Understanding

Capture and Validate

KYC Processes:
Global Experiences,
Challenges and
Learnings
May 2019

Copyright © 2019 GSM Association

 Understanding Capture and Validate KYC Processes:
Global Experiences, Challenges and Learnings

Digital Identity

The GSMA represents the interests of mobile operators The GSMA Digital Identity Programme is uniquely
worldwide, uniting more than 750 operators with over positioned to play a key role in advocating and raising
350 companies in the broader mobile ecosystem, awareness of the opportunity of mobile-enabled digital
including handset and device makers, software companies, identity and life-enhancing services. Our programme works
equipment providers and internet companies, as well as with mobile operators, governments and the development
organisations in adjacent industry sectors. The GSMA also community to demonstrate the opportunities, address the
produces the industry-leading MWC events held annually in barriers and highlight the value of mobile as an enabler of
Barcelona, Los Angeles and Shanghai, as well as the Mobile digital identification.
360 Series of regional conferences. 
  For more information, please visit the GSMA Digital Identity
For more information, please visit the GSMA corporate website at www.gsma.com/digitalidentity
website at www.gsma.com
Follow GSMA Mobile for Development on Twitter:
Follow the GSMA on Twitter: @GSMA @GSMAm4d

This document is an output of a project funded by UK

aid from the Department for International Development
(DFID), for the benefit of developing countries. The views
expressed are not necessarily those of DFID.

Author:
Matt Wilson, Senior Insights Manager, GSMA
Rob Waddington, Futuresight
 Understanding Capture and Validate KYC Processes:
Global Experiences, Challenges and Learnings

Contents
Executive Summary................................................................................... 2

The Capture and Validate Landscape............................................... 5

Establishing a ‘Capture & Validate’ System.................................... 11

Case Study 1: Pakistan................................................................................. 14
Case Study 2: Bangladesh.......................................................................... 16
Case Study 3: Peru...................................................................................... 18
Case Study 4: Uganda................................................................................. 20
Case Study 5: Senegal................................................................................. 22

Key Learnings:............................................................................................. 24
Capture and Validate Implementation....................................................... 24
Benefits to MNOs........................................................................................ 27
Economic Impacts on MNOs...................................................................... 29
Current and Future Opportunities............................................................. 31

Conclusion..................................................................................................... 34

Appendices................................................................................................... 36
Additional Country Case Studies............................................................... 36
Research Methodology............................................................................... 42
 Understanding Capture and Validate KYC Processes:
Global Experiences, Challenges and Learnings

Executive Summary

As of December 2018, an estimated 150 governments impose Know-Your-

Customer (KYC) regulations that require customers to present a valid proof
of identity – often a government-issued or recognised credential, such as
a national identity document or passport – before they can subscribe to
mobile services. Governments take different approaches to implementing
SIM registration policies, but these generally fall into one of the following
three categories, as defined by the GSMA.
1

Capture and Store

Mobile network operators (MNOs) are required to capture and keep a record of a set of
personal information about the SIM user. The required information varies from jurisdiction
to jurisdiction. About 85 per cent of the countries mandating SIM registration follow
this approach.

Capture and Share

MNOs are required to proactively capture and share the SIM user’s personal information with
the government or regulator, rather than upon demand. Roughly four per cent of the countries
mandating SIM registration follow this approach.

Capture and Validate

MNOs are required and enabled to validate their customers’ identification credentials against a
central government database, usually maintained by a government authority or regulator. Only
16 countries (11 per cent) mandating SIM registration follow this approach, of which 11 countries
(seven per cent) require MNOs to use biometric-authentication processes when registering
their prepaid SIM customers.

1. GSMA (2019) ‘Access to Mobile Services and Proof of Identity 2019: Assessing the impact on digital and financial inclusion’

