National PBA 115.00 0.00 0.00 115.00 Total 115.00 0.00 0.00 115.00 Expected Disbursements (in US$, Millions) WB Fiscal Year 2019 2020 2021 2022 2023 2024 2025 Annual 2.08 11.83 17.56 21.72 22.73 24.27 14.81 Cumulative 2.08 13.90 31.46 53.18 75.92 100.19 115.00 INSTITUTIONAL DATA Practice Area (Lead) Contributing Practice Areas Digital Development Social Protection & Jobs Climate Change and Disaster Screening This operation has been screened for short and long-term climate change and disaster risks SYSTEMATIC OPERATIONS RISK-RATING TOOL (SORT) Risk Category Rating 1. Political and Governance  High 2. Macroeconomic  Substantial 3. Sector Strategies and Policies  High 4. Technical Design of Project or Program  High 5. Institutional Capacity for Implementation and Sustainability  High 6. Fiduciary  Substantial 7. Environment and Social  Moderate 8. Stakeholders  High 9. Other  High 10. Overall  High Page 3 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) COMPLIANCE Policy Does the project depart from the CPF in content or in other significant respects? [ ] Yes [✓] No Does the project require any waivers of Bank policies? [✓] Yes [ ] No Have these been approved by Bank management? [✓] Yes [ ] No Is approval for any policy waiver sought from the Board? [ ] Yes [✓] No Safeguard Policies Triggered by the Project Yes No Environmental Assessment OP/BP 4.01 ✔ Performance Standards for Private Sector Activities OP/BP 4.03 ✔ Natural Habitats OP/BP 4.04 ✔ Forests OP/BP 4.36 ✔ Pest Management OP 4.09 ✔ Physical Cultural Resources OP/BP 4.11 ✔ Indigenous Peoples OP/BP 4.10 ✔ Involuntary Resettlement OP/BP 4.12 ✔ Safety of Dams OP/BP 4.37 ✔ Projects on International Waterways OP/BP 7.50 ✔ Projects in Disputed Areas OP/BP 7.60 ✔ Legal Covenants Sections and Description The Recipient shall establish, within sixty (60) days after the Effective Date, and thereafter maintain throughout Project implementation an Ecosystem Coordination Strategic Unit (“ECSU”), within a government agency, and with a composition, mandate and resources, designated by the PESC and acceptable to the Association, to be responsible for communicating guidance of the PESC to ecosystem partners engaged in collecting enrollment data Page 4 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) and reporting to the PESC on progress towards implementing Schedule 1 Parts 1 and 4(a) of the Financing Agreement. Sections and Description Without limitation to sub-paragraph (a) above, the Recipient shall, not later than ninety (90) days after the Effective Date recruit, and thereafter maintain throughout the Project Implementation as members of the ECSU: (i) an ECSU coordinator to head the ECSU; and (ii) a procurement specialist, all to be recruited on a competitive basis and all with qualifications, experience and integrity, and under terms of reference, satisfactory to the Association. The ECSU shall liaise with the Legal Reform Working Group. Sections and Description The Recipient shall cause NIMC to establish, within ninety (90) days after the Effective Date, and thereafter maintain throughout Project implementation a Project Implementation Unit (“PIU”), with a composition, mandate and resources satisfactory to the Association, for: (i) the day-to-day management of Project implementation; and (ii) reporting, through the Director General of NIMC, to the PESC on the progress towards implementation of Schedule 1 Parts 2, 3 and 4(b) of the Financing Agreement. Sections and Description Without limitation to sub-paragraph (a) above, the Recipient shall cause NIMC, not later than ninety (90) days after the Effective Date, to recruit, and thereafter maintain throughout the Project Implementation: (i) project coordinator; (ii) a technical lead; (iii) a procurement officer; and (iv) an environmental safeguards officer and a social safeguards officer, all to be recruited on a competitive basis and all with qualifications, experience and integrity, and under terms of reference, satisfactory to the Association. Sections and Description No later than ninety (90) days after the Effective Date, the Recipient shall prepare and furnish to the Association for review, a manual, which shall include provisions on the following matters: (i) details of Project activities set out in Schedule 1 to this Agreement; (ii) disbursement and flow of funds arrangements; (iii) institutional arrangements; (iv) fiduciary arrangements, including financial management, procurement, and anti-corruption; (v) environmental and social management systems, including the Safeguard Instruments and the Project grievance redress mechanism; (vi) the ID4D Principles and the Pillars of Inclusion; (vii) monitoring and evaluation, reporting and communication; (viii) detailed arrangements for verification of achievement of disbursement conditions set out in Section III.B of Schedule 2 of the Financing Agreement; (ix) a description of the output-based financing arrangements for Part 2(e)(i) in Schedule 1 of the Financing Agreement and the related definitions of Unit Costs; and (x) such other administrative, financial, technical and organizational arrangements and procedures as shall be required for the Project. Sections and Description Not later than one hundred eighty (180) days after Effectiveness Date, the Recipient shall on a competitive basis recruit one or more independent experts with experience, independence, integrity and capacity and under terms of reference acceptable to the Association to conduct ex-post verifications every calendar semester of the output- based financing activities under Schedule 1 Part 2(e)(vi) of the Financing Agreement. Conditions Page 5 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) Type Description Effectiveness The AFD Co-financing Agreement has been executed and delivered and all conditions precedent to its effectiveness or to the right of the Recipient to make withdrawals under it (other than the effectiveness of the Financing Agreement) have been fulfilled. Type Description Disbursement Notwithstanding the provisions of Part III.A of Schedule 2 of the Financing Agreement, no withdrawal shall be made: (a) for payments made prior to the Signature Date; (b) for any enrollment activities under Part 2(e)(vi) of the Project under Expenditure Category (2) of the Financing Agreement, unless and until: (i) the Data Protection Bill, in form and substance satisfactory to the Association, has been duly enacted into law; and (ii) the Association has assessed the enrollment system and determined that such system is ready for implementation under criteria to be set out in the Project Implementation Manual (PIM). Type Description Disbursement Notwithstanding the provisions of Part III.A of Schedule 2 of the Financing Agreement, no withdrawal shall be made for any enrollment activities under Part 2(e)(vi) of the Project under Expenditure Category (3) of the Financing Agreement, unless and until: (i) the condition set forth in paragraph III.B.1(a) of Schedule 2 has been met; and, in addition (ii) the NIMC Act and the Registration of Persons and Contents of the National Identity Database Regulations 2017 have been duly amended, in form and substance satisfactory to the Association, in accordance with the Annex to Schedule 2 of the Financing Agreement. Type Description Effectiveness The Recipient has established the Project Ecosystem Steering Committee according to Section I.A.1 of Schedule 2 to the Financing Agreement. Type Description Disbursement Notwithstanding the provisions of Part A of Schedule 2 of the Financing Agreement, no withdrawal shall be made for any output-based payments under Expenditure Categories (2) or (3) of the Financing Agreement, unless or until the Recipient has confirmed the number of measured Outputs achieved for said Category, in accordance with criteria set out in the PIM, and furnished all required verification documents, acceptable to the Association. Page 6 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) I. STRATEGIC CONTEXT A. Country Context 1. Nigeria’s pressing development challenges require a robust system which allows Government and service providers to verify individuals’ identity on demand. The Economic Recovery and Growth Plan (ERGP), prepared by the Federal Government of Nigeria (FGN) in April 2017, highlights the complex development challenges in Nigeria. With a population of 190 million, Nigeria grapples with poverty, inequality, youth unemployment, and an undiversified economy. According to the National Bureau of Statistics, 61 percent of people live below the poverty line; 22 percent of the labor force is made up of unemployed youth; and 95 percent of exports are from the oil sector, with manufacturing accounting for less than 1 percent of the country’s exports. The recent economic downturn is further precipitated by weak infrastructure, challenges in fiscal management, and limited transparency and accountability. Widespread conflict plagues parts of the country, making it difficult for households to access basic services or economic opportunities and resulting in major internal displacement.1 2. Gender inequality is also a pervasive issue in Nigeria, which is reflected in the current national ID system, where according to National Identity Management Commission (NIMC)data only 40 percent of those registered for national identity numbers (NINs) are women. Nigeria ranks 118 out of 134 countries on the Gender Equality Index. The emphasis placed on women’s childbearing and childrearing roles affects girls’ educational attainment, especially secondary school completion, and consequently, their level of human capital. Over two-thirds of girls in the north of Nigeria (ages 15–19) are unable to read, compared with less than 10 percent in the south. In the north, only 3 percent of girls complete secondary school, which 76 percent are married by age 18 in the northwest.2 About 50 percent of women (ages 15–64) are in the labor force compared to 60 percent of men, according to the World Development Indicators.3 The gender gap in use of formal financial services is also large, with men nearly twice as likely as women to have bank accounts.4 Persistent gender-based violence and high fertility rates further disadvantage women, and women also face additional institutional and cost barriers (such as distance and price) in accessing services.5 Finally, both men and women agree that opportunities and equality for women are not improving: in the 2017 Afrobarometer survey, over 74 percent of both men and women thought equal opportunities and treatment for women over recent years have either gotten worse or stayed the same. Given the nature and extent of gender inequality in Nigeria, women are likely to face several barriers in trying to obtain IDs. B. Sectoral and Institutional Context 3. An estimated 1 billion people globally, with approximately half in Sub Saharan Africa, lack a government-recognized proof of identity and consequently face barriers to accessing critical services 1 Sattar, Sarosh, and Souleymane Coulibaly. Forthcoming. Nigeria Systematic Country Diagnostic: Transitioning to a Middle- Class Society. The World Bank Group. 2 National Population Council (NPC) (Nigeria) and ICF (International Finance Cooperation). 2014. Demographic and Health Survey 2013. Abuja, Nigeria and Rockville, Maryland, USA: NPC and ICF International; British Council Nigeria. 2012. Gender in Nigeria Report 2012: Improving the Lives of Women and Girls in Nigeria. https://www.britishcouncil.org/sites/default/files/british-council-gender-nigeria2012.pdf. 3 https://data.worldbank.org/indicator/SL.TLF.ACTI.MA.ZS. 4 Sattar and Coulibaly 2018. 5 NPC and IFC 2014; Sattar and Coulibaly 2018. Page 7 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) and exercising political and economic rights. Robust, inclusive, and responsible foundational ID systems can be transformative for the poorest and most vulnerable by enabling access to basic health care, education, and social safety nets; facilitating financial inclusion; and fostering the empowerment of women and girls. Providing ‘legal identity for all’ by 2030 was adopted as a target (16.9) under the 2030 Agenda for Sustainable Development and the ability to uniquely identify individuals and reliably authenticate their identity is also a key enabler of progress toward many other Sustainable Development Goals (SDGs). 4. At a systemic level, strong foundational ID systems are essential to countries’ economic development, security, governance, and efficient delivery of services —enabling them to accelerate progress toward an inclusive digital economy. Foundational ID systems comprise both the national ID system and the CR system, which must work in tandem to ensure that the population is identified from birth to death and that national ID systems remain up-to-date. Digital foundational ID systems can generate significant benefits across the public and private sectors by increasing accountability (chiefly through the reduction of fraud, leakages, and waste) as well as driving innovation in service delivery (through the use of mobile or digital payments, for instance). Moreover, such systems can generate reliable and continuous data for policy makers to measure development progress and identify areas needing additional investment. 5. Evidence from a number of other countries has shown that a foundational approach to ID systems can serve as a platform upon which both the public and private sectors can rely for downstream transactions and service delivery. Functional ID systems are often designed and implemented from a narrow, sector-specific perspective, designed and implemented with a particular service or transaction in mind, such as voting, tax administration, or financial services. Maintaining many different, limited purpose, functional ID systems is costly, is administratively inefficient, and leads to a fragmented ID landscape with multiple parallel (and duplicative) ID systems, each accessible only to a subset of the population and accepted by a limited number of entities as proof of identity or eligibility. The negative effects of this fragmentation are disproportionately borne by the poor and by other marginalized groups who are unable to obtain an ID to access basic services or to exercise their rights. Good practice examples from countries, such as India and Peru, suggest that digital ID systems that can uniquely identify registrants are closely linked to CR; are interoperable with sectoral systems (for example, social protection, health, education, financial services, and so on); and do not connote legal status and thus can quickly scale to achieve full coverage and become a valuable tool for effective service delivery and poverty reduction. A responsible foundational ID system uses a minimal set of attributes, such as biometrics and biographic data, to ensure that each registered identity is unique. Critically, foundational ID systems should be underpinned by a robust legal and institutional framework. An inclusive foundational ID system is open to all; does not exclude persons based on their nationality or legal status; and has coverage that is not biased by gender, religion, ethnicity, disability, or socioeconomic status. 6. Several of Nigeria’s governance challenges could be alleviated by a well -designed and well- implemented foundational digital identification (ID) system. Better identification, authentication, and targeting mechanisms can improve transparency, reduce waste, and streamline service delivery. As the FGN helps people in Nigeria rise out of poverty and achieve greater prosperity, identification is also critical to deliver key services — such as basic financial access, health, education, and social safety nets — inclusively and effectively and ensure the country’s economic, social, and political progress. Page 8 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) 7. Nigeria’s existing foundational ID systems — comprising the national ID system and civil registration (CR) — suffer from low coverage across the population. The United Nations Children's Fund (UNICEF) birth registration statistics show that only about 30 percent of children under the age of five have had births registered. This figure drops to 19 percent in rural areas and to 7 percent for children in the poorest quintile of the population. Less than 50 percent of residents have any functional ID at all, while only 18 percent of individuals have a NIN. 8. The CR system is not functioning optimally and remains primarily paper based without the ability to link to the national ID system. A civil registration and vital statistics (CRVS) assessment, carried out by National Population Commission (NPopC), found that many aspects of the CRVS system are not functioning well. In particular, completeness of registration; international classification of diseases (ICD) practice, complaints, and certification; ICD coding; and data quality and plausibility were all rated as dysfunctional. There is incorrect and untimely reporting and recording of data, and the implementation of a data management system is weak at all levels (local government area, state, and national). Monitoring and evaluation (M&E) is also poor, with only the RapidSMS system to track birth registration performance. A digitized CR system linked to the national ID system will be necessary to realize a fully functional and sustainable foundational ID system in Nigeria. 9. The FGN incurs significant costs due to Nigeria’s fragmented identification landscape. Currently, over 13 government agencies6 and at least three state agencies offer ID services in Nigeria. Many of these capture biometrics and issue ID cards independently without establishing registries with the ability to query, be queried by, or to otherwise communicate with other systems, resulting in duplication and waste of resources. For instance, Nigeria registered 70 million voters at a cost of US$627 million during a one- off biometric voter registration exercise. Based on an illustrative analysis done in 2015, the FGN could have spent US$4.3 billion across all ID programs in Nigeria, of which US$1.2 billion has already been spent and US$3.1 billion is in the pipeline to support multiple, disconnected, and duplicative systems under the current fragmented approach. At a cost of US$10 spent per person over five years, the spending on identification is significantly over good practice benchmarks, which puts the cost of such systems at US$4– US$7 per person. 10. The FGN has indicated a strong desire to address the weaknesses of the existing ID ecosystem and develop a foundational ID system which can be leveraged to improve service delivery, and approved in 2018 a national strategy for identification. Based on completion of an initial ID ecosystem diagnostic in July 2016, the Vice President convened a workshop of all ID stakeholders in December 2016, which confirmed the need to develop a Strategic Roadmap charting the way forward. The Strategic Roadmap was then prepared, with the support of the World Bank Group and its Identification for Development (ID4D) Initiative, and highlighted the need for a minimalist, foundational, and ecosystem- based approach to identification in the country. The Strategic Roadmap was endorsed by the Harmonization Committee at a second Vice Presidential-level Workshop attended by over 200+ ID stakeholders on January 31, 2018. The group moved to submit the Strategic Roadmap to the Federal Executive Council (FEC), chaired by the President of Nigeria. FEC endorsed the Strategic Roadmap as the national strategy for identification on September 15, 2018. 6Including National Identity Management Commission (NIMC), NPopC, Central Bank of Nigeria (CBN), Independent National Electoral Commission (INEC), and Nigeria Communications Commission, among others. Page 9 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) 11. Nigeria has a solid base for a strong legal and institutional framework to guide the implementation of a foundational digital ID system. (a) The Constitution of the Federal Republic of Nigeria, 1999 (as amended) (the Constitution) sets out individual rights of privacy and protections against discrimination. In both instances, these provisions are applicable to citizens only. It also delineates the powers that may be exercised by federal, state, and local government. Beyond provisions included in the Constitution, there is currently no framework that broadly addresses protection of personal data or individual privacy rights. In addition, Nigeria does not have an institutional or governance body that is mandated to protect the personal data and privacy of citizens. The Data Protection Bill, 2018, which has had several iterations going back to 2015, was passed by the 8th National Assembly on May 16, 2019, and transmitted to the President of the Republic of Nigeria for assent. However, the Data Protection Bill was not assented to and the drafting and enactment process needs to be restarted. As a first step, the Data Protection Bill will be returned to the Federal Ministry of Justice (FMoJ) with reasons listed as to why it has not been signed. The bill will then be reviewed and the reasons listed will be addressed during the redrafting phase. Once the redrafting has been completed then the enactment process will begin again. The current draft of the Data Protection Bill which was not assented to included data protection obligations applicable to public and private sector entities that collect and process personal data, individual privacy rights, and a mandatory breach notification framework. The World Bank, working with the French Development Agency (Agence Française de Développement, AFD), European Investment Bank (EIB), and other partners, provided several rounds of input on the original bill. The Freedom of Information Act, 2011, provides for public access to public records and information, as well as for the protection of such information as consistent with the public interest and personal privacy. (b) In addition to nondiscrimination provisions included in the Constitution, the African Charter on Human and People’s Rights (African Charter) was incorporated into Nigerian law in 1983. In addition, a Discrimination Against Persons with Disability (Prohibition) Bill has been enacted which prohibits all forms of discrimination against persons with disabilities, regardless of citizenship status. (c) The NIMC Act, 2007, is the principal legislation defining and implementing the national ID system. It establishes the NIMC as the lead government agency responsible for developing a national identity management system (NIMS) in Nigeria. Under the NIMC Act, the NIMC’s functions include (i) Creating, owning, operating, maintaining, and managing the national identity database; (ii) Registering citizens and legal residents and assigning a unique NIN, the use of which is mandatory to conduct a wide range of essential transactions; (iii) Issuing a General Multi-purpose Card (GMPC) to each registered individual; (iv) Providing and assisting in the development of an identity verification and authentication service infrastructure; and (v) Harmonizing and integrating the existing ID databases in Nigeria. 12. Exercising the authority granted under the act, NIMC has subsequently issued a suite of regulations addressing a range of matters relevant to implementation of the NIMC Act. (a) The NPopC Act, 1988, establishes the NPopC, which is tasked with undertaking periodic censuses and establishing and maintaining a machinery for continuous and universal registration of births Page 10 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) and deaths. The Births, Deaths, Etc. (Compulsory Registration) Act, 1992, provides for the mandatory registration of births and deaths and provides procedures for registration of customary marriages, divorces, and adoption of children. (b) The Cybercrime (Prohibition, Prevention, Etc.) Act, 2015 (Cybercrime Act), provides a framework for the prevention, detection, and punishment of cybercrimes and the protection of critical national information infrastructure (CNII). (c) There is currently no framework that addresses digital signatures or electronic transactions. Separate versions of the Electronic Transactions Bill, 2017, were passed by the House of Representatives and Senate, though the current status of the Electronic Transactions Bill remains uncertain. This bill is intended to facilitate, promote, and regulate electronic commerce, including providing a framework for the secure use and verification of digital signatures within the national ID system. It also has provisions on protection of personal data. C. Relevance to Higher Level Objectives 13. The project is fully aligned with the FGN’s ERGP 2017–2020. As part of the ERGP, the FGN plans to deliver key government services to people in Nigeria, including safety nets, agriculture, food security, energy, transport, and enterprise development while strengthening the macrofiscal environment, investing in people, and developing a local digital economy. Identification is central to realizing the ERGP. Key government priorities, including delivery of social safety nets to the poorest and financial inclusion, rely on good identification. Firms, aiming to scale up the country’s digital economy, may not be able to offer innovative products and services to consumers without good identification. Identification is a requisite for the country’s economic, social, and political progress and works hand in hand with greater use of Internet, payments, and skills for a vibrant digital economy in Nigeria. 14. The project is fully aligned with the vision laid out in the Strategic Roadmap for Digital Identification in Nigeria, as well as with the FGN’s National Strategic Action Plan for CRVS (2018–2022) and the African Programme for Accelerated Improvement of CRVS (APAI–CRVS).7 The Strategic Roadmap is intended to offer a credible pathway for the FGN to develop identification at a low cost and fast pace. It proposes a modified approach to developing identification by leveraging the FGN’s existing institutions, capacities, and systems. The National Strategic Action Plan for CRVS and the APAI-CRVS aim to bring CR into the digital age, ensure legal identity for individuals from birth, and provide for the production of reliable vital statistics (for example, birth and death rates). 15. The Country Partnership Strategy (CPS) of fiscal year (FY)14–FY17, which was extended to FY19,8 includes in its Cluster 2 goals the ‘Quality, Effectiveness, and Efficiency of Social Services Delivery at State Level for Increased Social Inclusion’—particularly for health and education outcomes. The CPS envisioned a World Bank contribution for an ID4D Project to support the development of ‘a foundational ID [system] that can be leveraged to improve service delivery’. 16. The project is in line with the Country Partnership Framework (CPF) covering 2020-2024 that is currently under preparation and will be presented to the Board in May 2020. Nigeria’s key foundational 7 See http://www.apai-crvs.org/. 8 Report number 82501. Page 11 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) ID systems suffer from low coverage across the population, affecting the Government’s ability to provide services to vulnerable groups such as the poor, women, and rural communities. Health benefits, financial inclusion, safe and orderly migration, voting, education, and social safety nets rely on an accurate method of identifying individuals. This project is seen to have truly transformational potential for the delivery of public services and the growth of other sectors of the economy. 17. This project is harmonized with the regional Multiphase Programmatic Approach (MPA) and the West Africa Unique Identification for Regional Integration and Inclusion (WURI) program (P161329). The WURI Project focuses on regional mutual recognition of ID systems in the Economic Community of West African States (ECOWAS) and seeks to increase the number of persons who have a government recognized proof of unique identity that facilitates access to services. This MPA represents the World Bank’s first regionally focused operation on ID systems and is based on the substantial global upstream analytical work spearheaded by the ID4D Initiative for reaching the goals set forward in the World Bank’s Africa ID4D Business Plan, including providing access to basic digital ID for 150 million new individuals by the end of IDA 18. Due to its size and complexity, the Nigeria ID4D Project will not formally be a part of the regional MPA; nonetheless, it will follow a similar approach and project design for the ID system. On a technical level the system under this project will be fully compatible with all approaches taken in the ECOWAS region to enable regional integration. The Results Framework is also fully aligned to the WURI Project to enable coherent regional reporting. 18. The project is also aligned with the Digital Economy for Africa (DE4A) initiative, which supports the operationalization of the African Union’s Digital Transformation Strategy for Africa. The Digital Transformation Strategy for Africa sets out a bold vision to ensure that every African individual, business and government, is digitally enabled by 2030. The goal is to drive the digital transformation of Africa and ensure its full participation in the global digital economy. The Nigeria Digital ID4D Project will bring coverage of digital ID in Nigeria to 85 percent of the population and 97.5 percent of adults by the end of 2027, over the course of two envisaged phases of implementation, which is a foundational element of the digital economy. In addition, the project will actively build links to the financial sector to support access to digital financial services for all ID holders. 19. The project is conceived as the first of two potential phases of support over 10 years for foundational ID and digital economy in Nigeria. This project will support the expansion of a foundational ID system and ensure that the majority of people in Nigeria are issued an ID. It will also facilitate the use of this ID to improve access to services. A potential second phase would make additional investments, in particular on the CR system, to ensure that the foundational ID system supported in this project is maximally robust, and would also support additional value-added services built on foundational ID to facilitate the transition to a vibrant, inclusive, and safe digital economy in Nigeria. II. PROJECT DESCRIPTION A. Project Development Objective PDO Statement 20. The Project Development Objective (PDO) is to increase the number of persons with a national ID number, issued by a robust and inclusive foundational ID system, that facilitates their access to services. Page 12 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) PDO-level Indicators  Persons who have a NIN (Number)  Females who have a NIN (women and girls) (number)  Children who have a NIN (girls and boys under 16) (number)  Successful upgrade and deployment of the NIMS, enabling real-time generation of NINs and adequate safeguards for personal data, in keeping with international best practice (Yes/No)  Successful digital authentications in the context of service delivery (Number)  Successful digital authentications on behalf of women (Percentage)  Persons with NINs in the bottom two poverty quintiles (Percentage) 21. The project is gender informed and will make a concerted effort to close gender gaps in access to identification through a gender action plan informed by the gender deep dive research project. The ID4D Initiative has financed a research study on gender barriers to identification in Nigeria as part of project preparation. This study is employing qualitative research methods to understand the barriers to women’s access to identification as well as potential solutions to be included in the project, which will inform the gender action plan. The study considers the intersectionality of poverty, culture, religion, and gender and how this may compound barriers to identification for women. In addition, it seeks to understand how to better motivate women to seek identification (see annex 3 for more information.) Disaggregated indicators have been included in the Results Framework to track progress on closing gender gaps. Enrollment partners will be held to key performance indicators, which include gender targets and form part of the project M&E framework. B. Project Components 22. The project aims to strengthen the foundational ID system, and in doing so, improve national data protection, bolster Nigeria’s digital economy, and close gender and inclusion gaps in access to identification and related key services. By taking a holistic approach to identification, which upgrades and links both the national ID system and CR, the project will ensure an up-to-date national ID registry and identification from birth to death for the majority of the population over two potential phases of project implementation. A strong focus on four Pillars of Inclusion, a tailored enrollment approach to reach all parts of Nigeria, and the enforcement of key performance indicators for ecosystem enrollment partners will ensure that the project closes gender gaps in the foundational ID system and fosters inclusion for marginalized groups, such as persons with disabilities, the rural poor, and others. 23. To achieve these aims the project is structured around four main components: (a) strengthening the legal and institutional framework; (b) establishing a robust and inclusive foundational ID system; (c) enabling access to services through IDs; and (d) project management and stakeholder engagement. This section outlines the broad scope of each component. A summary of the components is provided here, with full details available in annex 2. Page 13 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) Component 1: Strengthening the legal and institutional framework (US$17 million equivalent, of which US$3 IDA, US$5 AFD, US$9 EIB) 24. Under this component, the project will finance the reform of the ID legal, regulatory, and institutional framework. The legal and regulatory reforms will promote inclusion and nondiscrimination for the project to achieve universal ID coverage. The legal reforms are necessary to promote trust in the ID system particularly with regard to the protection of privacy and personal data, strengthening the NIMC’s institutional and administrative framework, inclusion and nondiscrimination, and the interoperability of foundational and functional registries. This component also includes support for the drafting, amendment, and enactment of legislative frameworks for the broader legal and regulatory enabling environment of the Nigeria digital economy, including institutions such as NPopC and National Information Technology Development Agency (NITDA). The most crucial aspect of the legal reforms supported by this component is data protection, which is fundamental to the entire project. In 2018, a Data Protection Bill was passed by the National Assembly May 16, 2019, but the President did not assent due to various issues with the text, which will require a revised version to be sent back to the National Assembly before final enactment. The next step will be for the draft bill to be returned to the FMoJ by the Presidency with reasons as to why it has not been assented to so that the drafting process can begin again. The second most critical element of the legal reform process is the amendment of the NIMC Act to ensure that it is fully in line with the strategy laid out by the FGN in the Strategic Roadmap and that the new registration process financed under the project is fully lawful, inclusive, and nondiscriminatory. The remaining reforms to be supported under the project include amendment and enactment of legislation on electronic transactions and digital signatures, as well as on cybercrime and cybersecurity. The project will also finance technical assistance, institutional reform, and capacity building toward the establishment of key institutions, such as the data protection authority, which are required to develop and enforce the newly developed or updated legal and regulatory frameworks. 25. The legislative and regulatory reforms that will be undertaken under this component require both the drafting of new legislation and the amendment of existing legislation. These reforms may in some instances result in institutional mandates being changed and therefore require constant consultations with key stakeholders to prevent any delays or challenges. In instances where new legislation and governance bodies are proposed, political will at the highest level is required for effective implementation. It is specifically for this reason that the legal reforms will be undertaken in close consultation with all affected stakeholders in the ID ecosystem and coordinated by the Ecosystem Coordination Strategic Unit (ECSU) in consultation with the FMoJ, other relevant focal ministries and agencies of Government, as well as relevant oversight committees at the National Assembly. Legal and regulatory working groups consisting of key ID stakeholders will be established to ensure their inclusion in the decision-making processes. This approach has been effective to date in ensuring that the finalization of the Data Protection Bill is prioritized at the national level. Any form of legislative reform is prone to unpredictable challenges both at the enactment and implementation level in Nigeria, particularly when mandates are being changed and new bodies are being established. Close consultation is critical to ensuring effective reforms. 26. The proposed reforms are informed by the assessment of the legal and regulatory environment for the national ID and CR systems in Nigeria, including data protection and privacy aspects. This legal and regulatory assessment – conducted during project preparation - considered constitutional issues; institutional arrangements governing the national ID and CRVS systems, including the rules governing these systems; data protection, security, and privacy; and nondiscrimination and inclusion. It identified Page 14 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) inconsistencies, shortcomings, and other issues in the legal and regulatory environment that are likely to impede or undermine the implementation of the national ID system. The proposed mitigation measures will form the basis of the legal and regulatory reforms. 27. This component will also finance technical assistance to create the enabling legal and regulatory environment for the development of a digital CR system and strengthen its role in the country’s foundational ID ecosystem. This includes the digitization of existing birth registration processes to lay the foundations for continuous enrollment from birth in the digital foundational ID system. Developing the enabling legal and regulatory environment for the digitization and automation of the existing CR system is imperative to the sustainability of the ID Project. It is therefore essential that there is a legal framework which defines data record-keeping standards and quality check procedures to ensure the quality of data collected. 28. The component will finance institutional capacity building to build trust and credibility within the country’s ID ecosystem. Institutions such as NIMC, NPoPC, NITDA, the Office of the National Security Adviser (ONSA), and FMoJ may require significant capacity building to effectively implement the legal reforms supported under this component. Capacity building will include continuous training based on a skills gap capacity analysis to be conducted under the project. Institutional reform will also be required as part of the implementation of the recommendations from the legal and regulatory assessment, particularly those related to improvements required in the current administrative processes and systems. This includes the designation of an independent data protection authority. Efficient project management by the Project Implementation Unit (PIU), as well as strong links to the ECSU, will be critical to ensure the success of the foundational ID system. 29. Disbursement conditions will be used to encourage the Government to implement specific legal reforms without which the PDO will be negatively affected. There will be two tranches of funds for enrollments. The enactment of adequate data protection legislation is a condition for disbursement of the first tranche of funds. Amendments to particular provisions of the NIMC Act deemed to be critical to the PDO achievement are disbursement conditions on the second tranche of enrollment funds. These provisions include those related to promoting inclusion and nondiscrimination, protecting ownership of personal data, access to personal data by third parties, and mandatory use of NIN (see annex 2 for details on data protection legislation and the NIMC Act). These disbursement conditions are structured to allow the project to begin to disburse on legal reform and preparatory activities for enrollment. This will ensure adequate progress on implementation beginning at project effectiveness while also holding the FGN accountable for delivering the legal reforms necessary to adequately protect user data before enrollments commence (for more information on the Disbursement Conditions see annex 4.) Component 2: Establishing a robust and inclusive foundational ID system (US$306 million equivalent, of which US$59 IDA, US$78 AFD, US$169 EIB) 30. This component will support the harmonization of existing functional ID systems and the establishment of a digital foundational ID platform that issues free of charge a unique national ID number (NIN) as an identity credential to all persons in Nigeria as well as Nigerians living abroad. The project will revise the NIMC’s current approach and focus on gathering only the minimum biographic and biometric data fields required to ensure uniqueness and enable reliable authentication of the individual. This will facilitate rapid enrollment for Nigeria’s 200 million strong population and protect individual privacy by minimizing opportunities for misuse. Page 15 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) 31. The quality of ID systems depends on a number of design and technical factors and has profound implications for the utility, security, and sustainability of the ID system. This includes institutional arrangements for the provision of ID services and identity management; the choice of technology used for establishing uniqueness; the authentication infrastructure (that is, how IDs are used to authenticate the individual at the point of transaction); the form and type of the token or authenticator issued as a proof of identity (that is, different types of cards or the use of ID numbers in combination with remotely stored biometrics); and security measures put in place for securing databases against disasters and cyberattacks. Hardware and software should be based on open standards to reduce costs, avoid vendor lock-in, and provide flexibility for future adaptation. Operational guidance on topics such as technology approaches, costs, system architecture, and links with civil registration will be leveraged from a series of technical studies completed by the World Bank Group’s ID4D Initiative. A Technical Assessment of the Nigerian ID ecosystem conducted in 2018 presented a complete inventory of current information systems and institutional capacity and recommended design options, including a migration strategy for the potential integration of legacy data into the NIMS. These recommendations will be refined and extended through additional studies undertaken under the project. Figure 1. Architecture of the Foundational ID Ecosystem Resident Ecosystem Ecosystem Ecosystem Ecosystem Partner Partner Partner Partner (Service Provider) (Service Provider) (Service Provider) (Service Provider) Data Processing, Validation & De-duplication UIN generation Civil Registration System Biographical Biometric Transaction Metadata Analytics & Data Data APIs Reporting (Requests & Replies) API Layer (Authentication, Data Access, eKYC) Security & Cyberthreat Analytics National Identity Management System (NIMS) Foundational ID Ecosystem Source: World Bank. 32. Overall, the newly developed NIMS will aim to: (a) Be robust, in that it ensures the uniqueness of the assigned NINs and has the necessary technical and legal underpinnings to function reliably and effectively safeguard personal data; (b) Be inclusive, such that all individuals have access to a NIN that will provide them with an official Page 16 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) proof of identity from birth; (c) Be foundational, in that it is linked by design and practice to the CR and can be used by functional registers for identity authentication purposes; and (d) Facilitate access to services for individuals and effective service delivery in the public and private sectors by being able to reliably authenticate a person’s identity. 33. The system will also adhere to the 10 Principles on Identification for Sustainable Development, which outline the key features of ID systems needed to maximize benefits for development while mitigating the risks. They have been endorsed by 25 international organizations, nongovernmental organizations (NGOs), donors, and private sector entities active in the ID4D ecosystem. A summary of the principles is shown in figure 2.9 Figure 2. Principles on Identification for Development Source: World Bank. 34. The ID system will be maximally inclusive. In line with these Principles, the project will adhere to the following four Pillars of Inclusion: (a) The ID system, financed under the project, will be accessible to all persons in Nigeria, regardless of their origin, citizenship, or legal residency status, as well as all Nigerians residing abroad, and accordingly all such persons will be eligible to receive a NIN. (b) No person eligible for enrollment shall be prevented from obtaining a NIN due to an inability to produce a physical breeder document. 9 See https://id4d.worldbank.org/principles. Page 17 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) (c) No person eligible for enrollment shall be prevented from obtaining a NIN due to an incapacity to provide the required biographic or biometric data. (d) All NIMC services shall be equally accessible to all NIN holders. 35. All persons in Nigeria and all Nigerians abroad will be eligible to receive a NIN. According to the Strategic Roadmap, which was officially endorsed by the FGN on September 12, 2018, NIMC will “provide a lifetime, unique ID to every person on the soil of Nigeria, or of Nigerian origin, without discrimination, based on age, gender, tribe, religion, citizenship, income level, health status, etc.” or any other status. Additionally, the Strategic Roadmap notes that some groups with specific needs may require special measures to ensure their inclusion in the ID system, including “children (starting at birth), adult resident citizens, diaspora, foreign legal residents, refugees, internally displaced persons (IDPs), and undocumented people.”10 Through complete alignment with these government priorities, the project will ensure that the Nigerian foundational ID system does not exclude any group. This section describes the specific measures that will be taken to ensure this inclusivity. 36. Physical breeder documents will not be a prerequisite for enrollment. During enrollment, a licensed agent will collect biometric and biographic data corresponding to the attributes required for NIN issuance. Internationally, many different mechanisms are traditionally used to prove incoming identity data, including identity proofing against one or more physical breeder documents, such as a birth certificate or a trusted functional ID credential. Given the current state of development of ID in Nigeria, a large proportion of the population currently lack access to any physical breeder documents. To achieve the project’s inclusion objectives in the Nigerian context, NIMC will develop and implement nondocumentary identity proofing procedures that are adapted to the Nigerian context, providing the required trust for enrollment in the ID system while also ensuring inclusion of persons without access to documentary evidence of their identity. 37. Those who are unable to provide the required data will not be prevented from obtaining a NIN. The list of required fields for enrollment for a NIN will be minimal to maximize access to the system while also allowing NIMC to perform its core business of maintaining a register of the population and trust in the NIN credential. The collection of biometric data, in particular facial and fingerprint data, is critical to NIMC’s core business of identification and deduplication. However, there are some groups who may be unable to provide this required biometric data. There are documented difficulties in obtaining fingerprint data from certain groups such as manual laborers and the elderly, as well as some categories of persons with disabilities, including amputees, persons with physical disabilities, and those affected by leprosy. In addition, the algorithms used to ensure the quality standards for facial and iris photos do not always function as intended for some persons with disabilities, such as the visually impaired and those suffering from albinism. The system will include exceptional data capture and processing requirements for any such persons who are unable to provide the required biometric data in line with the objective of enrolling all eligible persons and issuing them with a NIN. These exception-handling mechanisms are detailed in Annex 2. 38. The entirety of NIMC’s service offering will be accessible to all NIN holders. NIMC will offer various services to the population in the context of its identity management mandate. Some examples of these services include ID and NIN issuance; identity management over the life cycle, including data updating; issuance and regulation of authenticators, including ID cards; and additional services such as 10 Strategic Roadmap. Page 18 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) stakeholder engagement and grievance redress. All such services will be fully accessible to all NIN holders. In particular, all NIN holders will be eligible to receive all physical and virtual authenticators offered by NIMC. 39. The enrollment process will be designed to be maximally inclusive. Whenever appropriate, the project will bring enrollment to the population—for example, by using mobile and offline-capable enrollment equipment—instead of requiring beneficiaries to travel to an enrollment center. The project will leverage agencies with contact with vulnerable populations (for example, the rural poor and IDPs) and develop identity validation mechanisms for individuals who are unable to provide breeder documents and exception handling for registrants unable to provide (sufficient quality) biometrics (for example, exceptions for individuals with disabilities). Figure 3. Stakeholder Roles: Mapping the Nigeria ID Ecosystem Source: World Bank. Note: NIBSS = Nigeria Inter-Bank Settlement System; MNOs = mobile network operators; NIS = Nigeria Immigration Service; NCC = Nigeria Communications Commission. 40. Registration for this foundational ID system will be conducted by various agencies using an ecosystem approach for enrollment (shown in figure 3). This model will integrate a pay-per-enrollment design which both offsets the costs of enrollment and incentivizes performance of ecosystem partners. Experience with this approach in India, where this model was instrumental to enrolling over a billion residents in just under five years, as well as the very large population in Nigeria suggest such an approach for the project. This model has the added advantage of building on previous efforts and existing investments in identification across the FGN rather than continuing to perpetuate fragmentation and duplication. The model allows for the new foundational ID database to use some data migrated from existing legacy databases, which have been deemed suitable for harmonization under a technical assessment conducted during project preparation. Because payments are only made based on successful enrollments that culminate in successful deduplication and NIN issuance, ecosystem partners are only paid when new persons are brought into the ID system. Page 19 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) 41. All persons enrolled in the foundational ID system will receive a basic physical authenticator at no cost. In many cases, the NIN alone, or a basic no-frills authenticator (such as a low-cost plastic card), may be sufficient for individuals to authenticate their identity when accessing a variety of public and private services. The project will finance the development of a national strategy for the issuance of physical authenticators, which will consider the different assurance levels and different types of authenticators required by different use cases and will also consider the possibility of making virtual or mobile-phone-based authenticators available to certain subsets of the population, to maximize access to and efficiency of the ecosystem of authenticators. 42. Data protection and user privacy are essential to the approach of this project for minimizing risks of unauthorized data disclosure. In addition to legal and regulatory mechanisms for protecting personal data and user privacy implemented under Component 1, the systems financed under Component 2 will reinforce these legal provisions by implementing “privacy by design” in the following ways: (a) Minimal data collection. The most secure data are data that are never collected. The foundational ID system will not collect data beyond the minimum required to achieve the objectives of uniquely identifying the population, facilitating access to services, and building the foundations of a digital economy. Standardized, secured enrollment software used by the entire ecosystem will prevent additional data from being collected. Standardized training for all enrollment agents will help ensure that data are collected appropriately. (b) Cybersecurity and information security. The security of the enrollment environment will be reinforced through secure enrollment software conforming to international best practices for data protection. Enrollment agents will be strongly authenticated, carefully monitored, and sanctioned — including revoking authorization — if they do not comply with standards for data integrity and security. Personal data will not be stored locally by the enrollment partners but will instead by transmitted directly to NIMC. Revised software will ensure that all data will be encrypted in transit and at rest during the enrollment process. Duplication of sensitive data will be minimized, with data stored centrally in secured data storage facilities. Cybersecurity of the ID ecosystem will be reinforced to protect personal data during enrollment and authentication. (c) Minimal data sharing and retention. The most securely shared data are data that are not shared. Authentication services that confirm a person’s identity without sharing personal data with service providers will replace, for most use cases, systems that seek to verify a person’s identity by sharing their personal data from a central server. In cases where data sharing is necessary, such sharing will be carried out locally. For example, data stored on a physical authenticator could be copied locally by a service provider, after obtaining consent from the individual, eliminating risks associated with online data sharing from a central server. If data sharing from a central server is justified, the system will safeguard privacy by limiting sharing to authorized parties and rigorously authenticating the recipients of such data before sharing occurs. (d) Fraud resistance. Accountability mechanisms to ensure compliance of the users and operators of the ID system, including enrollment agents, will be built into the design of the system. Extensive use of metadata collection will allow automated monitoring of system operators. The grievance redress mechanism (GRM), that is accessible to all, will allow further actionable feedback on field agents’ performance. Both will allow potential cases of noncompliance to be flagged and addressed as early as possible. Furthermore, requiring strong authentication for system field agents and other users will ensure that only authorized operators use the system, their compliance with data protection Page 20 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) standards can be effectively monitored, and authorization of noncompliant field agents can be definitively revoked. (e) User consent. The system will implement mechanisms for obtaining user consent for various operations involving personal data that are robust and appropriate to the Nigerian context, where individuals’ comprehension of and ability to use traditional consent mechanisms may be limited. (f) Privacy by default. All of the abovementioned privacy measures will be applied to all registrants and NIN holders by default, without the need for system users to take any action or opt in to any provisions. (g) Randomness of the NIN. The NIN is a random number generated centrally by NIMC, rather than a logical number which might inadvertently give away someone’s personal data (for example, gender or year of birth in logical structures where these form part of the number). (h) Logical separation of data such that, for example, biometric data cannot be linked directly to biographic data. This will entail the maintenance of separate databases for biographic and biometric data and strict access controls. (i) Tamper-proof audit mechanisms, including encrypted metadata from enrollments and a third- party monitoring system, will allow effective monitoring of the enrollment environment and control of data quality. (j) Multifactor and role-based access control mechanisms for NIMC staff to ensure that only the appropriate persons have access to only the data that concerns their specific role. (k) Other privacy protection mechanisms that may enhance data protection and privacy of registrants and NIN holders are detailed in the following paragraphs, including in annex 2. 43. To ensure sustainability, the project will lay the foundations for continuous enrollment into the foundational ID system from birth by linking to the CR system and incentivizing investment in ongoing biometric enrollment by ecosystem partners. These links will facilitate assignment of NINs at birth and lay the groundwork for full integration and interoperability between the NIMS and a digitized civil registry during a potential second phase of the project. The project will also invest in the digital enrollment ecosystem to ensure that enrollment partners invest in digital infrastructure and enrollment mechanisms that can facilitate ongoing biometric enrollment after project closure. 44. Component 2 comprises the following subcomponents and activities: (i) Subcomponent 2.1: Reinforcing the NIMS. This subcomponent will reinforce deduplication capacity at NIMC, back-end systems, telecommunications links, and human resources, as well as the development of specifications for key systems. (ii) Subcomponent 2.2: Reinforcing the foundational ID ecosystem. This subcomponent will support the foundational ID system’s capacity to deliver NINs at birth as part of the birth registration process through links with a digitized CR. It will finance a capacity assessment and institutional mapping of NPopC, the creation of a national CR database with interoperability with the NIMS, the development of new mechanisms for continuous digital birth registration with NIN generation, the development of mechanisms for continuous capture of biometric data for young adults, and a strategy to build NPopC’s capacity to manage a digitized CR system. Page 21 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) (iii) Subcomponent 2.3: Development of the enrollment system. An ecosystem enrollment model entails new risks for data protection and security. To mitigate these risks, the project will review and revise data standards and enrollment procedures, enrollment software, and standards for enrollment hardware. A system for monitoring and verifying enrollments will also be put in place. An assurance framework will be developed to license and onboard enrollment partners. (iv) Subcomponent 2.4: Reinforcing information security and privacy. To strengthen the safeguarding of private data and ID systems, activities to provide the necessary information security and cybersecurity will be supported under the project. Security at the back end will be bolstered to appropriately protect the integrity of the database and personal data against breaches, attacks, and human/physical vulnerabilities. The project will establish information security and cybersecurity compliance standards, conduct privacy audits and information technology (IT) security audits and maintain certifications, reinforce cybersecurity capacity and establish a National Identification Sectorial Computer Emergency Response Team (ID- CERT) with a Security Operations Center (ID-SOC), reinforce Public Key Infrastructure (PKI) for ID, and provide capacity building on information security. (v) Subcomponent 2.5: Registration of the population. The project will aim to issue a NIN to every adult in Nigeria, as well as some children and youth,11 and facilitate NIN issuance to Nigerians abroad through consulates. It will also begin to register children for NINs at birth, once links to NPopC have been established. This will entail support for continued harmonization of legacy data from functional registries, mapping and identifying special needs areas and/or populations, and developing mobile and offline enrollment systems. A business model will be developed defining the financing model for the enrollment ecosystem. (vi) Subcomponent 2.6: Training of ecosystem partners and their enrollment staff. Training of enrollment staff will develop specific technical and social skills that are essential to maximize inclusion, uniformity, security, and performance of the ID ecosystem. Training will be based on the standard operating procedures (SOPs), with a training manual revised to improve quality and mitigate social risks. The project will also take advantage of this training opportunity to close basic digital skills gaps of trainees and promote wider adoption of digital technologies across Nigeria. Component 3: Enabling Access to Services through IDs (US$66 million equivalent, of which US$12 IDA, US$17 AFD, US$37 EIB) 45. This component will support integration between public and private sector services and the foundational ID system to facilitate access to services. To incentivize the uptake of NINs and amplify their development impact, this component will identify key services that can benefit most from the foundational ID and reliable identity authentication of individuals at the point of service or transaction. Potential service sectors under this component include financial inclusion (strengthening know your customer [KYC] for bank accounts and access to credit and insurance), health and social protection programs (which require ID to verify beneficiaries), education (where a birth certificate is often an admission requirement), and mobile communications (for SIM card registration). Data from the latest ID4D-Findex survey indicate that in Nigeria, mobile and financial services are key ID use cases, with 34 percent and 31 percent of current ID holders, respectively, reporting using their ID to access these 11 The potential Phase II of the project will have a target of near universal enrollment of children and youth for NINs. Page 22 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) services. At the same time, there is considerable opportunity to expand financial inclusion, as over 60 percent of Nigerians (and 72 percent of women) ages 15 and above do not have a bank or mobile money account. This component will thus seek to facilitate features such as eKYC12 to improve people’s access to these services through their NIN. To protect the privacy of individuals, data required for eKYC will only be shared proportionally and with user consent. In addition, when asked to provide a NIN for authentication to access a service or perform a transaction, an online/mobile-based tool could generate temporary ID numbers—an ID ‘token’—derived from the person’s NIN to be used instead (similar to the Virtual ID for the Aadhaar number in India). 46. Component 3 will comprise the following subcomponents and activities: (i) Subcomponent 3.1: Developing authentication services at NIMC. NIMC will strengthen and upgrade authentication services to be used by service providers to improve service delivery. NIMC will pivot away from its current verification services to authentication services that do not involve sharing personal data for most use cases. NIMC may continue to share data with service providers in cases where benefits outweigh the risks, but this process will be strengthened to improve data protection. Multiple complementary authentication services could be implemented to maximize access without compromising security of higher-risk transactions. A study on the demand for authentication services will inform a strategy for the development of authentication services in line with identified priorities. Back-end systems for authentication will also be upgraded. Specifications for authenticators will be developed and a basic authenticator will be produced and distributed to all adults. Systems will also be put in place to support production of advanced authenticators by NIMC. The project will support key partners, particularly those in the public sector with low capacity, to meet standards for information security (including cybersecurity), privacy, and data protection as defined for the ID ecosystem and enable these partners to fulfil their roles. (ii) Subcomponent 3.2: Developing authentication services within the ecosystem. To complement NIMC-issued authenticators, the project will support the creation of a federation of providers of authentication services based on the NIN. A framework will be created under which public and private entities, including but not limited to partners in the enrollment ecosystem, could partner with NIMC to issue derived identities, identified using the NIN, for authentication. There will be a consultative process conducted with all stakeholders to develop a trust framework governing the ID ecosystem in Nigeria. The trust framework will define the modalities for the issuance of derived identities, including identity assurance and links to NIN; functioning of authentication services, including authentication assurance; and rules for data sharing and data protection. Technical assistance could be provided to develop rules for interoperability, including any rules for pseudonymization of NINs during authentication and seeding of functional databases. (iii) Subcomponent 3.3: Facilitating service delivery using foundational ID. The project will provide technical assistance for the rollout of NIMC authentication services to the broader ecosystem, including supporting information security of the authentication ecosystem. It will identify priority services for linking with the foundational ID, with an emphasis on pro-poor public services. An authentication management business unit will be created within NIMC. 12 Electronic Know Your Customer (eKYC) is a remote, paperless process to identify and verify a customer’s identity. Page 23 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) Component 4: Project management and stakeholder engagement (US$41 million equivalent, of which US$41 IDA, US$0 AFD, US$0 EIB) 47. Component 4 comprises the following subcomponents and activities: Subcomponent 4.1 will correspond to project management and stakeholder engagement in the ECSU and comprises the following activities: (i) M&E. The project will support the development and implementation of a comprehensive M&E system in the ECSU. Information systems, development of an M&E framework, system, and tools will be financed. (ii) Communications and awareness raising. A robust communications strategy will be developed to address the existing trust issues and to clearly explain how the new enrollment model will improve on past performance. Communications outside the ecosystem and awareness raising with the general public to ensure clear understanding of the streamlined ID registration process will be supported. (iii) Support for stakeholder engagement and social accountability. In consultation with the PIU, a comprehensive stakeholder engagement strategy and national consultation mechanism will be developed. Appropriate social accountability mechanisms (for example, third-party monitoring, civil society platforms, and so on) will be defined and implemented. (iv) Project implementation personnel and operating costs. This will finance salaries of a limited number of dedicated personnel and other operating costs for the ECSU to enable reliable project implementation and effective coordination. Subcomponent 4.2 will correspond to project management and stakeholder engagement in the PIU and comprises the following activities: (i) M&E. Information systems, development of an M&E framework, system, and tools, and an impact evaluation (IE) will be financed. The IE will be carried out with technical support from the World Bank. It will include multiple data collection at different stages of project implementation, which may include  A baseline study to capture the current picture of foundational ID registration as performed by NIMC and the ‘before’ picture before scaled-up implementation under the project;  Surveys/studies to test the most effective and efficient maximization of registration coverage and validate strategies for enrollment effectiveness; and  Surveys/studies to understand the development impact of foundational ID enrollment and subsequent access to services. The World Bank will work closely with the NIMC PIU throughout the project implementation period to quickly respond to operational priorities and constraints as they evolve. (ii) Support for grievance redress. A comprehensive GRM will be implemented through NIMC’s existing Customer Care Department to collect and respond to issues encountered by beneficiaries, ecosystem partners, and other stakeholders. Page 24 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) (iii) Communications and change management. A robust internal communications strategy will be developed to support communications and coordination within the ecosystem of implementing partners. The project will also support the development and implementation of a comprehensive change management strategy to ease the transition for all stakeholders of the foundational ID system, including NIMC. (iv) Project implementation personnel and operating costs. This will finance salaries of a limited number of dedicated personnel and other operating costs for the PIU to enable reliable project implementation and effective coordination. 48. Project costs and financing. The Strategic Roadmap, as adopted by the FGN, is costed at US$433 million, of which US$430 million is being provided by the project. The project is co-financed by IDA, AFD, and the EIB (US$115 million equivalent, US$100 million and US$215 million, respectively). The cost breakdowns between the co-financing partners will be provided for in the Financing Agreement (FA) and disbursement arrangements. The FA will include a provision that will allow the IDA credit to disburse once the IDA conditions are met irrespective of the co-financers’ ability to disburse. For more on conditions see annex 4. Table 1. Project Components and Costs Project Cost Project Components (US$, millions) Component 1. Strengthening the legal and institutional framework 17 1.1 Legislation, regulation, strategy, and policy development supporting data protection and 9 privacy 1.2 Institutional and governance framework 3 1.3 Institutional capacity building and technical assistance 5 Component 2. Establishing a robust and inclusive foundational ID system 306 2.1 Reinforcing the NIMS 90 2.2 Reinforcing the foundational ID ecosystem 40 2.3 Development of the enrollment systems 3 2.4 Reinforcing information security and privacy 23 2.5 Registration of the population 148 2.6 Training of ecosystem partners and their enrollment staff 2 Component 3. Enabling access to services through IDs 66 3.1 Developing authentication services at NIMC 45 3.2 Developing authentication services within the ecosystem 2 3.3 Facilitating service delivery using foundational ID 19 Component 4. Project management and stakeholder engagement 41 Page 25 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) Project Cost Project Components (US$, millions) 4.1 Project management and stakeholder engagement in the ECSU 8 4.2 Project management and stakeholder engagement in the PIU 33 Total Project Costs 430 Total Financing Required 430 C. Project Beneficiaries 49. By 2024, the project aims to increase coverage of the national ID in Nigeria to 148 million persons. This figure corresponds to 65 percent of the total 2024 population of Nigeria and will expand coverage to 91 million adults (80 percent) as well as 57 million children (50 percent). All persons present in Nigeria, regardless of their nationality or immigration status, as well as all Nigerians abroad, will be eligible to register for the national IDs provided under the project. In addition to receiving a national ID, project beneficiaries will also benefit from ID authentication, facilitating their access to services. Page 26 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) D. Results Chain Figure 4. Results Chain Page 27 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) E. Rationale for World Bank Involvement and Role of Partners 50. There is a clear rationale for public sector provision of foundational ID systems to ensure universal coverage, accountability, and effective functioning of government. Critically, provision of government-recognized IDs targets universal access—something profit-maximizing firms may not have the right incentives to achieve. Moreover, public provision often comes hand in hand with a higher level of system accountability, particularly because commercial interests may conflict with the need to ensure data security, protection, privacy and use limitation. Finally, public provisioning of a well-functioning foundational ID system allows for more efficient government service delivery (through improved tax collection and the reduction of leakages and fraud, for instance) and strengthens national security. However, it is important to note that public provisioning does not preclude partnership with the private sector: it is often advantageous to leverage competition and innovation in the market to partner on specific tasks, where needed, to ensure robustness, maximize efficiency, or drive down price (for example, in the enrollment process). 51. The World Bank presents significant value added to this ID4D engagement beyond the provision of financing. The World Bank can help convene cross-sectoral dialogue on ID systems—spanning ministries of health, interior, finance, immigration, rural development, and energy—and foster the cooperation of all requisite stakeholders. For instance, the proposed health pilot enrolling new mothers and their children into the ID system is made possible through a parallel World Bank engagement supporting a maternal and child health project developed by the World Bank’s Health, Nutrition, and Population team in partnership with the Global Financing Facility. Finally, the World Bank has developed substantial in-house technical expertise, analytics, and operational guidance specific to the rollout of robust, sustainable, and inclusive foundational ID systems through the ID4D Initiative. This expertise stems from a careful evaluation of lessons learned from numerous international case studies, as well as the regular convening of subject matter experts on critical focus areas such as technical standards, costs, and technologies. 52. The World Bank is a long-term development partner and can thus work with the FGN and other donors to map a multiphase program for digital development based on a foundational ID system. The project will build the basis of a robust foundational ID system which enables access to select key services. The AFD and EIB have committed to provide US$100 million and US$215 million, respectively, toward this project to help meet the full US$430 million need outlined in the Strategic Roadmap. The World Bank is also coordinating with the United Nations High Commissioner for Refugees (UNHCR) and International Organization for Migration on refugee, internal displacement, nationality, and migration issues in the region, to ensure that the newly developed ID system meets the needs of such marginalized populations (particularly in northern areas), as well as with UNICEF to leverage its expertise in reaching vulnerable populations to register births. Furthermore, a potential Phase II of the project is envisaged, for which the EIB has committed to contributing the euro equivalent of US$60 million in co-financing. This additional investment would support mechanisms for enabling continuous digital enrollment, including the full digitization of the CR system and ensuring that NINs are assigned at the time of birth registration, as well as provide additional financing for the development of value-added digital services such as digital certificates, links to the foundational ID system for additional services using the NIN, and strengthened cybersecurity. A long-term Stakeholder Engagement Plan will facilitate consultations with donors and key national and regional stakeholders throughout the engagement with the FGN. Page 28 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) F. Lessons Learned and Reflected in the Project Design 53. This project draws on lessons learned from other ID projects and the wealth of analytical and global convening work on identification by the World Bank’s ID4D Initiative. (a) Foundational identification should be accessible to all residents, regardless of nationality or legal status, and should provide identification based only on a minimal set of attributes (for example, name, gender, and date of birth), rather than attempt to serve as proof of eligibility for services or programs (for example, by collecting data on income, disability, and so on). A foundational ID system that attempts to centrally collect and manage all data needed to determine eligibility for multiple public services (for example, for health, education, and social protection) can be detrimental to privacy and data protection and would require an onerous and lengthy registration process, which poses a barrier to achieving universal coverage. Instead, different services and sectors can leverage the foundational ID system for authentication and verification of basic personal data and collect additional data, as needed, to fulfill their particular mandate or purpose. (b) A robust legal and regulatory framework underpinning an ID system is a critical enabler for success. Such frameworks provide clear institutional mandates to identify the roles of various stakeholders in fragmented systems, as well as institute laws which protect data (for instance, through use of purpose specification) and individual privacy. (c) Universal resident ID systems should enable unique identification from birth to death, with strong links to a robust CR system. Being able to uniquely identify a person, often enabled by biometric technology, helps minimize fraud and leakages in service delivery by facilitating the elimination of duplicate and ghost beneficiaries. Authentication (1:1 matching to a registered identity) at the time of service delivery, including for government-to-persons (G2P) payments, can curb double dipping and diversion to ineligible individuals. (d) The implementation of ID systems is more likely to be successful when it is accompanied by high- level political commitment and there is a powerful ‘champion’ to the cause. Given the multisector impact and expected utilization of foundational ID systems, high-level support is needed to coordinate cross-ministerial engagement and develop a synthesized national strategy or action plan. Such coordinated efforts are critical for harmonizing a fragmented ecosystem plagued with duplicative or one-off efforts by various individual ministries. (e) The most significant costs associated with ID systems arise from the issuance of sophisticated authenticators (for example, a smart card) and the large number of full-time staff hired, particularly for the initial (mass) enrollment of the population. Thus, digital ID systems could, under certain conditions, benefit from an ecosystem-based approach to enrolling populations to leverage existing capacity and establish a foundational registry containing minimal biographic and biometric data, which is used as a basis for issuing a unique ID number. Providing a basic, no-frills authenticator can be sufficient to verify beneficiaries’ identity to access many services, while services and transactions requiring a higher level of identity assurance can make use of remote, biometric authentication against the foundational registry. 54. Implementation of this project is expected to yield lessons for future investments in Nigeria’s digital economy. The implementation of a large-scale, digital ID system can provide valuable lessons for operations going forward, such as those aiming to develop additional digital platforms, support the implementation of digital payments, and set up digital service portals (for example, for eHealth, taxation, or credit assessment), including strategies to reach the most vulnerable populations. Developing initial links Page 29 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) with the birth registration system managed by NPopC will likely provide additional insights about the digital investments required to fully modernize the CR system. Finally, the piloting of the ‘enrollment ecosystem’ approach, which involves leveraging various public and private agencies toward one shared objective, will also be extremely informative for future government programs which involve mass mobilization to reach the population, for example, for immunization or other similar efforts. III. IMPLEMENTATION ARRANGEMENTS A. Institutional and Implementation Arrangements Figure 5. Institutional Arrangements of the Proposed Project Source: World Bank. 55. National implementation will be carried out in partnership with the NIMC PIU and the ECSU. A lean coordination team (the ECSU) will be established in a location to be designated by the Project Ecosystem Steering Committee (PESC) within 60 days after effectiveness, while the PIU will be embedded Page 30 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) in NIMC to build institutional capacity and ensure sustainability. The additional coordination layer in the ECSU is critical to maintaining strategic alignment, given the decentralized ecosystem approach detailed in the Strategic Roadmap and the currently fragmented nature of the ID landscape. The project will also rely on the ID4D PESC to be established prior to effectiveness of the project, to ensure high-level cross- sectoral ownership of the project. Further details on institutional arrangements can be found in annex 1. 56. The detailed roles and responsibilities of the PESC, the ECSU, the PIU, and the operational details of the coordination mechanisms between them will be outlined in the Project Implementation Manual (PIM), which will be developed no later than ninety days after this project becomes effective. B. Results Monitoring and Evaluation Arrangements 57. Progress toward the achievement of the PDO will be measured based on the PDO-level and intermediate results indicators as part of the project’s Results Framework (see section VI). Relevant data and information pertaining to measuring results, including project outcomes and quality of project execution, will be collected. Different aspects of the M&E system will be managed by the different implementing institutions, as detailed in annex 1. The World Bank team will conduct an annual evaluation to review the progress against results indicators, based on data supplied by the relevant data collection and reporting bodies. In addition to the PDO-level and intermediate results indicators tracked formally in the Results Framework, additional indicators relevant to project implementation will be tracked as well to allow for real-time course correction in implementation. These will include granular indicators linked to coverage of specific geographical zones and specific groups, for example, IDPs. Mechanisms for collecting, reporting, and using project data, including roles and responsibilities of relevant actors, will be detailed in the project’s M&E plan. 58. The NIMC PIU and the ECSU will each be responsible for aspects of M&E concerning implementation of activities falling under their purview. In particular, the PIU will manage M&E of enhancements to the NIMS and progress on NIN generation, while the ECSU will manage M&E of communication with the general public as well as implementation of Component 1. Both the PIU and ECSU will be responsible for developing an M&E system, to be described in detail in the project M&E plan, specifying standard protocols and developing guidelines for data collection and use for the duration of the project, as well as organizing trainings for relevant stakeholders of the M&E system. 59. Both the PIU and ECSU will prepare regular reports on project implementation, which will be submitted to both the PESC and the World Bank. Each unit will provide quarterly monitoring tables and progress reports on all PDO- and intermediate-level results indicators, as well as any additional indicators specified in their respective M&E plans, to the World Bank during routine implementation support missions, in addition to the reports they submit to the PESC (see section VI). 60. The project M&E will make use of multiple data sources implementing multiple types of data collection tools. The main project PDO indicator, which tracks the number of NINs successfully issued, will be monitored digitally with the aid of a tamper-resistant monitoring platform that is accessible by multiple stakeholders, allowing reliable tracking of enrollment outcomes while protecting the personal data of enrollees. In addition, the PIU and ECSU could make use of tools such as enrollment geotagging, poverty maps, geospatial data, and remote sensing data, as appropriate, to monitor the progress of mass registration. Such tools can help monitor the appropriateness of prevailing incentives for the ecosystem to reach various target populations, thereby helping inform adjustments to these incentives during Page 31 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) implementation, or helping identify hard-to-reach zones for targeted enrollment operations. Additionally, systematically collating registration data from remote/rural areas and urban areas can provide insight into the level of coverage, inclusion, and access, especially in poor regions and along borders. C. Sustainability 61. The NIMC system financed under this project is only the beginning of the set up of an improved foundational ID ecosystem in Nigeria, which will be expanded and made more robust through links with a digitized civil registry in a potential Phase II. This collaboration between NIMC and NPopC will result in a comprehensive foundational ID system that addresses the needs of all stakeholders of the ID system and fully corresponds to SDG 16.9, providing “legal identity for all, including birth registration” by 2030, as well as many other targets such as those related to ending poverty, gender equality and the empowerment of women and girls, and safe and orderly migration. 62. The project will finance the development of a business model for ongoing running costs, including continued enrollments and data updating, and authenticator issuance to ensure sustainability. Making cost-effective design choices and developing relevant revenue streams, where possible (through charging for advanced authenticators and/or authentication services), will be critical for the long-term sustainability of the foundational ID system. At the same time, the business model will need to ensure that any such revenue streams do not act as a barrier to accessing the system, either for individuals who wish to enroll or for service providers who wish to link their databases to the foundational ID system. Given Nigeria’s large population, there is potential for considerable revenue generation from even a nominal fee for NIMC’s services. Details on the business model can be found in annex 2. 63. The project will further support sustainability through the creation of a robust legal institutional and governance framework and the training of government officials. Ensuring that all stakeholders have clear mandates and clearly outlined responsibilities with regard to their role in the design and implementation of the foundational ID system is critical for the effective long-term functioning of the system. The governance of key aspects of the foundational ID system, including supporting institutions such as those governing data protection, PKI, and cybersecurity, will be clarified through Component 1. 64. The project will stimulate demand for IDs based on access to services and vice versa to ensure that the system provides continued value to individuals, the FGN, and public and private service providers. When access to services or social grants is tied to having a government-issued ID, demand for that ID will grow and foster rapid take-up. However, it may not be feasible to restrict access to certain services or transactions to those with an ID as this can result in exclusion when only a small fraction of the population has managed to obtain an ID. It is important to phase the linking of service provision to the ID to create incentives that do not prevent the most vulnerable from getting the services they need. Once there is a critical mass of ID holders, this will increase demand from service providers to use the IDs to authenticate their customers and beneficiaries. 65. The project will leverage additional complementary sources of financing to complement the present financing envelope in the medium term. The current operation is conceived as Phase I of a possible two-phase engagement. The EIB has already committed financing to Phase II to build on initial investments, providing for advanced ID-related services, in preparation of mutual recognition of Nigerian IDs through international trust frameworks, and providing for continuous digital enrollment, including through a modernization of the CR system. Each additional investment will further entrench the Page 32 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) foundational ID system as indispensable for developing a vibrant, inclusive, and safe digital economy in Nigeria. 66. The project will liaise with the World Bank’s broad portfolio of sectoral engagements to ensure that the NIN is mainstreamed into service provision across sectors in Nigeria. This includes the World Bank Group initiatives with the financial sector on regulation and financial inclusion to ensure that NIMC’s services are relevant for the financial sector moving forward and integration with the bank verification number (BVN) is accomplished. It also includes sectoral engagements in the social protection, health, and education sectors to ensure that the NIN is used when appropriate in these sectoral projects and to explore the possibility of these sectors participating in the ID enrollment ecosystem. In the social protection sector, the World Bank currently supports the National Social Safety Nets Project (NASSP) (P151488) which delivers targeted cash transfers to poor and vulnerable households across Nigeria through an electronic payments system using mobile wallets and payment agents. NASSP is building a National Social Registry of poor and vulnerable households to include the NINs of every individual in the registry.13 The payment services providers engaged under NASSP are natural enrollment partners in the ecosystem approach. The National Social Investments Office has also expressed interest in supporting enrollment in the NIN for other programs such as the school feeding program. Additionally, the World Bank-supported Basic Health Care Provision Fund has also expressed interest in becoming one of the first enrollment partners in the ecosystem. As the quality and quantity of public services improve in Nigeria due to sectoral investments and as these sectors come to rely increasingly on the foundational ID system, the sustainability of the present project will be further assured. 67. The fiscal savings generated by the foundational ID system are expected to exceed the cost of the initial investment required for mass registration as well as the system’s annua l operating costs in the long term. Recent analyses of ID system costs suggest that steady-state costs of foundational ID systems tend to be between US$0.10 and US$2.00 per head per year, with countries with larger populations and leaner institutional arrangements for ID administration toward the lower end of that scale. Based on the size of the G2P payments in Nigeria, the ID system will need to generate savings from eliminating leakages, diversions, and corrupt payments to ghost recipients equal to less than 5 percent of the total value of these payments to cover the initial enrollment costs and likely less than 1 percent to cover annual operating expenditures. Committing some of the surplus generated from the fiscal savings to the continued operation of the ID system should thus be sufficient to sustain the foundational. 68. While the project will finance the cost of necessary reforms, operating costs associated with the new system will, as much as possible, be built into NIMC’s normal operating budget. The project will partially finance operational expenses incurred by NIMC during the course of the project. 69. NIMC offices, other public entities, and the ecosystem can all be leveraged for continuous enrollment once the system reaches its steady state. This diverse set of touch points will also help ensure that the ID system is accessible for regular data updates, as may be required. Although the number of enrollment agents and enrollment points is likely to decrease once the majority of the population has been registered in the system, many ecosystem participants will have continued incentives to maintain enrollment terminals as long as they are usable in the framework of NIMC’s authentication and other ID- related services. Offering data updating and other identification-related services as a ‘one-stop-shop’ may 13The NASSP Results Framework includes an indicator for 20 percent of individuals in the National Social Registry to have a NIN by 2022. Page 33 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) help certain providers attract new customers and retain existing ones, providing a business case for continued ecosystem participation. IV. PROJECT APPRAISAL SUMMARY A. Technical, Economic and Financial Analysis 70. This section discusses (a) the rationale for the selected design; (b) the project’s expected impact on Nigeria’s socioeconomic development; (c) the rationale for public sector financing; and (d) the value added of World Bank support. 71. The technical design of the project is based on an extensive Technical Assessment. The Technical Assessment reviewed the technical aspects of the identity landscape in Nigeria to pinpoint bottlenecks in the existing ID ecosystem. The preparation of this Assessment was based on extensive in-country consultations with the Government and identity stakeholders, desk research, and technical missions over a four-month period in 2018. Apart from the foundational ID system implemented by NIMC, the Assessment studied selected other programs serving the functional ID needs of government agencies. Various ID services offered by government and nongovernment agencies were reviewed, including their coverage, use of demographic and biometric data, and technology infrastructure. The Assessment also looked at the status of harmonization of various ID programs with NIMC and the possibilities of migrating legacy data from these ID systems into the new NIMC system. The Assessment provides an overview of the existing front- and back-end IT systems, as well as procedures for enrollment, NIN issuance, and card issuance at NIMC. Enrollment, grievance redress, and communications activities were also evaluated. All the existing systems were evaluated against international technical standards14 related to ID, privacy, and data security. The recommendations made in the Assessment directly informed the design of the project and are in line with the FGN’s needs and the stated aims of the approved Strategic Roadmap. B. Development Impact Fiscal Savings 72. A robust foundational ID system has the potential to generate significant savings for the FGN. There are a variety of features and channels through which the core features of modern digital ID systems (digitization of databases and credentials, the creation of unique identities, greater integration and interoperability between systems, and digital authentication mechanisms) can decrease expenditures, generate fiscal benefits, and even increase public revenue. International experience, as described in a 2018 World Bank report, suggests that robust ID systems can generate public savings to the tune of millions of dollars per year (or even billions for larger economies) by reducing the number of ghosts, duplicates, and ineligible beneficiaries in public programs; eliminating redundant systems; and cutting transaction costs. For example, Pakistan saved close to US$250 million in the context of a single cash transfer program, aimed at households affected by severe floods. Each prospective beneficiary was asked to provide its unique ID number, which was then used to check for duplicate registrations and verify whether the applicants’ registered address was in a flood-affected area. The use of the ID enabled 14See the World Bank ID4D’s Catalog of Technical Standards for Digital Identification Systems available at http://id4d.worldbank.org/technical-standards. Page 34 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) authorities to eliminate about 40 percent of the initial 2.7 million applications as people were found to be ineligible or were duplicate family members. 73. The scope for public savings is particularly great when a universally held unique identifier is integrated across multiple registries to allow for cross-checking of records to determine eligibility. One of the earliest well-documented cases for savings through this mechanism comes from Argentina, where linking records across 34 program databases at the federal, provincial, and local levels through a unique national ID number revealed inclusion errors in eligibility of various social programs and led to a reduction in spending of US$143 million over an eight-year period. In addition, the Government estimated that the integrated digital ID platform saved over US$160 million simply by removing deceased individuals from social benefits registries in 2013 alone. Combining these two relatively conservative estimates yields a combined savings in G2P programs of some US$303 million, which is roughly eight times the US$38 million in World Bank funds used to implement the project. In a similar manner, Thailand eliminated 660,000 out of 8.4 million applicants from a cash transfer program aimed at low-income individuals based on cross- checking databases using registrants’ unique ID number, generating savings of US$30–US$60 million. To ensure that the process of cross-checking records does not result in unauthorized access or use of personal data, the Data Protection Bill provides a series of measures to ensure that personal data are processed in a manner that ensures appropriate security of the data, including protection against unauthorized or unlawful processing and access and against loss, destruction, or damage. These protection obligations cover all kinds of security arrangements from administrative measures to physical and technical measures. Additional provisions include the restriction of unauthorized and unlawful processing, data protection impact assessments, and the prevention of interference with rights and fundamental freedom. The enactment of a legal and regulatory framework and establishment of a data protection authority will support the protection of these rights. 74. Previous experience with smaller-scale functional biometric ID systems in Nigeria indicates that such systems can generate significant economic benefits by combating fraud and minimizing the diversion of public resources. Beginning in 2007, Nigeria implemented an Integrated Payroll and Personnel Information System (IPPIS) for its civil servants, which biometrically enrolled employees in a limited number of federal agencies. Through registration and deduplication, this process uncovered approximately 60,000 fictitious employees (some 20 percent of these agencies’ payrolls), reportedly saving the Government US$1.12 billion over a seven-year period between 2007 and 2014.15 Nigeria’s 2018 budget shows the equivalent of US$5.8 billion in expenditures committed to personnel costs and US$970 million for pensions; even if the introduction of the foundational digital ID leads to only a 5 percent reduction in expenditures due to reduced leakages and reduced number of ghost and ineligible beneficiaries, it would mean US$340 million in public savings per year. Thus, integrating the unique, foundational ID with the registries of other programs and agencies delivering G2P payments could potentially generate billions of dollars of savings over the course of the next decade, from reduced fraud and improved targeting of beneficiaries. 75. Costs can also be reduced if government programs can rely on foundational ID infrastructure which includes a single biometric registry rather than having to set up parallel functional ID systems with biometrics to meet their needs. The Nigerian ID landscape is currently characterized by a high level of fragmentation. Multiple functional registries have been created in recent years, many of them 15 World Bank. 2018. Public Sector Savings and Revenue from Identification Systems: Opportunities and Constraints. Washington, DC: World Bank Group. Page 35 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) containing biometric data, due to a lack of a robust ID system with national reach. Nigeria is estimated to have spent over US$3 billion on functional biometric ID systems over the last decade. For example, the banking sector created the biometric BVN database when it was unable to meet anti-money laundering’ countering financing of terrorism (AML/CFT) obligations to identify their customers using existing IDs. Over US$14 million was reportedly spent by the banks to purchase 10,000 biometric registration kits alone, with additional costs incurred for the set-up and maintenance of the registry, the deduplication of registrants, and the issuance of BVN cards. Another important area of fiscal savings would be the elimination of costly periodic biometric voter registration exercises and the issuance of voter ID cards, which has been common practice in the past in the absence of a reliable foundational ID system. In 2015, Nigeria reportedly spent NGN 120 billion (US$627 million) on its elections, with an estimated US$200 million spent on biometric voter registration and card issuance.16 The cost savings from reducing these duplicate investments can be very large. For example, since 1999, South Africa has leveraged its national ID database to generate the voter rolls ahead of each election instead of conducting a new voter registration exercise each time. This has contributed to a reduction in election costs from US$170 million to US$32 million between 1999 and 2009.17 76. ID systems can also help raise additional revenue by improving tax collection. Nigeria’s tax-to- gross domestic product ratio is currently at 6.1 percent, among the lowest in the world. Only 14 million out of Nigeria’s estimated 70 million economically active residents pay taxes and tax evasion is a significant concern. A unique population register can help identify the total base of potential taxpayers and using a unique identifier across multiple registries (for example, land records, vehicle registers, and customs databases) can help identify individuals and businesses who are underreporting their earnings. In Argentina, linking the tax database with other registers is estimated to have generated US$44 million between 1999 and 2007. Similarly, Pakistan’s National Database and Registration Authority identified 2.4 million wealthy individuals who were not filing taxes by querying multiple databases with records linked through users’ unique ID number. Social and Economic Returns 77. The proposed ID system is also expected to boost financial inclusion, generating significant economic and social returns. The lack of a robust proof of identity makes it difficult for millions of people to fulfill KYC and AML requirements or establish reliable credit histories. The 2017 Global Findex survey shows that 60 percent of Nigerian adults, or over 60 million people, do not have access to a bank account. Identification is a significant barrier: one in five Nigerians without a bank account cited lack of documentation as a reason for not having one. Providing a robust, verifiable proof of identity to all Nigerian residents could thus help close the financial inclusion gap. Based on these data, providing a robust and unique ID for all could directly help more than 11 million Nigerians open their first bank account, expanding economic opportunities and supporting livelihoods. 78. The social and economic benefits from identification may be particularly great for women. The 2017 ID4D-Findex survey found that there is a 20-percentage-point gap in ID coverage between men and women in Nigeria, mirroring a 24-percentage-point gap between men and women in financial account ownership. Lack of identification can hamper women’s full participation in economic and social life. 16 Gelb, A., and A. Diofasi. 2016. “Biometric Elections in Poor Countries: Wasteful or a Worthwhile Investment?” Working Paper 435, Center for Global Development, World Bank, Washington, DC. 17 World Bank. 2018. Public Sector Savings and Revenue from Identification Systems: Opportunities and Constraints . Washington, DC: World Bank Group. Page 36 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) Providing all women in Nigeria with a unique and verifiable digital ID could become an enabler for women’s empowerment across several fronts. In Pakistan, for example, the biometric authentication capability of the national ID system was leveraged to ensure that cash transfers were directly reaching low-income female beneficiaries rather than their husbands or brothers, as had been common under the previous system.18 A proof of identity is also critical for securing equitable access to and control over economic resources such as land, property, and inheritance, which is critical for supporting women’s livelihoods and economic opportunities. 79. Identification also plays an important role in creating access to employment opportunities by allowing people to gain qualifications that are widely recognized as genuine. Identity fraud related to examinations is a significant problem in Nigeria. In the absence of a robust ID system, the West African Examinations Council began issuing its own ID cards for students to track candidates for national examinations. A unique and widely held foundational ID could eliminate the need for the separate registration of students and increase trust in Nigerian certifications and diplomas. The integrity of the certification system may be further improved if recognized educational institutions can digitally certify and share qualifications and exam results linked to the individual’s unique ID number. 80. Digital ID systems can also boost private sector growth by increasing efficiency and reducing risk. Trusted identity authentication mechanisms can decrease onboarding and other administrative costs for private companies, creating significant savings and enabling more affordable service provision. For example, India’s Aadhaar system reportedly enabled the reduction of the average firms’ onboarding cost from around INR 1,500, or US$23, to approximately US$0.15 by allowing third parties to authenticate the identity of users and (in select cases) remotely and securely verify a limited set of attributes. In a similar vein, robust ID systems and authentication mechanisms can reduce compliance costs, such as those arising from domestic and international KYC and AML/CFT regulations, and help curb theft and fraud by making identity theft and impersonation more difficult.19 81. A robust digital ID system can also help private sector firms boost their revenues by increasing the identifiable customer base. Recent survey data suggest that about half of the adults in Nigeria do not have an official proof of identity, limiting the customer base for services and products that rely on being able to reliably verify their customer’s identities. Reliable identity authentication mechanisms provided through a foundation ID system can create significant opportunities for innovation and growth. In Pakistan, for example, Telenor was able to leverage the national ID and government-mandated SIM registration to reduce onboarding time to under 1 minute and double the customer base for its Easypaisa payments service within a year. Making it easier for customers to verify their identities when initiating a transaction or accessing a service can also reduce customer abandonment and rejection rates. 82. There are additional economic benefits to having a unique and verifiable ID that can provide an accurate picture of a person’s economic activity over time and across sectors. Credit rating agencies and microfinance institutions, for example, stand to benefit from the ability to integrate unique ID numbers with customer records across databases to build credit histories, unlocking a key barrier to accessing 18 Dahan, M., and L. Hanmer. 2015. “The Identification for Development (ID4D) Agenda: Its Potential for Empowering Women and Girls.” Background Paper, World Bank, Washington, DC. 19 World Bank. 2018. Private Sector Economic Impacts from Identification Systems. Washington, DC: World Bank. Page 37 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) finance.20 Finally, the existence of a robust system for authentication obviates the need for individual entities or industry associations to set up their own parallel authentication systems specific to certain sectors, duplicating costs many times over. 83. Identification can also yield social benefits for vulnerable populations, such as IDPs, asylum seekers, refugees, returnees, persons with disabilities, and other marginalized groups. Internally displaced, refugee, and returnee populations in Nigeria are at a heightened risk of lacking foundational ID credentials as a result of their displacement, particularly women, vulnerable households, and female- headed households. Lack of documentation can create exclusion and restrictions on livelihood opportunities for these populations, as freedom of movement is affected and SIM card registration and the ability to open bank accounts limited. Host communities also face barriers to enrollment as a result of living in fragile and conflict-affected areas. Similarly, persons with disabilities and other marginalized groups, such as ethnic or religious minorities, face similar forms of exclusion when they lack identification. Identification for vulnerable and marginalized groups can ensure that they experience less discrimination and greater access to services. 84. A robust ID system is instrumental for expanding health coverage in an inclusive and cost- effective manner and for improving the quality of care. As Nigeria seeks to scale and improve the targeting of its health insurance system, international experience shows that integrating a foundational identifier into health insurance programs can improve their effectiveness, targeting, and efficiency, while increasing inclusion. In Thailand, for example, the national population registry serves as the baseline list of beneficiaries for the universal health care scheme, allowing for rapid coverage and eliminating the need for a duplicative enrollment campaign.21 In Estonia, the link between the country’s health information system and population register—underpinned by its unique eID and X-Road integration layer—has enabled every child to be automatically listed as a beneficiary in the health insurance fund from birth. In addition, being able to uniquely identify a patient between visits and across health facilities is critical for providing effective treatment for certain illnesses, such as HIV/AIDS and tuberculosis as well as vaccinations that require multiple visits and adherence to established protocols. 85. Another important benefit of a foundational ID system is the ability to respond quickly in the context of a disaster. Thailand used its national population register to manage distribution of vaccinations when there was a dengue outbreak in provinces bordering the Lao People’s Democratic Republic. In 2005, Pakistan was able to disburse more than US$350 million to those affected by a major earthquake in just a few months using the national ID database and a robust authentication process. In contrast, when Nepal was hit by a devastating earthquake in 2015, millions of dollars and many months were spent collecting data on individuals living in the affected areas before aid could even be dispersed. More than two years after the event, the World Bank-supported efforts are still paying out benefits. 86. Taken together, the combined economic and social benefits to individuals, the increased efficiency of the overall economy, and the fiscal savings to the Government suggest that investing in a foundational ID system has a high rate of return. Quantifying these returns is complicated by the sheer scope of the impact of IDs. One of the only attempts at a rigorous cost-benefit analysis of an investment 20 Central Bank of Nigeria and International Finance Corporation. 2017. “The Credit Crunch: How the Use of Movable Collateral and Credit Reporting Can Help Finance Inclusive Economic Growth in Nigeria.” International Finance Corporation, Washington, DC. https://openknowledge.worldbank.org/handle/10986/26275 License: CC BY-NC-ND 3.0 IGO. 21 World Bank. 2018. The Role of Digital Identification for Healthcare: The Emerging Use Cases . Washington, DC: World Bank. Page 38 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) in a national ID system in a developing country is a forthcoming study commissioned by the World Bank on Zambia. This study uses conservative assumptions to estimate savings from reduced error, fraud, and corruption and leakages in public programs and also considers cost savings from not having to reissue voter IDs. On the cost side, the analysis considers not only the cost of initial mass registration but also recurring maintenance costs (for example, new enrollments and lost authenticators) over an 18-year period. The estimated internal rate of return ranged from 38 percent to more than 500 percent in the four scenarios presented. These high rates of return are driven primarily by fiscal savings related to social spending and lower costs of holding elections, both of which are recurrent, as opposed to one-off savings. Since the methodology of this study makes no attempt to quantify all of the economic and social benefits discussed earlier and operates on conservative assumptions of fiscal savings, it could be considered as a lower-bound estimate of the potential returns of a foundational ID system in Sub-Saharan Africa. Rationale for Public Investment 87. Foundational ID is an essential piece of a digital platform for an economy and is a public good. Providing ‘legal identity for all, including birth registration’ is target 16.9 under the SDGs and access to identification is a human right under a number of international conventions. It is only through public sector investment that the inclusion of poor and marginalized individuals and those living in remote areas is ensured. Private sector entities would have very little incentive to enroll these populations free of charge and given that over half of Nigerians live under the international poverty line of US$1.90 (purchasing power parity) per day, a large share of the population would be unable to afford the fees charged by private sector entities if identification services were offered on a for-profit basis. In addition, public sector investment helps ensure that personal data contained within the ID system are protected by adequate legal, regulatory, and IT standards. Analysis of Costs 88. The cost of the initial enrollment will be borne by the project, while ongoing enrollment will be embedded into ongoing government processes to ensure sustainability. The cost-sharing model between stakeholders (including the private sector) will include a pay-per-enrollment component, whereby enrollment partners are offered a dynamic financial incentive for each new individual they successfully enroll in the NIMS (culminating in successful NIN issuance). Ongoing enrollment will be ensured partly through direct financing under the project and partly through integrating enrollment mechanisms in existing government processes already provided for in the national budget, such as CR, to ensure sustainability. The project will also explore public-private partnerships to support expansion and maintenance of the ID system in the long term. 89. International experience suggests that initial enrollment costs—for capturing biometric and biographic data at enrollment points—can be as low as US$1 per enrollment. A close analysis of the cost drivers of ID systems across 15 countries has revealed that the two largest components of cost tend to be staff costs (35–65 percent) associated with enrollment and the cost of issuing a card or authenticator (between 10 percent and 40 percent of the total).22 Interestingly, there is a high (approximately 30 percentage point) spread in both these drivers in terms of their contribution to the total cost. This variation is typically attributed to a few key design choices: the biometrics collected, the enrollment time 22 World Bank. 2018. Understanding Cost Drivers of Identification Systems. Washington, DC: World Bank. Page 39 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) line, the technical features of the card or authenticator, the number of data fields collected, and the level of linking with the CR system. 90. Nigeria-specific analysis, subject to further validation, suggests that under an ecosystem-based, pay-per enrollment approach, registrars would need to be paid, on average, US$1.50 per enrollment in registration areas where the largest share of the population is expected to enroll. Payments are expected to be lower, about US$0.90 on average, in particularly easily accessible and well-served areas, where about the third of the population is expected to enroll. Per-enrollment registration cost in certain rural, remote, conflict-affected, or otherwise difficult-to-access areas is expected to be considerably higher. This calculation is based on an estimated enrollment and basic-authenticator issuance time of 12 minutes per registrant when enrollment can be completed online, in one step, and 16 minutes per registrants when enrollment is offline, and the issuance of the basic authenticator is completed during a second visit. Due to the added time, offline enrollments are expected to require a higher payment per enrollment than online, one-visit enrollments. A 30 percent profit margin is assumed as well as a 10 percent ‘unsuccessful’ registration rate, whereby the agent completes the registration process, but no NIN is generated (for example, because of a duplicate enrollment or other issues) and therefore no fee is paid. This analysis is sensitive to variation in daily operating costs—which depend on wages for enrollment agents and other expenditures related to the space for registration, transportation costs, and so on; the time needed for each enrollment; and the number of expected enrollments per day (which is influenced both by the time needed for each enrollment and demand for the ID). Operating costs and the number of enrollments per day may vary based on geographic location (rural, urban, or conflict-affected areas) and other factors that can influence the demand for IDs. The ease of entering the market as a registrar may be affected by many, not easily quantifiable factors in a given area. International experience suggests that providing enrollment services to the most marginalized communities can cost as much as four to eight times the enrollment cost in urban areas. Piloting of the ecosystem approach for enrollment across different regions of Nigeria during the initial phase of the project will allow the parameters of the business model to be confirmed or further refined so that per-enrollment fees provide appropriate incentives for registrars to operate. 91. By keeping the number of data fields minimal for registration, enrollment agents will be able to register a greater number of people per day for each registration kit, lowering the cost per registration. Faster enrollment times will imply a lower per-enrollment cost as the agent’s time (for example, reservation wage) and other fixed costs can be covered more rapidly (in less time). Similarly, the longer time it takes to enroll an individual, the longer it will take for a registrar/enrollment station to cover the lease/initial investment for the enrollment kit (assuming an ecosystem approach), thus requiring a higher per-registration fee to motivate agents. A difference of ±2 minutes in enrollment time per registrant is estimated to imply about a ±10 percent difference in required per-enrollment fees. Pilots at the beginning of the project implementation will provide a more accurate estimate for the average enrollment time and will allow for the fine-tuning of the enrollment fee structure and for any modifications in the enrollment processes needed to allow for faster enrollment. 92. Biometric technologies are an important investment to maximize the utility of the system and have the potential to generate substantial private and public sector savings that more than offset the up-front investments costs. Each additional biometric modality is associated with a 5–10 percent increase in total project cost.23 Nevertheless, using multiple biometric modalities is considered good practice for 23 World Bank. 2018. Understanding Cost Drivers of Identification Systems. Washington, DC: World Bank Group. Page 40 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) digital ID systems, especially in countries with a large target population such as Nigeria, as they increase deduplication and authentication accuracy and foster inclusion. The current NIMS already employs fingerprint and facial modalities, and the costs and benefits of adding a third modality will be studied under the project. 93. The target period for concluding mass registration is also an important cost factor. The sooner an ID program is expected to reach full coverage—or 80 percent, 90 percent, and so on coverage—the greater the manpower and initial equipment needs for mass registration. For an ecosystem approach, higher per-enrollment payments may be needed to incentivize enrollment partners to hire more staff to keep enrollment stations running for extended hours. Raising per-enrollment payments may also provide an impetus for the enrollment providers to advertise their services more widely and aggressively, promoting a rapid take-up of the system. Assuming a 12-minute average enrollment time per person, one enrollment station could enroll approximately 10,000 people a year if it was operational for 8 hours a day for 250 days a year. Although more rapid enrollment may imply higher initial costs, the faster critical coverage level is reached, the sooner the ID can be used for service delivery and social protection programs, delivering potentially large savings. 94. The project will cover the cost of issuing a basic, low-cost authenticator. To enable universal access to identification, the project will provide a low-cost, government-recognized physical credential (authenticator) and ensure its distribution to beneficiaries. For the fraction of the population that may need a more expensive authenticator (such as a smart card) for travel or other higher-risk and higher- value services, the cost of such authenticators may be borne by the Government or may be passed on to end users. The type of physical credential issued is usually a major cost component of the national ID system. If an online authentication infrastructure can be established, with the ability to directly query the central National ID registry for identity authentication, a ‘paper’ or laminated card with minimal security features may be sufficient. Not counting potential delivery costs, a simple paper card with a barcode (similar to that issued by India’s Aadhaar) is estimated to cost less than US$0.20 per card. The issuance of smart cards, which offer the capability of authentication of an individual against the biometric data stored on the chip, costs considerably more: a relatively basic polycarbonate smart card with contactless chip and medium-level security features is estimated to cost around US$3.50 per card, and depending on its additional features, the cost may be multiple times higher. C. Fiduciary (i) Financial Management 95. Financial management (FM) functions for the project will be provided by the Federal Project Financial Management Department (FPFMD) which will have the responsibility of establishing and maintaining arrangements acceptable to the World Bank. The performance of the FPFMD was assessed. Based on the assessment, the FM arrangements meet the minimum requirement in accordance with Financial Management Manual issued in 2017 and the World Bank Policy/World Bank Procedure for Investment Project Financing (IPF). The FPFMD being a multi-donor and multi-project FM platform is presently involved in the implementation of the World Bank assisted projects. The control features include the following: (a) a comprehensive Financial Procedures Manual (FPM) covering all the key elements of FM, that is, budgeting, funds flow, accounting, internal control, reporting, and audit; (b) computerized accounting system; (c) qualified staff who have been trained in relevant World Bank procedures and requirements; (d) robust segregation of functions/duties; (e) a strong control environment to mitigate Page 41 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) fiduciary risks; (f) highly independent and well-trained internal auditors; and (g) full alignment with the Government’s own FM system with some important enhancements and controls. Considering the risk mitigation measures, the residual FM risk for this project is assessed as ‘Substantial’. 96. Disbursement will be made based on incurred eligible expenditures (transaction-based disbursement procedure). The FPFMD will submit withdrawal applications separately to each of the financiers, that is, IDA, AFD, and EIB. IDA, AFD, and EIB will disburse to the NIMC’s Designated Account (DA) managed by the FPFMD who will be responsible for managing these funds. Details on disbursement and fund management procedure are provided in annex 1. The FM procedures will also be elaborated in the PIM. 97. Interim financial reports (IFRs) will be prepared and submitted by the FPFMD within 45 days of the end of each calendar semester. The FPFMD will be responsible for the preparation and submission of audited financial statements within six months of the end of the financial year. Independent auditors, against terms of reference acceptable to the World Bank, will be engaged by the FPFMD for external audit. (ii) Procurement 98. Applicable Procurement Regulations. The Borrower shall carry out procurement under the project in accordance with the World Bank’s ‘Procurement Regulations for IPF Borrowers: Procurement in IPF Goods, Works, Non‐Consulting and Consulting Services’ (Procurement Regulations), dated July 1, 2016, and revised in November 2017 and August 2018 under the ‘New Procurement Framework (NPF)’; the ‘Guidelines on Preventing and Combating Fraud and Corruption in Projects Financed by IBRD Loans and IDA Credits and Grants’, dated July 1, 2016; and other provisions stipulated in the FAs. The latest versions of the World Bank Standard Procurement Documents shall be used, where applicable. The project shall use the World Bank’s Systematic Tracking of Exchanges in Procurement (STEP), an online tool, for planning and tracking all prior and post review procurement transactions. 99. Project Procurement Strategy for Development (PPSD). NIMC has prepared a PPSD, which describes how procurement activities will support project operations for the achievement of the PDOs and deliver value for money. A PPSD and 18-month Procurement Plan have been agreed ahead of negotiations and cleared by the World Bank. 100. Implementation arrangements for procurement. The procurement capacity assessment of NIMC and the Office of the Vice President (OVP) was carried out during project preparation. NIMC has a procurement unit responsible for carrying out procurement activities, funded by the Federal Government’s budget allocations, in accordance with the National Procurement Act 2007. The assessment at NIMC identified weak capacity in the application of the World Bank Procurement Framework and the use of STEP as major procurement risks. However, the project shall be implemented by the PIU established within NIMC. A project preparation team, including a team lead and a short-term procurement consultant, was constituted and funded under the project preparation advance (PPA) to facilitate recruitment of the key positions in the PIU. The ECSU will perform coordination functions. Relevant staff including an ECSU coordinator, a procurement officer, and an internal auditor will be recruited for the ECSU. Detailed procedures for staff recruitment will be included in the PIM. The project team will require training on the features of the World Bank Procurement Framework and STEP. Overall, the procurement risk is Substantial. Page 42 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) D. Safeguards (i) Environmental Safeguards 101. The project is rated Category B, meaning that the expected potentially significant adverse impacts of the project will be minor and site specific. No major civil works are planned, while minor rehabilitation or upgrading of the existing ID and CR centers may take place. These activities (rehabilitation or upgrading of existing buildings) are generally expected to be minor, limited in space and time, and relatively easier to mitigate to an acceptable level typical of category B impacts. The project will not involve large-scale acquisition of new land, displacement of people, or restrict access to means of livelihood. Nevertheless, this project triggers World Bank Environmental Assessment policy (OP/BP 4.01) and Involuntary Resettlement (OP/BP 4.12). This is because the implementation of the ID4D Project may involve the rehabilitation and/or extension of buildings within government-owned land which may affect squatters who are living or using such compounds for economic or social activities (see the section on Social Safeguards). There are no large-scale, significant, or irreversible impacts. Potential negative environmental impacts consist of those associated with (a) the rehabilitation and upgrading of existing buildings; (b) the public health and safety risks involved in the handling of debris that might result from the rehabilitation of existing buildings; (c) dust generation; and (d) noise pollution. The exact locations and scope of project activities were not known in detail during project preparation. However, the project may have the potential to affect the environment and people if adequate prevention and mitigation measures are not taken. Therefore, an Environmental and Social Management Framework (ESMF) was prepared by the Borrower and disclosed country wide in Nigeria and on the World Bank’s external website before appraisal, as required. The ESMF was reviewed and cleared by the World Bank and disclosed in- country on May 27, 2019, and on the World Bank’s external website on July 11, 2019. The ESMF outlines the principles, approach, steps, and sequencing that will be taken in preparing site-specific safeguards instruments during implementation. (ii) Social Safeguards 102. Positive social impacts. The Nigeria ID4D Project is expected to have significant positive social impact by supporting the expansion of a foundational ID system and ensuring access to ID for millions of Nigerians, especially for women and vulnerable populations. This will also expand access to educational opportunities, financial services, health and social welfare benefits, economic development, and increase electoral participation. 103. Social risks. Historically, ID systems have led to exclusion due to limited access to breeder documents (for example, birth certificates) required to obtain an ID, as well as gaps in nationality laws and their application. A Social Assessment of the project, undertaken by the Borrower, identified four main categories of potential social risks that may arise from the implementation of the project: (a) exclusion of traditionally economically and socially marginalized groups; (b) risks from the improper use or sharing of data that could lead to discrimination or targeted persecution and erode the trust in the system; (c) concern that the project could create, reinforce, or deepen social conflict; and (d) stakeholder perception of the ID4D Project. In addition to assessing the potential negative effects of the project, the Social Assessment proposed a sound social development strategy to mitigate these risks which has been incorporated in the project design (see Annex 3). Page 43 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) 104. In response to concerns over improper use or sharing of data that could lead to discrimination or targeted persecution and erode the trust in the system, the project has been designed to mitigate this risk by, first, limiting the data in the central biometric registry to a strict minimum of necessary fields and, second, developing strong legal and institutional controls. Components 1 and 2 set out both legal and technical measures to be implemented by the project to safeguard privacy and personal data. 105. Stakeholder consultations and engagement. As part of efforts to mitigate potential exclusion risks on the project, with support from the ID4D Multi-Donor Trust Fund and the World Bank’s Rapid Social Response (RSR) fund, the World Bank and the Borrower have conducted a mapping of key marginalized groups who may be negatively affected by the rollout of the ID system in Nigeria. This was followed by national consultations with marginalized groups, particularly persons with disabilities, and other vulnerable populations as well as civil society organizations (CSOs) on barriers to identification. The robust consultations, which began during project preparation, will continue through the life cycle of the project. This will be complemented by strong public awareness campaigns, tailored outreach strategies, and an inclusive and transparent communications plan (see annex 3 for more on Stakeholder Engagement and Communication). 106. Involuntary resettlement. The policy is triggered because the project components may involve financing of rehabilitation and upgrading existing ID and CR centers, thereby resulting in involuntary land acquisition leading to potential loss of access to assets, means of livelihoods, or resources. Given that the detailed description of the investments under these components are yet unknown, the Borrower has prepared a Resettlement Policy Framework (RPF) in accordance with the World Bank’s Safeguards policy OP/BP 4.12. The RPF has been reviewed and cleared by the World Bank and disclosed in-country on May 27, 2019, and on the World Bank’s external website on July 11, 2019. The RPF outlines the resettlement process in terms of procedures for preparing and approving Resettlement Action Plans, institutional arrangements, likely categories of affected people, eligibility criteria and categories, compensation rates, methods of valuing affected assets, community participation and information dissemination, grievance redress for resettlement-related grievances, and effective M&E. These arrangements are to ensure that there is a systematic process (as against an ad hoc one) for the different stages of implementation of a framework that ensures participation of affected persons, involvement of relevant institutions and stakeholders, and adherence to both World Bank and Government procedures and requirements. 107. Strong public awareness campaigns, tailored outreach strategies, an inclusive and transparent communications plan, a robust GRM, and continuous stakeholder engagement will further help manage social risks. These are particularly important in addressing any potential for generating or deepening social conflict. (iii) Grievance Redress Mechanisms 108. A project-specific GRM will be developed in NIMC to ensure that grievances can be lodged against any ecosystem partner or NIMC regarding enrollment in the ID system. This will be based on NIMC’s existing Customer Care Department. The GRM will set specific service standards and outline clear procedures for addressing complaints. An annual GRM review will capture lessons learned to improve operational performance (see annex 3 for a detailed explanation). 109. Communities and individuals who believe that they are adversely affected by a World Bank (WB) supported project may submit complaints to existing project-level grievance redress mechanisms or the Page 44 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) WB’s Grievance Redress Service (GRS). The GRS ensures that complaints received are promptly reviewed in order to address project-related concerns. Project affected communities and individuals may submit their complaint to the WB’s independent Inspection Panel which determines whether harm occurred, or could occur, as a result of WB non-compliance with its policies and procedures. Complaints may be submitted at any time after concerns have been brought directly to the World Bank's attention, and Bank Management has been given an opportunity to respond. For information on how to submit complaints to the World Bank’s corporate Grievance Redress Service (GRS), please visit http://www.worldbank.org/en/projects-operations/products-and-services/grievance-redress-service. For information on how to submit complaints to the World Bank Inspection Panel, please visit www.inspectionpanel.org. V. KEY RISKS 110. A number of risks are associated with the implementation of ID systems, but these risks can be managed and mitigated through appropriate legal frameworks and institutional, technical, and operational arrangements. Well-designed and implemented foundational ID systems can render truly transformative results by empowering the most marginalized and vulnerable, enabling greater and more convenient access to services, and preventing waste of scarce public resources. The FGN has expressed its commitment to the Principles on Identification for Sustainable Development,24 a framework developed by the World Bank and the Center for Global Development in collaboration with other multilateral development banks, United Nations agencies, NGOs, donors, and private sector partners to mitigate the risks and maximize the benefits of ID systems in the development context. As noted earlier, these principles center around (a) inclusion: universal coverage and accessibility; (b) design: robust, secure, responsive and sustainable; and (c) governance: building trust by protecting privacy and user rights. Adherence to these principles facilitates management of concerns surrounding identification. Risks are also mitigated by the policy of making the foundational ID system accessible to all persons in Nigeria (potentially subject to certain minimum duration of presence requirements), irrespective of citizenship or legal status, as well as all Nigerians abroad. 111. The overall risk for the operation is High. The systematic operations risk rating tool (SORT) in the datasheet of this document presents programmatic risks by category. Primary risks arise from (a) unstable politics and governance; (b) sector strategies and policies related to IDs; (c) technical design; (d) low institutional capacity for implementation; and (e) fiduciary factors. 112. Political and governance risks are High. Successfully implementing significant reforms such as those proposed under this project requires high-level political commitment and continued leadership across all counterpart agencies. This engagement has been secured across the Government through an extensive consultative outreach effort coordinated by the World Bank before project preparation and which culminated in the endorsement of the Strategic Roadmap by all key public and private stakeholders, including the FEC in September 2018. To mitigate the inherent political risk of such a strategic reform, the project will (a) minimize delays in showing early results during project implementation, increasing the political costs to a future government of walking back aspects of the reform; (b) ensure that the governance structure of the reform is appropriately reflected in legislation; (c) front-load work on Component 1; and (d) implement the bulk of the proposed reforms through NIMC, which has a national, autonomous legal status and is not directly dependent on any given government or state. There is also a 24 See https://id4d.worldbank.org/principles. Page 45 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) minimal risk that states may not buy in to the FEC-endorsed Strategic Roadmap. Although states have no formal role in implementation, their support can only be helpful to the project. To bolster this support, the Strategic Roadmap will be presented at the National Economic Council to State Governors to outline the benefits of the national ID system for all and to assure them that this will strengthen and not supplant the existing state ID systems; if required, an annual update to the National Economic Council for State Governors would be considered. 113. Sector strategy and policy risks are High. The demand for the new ID credentials will be closely linked to holders’ ability to use the ID to prove who they are to access services and perform transactions. On the other hand, the demand and willingness from service providers (such as social protection or health) to integrate NINs into their database and query the foundational registry to authenticate and verify the identities of their users will depend on there being a sufficiently large pool of individuals with the newly issued IDs among their target population. The foundational ID system will need to obtain a critical mass of end users (that is, near universal coverage) to stimulate demand from service providers to use the IDs to authenticate individuals accessing their services. If no agreement can be arrived at with key public and private sector service providers to use the IDs to authenticate for services (such as financial services, health care, or G2P cash transfers), end users may see limited value in enrolling in the foundational ID system. Component 3 of the project has been designed with a specific view to mitigate this risk. By directly supporting several highly visible priority services in their efforts to link their databases to the foundational ID system, the project will show the value-add of such links both for these services and for their beneficiaries. 114. Technical design risks are High. There have been a number of previous attempts to build a foundational ID system in Nigeria. Commitment from stakeholders of the ID system will be critical as their active participation is key to the project’s success. In particular, these partners in the enrollment ecosystem will need to abide by NIMC’s standards for equipment and implement approved procedures to ensure data quality and protection. Additionally, the provision of NIMC authentication services, through Component 3, will be successful only if public and private services integrate the authentication functionality into the service delivery mechanisms. Also, partners’ participation will be vital should feasibility studies show a benefit to continued efforts to migrate legacy data from the existing functional ID systems, in particular the BVN or the voter rolls, into the NIMS. The dispersed nature of the ecosystem approach, whereby enrollment is outsourced to multiple entities, also presents technical design risks particularly in the areas of cybersecurity and data privacy. Data collection, storage, and transmission mechanisms must be designed to be secure, trusted, and monitorable across multiple actors participating in the registration process. Similar caution needs to be taken when engaging with eligible service providers who wish to authenticate their clients or beneficiaries against the foundational ID registry. To mitigate the risks associated with the technical design of the ID system, the project will finance the recruitment of a strategic coordination team, made up of staff technical profiles, with the mandate of sensitizing and ensuring communication between relevant stakeholders, ensuring strategic coordination of the rollout of the reforms to the ID ecosystem, and ensuring governmentwide buy-in on all legal reforms. This coordination team will also work closely with the existing Harmonization Committee, which includes representatives of the public and private sectors and is engaged in an ongoing dialogue on ID system reform, as well as with NIMC. Additionally, the project will invest heavily in national cybersecurity and information security infrastructure to mitigate security threats and adequately protect personal data. The project will also allocate financing for communication and consensus building, within the ecosystem of stakeholders, to ensure that the needs of NIMC’s partners are adequately taken into account in the development of all regulations, standards, and procedures that they will be expected to abide by. Page 46 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) 115. Institutional capacity for implementation risks are High. Weak institutional capacity would affect project implementation. Experience has shown that NIMC has limited technical capacity. Additionally, NIMC has no experience implementing World Bank projects and complying with fiduciary, safeguards, and project management requirements. These risks will be managed through capacity-building initiatives, including training for the PIU on the World Bank’s fiduciary procedures, the NPF, safeguards, and project management. Additionally, the project will build the NIMC’s human capacity by competitively recruiting appropriately skilled staff and its technical capacity by making investments in NIMC’s information systems, including those used to manage the central biometric database. 116. Fiduciary risk is rated Substantial. This is based on lack of experience and familiarity of the PIU and ECSU with the World Bank’s FM requirements and the ECSU’s lack of experience in implementing identity projects. The risk will be mitigated by strong FPFMD, Financial Procedure Manual, and implementation of FM action plan as well as constant follow-up and implementation support to the project. The FM risk will be reviewed during implementation and will be updated as appropriate. Further, this will be sustained by ensuring that strong FM systems are maintained for the project throughout its duration. See Annex 1 for more on fiduciary risks and mitigation measures. 117. Stakeholder risks are High. Historically, some ID systems have been inaccessible to certain individuals or population groups because of onerous enrollment procedures, which required registrants to pay high fees and present additional documents, such as birth certificates, to obtain an ID. The practice of linking the issuance of IDs to the determination of citizenship or legal status has also led to negative impacts upon marginalized groups due to exclusionary or ambiguous nationality laws and their application. As noted earlier, under this project, the ID system will be accessible to all regardless of nationality or legal status, documentary requirements for enrollment will be kept at a minimum, and registration and the issuance of basic ID authenticators will be free of charge to minimize exclusion risks. Activities carried out with RSR and ID4D support to study and address social risks include mapping of vulnerable groups likely to be negatively affected by the rollout of the ID system; national consultations with vulnerable groups, such as persons with disabilities; as well as South-South learning on privacy, cybersecurity, and access to services. An inclusive and transparent communications plan, powerful public awareness campaigns, tailored outreach strategies, continuous stakeholder engagement, and a robust GRM will further help manage social risks. It will be particularly important to secure the buy-in of ID ecosystem stakeholders and civil society to support the rollout of the communications strategy which will aim to overcome the trust issues arising out of the existing negative perceptions of NIMC and the national ID system. The project structurally limits opportunities for the improper use or sharing of data leading to discrimination or targeted persecution by limiting the volume and type of data collected and stored in the central biometric registry to a strict minimum of necessary fields and by putting in place strong legal and institutional controls. 118. There are other risks such as legal risks that are High. Two types of potential risks have been identified: (a) areas where revisions to the legal framework may be required to permit the lawful implementation of the national ID system as designed and (b) gaps, weaknesses, or other issues where legal reforms are warranted to strengthen the enabling environment and promote successful implementation of the national ID system. Proposed mitigation measures have been identified and discussed with Government. These involve amendments to the existing Federal legislation and the introduction of new Federal legislation. Key government stakeholders will be engaged throughout the reform processes to mitigate potential delays and challenges that may arise from the proposed amendments to the Federal legislation. Legal reforms will be coordinated under the ECSU to ensure Page 47 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) ownership of reforms across the Government. Support for implementing these mitigation measures is included in Component 1, which includes technical assistance for legal and regulatory reforms under the project. Disbursement conditions will be used to encourage the Government to enact the data protection law and to implement specific legal reforms to the NIMC Act to promote inclusion and nondiscrimination, protect ownership of personal data, provide access to personal data by third parties, and ensure mandatory use of NIN. Failure to amend these specific provisions will adversely affect the PDO. These disbursement conditions will be structured to allow the project to begin to disburse, including on enrollment-related activities, in parallel to legal reforms, with subsequent tranches of enrollment disbursements being conditioned on satisfactory progress on the legal and regulatory framework. Additional discussion of specific legal risks can be found in annex 2. 119. Other risks related to technology neutrality and vendor lock-in are High. On the technology front, it is critical that counterparts adopt a technology- and vendor-neutral approach, which helps ensure value for money and the future adaptability of the system. To promote such an approach and mitigate risks, specifications for the technology components of the key foundational registries and enrollment systems must be carefully developed, in line with international standards. The use of open standards enables market-based competition and innovation and is essential for greater efficiency and improved functionality of the ID systems. The use of open source software, where available and appropriate, should also be considered. 120. Climate risks pose little threat to the project at the regional and national levels. The operation has been screened for short- and long-term climate change and disaster risks. Small physical investments will be made to strengthen data centers and foundational ID system infrastructure (for example, servers, computers, and tablets). Extreme temperature, precipitation, and flooding could pose a risk to these systems, but they will be designed and installed with these risks in mind and highly secured in urban areas. In rural areas, equipment, in particular mobile biometric enrollment devices, will be somewhat exposed, but appropriate mitigation measures will be taken. . Page 48 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) VI. RESULTS FRAMEWORK AND MONITORING Results Framework COUNTRY: Nigeria Nigeria Digital Identification for Development Project Project Development Objectives(s) The Development Objective of the project is to increase the number of persons with a national ID number, issued by a robust and inclusive foundational ID system, that facilitates their access to services. Project Development Objective Indicators RESULT_FRAME_T BL_ PD O Indicator Name DLI Baseline Intermediate Targets End Target 1 2 3 4 Increase the number of persons who have a foundational ID Persons who have a NIN 36,894,074.00 40,000,000.00 60,000,000.00 80,000,000.00 110,000,000.00 148,000,000.00 (Number) Females who have a NIN 14,965,282.00 15,000,000.00 20,000,000.00 35,000,000.00 50,000,000.00 65,000,000.00 (women and girls) (Number) Children who have a NIN (girls and boys under 16) 750,876.00 750,876.00 750,876.00 10,000,000.00 25,000,000.00 50,000,000.00 (Number) Successful upgrade and deployment of the NIMS, enabling real-time generation of NINs and adequate No No Yes Yes Yes Yes safeguards for personal data, in keeping with international best practice (Yes/No) Facilitation of access to services for NIN holders Page 49 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) RESULT_FRAME_T BL_ PD O Indicator Name DLI Baseline Intermediate Targets End Target 1 2 3 4 Successful digital authentications in the context 0.00 0.00 0.00 100.00 5,000.00 10,000.00 of service delivery (Number) Successful digital authentications on behalf of 0.00 0.00 0.00 30.00 40.00 50.00 women (Percentage) Robust and inclusive foundational ID Persons with NINs in the bottom two poverty quintiles 0.00 15.00 40.00 (Percentage) PDO Table SPACE Intermediate Results Indicators by Components RESULT_FRAME_T BL_ IO Indicator Name DLI Baseline Intermediate Targets End Target 1 2 3 4 Component 1: Strengthening the Legal and Institutional Framework Development of a legal and regulatory framework that adequately protects No No Yes Yes Yes Yes individuals' personal data and privacy (Yes/No) Development of a NIMC legal and regulatory framework that promotes non-discriminatory, No No No Yes Yes Yes inclusive and universal access to ID (Yes/No) Government personnel trained 0.00 0.00 10.00 50.00 100.00 200.00 Page 50 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) RESULT_FRAME_T BL_ IO Indicator Name DLI Baseline Intermediate Targets End Target 1 2 3 4 in best practices for legal and regulatory enabling environments for foundational ID, including privacy and data protection. (Number) Component 2: Establishing a Robust and Inclusive Foundational ID System Deployment and successful pilot implementation of new enrollment system including No No Yes Yes Yes Yes offline and mobile enrollment modes (Yes/No) Public and private institutions licensed as enrollment partners 0.00 0.00 5.00 10.00 15.00 20.00 (Number) New enrollments for which collected biometric and biographic data meet quality 0.00 0.00 80.00 90.00 95.00 100.00 standards sufficient to allow NIN issuance (Percentage) NIN enrollments in rural areas (Percentage) 0.00 3.00 5.00 15.00 20.00 25.00 Offices of the Nigerian Government abroad equipped to register Nigerians for a NIN 0.00 0.00 0.00 10.00 50.00 50.00 (Number) National digital civil registry Database and backend Digital data collection Digital data collection Digital data collection system created and No system No system systems developed and mechanisms developed mechanisms developed mechanisms developed implemented by NPopC (Text) tested and tested and tested and tested Live births registered digitally and assigned a NIN (Number) 0.00 0.00 0.00 2,000.00 25,000.00 100,000.00 People trained on enrollment 0.00 0.00 5,000.00 20,000.00 40,000.00 50,000.00 procedures and technology, Page 51 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) RESULT_FRAME_T BL_ IO Indicator Name DLI Baseline Intermediate Targets End Target 1 2 3 4 including digital skills (Number) Component 3: Enabling Access to Services through IDs New NIN holders who have been issued a basic 0.00 0.00 70.00 80.00 90.00 100.00 authenticator (Percentage) Functional public and private services employing the foundational ID system for the 0.00 0.00 0.00 1.00 4.00 8.00 purpose of authentication and service delivery (Number) Pro-poor functional public and private services employing the foundational ID system for the purpose of 0.00 0.00 0.00 0.00 1.00 2.00 authentication and service delivery (Number) Component 4: Project Management and Stakeholder Engagement Annual consultations held with beneficiaries, ID stakeholders, marginalized groups and government to solicit feedback No Yes Yes Yes Yes Yes and report on actions taken to address feedback since prior consultations (Yes/No) Grievances responded to and/or resolved within the stipulated service standards for 0.00 0.00 60.00 70.00 80.00 90.00 response times (Percentage) IO Table SPACE Page 52 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) UL Table SPACE Monitoring & Evaluation Plan: PDO Indicators Methodology for Data Responsibility for Data Indicator Name Definition/Description Frequency Datasource Collection Collection Number of individuals assigned a NIN based on successful national-level Quarterly NIMS NIMS reports PIU Persons who have a NIN deduplication of biometric and biographic data of international quality standard. Number of females (women and girls) assigned a NIN based on successful Females who have a NIN (women and Quarterly NIMS NIMS reports PIU national-level deduplication girls) of biometric and biographic data of international quality standard. Number of children (boys and girls under 16 years) assigned a NIN based on Children who have a NIN (girls and successful national-level Quarterly NIMS NIMS reports PIU boys under 16) deduplication of biometric and biographic data of international quality standard. Successful upgrade and deployment of All technical and other PIU to submit project the NIMS, enabling real-time generation solutions developed, tested, Annual Admin Data PIU implementation reports of NINs and adequate safeguards for and implemented to enable personal data, in keeping with generation of NINs in real Page 53 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) international best practice time while providing adequate safeguards for personal data, in keeping with international good practices. Quarterly count of the successful digital Successful digital authentications in the Quarterly NIMS NIMS reports PIU authentications of a NIN- context of service delivery holder's identity in the context of service delivery Numerator: Number of successful digital authentications of female NIN holders' identity in the Successful digital authentications on context of service delivery. Quarterly NIMS NIMS reports PIU behalf of women Denominator: Number of successful digital authentications of both male and female NIN holders' identities. Impact Numerator: Number of NIN evaluation holders who fall in the Impact evaluation will Year 3 and midline Persons with NINs in the bottom two bottom two poverty conduct nationally PIU Year 5 (YR3) and poverty quintiles quintiles representative surveys endline (YR5) Denominator: Total number surveys. of NIN holders ME PDO Table SPACE Page 54 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) Monitoring & Evaluation Plan: Intermediate Results Indicators Methodology for Data Responsibility for Data Indicator Name Definition/Description Frequency Datasource Collection Collection Relevant data protection and/or privacy laws passed Development of a legal and regulatory ECSU to submit project and implemented, including Annual Admin Data ECSU framework that adequately protects implementation reports through the designation of individuals' personal data and privacy an independent data protection commission. The NIMC Act and relevant Development of a NIMC legal and regulations and guidelines Project Implementation regulatory framework that promotes non- are revised to ensure that Annual Admin Data ECSU Reports discriminatory, inclusive and universal enrollment of individuals is access to ID not restricted by any barriers. Count of government personnel that receive Government personnel trained in best training under the project in ECSU to submit project practices for legal and regulatory enabling best practices for legal and Annual Admin Data ECSU implementation reports environments for foundational ID, regulatory enabling including privacy and data protection. environments for foundational ID, including privacy and data protection. New enrollment system, including offline (ability to Deployment and successful pilot operate without connecting PIU to submit project implementation of new enrollment to a telecommunications Annual Admin Data PIU implementation reports system including offline and mobile network) and mobile (able enrollment modes to operate outside of a fixed environment and without mains power supply) Page 55 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) enrollment modes, is developed, tested, and implemented. Count of enrollment Licenses issued by Public and private institutions licensed as partners with licenses who Annual Admin Data NIMC and onboarding PIU enrollment partners have completed successful completed onboarding. Numerator: Number of incoming records, including both biometric and biographic data, emanating from ecosystem partners in the context of enrollment New enrollments for which collected for which data meets quality biometric and biographic data meet Quarterly NIMS NIMS reports PIU standards quality standards sufficient to allow NIN Denominator: Total number issuance of incoming records, including both biometric and biographic data, emanating from ecosystem partners in the context of enrollment Numerator: Number of NIN enrollments in rural areas (as defined by NBS) Geolocation of Quarterly NIMS PIU NIN enrollments in rural areas Denominator: Total number enrollments of NIN enrollments Rural areas as defined by NBS. Offices of the Nigerian Government Count of offices of the PIU to submit project Annual Admin Data PIU abroad equipped to register Nigerians for Nigerian Government which implementation reports a NIN are equipped and linked to Page 56 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) the enrollment system and able to carry out NIN enrollments abroad. Digital CR system, managed by NPopC, is designed, tested, and in production mode, and all associated NPopC to submit NPopC CR National digital civil registry system digital data collection Annual project implementation NPopC system created and implemented by NPopC mechanisms have been report developed, field tested, and implemented in participating NPopC registration centers. Count of records of newly NPopC to submit NPopC CR Live births registered digitally and digitally registered live Quarterly project implementation NPopC system assigned a NIN births by NPopC which have report been issued a NIN by NIMC Number of individuals Tracking of quality in trained on the enrollment People trained on enrollment procedures Annual Admin data project implementation PIU system and SOPs who meet and technology, including digital skills reports the standards stipulated in the licensing agreement. Numerator: Number of new NIN holders who have been New NIN holders who have been issued a Quarterly NIMS NIMS reports PIU issued a basic authenticator basic authenticator Denominator: Total number of new NIN holders Total count of the functional Functional public and private services ID systems or service Project implementation employing the foundational ID system for Annual Admin Data PIU providers in the public or reports the purpose of authentication and service private sectors which are delivery linked to the foundational ID Page 57 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) system for purposes of authentication for service delivery (e.g. banks, telcos, social safety net programs) Total count of public sector, NGO, CSO, or development partner programs (service Pro-poor functional public and private providers or functional ID Project implementation services employing the foundational systems) which target poor Annual Admin Data PIU reports ID system for the purpose of or vulnerable people authentication and service delivery employing the foundational ID system for purposes of authentication for service delivery. Annual consultations in the form of workshops, research, or similar outreach Annual consultations held with to civil society organizations beneficiaries, ID stakeholders, and/or beneficiaries ECSU to submit project marginalized groups and government to Annual Admin Data ECSU representing a wide variety implementation reports solicit feedback and report on actions of marginalized groups taken to address feedback since prior which solicits feedback from consultations said groups and reports on actions taken as a result of prior consultations. Numerator: Number of grievances responded to Analysis of grievance Grievances responded to and/or resolved and/or resolved within the Grievance response times against Quarterly PIU within the stipulated service standards for stipulated service standards register agreed service response times for response times. standards Denominator: Total number of grievances received. Page 58 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) Service standards including response times will be defined in the PIM. ME IO Table SPACE Page 59 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) ANNEX 1: Implementation Arrangements and Support Plan COUNTRY: Nigeria Nigeria Digital Identification for Development Project Project Institutional and Implementation Arrangements 1. Implementation arrangements for the Nigeria Digital ID4D Project will be fully mainstreamed into the existing government structures. Additional technical and coordination assistance will be supported through the project to strengthen implementation and increase the capacity of implementing agencies. The project institutional arrangements build on lessons learned from other World Bank-financed projects. 2. There are three main institutional structures responsible for project implementation: (a) the PESC; (b) the ECSU, coordinating the activities of ecosystem partners and implementing certain project components, including those relating to external communications and legal reform (Component 1); and (c) a dedicated PIU set up inside NIMC to manage day-to-day project implementation. The relationship of these three bodies to each other and to the broader ID ecosystem is illustrated in Figure 1.1. ID4D Project Institutional Arrangements. Figure 1.1. ID4D Project Institutional Arrangements Source: World Bank. Page 60 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) Figure 1.2. ID4D Project Ecosystem Steering Committee Source: World Bank. 3. The ID4D Project will have a PESC. The establishment of the PESC (with leadership and composition acceptable to IDA) will be a condition for effectiveness of the project. Convening at least biannually, its representatives will include, among others, ministers and leaders from relevant ministries, departments, and agencies (MDAs); the private sector; and civil society. MDAs to be represented may include the Ministries of Finance, Justice, Health, Education, Social Protection, Budget and Planning; the Secretary to the Government of the Federation; CBN; NPopC; the National Orientation Agency; and NIMC itself. The Director General of NIMC will serve as the Secretary. The PESC may elect to call upon the input of additional Government or nongovernment stakeholders as needed. Its role will be to provide strategic and technical guidance on (a) the reform of the legal and regulatory framework for ID; (b) implementation of the Strategic Roadmap; and (c) utilization of foundational ID to access services. The composition of the PESC is detailed in figure 1.2. Page 61 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) Figure 1.3. The Ecosystem Coordination Strategic Unit Source: World Bank. 4. The ECSU will be a full-time body responsible for communicating guidance of the PESC to the ecosystem partners and reporting to the PESC on progress toward project implementation under Components 1 and 4a. The PESC will designate the Government agency to house the ECSU and detail its roles and responsibilities. In particular, the ECSU will (a) monitor reform of the legal and regulatory framework for ID: (b) develop and implement a communication and awareness strategy around ID enrollment and harmonization; (c) provide M&E of the broader ID ecosystem; and (d) lead social accountability activities; and (e) such other responsibilities as may be assigned by the PESC, all in accordance with the FA and the PIM. The composition of this unit is indicated in Figure 1.3. The Ecosystem Coordination Strategic Unit Page 62 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) Figure 1.4. Project Implementation Unit Source: World Bank. 5. NIMC, supported by its dedicated internal PIU created and staffed to implement the project, will be responsible for day-to-day management of ID4D Project implementation and the implementation of Components 2, 3, and 4b. Specific responsibilities will include (a) regulating data collection for foundational ID; (b) regulating ID authenticator offerings; (c) providing technical coordination of the Nigerian ID ecosystem; (d) internal communications; (e) storing and managing data related to foundational ID; (f) generating and issuing unique ID numbers; and (g) providing for verification and usage of the national ID. The composition of this unit is indicated in Figure 1.4. 6. To promote sustainability, the project will make use of existing civil servants within and outside of NIMC whenever possible, supplemented by specialized profiles recruited into the PIU as needed. The human resource and change management strategy developed for NIMC under the project will address the specific mechanisms put in place to facilitate knowledge exchange between the PIU and NIMC staff. 7. Recruitment of key PIU and ECSU staff will be a dated covenant due ninety (90) days from effectiveness of the project. The key staff (a) at NIMC are the project coordinator, a technical lead, a procurement officer, and two safeguards officers (environmental safeguard officer and a social safeguard officer) and (b) at the ECSU are the coordinator to head the ECSU and a procurement specialist. Recruitment for the key positions has been launched as of December 2019. 8. While the NIMS will be managed at the Federal level, all state MDAs will be able to participate in the enrollment ecosystem alongside Federal MDAs. Existing state ID systems that wish to benefit from Page 63 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) links with the NIMS will be eligible to interoperate with the NIMS as functional ID systems, benefiting from deduplication, seeding with NIN (or derivative), and NIMC authentication services (as described in annex 2). 9. NPopC will receive support through the NIMC PIU and/or ECSU, as appropriate, over the course of this project. On the civil registration side, this project will be largely limited to investing in the necessary systems for a digital CR system and preparing and piloting innovative approaches, which will then be scaled up to a national level during a potential Phase II. As such, NPopC will not be an implementing agency of IDA funds until the potential second phase of the project when the majority of investments will focus on expanding the coverage and accessibility of civil registration. Financial Management, Disbursements, and Procurement 10. Financial management. An FM assessment of the implementing entities, NIMC and the OVP, was done in March and September 2019, respectively, in line with the Financial Management Manual issued in 2017. The objective of the assessment was to determine whether the implementing entities have acceptable FM arrangements in place that satisfy the World Bank’s IPF Policy and World Bank’s IPF Directive, to provide assurance that (a) all transactions and balances relating to the project will be correctly and completely recorded; (b) financial statements will be prepared in a regular, timely, and reliable manner; (c) the entities’ assets will be safeguarded; and (d) there are auditing arrangements acceptable to the World Bank. 11. The FM functions for the PIU and ECSU will be carried out by the FPFMD. The FPFMD is a multidonor and multiproject FM platform, established through the Federal Treasury Circular of March 2010 in the Office of the Accountant General of the Federation (OAGF) to handle the FM responsibilities for funds provided to MDAs by donor partners, including IDA. This department is currently involved in the implementation of several World Bank-assisted projects. The World Bank’s recent assessment revealed that the FPFMD is performing satisfactorily. 12. The FPFMD control features include the following: (a) a comprehensive FPM covering all the key elements of FM, that is, budgeting, funds flow, accounting, internal control, reporting, and audit; (b) computerized accounting system; (c) qualified staff who have been trained in relevant World Bank procedures and requirements; (d) robust segregation of functions/duties; (e) a strong control environment, which is required to mitigate fiduciary risks; (f) highly independent and well-trained internal auditors; and (g) full alignment with the Government’s own FM system with some important enhancements and controls. Subject to the recommended action plans being implemented, the FM arrangements meet the minimum FM requirement in accordance with World Bank Policy and the World Bank Directive - IPF. 13. The project financing and lending instruments are as follows: the project will be financed by an IDA credit, EIB, AFD, and government contribution. The lending instrument for the financing is IPF. 14. The FM risk of this financing is assessed as Substantial. This is based on lack of experience and familiarity of the PIU and ECSU with the World Bank’s FM requirements and the ECSU’s lack of experience in implementing identity projects. The risk will be mitigated by strong FPFMD, Financial Procedure Manual, and implementation of FM action plan as well as constant follow-up and implementation support to the project. The FM risk will be reviewed during implementation and will be updated as appropriate. Page 64 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) Further, this will be sustained by ensuring that strong FM systems are maintained for the project throughout its duration. 15. Planning and budgeting. Budget preparation will follow the Federal Government timetable. Financial projection/forecast/disbursement plan for the life of the project (analyzed by year) will be prepared before the start of the project activities. On an annual basis, the project accountant, in consultation with key team members, will prepare the budget for the coming year based on the work program approved by the World Bank. The annual budget and work program will be sent to the task team leader at least two months before the beginning of the calendar year for clearance. Detailed procedures for planning and budgeting will be documented in the FPM. 16. Internal control and internal auditing. The project management has the responsibility of ensuring proper internal control arrangements in the project. The internal auditors appointed by the Accountant General for the Federation will perform the internal audit function for the project. The control features include a comprehensive FPM; relevantly qualified staff who are well trained in relevant World Bank procedures and requirements, including procurement; segregation of functions/duties; and highly independent and well-trained internal auditors. A risk-based review of project activities will be carried out by the internal audit unit, which will report to the FPFMD on a quarterly basis. Reports will also be shared with the World Bank. 17. Accounting. The PIU and ECSU, in conjunction with the FPFMD, will account for IDA, EIB, and AFD funds as well as government contribution on cash basis, with separate records maintained to track commitments and assets. Accounting records will be maintained in foreign and local currencies (that is, U.S. dollars, euros, and Nigerian naira). All accounting and control procedures applicable will be documented in the FPM; regularly updated by the FPFMD; adopted by the PIU; and shared with the Government (Federal Ministry of Finance [FMoF], Office of the Auditor General of the Federation [OAuGF], and NIMC) and the World Bank. (a) Records and books of accounts. The PIU will maintain records of accounts which would include bank account details, bank statements, and bank reconciliation statements, as well as books such as cashbooks, ledgers, journals, fixed assets register, contract registers, and advance register. (b) The chart of accounts will facilitate the preparation of relevant monthly, biannual, and annual financial statements (AFSs). To ensure uniformity, the PIU and ECSU will adopt QuickBooks, currently in use by NIMC to maintain accounting records. The project will modify the existing accounting software with the capability of producing reports in format and contents acceptable to the World Bank. Information captured in the chart of accounts should include the following:  Financial contribution from all sources  Expenditure on each project component and activity  Assets and outstanding liabilities as at the end of each reporting period (c) Financial reporting. The FPFMD will render annual audited financial statements and periodic unaudited IFRs in the content, format, and frequency satisfactory to the World Bank. Page 65 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) (d) IFRs. Calendar semester IFRs will be prepared by the FPFMD for submission to the World Bank within 45 days of the end of each calendar semester. IFRs will include information provided for the period and cumulatively (for project life and year to date). The content of the IFR will include the following:  Sources and uses of funds (all sources including IDA, EIB, AFD, and counterpart)  Uses of funds by project component and expenditure category  Special account and drawdown account activity statement  Bank reconciliation reports  Bank statements (e) AFSs. On an annual basis, project AFSs will be prepared and submitted to World Bank within six months of the end of the government fiscal year by the FPFMD for the whole project. These will be prepared in accordance with applicable International Public Sector Accounting Standards. The contents of project financial statements consist of  A statement of funds received and expenditures incurred, showing funds from the World Bank, project funds from other donors and counterpart funds separately;  A summary of the activity in the special account and drawdown naira account;  A balance sheet;  A summary of the principal accounting policies that have been adopted and other explanatory notes;  A list of material assets procured to date with project funds; and  As an annex to the AFS, the project accountant should prepare a reconciliation of the amounts as ‘received by the project from the World Bank’, with those shown as being disbursed by the World Bank, which will be subject to audit. 18. External auditing. The FPFMD will appoint a relevant, experienced, competent, and independent external auditor based on terms of reference acceptable to the World Bank to perform the audit of the project. The scope of the audit will cover all project activities as summarized in the AFS. The auditor will express an opinion on the AFSs in compliance with International Standards on Auditing. Additionally, the external auditors will prepare the management letter giving observations and comments and providing recommendations for improvements in internal controls and compliance with financial covenants in the FA. In addition to the AFS, the audit report will include the following: (a) Project information and performance (b) Statement of project management responsibilities (c) Report of the independent auditor 19. Project preparation advance (PPA). In response to the request for financial assistance, the World Bank has extended an advance not exceeding US$3 million to finance activities as detailed in the PPA Agreement. The Borrower shall carry out its activities through the Federal Operations Coordinating Unit of the Youth Employment and Social Support Operation throughout implementation of the PPA, subject to maintaining FM arrangements and staffing acceptable to the World Bank. The Borrower will be required to prepare an audit of its financial statements before the refinancing date, covering the period indicated Page 66 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) in the PPA Agreement. The audited financial statements for this period shall be furnished to the World Bank not later than six months after the end of the period, in line with the PPA agreement. 20. Funds flow and disbursement. Project funding will consist of an IDA credit, co-financing from EIB, and AFD, as well as government counterpart funds. All project funds will be used in line with the project activities defined in the FA and for activities contained in the approved work program and budget for each year. Details on disbursement procedures will be included in the FPM. The disbursements from the World Bank will be made based on incurred eligible expenditures (transaction-based disbursement procedure). The FPFMD, on behalf of the PIU and ECSU, will open two project DAs with the CBN, one for each entity. Table 1.1. IDA Eligible Expenditure per Category Category Amount of the Credit Percentage of Expenditures to Allocated (expressed in SDR) be Financed (inclusive of Taxes) (1) Goods, works, non-consulting services, and 9,820,000 40% consulting services for Parts 1, 2 and 3 (except for enrollment activities under Part 2(e)(vi) of the Project (2) First tranche of enrollment activities under 21,140,000 40% of: (i) in respect of output- Part 2(e)(vi) of the Project based enrollment, total Unit Costs; and (ii) in respect of non-output-based enrollment, total expenditures incurred. (3) Second tranche of enrollment activities under 21,140,000 40 % of: (i) in respect of Part 2(e)(vi) of the Project output-based enrollment, total Unit Costs; and (ii) in respect of non-output-based enrollment, total expenditures incurred. (4) Goods, works, non-consulting services, consulting 30,100,000 100% services and Operating Costs for Part 4 of the Project. (5) Refund of Preparation Advance 2,200,000 Amount payable pursuant to Section 2.07 (a) of the General Conditions TOTAL AMOUNT 84,400,000 21. Banking arrangements. The specific banking arrangements are as follows: (a) PIU in NIMC. One DA for IDA, AFD, and EIB in euros will be managed by FPFMD within the OAGF for the PIU at NIMC. Two current (drawdown) accounts in naira to which drawdowns from the DA for NIMC will be credited in respect of incurred eligible expenditures (supplies and services, and outputs), maintaining balances in the account as close to zero as possible after payment. (b) ECSU. One DA for IDA, AFD, and EIB in euros will be managed by FPFMD within the OAGF for the ECSU. Page 67 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) One current (drawdown) account in naira to which drawdowns from the DA for the ECSU will be credited in respect of incurred eligible expenditures for supplies and services, maintaining balances in the account as close to zero as possible after payments. Figure 1.5. Account Structure (c) Signatories to the bank accounts. The authorized signatories for each account will consist of two panels (A and B).  Panel A consists of o Project coordinator, main, and o An officer not below the rank of a director from the parent ministry as alternates.  Panel B consists of o The director of the FPFMD as main; o Deputy director/sector head FPFMD as alternate I; and o Project accountant as alternate II. 22. Conclusion. The action plan in table 1.2 indicates the actions to be taken for the project to strengthen its FM system and the dates that they are due to be completed. Table 1.2. Action Plan Action Date Due By Responsible Entity 1 Agreement of formats of IFRs, AFSs, and Before effectiveness FPFMD and IDA external auditors’ terms of reference 2 Project internal auditor and project Cleared and assigned for the PIU FPFMD and PFMU Page 68 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) Action Date Due By Responsible Entity accountant seconded Pending for the ECSU by effectiveness 3 Appoint external auditor Within 90 days after effectiveness FPFMD and PFMU 4 Training of assigned project staff in the After effectiveness FPFMD and the World Bank FM procedures and World Bank Disbursement Guidelines 23. The FM assessment’s conclusion is that subject to the mitigation measures and the action plan being implemented according to the time frame, the project has met the minimum FM requirement in accordance with the World Bank IPF Policy and Directives. Further, this objective will be sustained by ensuring that strong and robust FM arrangements are maintained for the project throughout its duration. Detailed FM reviews will also be carried out regularly, either within the regular proposed supervision plan or a more frequent schedule if needed, to ensure that expenditures incurred by the project are reviewed and guidance provided to the project accountants to ensure eligibility. 24. Disbursements for selected activities under Subcomponent 2.5 are designed as output based. The project will reimburse costs incurred by NIMC’s enrollment partners financed through Activities 2.5.6 and 2.5.7, which offset the costs of registration for enrollment partners holding national licenses. Note that not all enrollments financed by Subcomponent 2.5 will fall under the output-based disbursement (OBD) arrangements. In particular, enrollments financed under Activity 2.5.7, which are carried out in the framework of geographically delimited contracts with NIMC, will not be eligible for OBD. 25. The output to be financed comprises three criteria: (a) the assignment of a new unique NIN; (b) the creation of a new validated record in the NIMS based on the deduplication of incoming personal (biographic and biometric) data; and (c) proof that the person received the NIN number and basic authenticator. Verification mechanisms for OBD will be based on the enrollment system data and will include (a) real-time verification facilitated by the implementation of a tamper-resistant third-party monitoring platform by NIMC (see Subcomponent 2.3.4) and (b) ex post verification through independent audits of the NIMS. The third-party monitoring platform will automatically issue the reports of enrollments which successfully meet the three criteria outlined above for the purposes of submission by NIMC for OBD payments. 26. All eligible enrollment partners will be categorized into one of three groups which will determine which type of disbursement they will be eligible for. Group A and Group B will both be enrollment partners issued national licenses to perform enrollments, and the expectation is that both groups will perform enrollments as an extension of their normal business activities. Group A will comprise public sector institutions (including MDAs) and select CSOs who will be eligible to acquire or lease required enrollment equipment25 at subsidized prices. The per-enrollment fee paid to Group A enrollment partners would be set initially to US$0.71. Group B will comprise private sector actors and interested development partners (for example, United Nations agencies) operating under national licenses, who will not be eligible for subsidized equipment, instead being expected to purchase or lease equipment at market prices and recoup costs through the per-enrollment fees. The per-enrollment fee paid to Group B enrollment partners would be set initially to US$0.90. The lack of prefinancing of enrollment equipment accounts for the higher per-enrollment fee paid to Group B. The initial amounts of these per-enrollment payments to 25A flow-on benefit of the equipment used by both Groups A and B is that it can also be used simultaneously or after mass registration for the delivery of services (for example, authentication). Page 69 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) Groups A and B would be revised, as appropriate, during implementation to recalibrate incentives for enrollment partners in response to monitoring data. Finally, Group C comprises any private sector firm, CSO, or development partner who are awarded contracts by NIMC to carry out enrollment drives in geographically delimited zones targeting groups that have been categorized as hard to reach. Because contracts for such geographically delimited enrollment drives will be awarded according to the procurement procedures applying to the rest of the project, they will not fall under the OBD arrangements discussed here. Figure 1.6. Types of Enrollment Partners 27. While partners in Groups A and B would be expected to perform enrollments alongside their normal business activities, Group C partners would carry out dedicated enrollment drives in their assigned geographical zones. Accordingly, Group C partners would be held accountable for specific coverage targets of NINs in their assigned geographical area, with any bids calibrated to an expectation that they will deliver a NIN to all residents of that geographical area. Partners in Groups A and B, in contrast, would only be held accountable for delivering a minimum quota of NIN registrations, with the quotas intended merely to ensure that they are indeed actively carrying out enrollments. Because Group A and B partners will be carrying out enrollments alongside their normal business activities, some of which may be relatively low volume, it is not expected that all partners in Groups A and B will necessarily deliver a very large volume of NIN enrollments. For such partners, the investment in enrollment infrastructure is Page 70 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) justified based on facilitating their full integration into the NIMS and mainstreaming of NIMC services, including authentication, into their everyday business practices. 28. To offset the up-front costs associated with acquiring the necessary enrollment equipment, NIMC may make such equipment available to ecosystem partners for lease. These leases would be at either subsidized or unsubsidized rates depending on the profile of the enrollment partner, as detailed earlier. The purpose of unsubsidized leases would be to offset the up-front cash outlay associated with acquiring equipment to relax any liquidity constraint and not to subsidize the overall cost of using the equipment itself. 29. Unit costs for Groups A and B have been calculated provisionally based on international experience with similar enrollment campaigns. These will be recalculated as necessary as further information is received. The estimated US$0.71 and US$0.90 per enrollment are mid-range values applying to Groups A and B, respectively. Due to transport and logistic costs, data collection in Sub- Saharan Africa tends to be more expensive than in other regions and, in general, data collection in Nigeria tends to be very expensive, especially when enrollment agents are expected to travel to enrollees’ places of residence instead of waiting for potential enrollees to come to them. This is explained by factors such as power outages, fuel shortages, the high cost of living, seasonal transportation difficulties, and damage to infrastructure because of the insurgency in other localities. The values estimated above may be reconfirmed by studies based on additional data collected during implementation and may be revised upward or downward accordingly, if appropriate. 30. The price for enrollments performed by actors in Group C will be determined on a case-by-case basis according to the World Bank procurement procedures, promoting value for money. The value of US$1.51 for Group C represents an estimated average value for all Group C contracts. The estimated unit cost for Group C is higher than those for Groups A and B because the enrollment arrangement corresponding to Group C (geographically delimited mobile enrollment campaigns) will primarily be employed for populations that are classified as hard to reach than average in a geographical mapping exercise (see Subcomponent 2.5.2). The arrangements applying to Groups A, B, and C are summarized in Table 1.3. and Figure 1.6. Page 71 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) Table 1.3. Enrollment Ecosystem Partners and Remuneration Arrangements Category Coverage Expected Procurement Disbursement Account Equipment Sector Expected Expected Unit Cost Type Acquisition Share of Enrollment (US$) Enrollments Cost (US$, (%) millions) Public sector 8 6.70 Group A National 0.71 Licensing only Output based Outputs Subsidized Civil society 2 1.68 Private 34 36.11 sector Group B National 0.90 Licensing only Output based Outputs Unsubsidized Development 1 1.10 partners Supplies Private 50 89.21 a Group C Regional 1.51 Tendered Standard and Unsubsidized sector Services Civil society 5 8.90 100 143.68 Note: a. Because these regional contracts will be tendered individually, including through competitive bidding, unit costs are unknown ex ante; however, because it is expected that the populations in tendered zones will be, on average, harder to reach than the populations enrolled by the ecosystem partners with national licenses, this figure is provisionally estimated at US$1.52 per enrollment. Page 72 of 110 The World Bank Nigeria Digital Identification for Development Project (P167183) ANNEX 2: Technical Design and Component Descriptions COUNTRY: Nigeria Nigeria Digital Identification for Development Project Component 1: Strengthening the legal and institutional framework (US$17 million equivalent, of which US$3 IDA, US$5 AFD, US$9 EIB) 1. This component will finance the development of a data protection and privacy legal and regulatory framework. Before detailing activities to be financed, deficiencies in the current legal and regulatory framework for digital ID in Nigeria are discussed. The subsequent text begins by detailing some of the key challenges before describing how deficiencies in the legal and regulatory framework will be addressed under the project. 2. Current absence of comprehensive data protection and privacy framework. Nigeria does not have a comprehensive data protection and privacy framework. The Constitution does grant a general right of privacy. However, because this right has not been codified in an implementing statute, the applicability and extent of this right is unclear. Also, the Constitutional right is expressly limited to citizens. Several sector-specific regulations have data protection and/or privacy protections of limited applicability. The NIMC Act, regulations, policies, and guidelines have provisions that seek to protect individuals’ right to privacy. In addition, other institutions have included in their legal frameworks stand-alone provisions to protect individuals’ right to privacy. However, these frameworks remain inadequate to ensure that the personal data of registered individuals is sufficiently protected and that individual privacy rights are appropriately guaranteed. Over the course of 2018, the project supported the Government, through the PPA, to draft a Data Protection Bill, which was passed by the National Assembly on May 16, 2019, and sent to the President for assent. However, the Data Protection Bill was not assented to due to various issues with the text, which will require a revised version to be sent back to the National Assembly before the bill is enacted. The draft which was not assented to by the President will be returned to the FMoJ with the reasons why it was not signed. The key stakeholders will be expected to address these reasons as part of the redrafting and then send it back to the National Assembly for enactment. Once it is enacted, the Data Protection Bill would provide a comprehensive harmonized national framework including standardized definitions for critical issues like privacy and other matters. The Data Protection Bill sent to parliament on December 11, 2018, was aligned with the EU General Data Protection Regulation (GDPR) as well as other relevant international privacy and data protection legislations to ensure compliance with international best practices. The bill also provides for the designation of an independent data protection authority to implement the law by serving as the national data protection regulator. The operationalization of this regulatory body will be necessary to reinforce and monitor compliance with data protection legislation. 3. Limitations on eligibility for registration. Under the NIMC Act, registration in the national ID system is limited to individuals who are (a) citizens of Nigeria; (b) lawfully and permanently resident in Nigeria; and (c) noncitizens lawfully resident in Nigeria for a period of two years or more. Temporary immigrants, asylum seekers, and stateless persons, for example, are ineligible for registration in the national ID system under the current law. Because the NIN is required for a range of transactions, with sanctions and penalties for defaulters, this could have an exclusionary effect on those ineligible individuals. To promote inclusion, the NIMC Act will be amended to remove such limitations on eligibility for registration which will ensure that a wider range of individuals are able to register. Documentation Page 73 of 113 The World Bank Nigeria Digital Identification for Development Project (P167183) requirements will also be set not to effectively raise the barriers to registration. Failure to remove limitations on eligibility from the NIMC Act threatens the universal coverage objective of the project. 4. Mandatory use of the NIN for access to services. The NIMC Act and accompanying regulations make the use of the NIN mandatory for various transactions, which will touch every Nigerian resident in their day-to-day lives. A more extensive list is contained in NIMC regulations. The types of transactions, online and physical, for which the use of NIN is mandatory, include accessing health and medical services; purchasing and registering motor vehicles; purchasing and using travel tickets for air, rail, road, and water transport; boarding aircraft, trains, commercial vehicles, ships, and boats; purchasing insurance; using cyber cafes; enrolling in schools; obtaining a driver’s license; operating a bank account; obtaining a loan; and applying for any local, state, or federal job, contract, or benefit. The regulations also extend the list to include any transaction, contract, or agreement for valuable consideration, which is extremely broad. No provision appears to be made for persons who do not have a NIN, whether because they are not eligible to register under the NIMC Act, such as stateless persons, temporary immigrants, asylum seekers, persons living in fragile or conflict affected areas, and visitors or have not yet registered (including for example, due to delays in the NIMC registration systems). The NIMC Act does not appear to render transactions carried out without the NIN void. However, the NIMC Act specifically makes it an offence (punishable by fine and/or imprisonment for individuals and by fine in the case of corporate bodies and line managers) to carry out (or permit the carrying out of) any transactions specified in the act as mandatory without a NIN. To mitigate these risks of exclusion and potential for criminalizing everyday activities, the NIMC Act will be amended to provide that the NIN will be the sole method of establishing an individual’s identity in Nigeria but will not be mandatory to carry out any transactions. In addition, the offences and penalties related to mandatory use of the NIN will be repealed. Individuals should continue to be permitted to establish their identity by alternative means. A ‘sufficiency’-based approach will ensure that the ID program is genuinely enabling and thereby reducing the risk of exclusion or discrimination. 5. Issuance of the GMPC. The NIMC Act places a mandatory obligation on NIMC to issue the NINs and GMPCs. Under the Mandatory Use of National Identification Number Regulations, 2015 and 2017 (MUNIN Regulations) issued by NIMC, the NIN is issued on a physical ‘slip’. Due to cost implications, NIMC is today prioritizing issuance of a NIN, over issuance of a GMPC. The form of the NIN slip and the GMPC are different in that the NIN slip only contains the NIN and the GMPC contains additional identifying information. Hence, the issuance of the NIN does not alleviate NIMC of its obligation to issue the GMPCs under the act. Due to budgetary constraints, NIMC has been unable to issue the GMPC in recent years. If NIMC remains unable to issue the GMPCs, or the preferred approach under the project omits the issuance of a GMPC, then it would be in violation of the NIMC Act. Accordingly, the NIMC Act should be amended to remove the requirement to issue the GMPCs or at least to make the issuance subject to the FGN’s discretion. 6. Absence of electronic transactions framework. Nigeria currently does not have a legal and regulatory framework governing electronic transactions and digital signatures (including PKI). The Electronic Transactions Bill should be finalized and enacted to support the successful implementation of the national ID system. 7. Ownership of personal data in the database. The Registration of Persons and Contents of the National Identity Database Regulations 2017, issued by NIMC pursuant to the NIMC Act, provides that all information contained in the National Identity Database is the property of the FGN. This provision is not aligned with global data protection and privacy best practice or the Data Protection Bill. While the Page 74 of 113 The World Bank Nigeria Digital Identification for Development Project (P167183) database itself may be owned by the Government, the personal data of individuals belongs to the registered individuals. Furthermore, the NIMC Act itself does not specify ownership of personal data or grant NIMC the authority to do so, potentially making this provision of the regulations void. Accordingly, the regulations will be amended to remove this provision and clarify that personal data are owned by the registered person but held by the FGN in trust. 8. Third-party access to personal data. The NIMC Act gives NIMC the power to provide information about a registered person to third parties without the person’s consent. The circumstances under which personal information can be shared are (a) where the disclosure is in the interest of national security; (b) where the disclosure is for the prevention or detection of crime; and (c) for any purpose as may be prescribed by NIMC in a regulation. These circumstances are vague and potentially unrestricted, and ‘third parties’ are not defined in the act although they are defined in the regulations. As a result, the current formulation raises substantial privacy concerns. The disclosure of personal information ‘for the prevention or detection of crime’ is also very broad and risks opening the door to the use of the ID system as a means of state surveillance, contrary to due process protections. The NIMC Act will be amended to narrow the ability of NIMC to share personal data, specify which third parties can receive such information, and prescribe obligations to apply to third parties who receive such information. In addition, regulations will be prepared to prescribe the specific processes under which these data will be shared in compliance with the Data Protection Bill. Apart from the amendment to the NIMC Act to address third-party access, the Data Protection Bill specifically addresses the issue of consent. This is reflected in the relevant provisions of the Data Protection Bill including the definition and application of consent, which largely mirrors the EU GDPR which sets the international standard on data protection. The current wording in the Data Protection Bill provides for the processing of personal data on the basis of “free, specific, informed, and unambiguous consent” of the data subject or on a “legitimate basis laid down by law.” 9. NIMC’s power to impose administrative fines. Regulations currently purport to empower NIMC to enforce the act, including through imposition of administrative fines. However, this power is not expressly granted in the NIMC Act and it is uncertain whether it can be read into other more general provisions. To ensure that NIMC’s enforcement powers are not subsequently curtailed by the courts, if challenged, the NIMC Act should be amended by expressly authorizing NIMC’s enforcement powers. 10. Barriers to migration of legacy data. Under the NIMC Act, NIMC’s powers include migration of legacy ID data from functional ID systems into the NIMS through “harmonization and integration of existing identification databases in government agencies and integrating them into the National identity database.” However, many of these existing databases are subject to laws, regulations, and/or policies that limit sharing of information. This may present a real challenge to such harmonization. To address this, the NIMC Act will be amended to ensure that relevant provisions relating to harmonization override contrary provisions in other statutes, except in limited circumstances. 11. Power to register births and deaths. Under current law, three entities have been charged with registration of births and deaths: NPopC, local government councils, and NIMC. First, concerning NPopC, the Third Schedule to the Constitution expressly provides that NPopC “shall have power to establish and maintain machinery for continuous and universal registration of births and deaths throughout the Federation,” and such power is implemented through NPopC Act. Second, concerning local government councils, the Fourth Schedule to the Constitution includes as a “main function” of local government council the “registration of all births, deaths and marriages.” Third, concerning NIMC, the NIMC Act states that NIMC “shall carry out the registration of births and deaths in Nigeria.” Of these three entities, only Page 75 of 113 The World Bank Nigeria Digital Identification for Development Project (P167183) NIMC is not granted its power by the Constitution. The power granted solely under the NIMC Act may present Constitutional questions as the Constitution has already expressly granted these powers to other entities. To date, NIMC has not exercised its power to register births and deaths and has indicated that it is currently uninterested in doing so. Also, in practice, the local government councils do not exercise the function of registering births and deaths and have instead ceded this function to NPopC. To address this issue, NIMC could cede its function of registering births and deaths under the NIMC Act to NPopC. However, this would not solve the underlying Constitutional conflict. A better solution would be to amend the NIMC Act to remove the provision purporting to grant the power, or at least clarify that NIMC’s use of information on births and deaths would be for the sole purpose of managing the national ID system. In an effort to address a series of legal conflicts, including this one, a national legal committee was established consisting of NIMC, NPopC, INEC, the National Health Insurance Scheme, and the Nigerian Police Force. The project will support the resolution of this issue through technical assistance as described below. 12. Constitutionality of the NIMC Act to govern a national ID system. The Constitution delineates powers governing three sets of legislative matters. Those matters on the ‘exclusive list’ can only be legislated by the National Assembly. Matters on the ‘concurrent list’ can be legislated by either the National Assembly or State Houses of Assembly. Any other ‘residual matters’ can only be legislated by the State Houses of Assembly. The Constitution provides in the exclusive list that the National Assembly is exclusively empowered to make laws regarding “fingerprints, identification and criminal records.” There is an ambiguity in this formulation: ‘identification’ can be interpreted broadly to encompass all identification matters (such as a national ID system) or to relate narrowly only to criminal records. The NIMC Act is an act of the National Assembly, but State legislation, such as the Lagos State Registration Agency Law, has also addressed identification systems and state agencies have implemented identification systems. Under the broad interpretation, the National Assembly would have the exclusive power to legislate on ID systems. In this case, the state legislation, and state actions already taken with respect to ID systems, could be deemed unconstitutional. A possible solution would be for NIMC to engage with state agencies to use their existing identification infrastructure as part of the national ID system. Under the narrow interpretation, national legislation addressing identification generally would not be justified under the exclusive list or the concurrent list and would be a residual matter that can only be legislated by the State Houses of Assembly. This interpretation could render the NIMC Act, and the implementation of the national ID system, unconstitutional. A possible solution would be to have state agencies use NIMC’s identification infrastructure to implement the national ID system on a state-by-state basis. A judicial decision would be necessary to arrive at a judicial determination of the applicable interpretation of the Constitution. Unless and until challenged in court, the NIMC Act and relevant state laws remain good law and are applicable until set aside. Thus, either solution would require legislative and administrative action, one at the national level and the other at the state level. Further analysis and dialogue with NIMC, the Federal Government, and relevant state bodies is likely necessary to settle on and implement a strategy for this issue. Support for engagement on this issue will be included in the component for technical assistance for legal and regulatory reforms under the project. 13. Legal framework for cybersecurity. Nigeria has a Cybercrime Act (2015) which aimed to also cover issues related to cybersecurity. However, a legislative review, conducted in 2018, found that this combined legislation does not provide for sufficient treatment of cybersecurity and recommended that Nigeria consider maintaining separate laws for each of these areas. It further recommended that amended cybersecurity legislation should clearly state the penalties for breaches of obligations by CNII holders rather than empowering the respective sectorial regulators—not all of which are yet in place—to define Page 76 of 113 The World Bank Nigeria Digital Identification for Development Project (P167183) the penalties for cybersecurity breaches in their sector and potentially cause misalignment of penalties across sectors. An amended law should also define the time line for the reporting of cybersecurity incidents, contain provisions for requiring cybersecurity service providers and products to be licensed, and establish clear powers of the national CERT to prevent and investigate cybersecurity breaches. The amended cybersecurity legal framework should also set standards for IT security of government information systems and databases. Subcomponent 1.1: Legal, regulatory, and enforcement framework for data protection, privacy, and cybersecurity 14. This subcomponent will finance the development of a robust legal, regulatory, and enforcement framework for data protection, privacy, and cybersecurity. This legal framework will ensure that personal data are lawfully collected, managed, and protected. This is essential to promote trust and confidence in the foundational ID systems which will ultimately support the Government’s broader digital strategy. Activity 1.1.1: Preparing a legal and regulatory framework for data protection 15. This activity will support the development of a robust legal, regulatory, and enforcement framework for data protection and privacy. The drafting and enactment of the Data Protection Bill is of utmost priority. The project will support the legislative process of the Government, including with technical and legal assistance, to ensure that the issues with the Data Protection Bill are addressed and that it is passed by parliament in a form that can be assented to by the President. Additionally, once the bill is enacted, a series of follow-on activities need to be implemented including the preparation of national policies, strategies, regulations, and enforceable guidelines to ensure the judicious application of the law. To mitigate conflict of laws and concurrent jurisdiction, repeals and amendments of stand-alone legislations and regulations will be conducted. Additional stand-alone legislation will be drafted to formalize governance arrangements including the data sharing framework between NIMC and other public institutions. Activity 1.1.2: Preparing a legal and regulatory framework for cybersecurity and cybercrime 16. The entire cybersecurity legal framework will undergo reform under this activity. This will include support for the amendment of the current Cybercrime (Prohibition, Prevention, Etc.) Act, 2015 (Cybercrime Act) to increase focus on cybercrimes and empower the Nigeria Computer Emergency Response Team (ngCERT)26 and/or sectoral CERTs through administrative, monitoring, and enforcement provisions. Support will also be included for the drafting of a separate cybersecurity act to provide increased focus on cybersecurity. The drafting and enactment of relevant secondary legislation will also be supported. Activity 1.1.3: Preparing a legal and regulatory framework for electronic transactions 17. A legal and regulatory framework governing electronic transactions and digital signatures will be drafted and enacted. This activity will include support for the drafting and enactment of the current Electronic Transactions Bill or equivalent legislation, as well as any necessary updates to the legal 26 ngCERT aims to achieve a safe, secure and resilient cyberspace in Nigeria that provides opportunities for national prosperity. It prepares, protects, and secures the Nigerian cyberspace in anticipation of attacks, problems, or events. Page 77 of 113 The World Bank Nigeria Digital Identification for Development Project (P167183) mandates of institutions charged with implementing electronic transactions legislation. For example, if the current Electronic Transactions Bill is enacted, then the NITDA legal framework would also be amended to give effect to its proposed legal mandate to regulate, monitor, and enforce Electronic Signature Certification Services. A set of legal and regulatory instruments, including regulations, will also be prepared across the various legislations. Subcomponent 1.2: Institutional and governance framework 18. This subcomponent will strengthen the institutional and administrative frameworks of the ID ecosystem. This will include strengthening of governance arrangements, monitoring, enforcement, harmonization, and accountability mechanisms. Under this subcomponent, links will be made with the regulatory reforms undertaken with World Bank Finance, Competitiveness and Innovation (FCI) and IFC operations related to AML/CTF, credit information, and SIM registration to support open access to the financial and mobile sectors. Activity 1.2.1: Institutional and governance reform for key relevant institutions 19. A series of legislations and regulations will be drafted and/or amended to support institutional and administrative governance. NIMC and other institutions such as NPoPC, NITDA, and ONSA will be supported to restructure their legal and regulatory framework to improve their governance processes including licensing, monitoring, and enforcement to ensure that they implement the ID system in a lawful, nondiscriminatory, and inclusive manner. Concerning the NIMC Act, key provisions such as limitations on eligibility for registration, mandatory use of the NIN for access to services, validity period of NIN, issuance of the GMPC, limited enforcement powers, and limited powers to request information from public agencies will be amended under the project. Concerning data protection, a study could be financed to advise on the most suitable institutional arrangement for the necessary independent data protection authority required to implement the new data protection law. The findings of the study would provide support to the development of the legal, institutional, and governance frameworks for the data protection authority, which will be essential to enforce and monitor compliance with data protection legislation. Concerning civil registration, the engagement with NPopC to develop new mechanisms for digital registration of live births, digital processing, and archiving of CR records may reveal inadequacies in the present legal and regulatory framework for civil registration, including institutional legislation for NPopC. In this case, appropriate revisions would be supported under this activity. Subcomponent 1.3: Institutional capacity building and technical assistance 20. This subcomponent will finance capacity building for key institutions in the ID ecosystem. The legal reforms under this project will lead to significant restructuring of institutional, governance, and enforcement mechanisms for key institutions. It is essential that these institutions are provided with capacity building to effectively implement their restructured roles. The new data protection authority will require substantive capacity building to ensure their effectiveness from the onset. Activity 1.3.1: Institutional capacity building 21. A skills gap analysis will be conducted to determine the gaps and weaknesses that need to be strengthened across institutions. Institutional, governance, and enforcement instruments will be Page 78 of 113 The World Bank Nigeria Digital Identification for Development Project (P167183) developed for the data protection authority. Capacity building will also be provided in the form of formal training, study tours, and workshops. Activity 1.3.2: Technical assistance 22. Technical assistance will be provided to the data protection authority, NIMC, NPoPC, and FMoJ. A legal person will be recruited to coordinate the various legislative reforms across the various institutions. Component 2: Establishing a robust and inclusive foundational ID system (US$306 million equivalent, of which US$59 million IDA, US$78 million AFD, US$169 million EIB) Subcomponent 2.1: Reinforcing the NIMS 23. This subcomponent will finance the reinforcement of the NIMS. Managed by NIMC, the NIMS, lies at the heart of the foundational ID ecosystem and provides a comprehensive database of all persons in Nigeria and all Nigerians abroad, with uniqueness guaranteed by biometrics. By linking with the digital CR system (at NPopC), the robustness, coverage and legal validity of the foundational ID ecosystem will be ensured in the long term. The NIMS will also support authentication of unique identity at the point of service delivery or client/beneficiary onboarding (see Component 3 for details.) 24. The NIMS generates and manages NINs over the life cycle. NIN generation will ensure uniqueness and randomness of assigned numbers. For newborns, NINs will be generated without biometric data, meaning that uniqueness may not necessarily be guaranteed. Biometrics will be captured at a later date, at which time the deduplication process will be completed. Activity 2.1.1: Reinforcing deduplication capacity at NIMC 25. A study will be carried out to assess the costs and benefits of implementing different biometric technologies in the Nigerian context. Automated deduplication can be implemented using various biometric technologies, each with its strengths, weaknesses, and cost implications. Rapid technological advances mean that yesterday’s best practice can be inefficient or ineffective today. In addition, the quality of biometric data that can be collected is highly specific to the target population, limiting the ability to generalize from international experience. To assess these costs and benefits in the Nigerian context specifically, the project will finance a study examining the marginal costs and benefits of adopting different biometric technologies and modalities, as well as different options for deduplication. The key processes to be investigated will include (a) biometric enrollment; (b) deduplication (1:n); and (c) verification/authentication (1:1). Topics of focus could include the added value of (a) implementing iris scans; (b) requiring fingerprint images to be collected with four-finger (‘4-4-2’) scanners; (c) implementing multiple Automated Biometric Identification Systems (ABISs); (d) implementing multiple biometric matching algorithms, optimized for different situations; (e) optimizing the matching workflow or middleware; and (f) having manual adjudication in biometric matching. Advances in privacy and security as well as vendor lock-in resulting from biometric technologies will also be investigated. 26. NIMC’s capacity to automatically deduplicate records using biometrics will be reinforced. Based on the results of the above study, the project will make targeted investments in NIMC’s back-end automated biometric matching systems to increase the efficiency, reliability, and scalability of NIMC’s ID Page 79 of 113 The World Bank Nigeria Digital Identification for Development Project (P167183) services by allowing deduplication to occur in real time with minimal manual intervention. Investments in biometric matching systems will also support using ID to access services (see Component 3 for details.) Activity 2.1.2: Reinforcing back-end systems at NIMC 27. Additional systems integration services will be procured to supplement existing systems integration and facilitate implementation of new IT systems and ensure compatibility with existing NIMC components that will be reused. The systems integrator(s) will take the lead in software integration across modules; redesign of parts of the overall system architecture to increase efficiency and integrate new components financed under this project; addition of new features, such as selected privacy-by-design mechanisms; transition management; systems deployment and maintenance; and training of NIMC system administrators and ensuring of knowledge transfer. 28. Back-end capacity will be reinforced. To allow NIMC’s systems to scale up, their back-end systems will need to be resized to accommodate the throughputs required to function reliably at scale. Investments could include expanding capacity of servers and communication links to meet storage and bandwidth requirements; renewing and expanding the scope of current software licenses, as needed; ABIS upgrades; upgrading power backup systems; improving last-mile systems; and replacing or upgrading end-of-life hardware. 29. Test environments will be added. These test environments (such as sandboxes and test beds) are necessary to protect production when software patches are tested and new functionalities are introduced. 30. Redundancy of critical IT assets will be improved and single points of failure eliminated. To maintain trust in the NIMC system and for it to operate effectively at scale, all IT systems should be fully redundant to prevent service interruptions due to component failures, cyberattacks, outages, upgrades, and so on. Full redundancy could also be extended to the Disaster Recovery Center (DRC) to further increase systems’ availability. 31. The current DRC’s capacity will be further reinforced, for example, by resizing and upgrading it to make it fully online (active/active mode) and thus highly available so that production can be swiftly switched in case of a disaster happening at the main NIMC Data Center. 32. New back-office management tools will be acquired to increase NIMC’s productivity. New systems to improve NIMC’s operational capacity may be implemented, including an Electronic Document Management System, Enterprise Backup System, and a Visitor Management System. Activity 2.1.3: Reinforce telecommunication links 33. The activity will finance improved telecommunications links between NIMC's critical bank-end sites. Rapid data links are critical to maintaining NIMC's quality of service and allowing it to scale up. The project will finance (a) a preliminary study to identify bottlenecks and recommend targeted improvements to inform the final design and (b) leasing of telecommunications bandwidth as appropriate under this activity. Page 80 of 113 The World Bank Nigeria Digital Identification for Development Project (P167183) Activity 2.1.4: Reinforce human resources at NIMC 34. Human resources will be reinforced and restructured to allow NIMC to carry out its new mandate. Under the Strategic Roadmap, NIMC will shift its primary focus away from performing enrollments and toward managing identification and authentication services on the backend level and regulating an ecosystem of functional ID providers and enrollment agents. As NIMC adjusts to this new mandate, its human resources will need to reflect this shift in institutional priorities. To this end, a complete inventory of NIMC’s current human resources will be carried out, including a gap analysis in light of NIMC’s new business needs. Based on the results of this study, a comprehensive staffing plan will be developed to reassign staff and provide for the creation and expansion of certain business units and the reorganization of others. A change management plan, with provisions for training for all new or reassigned staff, will also be developed. The project could finance expert consultants to provide training, perform key technical functions on a temporary basis, or facilitate knowledge transfer to regular NIMC staff, while regular staff working in newly created or expanded business units on an ongoing basis would be financed out of NIMC’s normal operating budget. Activity 2.1.5: Developing specifications for key systems 35. The activity will finance technical assistance for developing technical specifications for core systems to be financed under the project. The project will make substantial investments in NIMC’s capacity, including at the backend, for managing enrollment and for the provision of authentication services. Technical assistance will be needed to draft technical specifications and bidding documents for these systems. Subcomponent 2.2: Reinforcing the foundational ID ecosystem 36. This subcomponent will support the foundational ID system’s capacity to deliver NINs at birth as part of the birth registration process through links with a digitized civil registry. NIMC and NPopC are partners in the foundational ID ecosystem, with complementary roles and responsibilities. Under the project, NIMC’s role will focus on its core mandates of identification and NIN management, provision of authentication services, and regulation of the national ID ecosystem. NPopC will be charged with the continuous registration of births and deaths, as well as maintaining a database of filiation. At maturity, links between the digitalized CR database (managed by NPopC) and the NIMS (managed by NIMC) will allow NINs to be issued at birth and revoked at death in real time. Linking of the NIMS to the CR is critical to the long-term strategy as appropriate links of the ID system to birth records are necessary to ensure that the national ID credential is as robust as possible and also that sustainability is ensured through integration with continuous mechanisms to register the flow of new persons into the foundational ID system at birth and death. 37. This activity is part of a multiphased approach to reinforcing the CR side of the foundational ID system and will be followed by further investments in a potential Phase II. The present project, which is conceived of as the first of a multiphase investment in ID in Nigeria, will make targeted investments in NPopC to build its capacity and digitalize key systems. These initial investments will be to bring the CR fully into the digital age, reinforce capacity on the central level, and pilot new mechanisms for digitalized registration of births and deaths on a subnational level, before scaling in a potential Phase II project. Activity 2.2.1: Capacity assessment and institutional mapping of NPopC Page 81 of 113 The World Bank Nigeria Digital Identification for Development Project (P167183) 38. This activity will also support a complete inventory and evaluation of the state of the CR system to better understand the investments required to allow digitalization of the process for registering births and deaths and eventual digitization of legacy records. This inventory will include a mapping of local CR offices, an evaluation of the state of local CR officers and other decentralized infrastructure, recording of the organizational structure of NPopC, an evaluation of NPopC’s current human resources,27 and an evaluation of processes currently in place for registering births and deaths. An evaluation of the quality of paper-based archives and their potential for digitization will be included. This study will also inform the preparation of a potential Phase II which would scale up digital CR. Activity 2.2.2: Creation of a national digital civil registry database 39. A centralized CR database will be put in place. To provide the back end to support digital registration of new births and deaths, as well as the management of vital records, the project will invest in a fully digital CR back-end system for NPopC. In additional to the development and implementation of this database, this activity will also finance maintenance during the project period, as well as training and full knowledge transfer to NPopC staff for management and maintenance going forward. Activity 2.2.3: Supporting interoperability between the NIN and CR databases 40. Technical policies and protocols will be elaborated to allow interoperability between the NIMS and CR system. These technical policies and protocols will allow for data transfer between the NIMS and CR systems and support and reinforce the legal framework (for example, data privacy safeguards, sanctions, and penalties for misuse). Interoperability between NIN and CR systems will ensure that, going forward, the uniqueness of vital records can be ensured using the NIN. Activity 2.2.4: Developing and piloting mechanisms for continuous digital birth registration and delivery of a NIN at birth 41. This activity will finance the development of new digital mechanisms to facilitate the provisioning of NINs to individuals newly registered in the CR system. The foundational ID system will develop mechanisms for decentralized digitalized registration (for example, health centers in communities) of new vital events and decentralized printing of any required documents. Digital data collection will allow near-real-time creation of a birth records in the centralized CR system and issuance of a NIN attached to this birth record. These mechanisms will entail a comprehensive approach to digitizing the process for registering births; creating, managing, and archiving birth records; and issuing birth certificates. The development will attend to change management aspects related to digitalization of the existing analogue systems, including aspects linked to people, processes, technology, as well as legal and institutional aspects. Development of these new mechanisms will be iterative, including extensive field testing and adjustment to ensure that they are fit to be rolled out at scale in the potential Phase II. Once the mechanisms have been developed, this activity will also finance pilots of these new mechanisms on a subnational scale to prepare for scale up. In the development and testing of these new mechanisms, the project will finance a study to determine the ideal approach and will work closely with actors who 27The human resources study will develop a budgeted human resources plan for NPopC including hiring, reassignments, retraining, outside expertise, change management, and so on for central back-end level and also field operations level. Page 82 of 113 The World Bank Nigeria Digital Identification for Development Project (P167183) have experience in innovative mechanisms for birth registration in Nigeria and elsewhere, including UNICEF, to benefit from their technical expertise in this area. Activity 2.2.5: Developing and piloting mechanisms for continuous capture of biometric data for young adults 42. This activity will also finance the development of complementary digital mechanisms to allow the biometric data of young adults, who were assigned a NIN at birth, to be collected once those persons reach the appropriate age. Such mechanisms may involve sending itinerant agents of NPopC or NIMC to schools, health centers, or other appropriate sites to collect biometric data of youth to complete their records in the NIMC system. The development of these mechanisms will follow a similar approach to that described in Activity 2.2.4. The activity will also finance pilots of these mechanisms on a subnational scale to prepare for scale-up during the potential Phase II. Subcomponent 2.3: Development of the enrollment ecosystem 43. An ecosystem enrollment model entails new risks for data protection and security. The Strategic Roadmap moves from an enrollment model where NIMC collects data by itself to an ecosystem approach where partners collect data on NIMC’s behalf. Although justified for efficiency reasons, this ecosystem approach entails new risks for system security and data protection as NIMC loses the ability to directly monitor the performance and quality of enrollment agents, and NIMC’s ability to directly enforce adherence to SOPs to enrollment is also reduced compared to working with their own staff. The software, hardware, and procedures used for enrollment must therefore be adapted to an uncontrolled environment (in person to remote control). To ensure data quality new measures are needed. Activity 2.3.1: Review and revise data standards and enrollment procedures 44. NIMC’s standards and procedures require updating to be compatible with the approach laid out in the Strategic Roadmap. Today, the NIMC database system contains over 80 data fields for which data must be collected for all NIN holders. In addition, the data must be proofed against physical breeder documents before the data can be considered validated and the NIN generated. In recognition of the costs to efficiency, accessibility, and scalability of continuing with this approach, the Strategic Roadmap specifies that the number of fields will be reduced and that documentary evidence of identity will become optional for obtaining a NIN. 45. Data and identity-proofing requirements for NIN issuance will be reviewed to ensure efficiency and accessibility. In consultation with the Harmonization Committee, NIMC has already developed a revised list of required and optional data fields that reduce the total number of required fields from 80 to 10. Under this activity, this will be further optimized. The modalities for collecting biometric data will be updated in light of the conclusions of the study conducted in Activity 2.1.1, in particular regarding the appropriateness of iris technology and 4-4-2 fingerprint scanners. Additionally, identity-proofing requirements will undergo review to ensure that the enrollment model allows fulfilment of the Pillars of Inclusion. Semantic requirements for biographic data will also be reviewed to facilitate migration of legacy data as well as future interoperability with the CR and functional ID systems. 46. Functional specifications for enrollment hardware and software will be developed. The activity will finance technical assistance to develop functional specifications, including drafting of any relevant Page 83 of 113 The World Bank Nigeria Digital Identification for Development Project (P167183) bidding documents, for the systems required to perform enrollments, including software and hardware aspects. The specifications will take into account the need to collect high-quality data as inclusively as possible while maximizing privacy and data protection and minimizing cost. Activity 2.3.2: Review and revise software used for enrollment 47. Standardized enrollment software will be used by all enrollment partners. For reasons of data protection, information security, and efficiency, as well as effective monitoring and quality control of the enrollment environment, the entire ecosystem will use standardized software that is developed and maintained under the supervision of NIMC. Software will be adapted to run on multiple platforms (for example, mobile and desktop), as well as online and offline use cases. The software will be updated frequently and iteratively over the course of implementation to best meet the needs of enrollment partners and take into account feedback from the field. 48. Enrollment software will be updated to improve monitoring of the enrollment environment. Increased collection and use of metadata—including location data, processing time, operator authentication attempts, any errors encountered, and so on—could allow for more effective monitoring of the enrollment environment and allow corrective action in case of noncompliance or fraudulent activity on the part of enrollment agents. These monitoring tools will also allow for an audit trail, in cases of poor data quality, so that the problem could be diagnosed and addressed. At the operator level, software could require strong authentication of operators to reduce fraud during data entry and enable effective sanctions for operator performance.28 All of the above would increase NIMC’s capacity to monitor and manage agents remotely and reduce reliance on ecosystem partners for managing enrollment agents and incoming data quality. Mobile Device Management could allow centralized management of all enrollment terminals and associated permissions. In all cases where such metadata are collected, they would be subject to the prevailing regulation on the protection of personal data, and enrollment systems and procedures used to collect such metadata would be implemented accordingly. 49. Enrollment software will be updated to reinforce security, data quality, and data protection. For details, see Subcomponent 2.4. 50. Enrollment software will allow offline data collection to increase accessibility. Performing enrollments without connectivity is necessary to enroll populations who are not in areas with good-quality network connections. Offline data collection, however, poses additional challenges compared to online data collection, with impacts on the ability to monitor the enrollment environment, manage devices, and issue NINs in real time. Due to this complexity, the project will finance pilot data collection in offline areas to test and refine the software and procedures for offline environments before scaling offline enrollment. 51. Enrollment software will also manage the decentralized personalization and distribution of basic authenticators to enrollees. Due to the size and complexity of the Nigerian context, including the very large rural population, decentralized personalization of basic authenticators in the field by enrollment agents will be required to allow them to be distributed in real time, thus eliminating any 28Experience from the rollout of Aadhar in India shows that lack of strong, multifactor authentication for enrollment operators can constitute a significant source of fraudulent enrollments. Page 84 of 113 The World Bank Nigeria Digital Identification for Development Project (P167183) logistical costs associated with delayed distribution and eliminating wait times.29 Enrollment software will include functionality to personalize basic authenticators in the field and allow NIMC to effectively monitor their distribution. 30 52. NIMC’s capacity to manage ongoing software development will be reinforced through the provision of one full-time equivalent (FTE) software developer in the NIMC PIU. Given the complexity of the enrollment ecosystem, software will need to be updated regularly to respond to lessons learned from the field and any feedback from the GRM and adapt to new security threats. In addition, any software- relevant conclusions of the regular security audits will need to be integrated into the software. Overall, an iterative approach to software development is required, and NIMC will require internal capacity to manage this process and liaise with and manage external firms retained to carry out these substantive revisions. This activity will finance one FTE with a developer profile in the NIMC PIU to perform any day- to-day adjustments and manage and coordinate the work of software vendors. This FTE will work with and build the capacity of the existing NIMC staff to manage software development. Activity 2.3.3: Review and revise standards for enrollment hardware 53. Hardware specifications will be reviewed to reinforce security, ensure accessibility, and promote compatibility with existing systems. The enrollment ecosystem will need to support the various monitoring and authentication mechanisms implemented at the licensing and software levels. For example, if location data for each enrollment are necessary for monitoring of enrollment agents, and the software is configured to require a location stamp for each enrollment, then the hardware standards could specify a Global Positioning System sensor as part of the required hardware for enrollment. To facilitate decentralized distribution of basic authenticators by enrollment partners, the required enrollment hardware package will also include a device for personalizing the basic authenticator. Functional and/or technical specifications for hardware will be developed, as appropriate, for all required hardware, and these specifications will be used as a reference for the procurement of all hardware used for enrollment. This includes hardware procured by NIMC and any hardware procured by licensed enrollment partners or their subcontractors. Unless technical specifications are necessary to meet the project’s goals, functional specifications will be privileged to preserve an open market for hardware. NIMC’s specifications will be aligned with global standards as appropriate, for example, for biometric scanners, to ensure adequate image quality. Hardware specifications should be flexible enough to keep costs manageable and avoid vendor lock-in while also being exacting enough to maintain data quality. Hardware specifications will be reviewed continually during implementation to integrate lessons from field experience and to incorporate new technologies that may become available. 54. Hardware specifications will be developed to facilitate the use of mobile enrollment devices (such as integrated biometric tablets) with a portable form factor and not limit enrollment partners to using traditional PC-based enrollment kits. Reaching the entire population, including the poor, remote, and most vulnerable, will require enrollment partners to proactively approach the population where they reside instead of requiring them to travel to an enrollment center. To facilitate this strategy, NIMC’s hardware specifications will allow for portable-, mobile-, and/or tablet-based form factors. Portable units’ 29 Note that the Nigerian postal system does not have adequate capacity to allow reliable after-the-fact distribution of authenticators, in stark contrast to many good practice examples, notably India. For this reason, the project privileges real-time personalization and distribution of authenticators whenever feasible. 30 Note that the data protection risks of such decentralized personalization by enrollment partners are minimized because the basic authenticator does not include fingerprint data. Page 85 of 113 The World Bank Nigeria Digital Identification for Development Project (P167183) lower power consumption, small form factor, and ability to be charged using portable solar panels can increase the reach of enrollment teams into areas without electricity. When combined with software that provides for offline data collection, this can allow for enrollments in totally non-connected environments to reach the remotest populations. Tablets can also be less costly than kits based around a PC, especially if the latter must be acquired solely for the purpose of performing biometric enrollments. If tablets also contain biometric and other peripherals integrated into one form factor, this can increase hardware security, reduce the risks of tampering and spoofing, and also increase durability in harsh enrollment conditions. At the same time, PC-based form factors will also be provided for in the hardware specifications to accommodate legacy equipment and the differing business needs of different ecosystem partners, not all of whom may perform itinerant enrollments. Activity 2.3.4: Implement a system for monitoring and verifying enrollments 55. This activity will support the development of a tamper-resistant system to allow monitoring and automatic reporting of successful enrollments. Such a system is necessary to engender trust and accountability in the enrollment ecosystem, particularly for the payment of per-enrollment fees through OBD for successful enrollments. This system will also allow real-time monitoring of progress toward enrolling the population while enabling tracking of the dispersion of enrollment efforts over geographic and socioeconomic groups. The enrollment ecosystem will require centralized systems to implement Mobile Device Management to ensure data quality and security, authenticate and manage the authorization permissions of enrollment agents, and provide a tamper-proof audit trail of enrollment activities. In addition to allowing for monitoring of the work of ecosystem partners, this system will allow for independent verification of the performance of the enrollment ecosystem, including number of NINs successfully generated and number of authenticators successfully delivered, providing a basis for OBD under Activities 2.5.6 and 2.5.7. Activity 2.3.5: Licensing and assurance of enrollment partners 56. This activity will support the development of licensing, assurance, and onboarding requirements for ecosystem partners to ensure that data- and service-quality standards are maintained. All enrollment partners will need to undergo an assurance process to make them eligible for a license to carry out enrollments under the project. Such an assurance process is necessary to provide NIMC control over the enrollment environment by vetting potential enrollment partners in terms of their financial, technical, and operational capacity and ability to deliver the desired user experience and thus minimize reputational risk for NIMC; identify potential motives to commit fraud; and ensure that all enrollment operators have undergone the required training. This assurance process will be performed under the auspices of NIMC, although it may be wholly or partially outsourced to a trusted third party for reasons of efficiency and efficacy. The assurance process may include a combination of methodologies designed to balance needs for oversight and efficiency and may draw upon self-assertion methods31 for certain aspects of the process. Obtaining an enrollment license will require providers to go through multiple stages to ensure the quality of enrollment partner solutions, with applicants required to complete all stages of the 31In a self-asserted certification approach, enrollment partners submit evidence of their compliance to standards and requirements, with accurate reporting encouraged through various means, including public listed for anyone to scrutinize. One working example of such an approach is OpenID Certification (https://openid.net/certification/). Page 86 of 113 The World Bank Nigeria Digital Identification for Development Project (P167183) process before being allowed to operate in a live environment.32 Throughout the assurance process, NIMC will support ecosystem partners to ensure that they have a complete understanding of the requirements for implementation and how they can ensure that their solutions are compliant with standards. Such support could include the provision of test environments, compliance toolkits, and access to technical support for integration. Full compliance with all aspects of the assurance process will be a necessary pre- requisite for the issuance of a license to operate as an enrollment ecosystem partner on behalf of NIMC. The licensing, assurance, and onboarding framework must provide adequate quality controls, monitoring capacity, and protection for users’ personal data before enrollment licenses can be issued and before ecosystem enrollments can begin (for details on disbursement conditions, see annex 4). Subcomponent 2.4: Reinforcing information security and privacy 57. Information security foundations. To strengthen the safeguarding of private data and ID systems, activities to provide the necessary cybersecurity foundations will be supported under the project. These include (a) a cybersecurity architecture for the ecosystem to work in complementarity with the technical design of the ecosystem ex ante and by design; (b) a Cybersecurity Work and Action Plan with clear delineations of responsibilities and roles to be created and implemented, with annual evaluation and revisions as needed; (c) a set of compliance standards for cybersecurity across the ecosystem to be included in the licensing requirements for partners and to be based on existing policies and procedures, such as the National Guidelines for the Protection of CNII; (d) a Trust and Transparency Framework for the ecosystem; and (e) strengthening of the International Organization for Standardization (ISO) 27001 certification (further details are provided in paragraph 62). Other activities, as recommended by follow- up studies undertaken during implementation of the project, may be added to this list. 58. Security at the back end will be bolstered to ensure that integrity of the database is maintained and personal data are protected against attacks. The current database management system will be upgraded to enable the encryption of personal data at rest and data separation in accordance with good practices for the protection of personal data. Activity 2.4.1: Conduct privacy audits, IT security audits, and maintain certifications 59. The project will finance regular independent privacy audits, conducted by a third party with a proven track record. These audits would include in their scope the design and implementation of the main data systems and processes financed by the project, including enrollment systems and authentication services, to ensure that they implement best practices of privacy by design.33 These privacy audits should be carried out at least on a yearly basis, starting during the early phases of the design and implementation of data collection process systems. These privacy audits will identify key risks of the project for the privacy 32 One example of this approach was the GOV.UK, in which the United Kingdom Government onboarded identity providers into the GOV.UK Verify federation. The onboarding process consisted of an initial planning stage, called a ‘gate’, followed by technical and UX gates, and an operational gate (each including multiple sub-gates, as required). Providers were required to complete all gates before being allowed to operate in a live environment. The operational overhead related to providing such an onboarding process was, in this case, justified by the quality of provider solutions, which greatly increased due to interaction with the regulation authority and the risk of noncompliance reduced considerably. 33 The seven foundational principles of the privacy by design approach are (a) proactive not reactive, preventative not remedial; (b) privacy as the default setting; (c) privacy embedded into design; (d) full functionality—positive-sum, not zero-sum; (e) end- to-end security—full life cycle protection; (f) visibility and transparency—keep it open; and (g) respect for user privacy—keep it user centric. Page 87 of 113 The World Bank Nigeria Digital Identification for Development Project (P167183) of beneficiaries and produce a corrective action plan including recommend mitigation measures. The full reports of these audits will be made available to the PESC and the data protection authority. 60. The project will finance regular, independent security audits by certified external parties. The scope of these IT security audits will be well defined and include back-end servers, ABISs, manual biometric adjudication systems, DRCs, enrollment systems, authentication systems, communications systems, and so on and could include proactive penetration and vulnerability testing. Special attention will be given to the IT systems running within uncontrolled environments. 61. Enrollment software will be updated to reinforce security, data quality, and data protection. For data protection, the software will implement good practices for encryption, in particular in-memory encryption, as well as unsynchronized data deletion after a specified period. Tamper prevention and data integrity will be ensured through measures such as digitally signing and hashing software configurations files, audit trails, and metadata, as well as registering and authenticating sensitive devices and peripherals, such as fingerprint scanners. The software will be configured to perform quality checks of the incoming biometric data in real time to allow any poor-quality data to be recaptured while enrollment teams are still in the enrollee’s presence, thus avoiding costly repeat operations. 62. Extend the scope and renew the ISO 27001 certification. Strengthening of the ISO 27001 certification of NIMC through the expansion of the corresponding Information Security Management System to include the DRC and critical subsystems such as the servers and workstations used for post- deduplication manual adjudication. Activity 2.4.2: Reinforcing cybersecurity capacity for ID 63. Intelligence monitoring, detection, and analysis. An important first step for cybersecurity is collecting intelligence on potential threats and risks. Activities supported are the following: (a) A risk analysis (b) Systems and software to enable capable threat intelligence for the ID ecosystem (c) An ID-SOC and team that will undertake threat intelligence and monitor the critical information infrastructure assets of the sector (d) Tools to detect human and physical vulnerabilities (e) Fraud detection tools (f) Capacity building and ongoing skills development for NIMC and selected ecosystem partners, with a strategy to overcome staff turnover challenges 64. Prevention. Once hackers have successfully penetrated a system, mitigation and recovery can become costly endeavors in terms of time, effort, and budget. The key element of a cybersecurity program is therefore prevention. This project will support the following: (a) technical solutions for the safe transfer and interoperability of data between the ecosystem and NIMC through encryption and standards; (b) reinforcing of PKI for identification through upgrades; (c) regular Cyber Risk Assessments of NIMC and the ecosystem; (d) regular audits of NIMC infrastructure and processes by external vendors; and (e) regular penetration tests by external vendors, certified ethical hackers, and potentially by government entities such as CERT to identify vulnerabilities. Page 88 of 113 The World Bank Nigeria Digital Identification for Development Project (P167183) 65. Enforcement within ecosystem. As the hub in the hub-and-spokes model of the national ID ecosystem, NIMC’s role is to enforce the cybersecurity of its partners. To achieve this, the project will support (a) a cybersecurity evaluation and audit framework for the ecosystem partners; (b) regular cybersecurity audits of partners spanning government agencies and private sector-licensed partners to ensure compliance; (c) certification of the ecosystem partners’ hardware and software used for NIMC business; and (d) cybersecurity requirements for the licensing of ecosystem partners. Some of these will be harmonized with provisions in the licensing and assurance framework and onboarding requirements for ecosystem enrollment partners. 66. Reporting, response, and mitigation. The Nigerian Cybersecurity Strategy and Policy Framework encourages sectors to establish their own emergency response mechanisms. The national-level CERT, housed at the ONSA, is complemented by a CERT for the finance and banking sector housed at CBN and a CERT for the government sector housed at the NITDA. This project will therefore support reporting, response, and mitigation activities for the national ID sector, including (a) establishment of an ID-CERT to link to the CERT and provide the necessary sectorial support; (b) institutional, governance, and technical mechanisms and procedures for ecosystem partners to report incidents to the ID-CERT; (c) response and mitigation tools, mechanisms, and procedures by the ID-CERT; (d) hardware and software support for this team; and (e) capacity building and ongoing skills development for this team, with a strategy to overcome turnover challenges. 67. Recovery. In the event of a breach, a crucial element of a cybersecurity program is to recover and attain regular operating levels as quickly as possible. This project will support activities to achieve this, including (a) defining of a business continuity plan that takes into consideration the business operation for the national ID ecosystem; (b) exercising and testing of the business continuity plan; (c) defining of a disaster recovery plan that takes into consideration the infrastructure operation for the national ID ecosystem, including redundancy; and (d) related capacity building. Activity 2.4.3: Reinforcing Public Key Infrastructure for ID 68. PKI will be reinforced to secure the ecosystem and the authenticators issued by NIMC. Initially, PKI will be useful for securing the ecosystem, including securing communication, and the transfer of personal data, tamper-proofing of software configuration files, integrity of reporting and monitoring data, and so on. This will also be important during authenticator issuance. In the long term, PKI may facilitate value-added services provided by the ID ecosystem, such as digital document signatures. To this end, the project will also invest in the overall trust framework so that the NIMC PKI is fully integrated into the national PKI to ensure the long-term sustainability of the system. Activity 2.4.4: Capacity building for information security 69. The activity will support capacity building to ensure the security of data in the national ID system, including against cyberattacks. To provide NIMC and selected public sector partners such as NPopC, INEC, and NIS with the skills required to comply with cybersecurity standards, this project will support the needed skills development for cybersecurity managers and technical staff: (a) Technical training for NIMC and selected ecosystem partners (b) Regularly review capacity-building plans and retention plans over the life cycle of the project (c) Tailor awareness-raising for management and budget deciders Page 89 of 113 The World Bank Nigeria Digital Identification for Development Project (P167183) (d) Study tours to best practice countries (e) Capacity building for the ID-CERT and ID-SOC teams and business continuity/disaster recovery efforts (f) A strategy for overcoming turnover challenges of staff moving to more lucrative employment after they have been trained 70. This activity will finance a study on enhancing privacy of the NIMS, including the ecosystem, to inform the final systems specifications. Moving to an ecosystem model will imply substantial data sharing during both enrollment and also when using the foundational ID system to facilitate access to services, such as through eKYC and authentication. In addition, as interoperability between the NIMC database and functional ID systems becomes the norm, and more and more databases in Nigeria are seeded with the NIN or its derivative, the risks to privacy will multiply exponentially. Systems will need to be carefully designed with these new risks in mind. This study will seek to identify such risks and make appropriate recommendations for systems specifications. Subcomponent 2.5: Registration of the population 71. The project will aim to issue a NIN to every adult in Nigeria and facilitate NIN issuance for Nigerians abroad. The project will also begin to register children, with NIN eligibility starting at birth, in preparation for a drive to register all children in a potential Phase II through partnerships with NPopC and others. Registration will be achieved both through continued harmonization or migration of legacy data from functional ID sources, as well as enrollments through the ecosystem. 72. Activities 2.5.6 and 2.5.7 concern the costs of registration, although each activity applies to a different category of enrollment actor: Group A/B and C, respectively (see details in the Financial Management, Disbursements, and Procurement section of annex 1). 73. Certain disbursement conditions will apply to ecosystem enrollment Activities 2.5.6 and 2.5.7 to ensure readiness of the enrollment ecosystem before rollout. Funds for enrollments have been divided into two equal tranches. A first set of disbursement conditions will apply to the first tranche of this category (50 percent of available funds); a second set of disbursement conditions will apply to the second tranche of this category (50 percent of available funds). The details of these disbursement conditions are set out in annex 4. Well before the first tranche is exhausted, progress toward the completion of the disbursement condition on the second tranche will be formally assessed to ensure continuity in enrollments. 74. Field testing of enrollment systems is exempted from these disbursement conditions. To allow for testing and iterative development of enrollment systems, field testing that is conducted on a limited scale will be financed as a procurable activity outside the framework of Activities 2.5.6 and 2.5.7 and thus unaffected by these disbursement conditions. Activity 2.5.1: Support for continued harmonization 75. Under the mantle of ‘harmonization’, NIMC has endeavored to migrate legacy ID data from functional ID data sources and to assign a NIN upon successful deduplication. Currently, the BVN database, which is used for identifying accounts in the financial sector, is the only functional database actively contributing records under the harmonization process. This effort has been a mitigated success: Page 90 of 113 The World Bank Nigeria Digital Identification for Development Project (P167183) although 11 million NINs have been generated through harmonization, all have come from a single data source—the BVN. 76. Further harmonization could be supported, if needed, up through the scale-up of the enrollment ecosystem. For example, this activity could finance further migration of the BVN records to NIMC to ensure that all BVN holders also have a NIN. In addition, a study could be financed to study the merits of expanding the scope of the harmonization exercise to other functional ID databases. This study could look at the technical feasibility as well as the cost efficiency of further harmonization based on an analysis of representative samples of biographic and biometric data from candidates’ functional source databases. The NIN records created during the harmonization process will be conserved in the next generation of the NIMS, although the ecosystem enrollment points may be used to collect any missing data, obtain user consent, or issue authenticators, as may be required. Data migration from legacy databases under the framework of harmonization will be discontinued once the enrollment ecosystem is live, to ensure that all new enrollments pass through the newly secured enrollment channel, allowing adequate protection of personal data and ensuring the quality of incoming data. Migrated records will not be eligible for per- enrollment fees. 77. If harmonization does continue, a mechanism will be developed to inform persons whose records were harmonized. Currently, no system is in place to systematically communicate with people who are assigned a NIN based on back-end migration of BVN records. As part of NIMC’s role to coordinate and communicate within the ecosystem, mechanisms would be put in place to inform new NIN holders of their NIN, facilitate issuance of the basic authenticator, and potentially obtain any required consent. Activity 2.5.2: Identifying special needs 78. A comprehensive mapping of Nigeria will identify hard-to-reach populations. A geospatial mapping would assess the difficulty of reaching various areas and categorize Nigeria into segments based on difficulty of reaching them for the enrollment ecosystem. Some or all of the following data sources may inform the mapping: national poverty estimates, remote sensing data, maps of road and transportation networks, mobile network coverage maps, displacement data, and census data and population projections. This mapping will be used as an input for calibrating the approach to enrollment to ensure that all persons in Nigeria are able to register. Activity 2.5.3: Developing mobile and offline enrollment systems 79. Reaching the entire population, including the poor, remote, and most vulnerable, will require enrollment partners to proactively approach the population where they reside instead of requiring them to travel to an enrollment center. To facilitate this strategy, it will be necessary to adapt enrollment systems and procedures to allow for enrollments in situations where no network connection is available, with subsequent batch synchronization of records, as well as enrollments in areas without reliable mains power. Such offline and mobile enrollments post increased challenges, including to data quality, data protection, and system monitoring. To adapt the enrollment system to these new challenges, it will be necessary to develop systems and procedures to deal with offline and mobile use cases. This activity will finance developing and field testing of these systems before their full deployment as part of the ecosystem. Page 91 of 113 The World Bank Nigeria Digital Identification for Development Project (P167183) Activity 2.5.4: Development of a business model for the enrollment ecosystem 80. A business model will be developed defining the financing model for the enrollment ecosystem. Once the enrollment system has been developed—including hardware and software requirements as well as enrollment procedures—a business model for the enrollment ecosystem will be developed, in consultation with enrollment partners, in line with international lessons learned and good practices. This detailed business model is essential to ensuring that ecosystem partners are adequately incentivized to reach all persons in Nigeria, including the hardest-to-reach populations, while remaining cost effective and perceived as fair by all stakeholders. The business model could enumerate the roles, responsibilities, and obligations of different ecosystem partners. It could also detail how and to what degree the costs associated with enrollment would be offset by the project and on what basis. Costs that could be offset may include capital expenditures for required equipment and operational expenditures. The business models for public and private sector enrollment partners may differ, with the former—especially programs that are mandated to serve marginalized groups or the poor—potentially eligible for additional support. To keep costs manageable, the option of centralized procurement of enrollment hardware or bulk negotiation with suppliers could be explored. If some ecosystem partners, in particular those in the public sector, are unable to cover the up-front costs of acquiring the required equipment, then the business model could feature an option to allow for leasing of this equipment from NIMC, with the project covering the up-front costs. The business model could also detail the conditions for disbursement to ecosystem partners upon successful NIN generation and any associated reporting requirements. The business model will provide for the enrollment of all persons in Nigeria, irrespective of citizenship or legal status (through the ecosystem of public and private enrollment partners) and also Nigerian nationals abroad (through Nigerian consulates and other licensed NIMC partners abroad). The business model will also ensure that incentives are in place for the personalization and distribution of basic authenticators by enrollment partners, including in the case of offline enrollments, where it may not be possible to distribute basic authenticators on the spot during data collection, requiring additional logistical mobilization on the part of the enrollment agents. 81. The business model will also address continued ‘steady state’ enrollments and data updating once the initial enrollment campaign is finished. The initial business model for the enrollment ecosystem assumes that a critical volume of enrollments is possible to enable cost recovery for enrollment hardware and associated costs. Because these volumes will not persist beyond the initial enrollment campaign. Once most eligible persons have a NIN, there will no longer be a need for an expansive network of enrollment partners. Furthermore, because the hardware required to use NIMC authentication services will be less costly than the full enrollment kit, some ecosystem partners may wish to discontinue enrollment activities, while remaining active users of NIMC authentication services. Although fewer enrollment points will be required once most eligible persons have a NIN, there will be a persistent need for mechanisms to enroll new persons (for example, migrants who arrive after the initial enrollment drive and youth who reach the age at which biometrics must be enrolled) as well as allow data updating for those who already have a NIN (for example, name change and updating contact information). The business model will thus need to evolve accordingly. For ongoing issuance of new NINs, the business model will shift reliance away from a diverse network of ecosystem partners and in favor of a broadened role for NPopC as a strategic partner for NIMC, complementing the NIMC regional offices, which will remain limited in number. This transition will dovetail with the transition to the potential Phase II of the project, in which NPopC’s capacity will be built up at a national scale and will work in collaboration with the existing NIMC field offices as well as the health and education sectors to ensure continued access to NIN enrollment. For data updating, NIMC may require partners in the authentication ecosystem to process data updates as a Page 92 of 113 The World Bank Nigeria Digital Identification for Development Project (P167183) condition of their using authentication services. Finally, the steady-state business model will also factor in the revenue potential of NIMC’s products, including authentication and eKYC services. Activity 2.5.5: Enrollment of Nigerians abroad 82. Enrollment of the Nigerian diaspora will be possible through Nigerian Government offices abroad and through licensed private sector partners. Arrangements for the enrollment of the Nigerian diaspora will be separate from the ecosystem pay-per-enrollment model. Nigerian Government offices abroad, such as consulates, may be outfitted with enrollment equipment and have personnel trained to participate in the enrollment ecosystem, as well as to use the equipment for authentication. NIMC may also elect to license addition partners abroad to perform enrollments or carry out authentications, potentially including private sector partners. The particularities of this use case will be studied and integrated in the specifications of the software used for enrollment and authenticator issuance as well as for authentication. 83. Enrollment SOPs will be modified for use abroad and data collection agents abroad, such as consular staff, will be trained accordingly. Some deviations from the domestic enrollment SOPs may be required. In particular, it may be appropriate to require physical breeder documents for identity proofing for international enrollments because, unlike for enrollments taking place on Nigerian soil, territorial presence may not be a sufficient eligibility criterion for NIN issuance. Activity 2.5.6: Enrollment by ecosystem partners (Groups A and B) 84. This activity will offset the costs of enrollment incurred by actors in the public and private sectors, civil society, and development partners enrolling under national ecosystem licenses. Enrollment partners falling under this category will be reimbursed based on their outputs (see Financial Management, Disbursements, and Procurement section of annex 1 for details). 85. The cost that ecosystem partners incur when performing enrollments will be offset according to the business model. Payment will be conditional based on successful deduplication on the NIMC backend and the assignment of a new NIN. A part of the payment could be conditional on the delivery of the basic authenticator to the enrollee (see Component 3 for details on authenticators). These cost offsets will be disbursed as specified in the enrollment business model. Disbursements will be audited based on verification of the tamper-proof audit trail generated by each NIN issuance by the enrollment monitoring system financed in Subcomponent 2.3. 86. Humanitarian partners will also be welcome as part of the ecosystem. NIMC has already partnered with humanitarian actors through, for example, setting up mobile enrollment centers in IDP camps. The project will seek to build on this work at the same time as recognizing the limitations in the enrollment ecosystem in fragile and conflict-affected areas and the challenges caused by limited connectivity and displacement. It will pilot a new approach to facilitate enrollments, using mobile teams in targeted geographic zones, with the support of humanitarian partners. The pilot approach will benefit from accelerated procedures as a result of enrollments that take minimum information, do not require breeder documents, and speed up the deduplication process. These pilot projects will target all affected communities in specific geographic zones, including returnee refugees and IDPs living in both camp and host communities and the host communities themselves. This project will seek to collaborate actively with UNHCR both technically, to ensure that approaches to enrolling IDPs, asylum seekers, refugees, and Page 93 of 113 The World Bank Nigeria Digital Identification for Development Project (P167183) returnees are adequate and in line with best practices and in examining alignment with humanitarian registration and assistance delivery systems, as well as operationally as a potential enrollment partner. Activity 2.5.7: Enrollment by ecosystem partners (Group C) 87. This activity will finance enrollments performed by private sector and civil society actors in the framework of a contract awarded by NIMC to carry out an enrollment drive in a geographically delimited zone. These enrollments will not be eligible for OBD and enrollment partners will be selected using standard World Bank procurement procedures (see Financial Management, Disbursements, and Procurement section of annex 1 for details). Subcomponent 2.6: Training of ecosystem partners and their enrollment field agents Activity 2.6.1: Training of ecosystem partners and their enrollment field agents 88. This activity will finance the training of ecosystem partners and their enrollment field agents through various models. Training of those carrying out enrollments is critical for developing specific technical and social skills that are essential to maximize inclusion, uniformity, security, and performance of the ID ecosystem. 89. Training will be based on the SOPs, with a training manual revised to improve quality and mitigate social risks. The SOPs will be revised to elaborate clear protocols for the entire enrollment process, while paying special attention to the needs of marginalized groups. In particular, the SOPs will detail specific procedures for exception handling (for example, for those whose biometric data cannot be collected) and identity proofing (that is, validating incoming ID data before finalizing a new record). To ensure that these SOPs are being enacted, they will be included in the standardizing training modules that all enrollment agents much pass before being certified to perform enrollment. Adherence of enrollment agents to these guidelines will also be monitored through the project M&E system, in particular through third-party monitoring and through any complaints through the GRM. Detailing such requirements in the SOPs, and ensuring that training of enrollment agents adequately covers these areas, is essential to ensuring that the project adheres to the Pillars of Inclusion. In addition, the SOPs will abide by the guidance set out in the safeguards documents to reach and protect vulnerable populations. These SOPs will also be fully integrated into the assurance process for licensing and onboarding ecosystem partners, with all licensees required to have in place systems and processes to ensure that all field agents are appropriately trained on and compliance with the SOPs (see Activity 2.3.5 for further details on the licensing and assurance framework for ecosystem partners). 90. Ecosystem partners and their enrollment staff will be trained through a variety of approaches, phased to the stage of program rollout. A training-of-trainers model will be employed at the start to permit scaling up of training over time. To ensure the quality of the training-of-trainers training, the licensing and assurance framework for onboarding ecosystem partners will include provisions to ensure that all enrollment agents are adequately trained to carry out enrollments, including mechanisms for assessing that training has been carried out appropriately, for example, through an online certification program to be monitored via the enrollment system to ensure quality. The program will also take advantage of this training opportunity to close basic digital skills gaps of trainees and promote wider adoption of digital technologies across Nigeria. Training will be developed and managed centrally by NIMC to ensure quality and standardization. Page 94 of 113 The World Bank Nigeria Digital Identification for Development Project (P167183) Component 3: Enabling Access to Services through IDs (US$66 million equivalent, of which US$12 million IDA, US$17 million AFD, US$37 million EIB) Subcomponent 3.1: Development of NIMC authentication services 91. NIMC will develop authentication services to be used by service providers to improve service delivery. While NIMC has started to work on an authentication ecosystem, its architecture will need to be reviewed and aligned with state-of-the-art technology to ensure better efficiency, security, business continuity, and privacy protection. This subcomponent will support NIMC to develop authentication services that align with the needs of service providers in Nigeria. 92. NIMC will pivot away from its current verification services to authentication services that do not involve sharing personal data for most use cases. In developing its suite of authentication services, NIMC will refocus on its core mission of providing accessible and reliable authentication that allows NIN holders, including the poor and marginalized groups, to access services while effectively safeguarding personal data. Currently, NIMC allows authorized service providers to verify the ID of their beneficiaries and customers (claimants) at the point of service delivery. Known as ‘ID verification’, this service involves sharing personal biographic ID data with authorized service providers from the central NIMC server, allowing them to manually cross-check this data against biographic data supplied by claimants to verify integrity. Because these verification services disseminate personal data, they pose certain security and privacy risks. These risks are complicated by the fact that the recipients of the data are not systematically authenticated using strong authentication before data are shared. For the majority of use cases, it is not necessary to share personal data to supply service providers with a strong assurance of a claimant’s identity. Instead, this assurance can be provided through a process that supplies the service provider with a binary (yes/no) response with an assurance level corresponding to the risk associated with the transaction. Such assurance of a claimant’s identity through a binary response without recourse to sharing personal data is referred to as authentication. 93. NIMC may continue to share data with service providers in cases where benefits outweigh the risks, but this process will be strengthened to improve data protection. While a binary authentication of a person’s identity is sufficient for the majority of service providers’ business needs, there may be some cases where sharing personal data is required or where it delivers significant efficiency benefits. Even when such data sharing is necessary, it can often be shared locally (for example, copying from a locally available card or authenticator) instead of sharing from a central server, to minimize data protection risks while accomplishing the same objective as data sharing from a central server. In those cases where central data sharing may be justified given these risks, procedures will be developed to ensure that recipients of the data are authorized by prevailing legislation and that their identity is authenticated using strong authentication before any sharing of personal data. 94. Multiple complementary authentication services could be implemented to maximize access without compromising security of higher-risk transactions. There is a tradeoff between, on the one hand, the strength of an authentication service—or level of assurance provided concerning a claimant’s identity—and the cost, efficiency, usability, and accessibility of that service on the other. Therefore, NIMC’s authentication services offerings will need to be carefully calibrated to the specific needs of the Nigerian market, and multiple services may need to be developed to cover different use cases. Increasing access to authentication for the poor and marginalized groups should not come at the cost of authentication strength for high-risk use cases and high-value transactions. Offering multiple Page 95 of 113 The World Bank Nigeria Digital Identification for Development Project (P167183) authentication services, implementing different technologies, and offering different levels of assurance will help ensure that NIMC’s authentication offerings are relevant to a broad array of service providers. Additionally, NIMC will provide the means, through attestations or Application Programming Interfaces (APIs), as well as technical assistance, as appropriate, for private sector digital identity providers to link to the NIMS, allowing for innovation in uses of identity and the emergence of alternative authenticators (see Subcomponent 3.2). Activity 3.1.1: Study on demand for NIMC authentication services and development of a strategy 95. A study analyzing the demand for authentication services will be conducted to inform the design of NIMC’s service offerings. To inform the design of NIMC’s authentication service offerings, it is necessary to understand the business needs of users of these services. Users will include service providers in the public and private sectors who must identify customers or beneficiaries in the framework of service delivery. This activity will finance a study on the risk levels associated with use cases and transactions for which NIMC authentication services will be implemented; business needs of service providers; any constraints imposed by available infrastructure or capacity, both at the service provider and end user levels; and demand for authentication services, including willingness to pay. The study will be carried out in consultation with potential users of authentication services and other key stakeholders. 96. NIMC will define a strategy for delivering authentication services and choosing among multiple options for leveraging foundational IDs for authentication of identity. Some of the factors that influence the choice of authentication systems design include the type of authenticator, for instance, if it is a smart card, then offline authentication is feasible. If the issued authenticator is a basic one without a chip, an online comparison of biometrics against the template of stored biometrics in the foundational ID system can be done. If a virtual authenticator is implemented, such as mobile ID, then a mobile-based authentication mechanism can be applied. The level of assurance required for a transaction also determines the type of authentication mechanism to be used. For a high-value transaction, a multifactor authentication modality would be implemented. By contrast, for simpler transactions requiring lower assurance levels, a demographic authentication, document authentication, or simple biometric authentication may be appropriate. It may be desirable to allow service providers to also switch from online authentication to offline authentication in instances when Internet connectivity is poor or nonexistent. Other factors that influence choice are Internet coverage; cost of the equipment required for smart card-based systems (for example, smart card readers, biometric readers, and the smart cards themselves), existing investments in equipment and infrastructure of users of the system; and network coverage and availability of services linked to the foundational ID system. Activity 3.1.2: Development of authentication services in line with identified priorities 97. Authentication services will be developed to meet local demand and business needs. NIMC will develop authentication services that provide a level of assurance appropriate to business needs and demand for authentication services while also ensuring accessibility of authentication for the poor and most vulnerable in Nigeria. 98. To ensure accessibility, at least one authentication service will be designed to be maximally accessible. While NIMC may elect to offer authentication services that are appropriate for higher-risk or higher-value transactions, such services may be limited in their accessibility. Achieving higher assurance levels often requires implementing multiple authentication factors or solutions requiring claimants to use Page 96 of 113 The World Bank Nigeria Digital Identification for Development Project (P167183) authenticators. While such measures can increase authentication strength, they can also increase system complexity, costs, usability, and accessibility for end users. The use of many authenticators implemented for strong authentication presupposes cognitive skills, which populations with less education may not have. Such authenticators can also be relatively expensive, which can reduce access for the poor if these costs are passed on to end users. Additionally, such expense may not be justified for populations whose need for authentication is limited to low-risk transactions. Even if the authenticator itself is affordable, if authentication services presuppose devices or infrastructure, this can also constrain access if all users do not have access to this infrastructure. To ensure that similar constraints do not unduly impede access to authentication services, NIMC will develop at least one authentication service that places a premium on minimizing complexity and maximizing usability and accessibility, potentially through leveraging biometric data as an authentication factor. Offering this basic authentication service will not prevent NIMC from also offering or licensing the offering of other complementary authentication services that may be desirable for high-risk or high-value transactions where accessibility is less of a concern. Activity 3.1.3: Upgrading authentication backend at NIMC to reinforce authentication services 99. NIMC’s back-end capacity to provide authentication services will be reinforced. NIMC will develop a framework for authentication services that safeguards personal data in line with the data privacy legislation. For any authentication services requiring database interoperability, policies will be developed to allow access to authentication and other services (for example, through web services or APIs) while maintaining appropriate access control and data privacy safeguards. All authentication APIs developed will be in line with the requirements of the trust framework (see Subcomponent 3.2). Communication services may also be implemented to facilitate issuance of one-time authentication codes and provide appropriate feedback to users of the system. Policies will be developed detailing the types of service providers allowed to link to the NIMC system, the various use cases, technical protocols for data transfer, and appropriate data privacy safeguards, as well as penalties and sanctions for misuse of data. The capacity of NIMC’s ABIS will also be reinforced to accommodate the increased volumes associated with online biometric matching. Activity 3.1.4: Developing specifications for authenticators 100. NIMC will develop specifications for a low-cost physical authenticator designed to facilitate basic authentication and distribute it to all NIN holders. The purpose is to allow universal coverage and access to authentication services. The rollout will be financed by the project. The chosen design should be of minimal cost and should allow decentralized personalization by the enrollment partners without compromising security of personal data or authenticator quality. Potential form factors may include a laminated paper or plastic card. The basic, low-cost authenticator could securely store personal data in a machine-readable code (for example, bar code, QR code). This machine-readable code could allow authorized agents, using a compatible terminal, to perform document authentication and eKYC in offline environments. It could also facilitate the use of NIMC authentication services in online environments, thus facilitating access to services. 101. To support their offline authentication modalities or provide other authentication services, including strong authentication, NIMC may elect to develop an advanced physical authenticator, such as a smart card, to be distributed to a subset of NIN holders. For example, NIMC could implement a cost- effective smart card to replace the current GMPC, which could support offline biometric authentication through a biometric-match-on-card applet or other relevant authentication services. This offline capability Page 97 of 113 The World Bank Nigeria Digital Identification for Development Project (P167183) could help facilitate access to services using foundational IDs for those who live in areas without connectivity. Other new technologies may also provide the required authentication functionality at a reduced cost compared to smart cards, and these possibilities will be studied under the project before advanced authenticator specifications are finalized. Due to the increased cost of this advanced authenticator compared to the basic authenticator, its coverage would be limited to the subset of NIN holders who require the additional functionality. To promote the development of a sustainable financing model for NIMC-issued authenticators, the variable cost of producing and distributing advanced authenticators (including any required card stock or personalization) will not be borne by the project. 102. This activity will support market research and field testing to ensure that NIMC-issued authenticators are relevant to their target populations and functions as intended. In the recent history of identification, countries in Africa have rolled out smart cards—in many cases as mandatory national ID cards—which have failed to reach their full potential. Card specifications often permit advanced functionality that is never used by card holders. In Nigeria, for example, the current GMPC has applets, including a biometric match-on-card applet and a payments applet, neither of which are fully implemented in practice. To ensure that specifications do not drive up the cost of authenticators unnecessarily, it is important to calibrate these features to demand. This activity will support demand research and design work to ensure usability. It will also support field testing to ensure that all technologies implemented, such as a match-on-card applet to be used in the framework of offline biometric authentication, are rigorously tested for functionality in the Nigerian context before being rolled out. Activity 3.1.5: Production and distribution of the basic authenticator 103. The cost of producing and distributing the basic authenticator through the enrollment ecosystem will be borne by the project. Because one objective of the basic authenticator is to achieve universal coverage, its cost will be offset fully by the project. The systems for decentralized production of the basic authenticator will allow enrollment partners to personalize and distribute authenticators in the field immediately following enrollment. The functional specifications for these authenticators will ensure that they are as low cost as possible and make use of inexpensive materials, such as PVC or laminated paper, that nonetheless have adequate levels of durability and security. The card production system, as all other systems financed by the project, will make use of open standards and technologies whenever possible to ensure sustainability and technology neutrality and avoid vendor lock-in. Activity 3.1.6: Implementing systems for producing advanced authenticators 104. The costs of the systems for producing advanced authenticators will be borne by the project. The production system could include equipment and software used to personalize advanced authenticators, software applications linked to processing requests (for example, request, production, quality control, delivery, and payment). Depending on the type of data to be stored on advanced authenticators (in particular if biometric data are to be included), it may be necessary for production to be centralized and managed by NIMC directly to ensure data protection. 105. The variable cost of producing and distributing the advanced authenticator will be passed on to users. Users could include not only end users but also public programs, who might choose to offset the cost of this authenticator for their beneficiaries to facilitate service provision. This activity will, however, support iterative development and piloting of this advanced authenticator, and thus its distribution on a Page 98 of 113 The World Bank Nigeria Digital Identification for Development Project (P167183) small scale, to ensure thorough testing and ensure its relevance for its target population. Variable costs associated with scaled-up distribution of advanced authenticators, notably any card blanks, will not be eligible for project financing. This activity will also finance the development of a sustainable financing model for ongoing authenticator production to efficiently balance concerns of financial sustainability and access to advanced authenticators. 106. The key differences between the basic and advanced authenticators supported under this component are summarized in Table 2.1. Comparison of Authenticator Types. Table 2.1. Comparison of Authenticator Types Project Financing Cost Coverage Biometric Data Personalization Fixed Variable Costs Costs Basic Minimal All NIN holders No Decentralized Yes Yes authenticator Those requiring Advanced Moderate advanced Potentiallya Centralized Yes No authenticator functionality Note: a. Authenticator development financed under this activity will determine authenticator specifications and, in particular, whether storing biometric data on the advanced authenticator is necessary to provide the requisite functionality and usability in the Nigerian context. Subcomponent 3.2: Development of authentication services within the ecosystem 107. To complement the NIMC-issued authenticators, the project will support the creation of a federation of providers of authentication services based on the NIN. A framework would be created under which public and private entities, including, but not limited to, partners in the enrollment ecosystem, could partner with NIMC to issue derived identities, identified using the NIN, for the purposes of authentication. Basing these derived identities on the NIN will ensure uniqueness even across identities issued by multiple partners and prevent fragmentation of ID systems by ensuring that all identities in Nigeria are appropriately linked to the foundational ID. Opening up the provision of authentication services under a federation model will allow for increased competition and innovation as users are able to choose an authentication modality that best meets their needs. Different providers of these derived identities could offer different solutions targeted toward specific use cases that are relevant to certain subpopulations, such as authentication for high-risk and high-value transactions, authentication in offline environments, accessible authentication modalities for illiterate persons or persons with disabilities, and so on. Ecosystem actors may wish to develop their own authentication services and issue their own authenticators, in line with NIMC regulations. The trust framework will ensure that all such derived identities follow a common set of rules and standards that facilitate trust in the strength and reliability of authentication transactions carried out against derived identities issued by federation partners as well as authentications against the NIMC authenticator itself. Activity 3.2.1: Developing a trust framework for a federation of authentication service providers 108. This activity will support a consultative process conducted with all stakeholders to develop a trust framework governing the ID ecosystem in Nigeria. The trust framework would define the modalities for the issuance of derived identities, including identity assurance and linking to NIN; functioning of Page 99 of 113 The World Bank Nigeria Digital Identification for Development Project (P167183) authentication services, including authentication assurance; and rules for data sharing and data protection. Technical assistance could be provided to develop rules for interoperability, including any rules for pseudonymization of NINs during authentication and seeding of functional databases. Subcomponent 3.3: Facilitating service delivery using foundational ID Activity 3.3.1: Identify priority services for linkage with foundational ID 109. This activity will finance the elaboration of a national strategy for Nigeria for the link of public and private services to the foundational ID system. Appropriate links with the foundational ID can serve both to guarantee the uniqueness and robustness of functional ID systems in Nigeria and promote the use of authentication services based on the foundational ID to improve service delivery. The development of this strategy will be based on a survey of the existing service providers and functional ID systems, including sectoral and subnational ID systems, who are eligible for linking to the foundational ID, as well as detailed sectoral analysis highlighting the transformational potential of linking to the foundational ID, as well as consultations with key stakeholders. The final strategy will include a prioritized list of relying parties to be linked to the foundational ID system in the short, medium, and long term, in order of priority. The strategies will be based on the needs and priorities of key stakeholders; the capacity and readiness of the various potential services for integration with the foundational ID system; the potential impact on end users of each linking, including capacity to ensure protection of personal data; the potential impacts on economic development and poverty reduction; the need to demonstrate the utility of linking to the foundational ID system in a diverse array of applications in the public and private sectors; budgetary considerations and cost efficiency; and the availability of financing, including non-project financing. The approach adopted by the project in Subcomponent 3.3 will be informed by this strategy document. Activity 3.3.2: Facilitate creation of an authentication management business unit within NIMC 110. A business unit will be created at NIMC to manage authenticators over the life cycle of the project. Functions could include authenticator issuance, activation, and revocation; account recovery, including resetting any associated PIN codes, or changing phone numbers; and help desk services. This business unit will develop procedures and services that maximize access to all NIN holders. Activity 3.3.3: Technical assistance for rollout of NIMC authentication services in the broader ecosystem 111. Service providers and functional ID providers require support to optimally develop and implement links with foundational ID that will permit the latter to be used to facilitate access to services. If service providers are neglected by identity providers, it can lead to uninformed design decisions on the part of service providers on how to build links with the ID. This can lead to slow adoption, suboptimal implementation, and subsequently damaging public perception and trust. Similarly, functional ID systems should be linked to foundational ID to reinforce the former using unique ID and also minimize duplication of efforts across the Government. 112. This activity will finance technical support and assistance for functional ID and service providers. Such support will allow service providers and functional ID systems, potentially including both sectoral and state-level ID systems, to build technical links with the NIMC infrastructure that are required to benefit from NIMC's services. Functional ID providers could receive support to seed their functional databases with the NIN or a derivative token to ensure uniqueness of the functional ID. Service providers Page 100 of 113 The World Bank Nigeria Digital Identification for Development Project (P167183) could be consulted in the development of and subsequently educated about service-level agreements and levels of assurance offered by various NIMC authentication services and how these can be optimally implemented given the service providers' risk profiles. Service providers and functional ID systems could be supported through technical assistance to build links to the foundational ID system, including through implementation of SDKs and APIs in their own client software, to securely interoperate with the NIMC system and minimize authentication failure rates. Service providers could also be given technical assistance to train staff or implement any required infrastructure, such as biometric-enabled terminals, that may be required to perform authentication against the foundational ID at the point of service delivery. Activity 3.3.4: Facilitating service delivery for the most vulnerable by supporting rollout of NIMC authentication services for selected pro-poor public services 113. The project will provide targeted support for acquiring biometric equipment necessary for authentication processes to selected public services. This activity will invest in biometric terminals and other equipment needed to ensure the successful rollout of NIMC authentication among selected public services mandated to reduce poverty or improve human development. The project will finance technical assistance for the design and implementation of links with the foundational ID system to ensure quality and sustainability (for example, review and revise business processes and service models in light of the foundational ID system to improve service delivery and capacity building of key staff to ensure optimal use of the new systems). One or more services will be linked to the foundation ID system based on the recommendation of the strategy developed under this activity. Activity 3.3.5: Supporting information security of the authentication ecosystem 114. This activity will support cybersecurity compliance of service delivery and ecosystem partners through capacity building and monitoring. Component 4: Project management and stakeholder engagement (US$41 million equivalent, of which US$41 million IDA, US$0 AFD, US$0 EIB) Subcomponent 4.1: Project management and stakeholder engagement in the ECSU Activity 4.1.1: Monitoring and evaluation 115. The project will support the development and implementation of a comprehensive M&E system in the ECSU. This activity will finance consultant services and goods to support the implementation and monitoring of project-related activities and outcomes. This component will entail support to ensure that (a) all project activities and tasks are executed; (b) there is coordination among all actors involved in project implementation; (c) procurement and fiduciary requirements and audits are fulfilled and monitored; and (d) project outcomes and intermediary results are monitored and evaluated. Activity 4.1.2: Communications and awareness raising 116. The complexity of the ID ecosystem to be supported under this project, and the existing negative public perception of NIMC, means that effective communication is imperative to improve trust in the system and ensure buy-in of ecosystem enrollment partners as well as individual enrollees. Page 101 of 113 The World Bank Nigeria Digital Identification for Development Project (P167183) Negative perceptions of NIMC have arisen over time due to the delays in the delivery of NINs and GMPCs and the often-cumbersome registration process. A robust communications strategy will be an important tool for overcoming existing negative perceptions surrounding the national ID system and ensuring that users, implementers, and officials have a strong understanding of the new streamlined registration system, as well as their entitlements, eligibility, and service standards. 117. Communication with non-implementing stakeholders and the general public will be managed by the ECSU. Because the measures required to communicate with the various stakeholders differ significantly, the project will distinguish between ‘internal’ and ‘external’ communication, with the former understood as communication and coordination with the ecosystem of implementing partners and the latter understood as communication with the wider group of stakeholders not directly involved in implementation as well as awareness raising with the general public. Internal communications will be overseen by NIMC PIU while external communications will be overseen by the ECSU. 118. The development of a communications strategy for stakeholders external to the ecosystem will ensure that the general public understand the new approach and understand how to get and use an ID. To overcome existing negative perceptions surrounding NIMC and ensure that the system is maximally accessible, it is necessary to adopt a comprehensive and coordinated approach to communicate with stakeholders of the ID system and the general public. This activity will support the development of a strategy to explain the new approach to ID as reflected in the Strategic Roadmap; the relevance of foundational ID and the utility of obtaining one; eligibility for foundational ID and measures put into place to expand access; the steps required to obtain a foundational ID, including any authenticators; how to use foundational ID to access services; and options for grievance redress. The strategy will also address concerns about privacy, data protection, inclusivity, costs associated with obtaining and using a foundational ID, as well as the benefits of having a foundational ID. The strategy will also endeavor to make communication maximally accessible. Communication should be easily consumed by all members of the public; made available in multiple languages; and disseminated through various media as needed (for example, radio, television, newspapers, pamphlets, new media, engagement with local leaders, roadshows, and so on). The strategy will take care to ensure that marginalized groups and persons with disabilities receive all relevant information about the foundational ID system and understand any special measures in place to facilitate their access. The strategy will also place particular emphasis on groups that were previously excluded from these services due to lack of a suitable ID, to ensure that they understand the relevance of foundational ID to their situation well in advance of registration drives. The strategy will also ensure that everyone eligible for a NIN is aware of their options for grievance redress (see annex 3 for information on the GRM). 119. External communication and awareness-raising activities will be carried out according to the strategy. This activity will finance communications campaigns to raise awareness about the new foundational ID system. The design of the communications campaigns and other awareness-raising activities will draw on the communications strategy and will be adapted to permit communication with the various groups targeted in the strategy, including vulnerable groups such as illiterate persons and linguistic minorities, who will access these priority services (for example, social safety net and health). These are building blocks for a strong system of citizen engagement which actively involves beneficiaries in providing feedback about the project. Page 102 of 113 The World Bank Nigeria Digital Identification for Development Project (P167183) Activity 4.1.3: Stakeholder engagement and social accountability 120. A comprehensive stakeholder engagement strategy will be developed and implemented. National IDs are of interest to stakeholders across sectors due to the role of foundational ID as a key enabler for providing services of all types. Such stakeholders include functional identity providers and ecosystem enrollment partners, service providers in public and private sectors, civil society, and NIN holders themselves and those eligible to enroll. This activity will finance the consultative development and implementation of a comprehensive strategy to ensure that all stakeholders are appropriately engaged at all stages of the project cycle and that their input is effectively taken into account in implementation. 121. A national consultation mechanism will be established, led by NIMC. The mechanism will focus on clearly communicating project design, expected project outcomes, and objectives of the consultative process, as well as collecting and responding to feedback. Stakeholder identification for participation in the consultations will include due consideration of representativeness and inclusion of marginalized groups. Consultations will take place on an annual basis. Further details on the approach to stakeholder consultations can be found in annex 3. 122. Appropriate social accountability mechanisms will be defined in collaboration with the PIU and ECSU. Given the breadth of social accountability approaches, a wide range of mechanisms could be considered including a civil society platform, to engage in regular feedback on project implementation; traditional consultation and feedback mechanisms, such as focus groups and satisfaction surveys; participatory mechanisms, such as community scorecards; third-party monitoring mechanisms, such as social audits, citizen report cards, public expenditure tracking surveys; and working with independent monitoring entities such as information commissions, ombudsmen, or supreme audit institutions.34 Activity 4.1.4: Project implementation personnel 123. The project will, as much as possible, be implemented by civil servants seconded to the ECSU; however, the project may finance the salaries of a limited number of dedicated external candidates essential to project implementation and ecosystem coordination if no qualified civil servants can be identified to fill those posts. The ECSU will feature a small team to manage a subset of activities such as those related to legal reform and external communications. Personnel in the ECSU will be competitively recruited, with priority given to existing civil servants who will be seconded into the ECSU. Positions will only be opened up to external candidates when the required capacity cannot be found within the civil service. In cases where the ECSU positions are filled by civil servants, their salaries will not be eligible for project support, but the project will employ productivity allowances developed to reward performance based on results, as is the case on similar World Bank-assisted projects in the country. In cases where the ECSU positions are opened up to external candidates, recruitment will be carried out according to World Bank procurement procedures and wages of retained staff will be supported by the project. The list of human resources in the ECSU who are eligible for project financing are enumerated in annex 1. 34 World Bank Strategic Framework. 2014. Page 103 of 113 The World Bank Nigeria Digital Identification for Development Project (P167183) Activity 4.1.5: Operating costs 124. The project will finance operating costs for the PIU and ECSU to enable reliable project implementation and effective coordination. Eligible expenditures include, but are not limited to, renting of office space, office supplies and consumables, and transportation costs for key project personnel for implementation-related travel. Subcomponent 4.2: Project management and stakeholder engagement in the NIMC PIU Activity 4.2.1: Information systems for project management and monitoring 125. The project will finance reinforcement of NIMC’s information systems to assist in project management and monitoring. This activity will finance upgrades to NIMC’s information systems to improve overall project management by tracking and reporting information, triggering early warnings on issues and bottlenecks and providing an evidence base to inform future policy. The project management and monitoring system upgrades will support, at the minimum, the following core functions: (a) operations, including ongoing enrollment through the ecosystem system and management of enrollment agents and devices; (b) monitoring and management, including creation of indicators and management alerts; (c) control and accountability, including the generation of reports and materials for communication with the stakeholders and the public; and (d) management and resolution of grievances received through the project’s GRM system, including communication with beneficiaries. Activity 4.2.2: Monitoring and evaluation 126. The project will support the development and implementation of a comprehensive M&E system. This activity finances consultant services and goods to support the implementation and monitoring of project-related activities and the evaluation of project outcomes. This component would entail support to ensure that (a) all project activities and tasks are executed; (b) there is coordination among all actors involved in project implementation; (c) procurement and fiduciary requirements and audits are fulfilled and monitored; (d) project outcomes and intermediary results are monitored and evaluated; (e) the performance of ecosystem partners and compliance with licensing terms are monitored; and (f) an IE is carried out to measure program effectiveness on beneficiary and household- level outcomes. 127. The IE, including multiple rounds of data collection through household surveys, will be carried out by NIMC in partnership with the World Bank. The World Bank IE team will work closely with NIMC’s technical team throughout the implementation period, to ensure that the IE responds to operational priorities and constraints and produces insights relevant to implementation. The IE studies will be fully integrated into the project’s M&E framework, using monitoring and administrative data whenever possible. In particular, the IE study findings will also feed directly into the Results Framework, for example by measuring the socioeconomic profile and poverty status of NIN holders. The World Bank IE team will also directly support regular M&E activities by working with NIMC and the ECSU to strengthen M&E data collection. The studies carried out in the framework of the IE may include the following: (a) Baseline study to understand pre-implementation coverage and flag potential issues that the registration process may face. Baseline data will be collected on a stratified, representative, random sample of a sufficient number of households to ensure that the study has adequate Page 104 of 113 The World Bank Nigeria Digital Identification for Development Project (P167183) statistical power and is sufficiently representative. The objective of this study will be to (i) build a baseline, pre-implementation snapshot about the current levels and types of ID coverage across the population; (ii) help identify households that are at risk of being excluded from the ID registration process (for example, those in remote areas, who are less informed or have other concerns about registration), building on and extending the results of the Social Assessment; and (iii) use the survey to test the effectiveness of different registration and communication strategies for national rollout. The findings from the study will feed directly into the design of the registration process and communication/enrollment strategy and/or revisions of these. The surveyed households will be followed and resurveyed during future points during the project implementation period (for example, midline and end line). Baseline data will also inform the midline and end line studies described in the following paragraphs. (b) Midline study to understand the effectiveness of foundational ID enrollment in maximizing coverage. The World Bank will work closely with NIMC to develop a midline study that measures (i) ex post, which registration and communication strategies were most cost efficient at increasing coverage with maximum inclusion of at-risk groups and (ii) the immediate (that is, short term) impacts of foundational ID on households, for example, in terms of access to jobs and services, civic engagement and participation, and so on. The study will include a heterogeneous analysis to measure the impacts on particular groups of interest including women, marginalized groups, ethnic minorities, and the poor. (c) End line study to understand the development impacts of foundational ID on household economic and welfare outcomes. The final round of data collection will be geared toward measuring the development impacts of foundational ID once it is connected to other public and private systems, including the impacts on access to public and private services, social safety nets, financial inclusion, and so on, as well as downstream impacts on access to credit, jobs, income, and subjective well- being. The study will conduct heterogeneous analysis to measure the impacts on particular groups of interest including women, ethnic minorities, and the poor. Activity 4.2.3: Grievance redress 128. A GRM will be developed and implemented to collect and respond to issues encountered by beneficiaries, ecosystem partners, and other stakeholders. A GRM is a system which responds to queries or clarifications, resolves problems with implementation, and efficiently and effectively addresses complaints. To this end, this activity will finance goods and consulting services to (a) develop and implement tools to support better collection, tracking, and response to grievances; (b) provide capacity building for NIMC’s Customer Care Department, particularly training of personnel; (c) develop and implement feedback mechanisms to ensure that GRM data are used continuously to improve implementation, (d) develop the SOPs for grievance redress that specify clear performance standards; (e) hire one FTE grievance redress specialist working in the PIU to support the GRM as it relates to ecosystem enrollments; and (f) conduct an annual review to evaluate and strengthen GRM performance. Further details on the approach to grievance redress can be found in annex 3. Activity 4.2.4: Communications 129. Communication with implementing partners will be managed by NIMC. NIMC will take charge of internal communications as an extension of its overall responsibilities for coordinating the activities of Page 105 of 113 The World Bank Nigeria Digital Identification for Development Project (P167183) the various ecosystem partners, both maximizing efficiency and sustainability and building NIMC’s coordination capacity. 130. The development of a communications strategy for internal stakeholders will support effective coordination between ecosystem partners. The strategy will provide for communication with implementing partners about their roles, rights, and responsibilities in the new system; implementation of the change management strategy; coordination of ecosystem activities; communication on service standards and operating procedures; a help desk to respond to difficulties encountered during implementation; and a mechanism for diffusing information about lodging grievances and using the internal GRM to submit feedback to NIMC and the PESC. 131. Internal communication and coordination activities will be carried out according to the strategy. This activity will finance communication campaigns among ecosystem partners to raise awareness about the new foundational ID system. The design of the communications campaigns and other awareness- raising activities will draw on the communications strategy. Activity 4.2.5: Change management 132. The project will support the development and implementation of a comprehensive change management strategy to ease the transition for stakeholders of the foundational ID system. The process of creating digital links between the foundational ID system and functional ID systems, including databases of service providers, for the purpose of deduplicating functional ID registers and authenticating identity in real time is in its infancy in Nigeria. While this new functionality has significant potential to improve service delivery—especially to vulnerable populations and groups that have historically been excluded— doing so also represents a significant departure from the status quo, both for service providers and for beneficiaries of those services. Given the scope of the reforms to be undertaken in the project, effective change management will be necessary for stakeholders at all levels to facilitate acceptance and uptake of the foundational ID system. Business models of enrollment partners and users of authentication services will need to be adapted to take into account these new activities, clarify the benefits of their use from a firm or institutional perspective, and integrate any necessary investment in equipment and capacity building as well as any applicable fees. New authentication mechanisms will require adaptation of business processes and training for personnel at the service provider and functional ID level. In particular, the new mechanisms for registration of vital events at NPopC will imply institutional reforms that will need particular attention. Additionally, legal and regulatory reforms implemented under Component 1 may require institutional changes and capacity reinforcement that need to be planned for and executed effectively. To ensure a shared vision, this activity will finance the development and implementation of a comprehensive change management strategy, based on consultation of relevant stakeholders. This strategy will also inform the communications strategy and activities implemented under Activity 4.2.5. 133. The development of a change management strategy for stakeholders internal to the ecosystem will support effective coordination between ecosystem partners. The strategy will be developed in consultation with stakeholders in the ecosystem and will define processes for change to the new operating models for enrollment into the foundational ID system, linking of the existing functional ID systems with the foundational ID, and provision of authentication services. The strategy will pay special attention to aspects related to new practices required to ensure data protection and information security. Page 106 of 113 The World Bank Nigeria Digital Identification for Development Project (P167183) 134. The project will support the development and implementation of change management strategy for NIMC, based on a comprehensive analysis on institutional and human resources capacity gaps. To implement the project, NIMC will need to increase its institutional capacity, through a combination of hiring new staff, building the capacity of existing staff, and reorganizing the existing human resources and business units in line with the vision articulated in the project and the Strategic Roadmap. This activity will finance (a) a detailed gap analysis of NIMC in terms of institutional structure and deployment of human resources to identify capacity reinforcement needs and (b) a change management strategy for NIMC, based on consultation at all levels of the organization, and taking into account the need to facilitate knowledge transfer from the PIU to the existing and newly recruited NIMC civil servants and other personnel. Activity 4.2.6: Project implementation personnel 135. The project will, as much as possible, be implemented by civil servants seconded to the PIU; however, the project may finance the salaries of a limited number of dedicated external candidates essential to project implementation and ecosystem coordination if no qualified civil servants can be identified to fill those posts. In NIMC, a dedicated team of project implementation personnel and technical experts will be placed. They will work alongside the current NIMC staff who will continue to provide day-to-day implementation and business-as-usual functions. Personnel in the PIU will be competitively recruited, with priority given to the existing civil servants who will be seconded into the PIU. Positions will only be opened up to external candidates when the required capacity cannot be found within the civil service. In cases where the PIU positions are filled by civil servants, their salaries will not be eligible for project support, but the project will employ productivity allowances developed to reward performance based on results, as is the case on similar World Bank-assisted projects in the country. In cases where the PIU positions are opened up to external candidates, recruitment will be carried out according to World Bank procurement procedures and wages of retained staff will be supported by the project. The list of human resources in the PIU who are eligible for project financing is enumerated in annex 1. Activity 4.2.7: Operating costs 136. The project will finance operating costs for the PIU to enable reliable project implementation and effective coordination. Eligible expenditures include, but are not limited to, renting office space, office supplies and consumables, and transportation costs for key project personnel for implementation- related travel. Page 107 of 113 The World Bank Nigeria Digital Identification for Development Project (P167183) ANNEX 3: Effective Inclusion and Beneficiary Engagement 1. Equal access to identification documents can contribute to inclusion and the economic and social empowerment of women and marginalized groups. Identification can facilitate access to social protection programs, legal protection, financial services; strengthen political participation; and remove barriers to voter registration.35 2. However, historically, ID systems have often led to exclusion due to gaps in nationality laws and their application or other barriers to enrollment, such as lack of required breeder documents, cost, or distance. As proof of identity becomes increasingly ubiquitous and necessary for accessing services, marginalized groups face increasingly risks of exclusion. 3. The causes of exclusion are varied. Logistics, direct and indirect costs, and distance might be the main barriers to registration for some, while social stigma might hinder the participation of others, particularly persons with disabilities. Women might be deterred from participating in the public sphere and thus in obtaining an ID, particularly in traditional or religious settings. Finally, some groups might be hesitant to register for fear of persecution (e.g. informal traders and laborers); deportation (e.g. asylum seekers and migrants); stigma and violence (e.g. pastoralists and unaccompanied minors); or losing their assets (e.g. child-headed households and slum dwellers). Discrimination at the level of service delivery is also a common underlying factor of exclusion, either through overt denial of registration; derogatory practices; inability to meet the needs of certain groups (that is, lack of interpreters); or lack of cultural awareness (that is, registration errors may be higher for names of ethnic minorities). 4. The project will place a special focus on ensuring that technocratic solutions do not inadvertently institutionalize exclusion or discrimination against marginalized groups. Strengthening national IDs should result in improved efficiency of public and private services. However, improving ID systems can also have the unintended consequence of making access to these same services more difficult for people who are unable to obtain IDs. The project will pay particular attention to inclusion of the perspectives and needs of marginalized groups such as orphans and vulnerable children, women, the elderly, persons with disabilities, religious and ethnic minorities, migrants, refugees, asylum seekers, IDPs, returnees, border populations, noncitizens, and stateless persons. As part of project preparation, the World Bank commissioned a note which identified the key marginalized groups in Nigeria at risk of exclusion from the ID system, as well as entry points for reaching these groups through civil society and other representatives. 5. The project will promote transparency and accountability, participation, grievance redress, regular monitoring to improve operational performance, and mitigation of identified social risks. Gender 6. It is important to address gender gaps in ID coverage, particularly where it is low. This is both because the ability to prove one’s identity is a fundamental right and because IDs are instrumental to accessing many other rights and services where proof of identity is required, such as access to finances, ownership of mobile phones, health services, and social protection, and claiming rights under the law. 35Dahan, M., and L. Hanmer. 2015. “The Identification for Development (ID4D) Agenda: Its Potential for Empowering Women and Girls.” Background Paper, World Bank, Washington, DC. Page 108 of 113 The World Bank Nigeria Digital Identification for Development Project (P167183) Without official ID documentation, women cannot file entitlement claims or carry out family and property transactions requiring individual legal status, and they face barriers claiming basic citizenship rights, including voting. Further, lack of an ID can limit women’s voice and ability to have influence and be heard, as without official ID, women are constrained from seeking formal leadership roles (for example, as elected officials). 7. Better access to identification documents can have positive impact on women’s economic empowerment. As more women start requiring bank or mobile money accounts to be paid, save, or access credit, IDs will become critical. There is a sizeable gender gap between men’s and women’s access to bank accounts—in Nigeria, 51 percent of men over 15 years of age have bank accounts compared to only 27 percent of women over 15.36 Easier access to a national ID can also support women entrepreneurs. Many women play an important role as small traders and IDs can make them more profitable by enabling them to cross borders more easily and buy goods and services (for example, through accessing financial services and SIM cards). 8. Women are often disproportionately affected by formal and informal barriers to accessing identification. For example, while married women can access the national ID in the same way as married men, this is not the case for applying for a passport, another critical form of identification.37 Informal barriers include the inability to leave home, lack of funds for costs associated with registering for an ID, lack of safe transport to enrollment centers, and lack of breeder documents, among others. Cultural or religious beliefs may also limit women’s ability to access identification. 9. Efforts to identify and address barriers that women face in Nigeria in obtaining IDs —and, indeed, in many aspects of their lives—need to consider Nigerian women’s multiple identities, which intersect to create relatively more or less disadvantage for women in different social groups. Interviews with CSOs working in the birth registration and ID space raised the importance of intersecting identities that influence the extent of disadvantage for women in Nigeria. Specifically, these are thought to be religion (Muslim versus Christian), region of residence (south versus north), and class. For example, Muslim women from poor households in the northern region are most likely to be excluded from society and least likely to have—or be able to obtain—an ID (K. Okenyodo, key informant interview [KII], January 14, 2019). Similarly, child marriage is prevalent in Nigeria and young and child brides (married before 18 years) may face greater obstacles than older women or their male contemporaries to accessing ID. This is both due to social norms that restrict mobility and because once they have moved away from their parents’ home registration becomes more difficult, especially for child brides, as registration of those under 18 requires the presence of a parent. In general, pastoralists, migrant fisherfolk, and migrant farmers are groups that traditionally shy away from engagement with the Government and are less likely to have IDs, though here too there is significant regional variation as pastoralists in some parts of the country are much more powerful than in others. Women from these communities are likely to be doubly disadvantaged: by their gender and their pastoral identity (S. Momale, KII, January 15, 2019). Women with disabilities and women in the large internally displaced populations across the country are also likely to face additional barriers and be more excluded from society than women without disabilities or women who are not internally displaced (E. Umoh, KII, January 27, 2019; K. Okenyodo). 36 Demirgüç-Kunt, Asli, Leora Klapper, Dorothe Singer, Saniya Ansar, and Jake Hess. 2018. The Global Findex Database 2017: Measuring Financial Inclusion and the Fintech Revolution. Washington, DC: World Bank. 37 World Bank Group. 2018. Women, Business, and the Law 2018. Washington, DC: World Bank. Page 109 of 113 The World Bank Nigeria Digital Identification for Development Project (P167183) 10. To be fully gender informed, the ID4D Initiative has financed a deep dive on gender and identification in Nigeria to be completed before project effectiveness. This study is employing qualitative research methods to understand the barriers to women’s access to identification and potential solutions to be implemented under the project. The study considers the intersectionality of poverty, culture, religion, and gender and how this may compound barriers to identification. 11. The results of the gender deep dive research will inform a gender action plan and strategy for the ecosystem enrollment model. Consultations 12. Meaningful consultations can improve the design, implementation, and sustainability of the project. They provide an avenue for receiving and acting on input relevant to project design and implementation, give voice to the needs of marginalized groups, improve project risk management, and increase transparency and public understanding.38 As part of project preparation, consultations were held with marginalized groups and civil society, including persons with disabilities. As a result of consultations, civil society has been incorporated in the enrollment model of the project and the needs of marginalized groups have informed the development of the Pillars of Inclusion outlined in Component 2. 13. A national consultation mechanism will be established, led by NIMC, to continue dialogue with civil society stakeholders and marginalized groups. The mechanism will focus on clearly communicating project design, expected project outcomes, and objectives of the consultative process, as well as collecting and responding to feedback. Stakeholder identification for participation in the consultations will include due consideration of representativeness and inclusion of marginalized groups. Consultations will take place on an annual basis. 14. The consultation mechanism will close the feedback loop between users and the Government. Beneficiaries and stakeholders will be able to express their concerns based on knowledge of the project objectives, expected results, and its implementation arrangements. The Government will also be able to communicate actions taken to improve implementation in response to received grievances and feedback. Communications 15. A robust communications strategy will be an important tool for overcoming the existing negative opinions about the national ID system and ensuring that users, implementers, and officials have a strong understanding of entitlements, eligibility, and service standards under the revamped ID system. Communications strategies should provide quality information that is easily consumed by the public; available in multiple languages; and disseminated through various media (for example, radio, television, newspapers, pamphlets, roadshows). 16. The ECSU will develop a communications strategy to explain the ecosystem approach to identification. The strategy will explain each step, from eligibility through enrollment and receipt of 38Manroth, Astrid, Zenaida Hernandez, Harika Masud, Jad Zakhour, Miguel Rebolledo, Syed A. Mahmood, Aaron Seyedian, Qays Hamad, and Tiago Peixoto. 2014. Strategic Framework for Mainstreaming Citizen Engagement in World Bank Group Operations: Engaging with Citizens for Improved Results. Washington, DC: World Bank Group. http://documents.worldbank.org/curated/en/266371468124780089/Strategic-framework-for-mainstreaming-citizen- engagement-in-World-Bank-Group-operations-engaging-with-citizens-for-improved-results. Page 110 of 113 The World Bank Nigeria Digital Identification for Development Project (P167183) authenticators, and will address concerns about privacy, cost, link to nationality, access, and particularly usefulness (that is, why an ID is necessary). 17. Public awareness campaigns will outline the rights and responsibilities of users and ecosystem partners and will publicly relay service standards and information about lodging grievances. These are building blocks for a strong system of citizen engagement, which actively involve beneficiaries in providing feedback about the project. For example, the campaign should be particularly clear about service standards (that is, entitlement/eligibility for an ID, right to grievance redress, and the various partners through which to access an ID). Specific communication on the GRM should include the types of grievances that can be submitted, how to submit a complaint, standards and time frames for complaint resolution, and options available to a complainant if s/he is dissatisfied with the grievance redress process or outcome. Emphasis should be placed on communicating that there is no cost for making a complaint, grievances will be confidential, and complainants will not be punished for lodging complaints. GRM 18. A GRM is a system which responds to queries or clarifications, resolves problems with implementation, and efficiently and effectively addresses complaints and grievances. The project will develop a GRM for the ecosystem partners, managed by NIMC. The GRM will (a) be responsive to the needs of beneficiaries and non-beneficiaries and address and resolve grievances; (b) serve as a channel for soliciting enquiries, inviting suggestions, and increasing participation; (c) collect information to improve operational performance; (d) enhance project legitimacy among stakeholders; (e) promote transparency and accountability; and (f) deter fraud and corruption and mitigate project risks. 19. The GRM will collect complaints about enrollment by all partners and will include a centralized grievance register, contract center, and various channels for submitting complaints. The World Bank’s Technical Assessment of NIMC found that NIMC’s existing Customer Care Department is overwhelmed with complaints and requires support to better collect, log, and respond to grievances. These issues are only likely to increase with the addition of ecosystem enrollment partners. A strengthened and centralized GRM will enable NIMC to address existing issues with meeting user needs and better manage ecosystem enrollment partners. 20. The GRM manuals will be developed to guide all stakeholders on their key functions, roles, and responsibilities. These will include clear procedures on how to address each type of complaint and ensure that feedback is provided to complainants. The GRM manual will also set performance standards and targets for grievance handling. 21. An annual GRM review will be carried out to ensure that the GRM produces results. If complaints and queries are not responded to on time, beneficiaries will not trust the system. Measuring performance of the GRM is critical to understanding whether citizens are aware of how to register complaints and whether NIMC and ecosystem partners are handling grievances properly and on time. Lessons learned from the reviews will be fed back into the GRM, communications strategy, and consultations, as applicable, to strengthen operational performance. Page 111 of 113 The World Bank Nigeria Digital Identification for Development Project (P167183) ANNEX 4: Effectiveness and Disbursement Conditions Effectiveness Conditions 1. The project financing is subject to various effectiveness conditions designed to ensure readiness for implementation. Effectiveness conditions apply to the first disbursement of funds from each co- financing partner. Effectiveness conditions applicable to the IDA Credit (US$115.0 million equivalent) 2. The effectiveness of the IDA Credit is conditioned on (a) The AFD Co-financing Agreement has been executed and delivered and all conditions precedent to its effectiveness or to the right of the Recipient to make withdrawals under it (other than the effectiveness of the IDA Credit FA) have been fulfilled. (b) The establishment of the ID4D Project PESC with leadership and composition acceptable to IDA and (c) Submission of the Legal Opinion in respect of the FA, unless the Association opts to forego requiring the legal opinion pursuant to Section 10.02(b) of the General Conditions. Effectiveness conditions applicable to the EIB loan (US$215.0 million) 3. As approved by the EIB Board, the EIB funds are subject to the following effectiveness conditions. The first disbursement of EIB funds for the project (EIB loan effectiveness) is conditioned on (a) The enactment of a data protection law and its effective implementation, notably the designation and effective operationalization of the data protection independent national authority responsible for enforcing and monitoring the compliance with data protection legislation, and (b) Written confirmation from the World Bank that the implementation of the components to be financed by the corresponding disbursements complies with the EIB’s procurement requirements and environmental and social standards, as stipulated in the co-financing agreement signed between EIB and the World Bank. 4. Effectiveness conditions applicable to the AFD loan (US$100.0 million). The effectiveness conditions of the AFD financing, as approved by the AFD Board, are to be fully harmonized with the conditions applicable to the IDA Credit, as reflected earlier. Disbursement Conditions 5. To ensure that the personal data collected during NIN enrollments are adequately protected, a portion of project financing has been made conditional on satisfactory progress on certain critical legal reforms. These disbursement conditions are in addition to the effectiveness conditions detailed earlier. These reforms to the legal, regulatory, and institutional framework for ID include reforms necessary to develop a legal and regulatory framework that (a) adequately protects individuals’ personal data and privacy and (b) promotes nondiscriminatory, inclusive, and universal access to ID. The specific Page 112 of 113 The World Bank Nigeria Digital Identification for Development Project (P167183) disbursement conditions applicable to the IDA Credit and partner financing are detailed in the following paragraphs. 6. Disbursement conditions applicable to the IDA Credit (US$115.0 million equivalent). The disbursement conditions applicable to IDA funds under this project apply exclusively to enrollment activities in Activities 2.5.6 and 2.5.7, the per-enrollment payments to the NIMC partners in the enrollment ecosystem (Groups A and B) which employ the OBD modality.39 This category will be divided into two tranches, each of which contain half of the funding available for per-enrollment payments to ecosystem partners. A first set of enrollment conditions will apply to the first tranche of this category (50 percent of available funds); a second set of enrollment conditions will apply to the second tranche of this category (50 percent of available funds). The specific conditions are as follows: (a) The disbursement of the first tranche of IDA funds to the NIMC partners in the enrollment ecosystem will be conditioned on (i) Enactment of a data protection bill and (ii) Assessment of enrollment system readiness by the World Bank (adequacy of technical aspects; business model and per-enrollment payments; enrollment partner licensing, assurance, and onboarding arrangements; security, privacy, and data protection; and existence of the tamper-proof enrollment verification system with audit trail required for disbursement of the OBD category). (b) The disbursement of the second tranche of IDA funds to the NIMC partners in the enrollment ecosystem will be further conditioned on (i) Amendment of specific provisions in the NIMC Act and the Registration of Persons and Contents of the National Identity Database Regulations 2017 related to enrollment eligibility; mandatory use of the NIN for access to services; and NIMC’s mandate related to sharing of personal data with third parties to align with the project design and objective to promote universal coverage, inclusion, and nondiscrimination. 7. Disbursement conditions applicable to the EIB loan (US$215.0 million). As approved by the EIB Board, the EIB funds are subject to the following disbursement conditions: (a) The first disbursement of the EIB funds to the NIMC partners in the enrollment ecosystem will be conditioned on (i) Development and implementation of the performance auditing framework, including the system and operating model, for the verification of the volume of unique identities registered by each enrollment partner, to the satisfaction of the EIB. 8. Disbursement conditions applicable to the AFD loan (US$100.0 million). The disbursement conditions of the AFD financing, as approved by the AFD Board, are to be fully harmonized with the conditions applicable to the IDA Credit, as reflected earlier. For details on the groupings of enrollment partners as well as OBD arrangements, see annex 1. Page 113 of 113