2 Executive Summary
 Understanding Capture and Validate KYC Processes:
Global Experiences, Challenges and Learnings

Of these three categories, GSMA has asserted that Research Methodology

‘Capture and Validate’ processes give the highest
Desk-based research was conducted to provide
level of assurance that the registered individual
a detailed overview of the key stakeholders,
‘is who they claim to be’. This can mitigate the
institutions, regulations, legislation, systems and
incidence of fraud and offers new opportunities
processes in 11 countries understood to have
for mobile to be used as a digital identity when
implemented a Capture and Validate system in Latin
accessing value added services.2 However, these
America, Sub-Saharan Africa and South/Southeast
benefits must be balanced against the risk of data
Asia.4 This includes: Ecuador, Peru, Ghana, Senegal,
misuse and mobile users’ rights and legitimate
Uganda, Bangladesh, India, Indonesia, Malaysia,
expectations, for example in the context of
Pakistan and Thailand. To help validate the available
privacy and data protection. Capture and validate
published information, stakeholder interviews
capabilities, therefore, do not tend to involve giving
were conducted to collect the views and opinions
MNOs access to personally identifiable information
of subject matter experts and local stakeholders
held by government; instead, they usually allow
in each country. Short case studies on six of these
MNOs to query a customer’s identification credential
countries can be found in Appendix 1.
against the database, and in turn the relevant
authority confirms whether the credential matches In five of the 11 Capture and Validate countries –
the one stored in their official records. Pakistan, Bangladesh, Peru, Uganda and Senegal
– structured interviews were conducted in-country
There is also anecdotal evidence to suggest that a
with individuals who possess particular knowledge
Capture and Validate approach – particularly when
of, and experience with, the local Capture and
identification systems have sufficient coverage – can
Validate system. Where possible, this included
bring direct benefits to MNOs and other private
telecommunications regulators, national identity
sector organisations by decreasing administrative
authorities and MNO representatives from relevant
costs, reducing fraud, increasing revenue and
business functions: Policy or Regulatory Affairs,
widening the customer base.3 However, to date
Compliance, Commercial and others. A more
there is little robust evidence to support these
detailed summary of the stakeholders engaged in
claims, nor assessments examining the impact
each of these focus countries are found in Appendix
of this approach on MNOs and the opportunities
2. The insights and recommendations found in
that might arise from it. This report addresses
this report reflect the anonymised perspectives of
this knowledge gap and, in turn, provide shared
these individual stakeholders, and caution has been
learnings for other MNOs that might be required
taken not to extrapolate the findings too broadly.
to implement a Capture and Validate system in the
Furthermore, precise data related to the cost of
near future.
these initiatives or their broader societal impacts
(for instance, reduction in small-scale crime) was
not always available and in many cases has been
carefully estimated.
Case studies documenting how MNOs in each of
the five countries navigated the implementation
of Capture and Validate systems are found on
pages 11 to 13. A summary of lessons learned from
all 11 countries – related to implementation, the
benefits and costs to MNOs, and current and future
opportunities – are found on pages 24 to 33.

2. GSMA (2016) ‘Mandatory registration of prepaid SIM cards: Addressing challenges through best practice’
3. See for instance: World Bank (2018) ‘Private Sector Economic Impacts from Identification Systems’
4. As identified in GSMA’s ‘Access to Mobile Services and Proof-of-Identity: Global policy trends, dependencies and risks’ (2018, Annex 8). There were five Capture and Validate coun-
tries not included in this research project: Bahrain, China, Egypt, Hungary and Saudi Arabia.

Executive Summary 3
 Understanding Capture and Validate KYC Processes:
Global Experiences, Challenges and Learnings

Key insights highlighted in this report include:

Capture and Validate systems offer clear benefits to MNOs
Across all Capture and Validate countries, there was consensus amongst MNOs and other
stakeholders that the Capture and Validate system had delivered a more streamlined SIM
registration process, resulting in a better on-boarding experience for customers and a reduction
in administration, transaction and compliance costs. Across the five countries which had also
implemented biometric verification, MNOs and regulators agreed that the system had produced
improvements to database management tracking and reporting. There was also anecdotal
evidence to suggest a reduction in small-time criminality (as evidenced by a reduction in
consumer complaints and the number of investigations into particular types of crimes).

However, the benefits of Capture and Validate systems can be costly for MNOs
MNOs in each of the five focus countries reported that they were required to cover all costs
associated with implementing the new Capture and Validate system. Almost all MNOs also saw
some reduction in their customer base. The amount of capital investment required – for example
to purchase scanners, servers and other devices – varied according to the system approach
(biometrics or biodata), the size of the retail network and the subscriber base. Operational
expenditure depended largely on the MNOs training requirements, data capture and storage
needs (text and/or images) and verification fees. Notably, the operational costs decreased in
most countries once the new registration system was established.

The importance of careful and strategic implementation

The experiences of MNOs across all nine research countries show that when implementing
a new registration system, there are several important factors that all stakeholders should
consider in order to relieve some of the impacts on MNOs. Collaboration – within the industry,
as well as with the government and regulators – is critical for reducing implementation costs,
setting shared objectives, creating positive incentives that motivate operators, and building
consensus around how to develop the registration platform. To minimise disruption and
customer deactivations, governments must also ensure that mobile subscribers have access to
the required identity documents (such as national identity cards), and that the national registry
contains up-to-date, matching data.

Future opportunities
Capture and Validate systems provide MNOs with unique opportunities to establish digital
identities for their customers and provide access to new mobile services that generate both
commercial and social impact. MNOs in Pakistan are already leveraging the Capture and Validate
systems to offer new identity-linked services to vulnerable segments of the population, such
as social cash transfers delivered via mobile money, health services, and Internally Displaced
Person cards. In other countries, MNO representatives participating in our research saw value
in working with the GSMA to champion the development of new identity-linked services, or to
help to address the barriers that prevent millions of individuals from accessing official proof of
identity and registering for mobile services in their own name.

4 Executive Summary
 Understanding Capture and Validate KYC Processes:
Global Experiences, Challenges and Learnings

The Capture and

Validate Landscape

Fundamentally, Capture and Validate systems are dependent on the

availability of a verifiable identity scheme (a digital government registry
holding the identity data of its citizens), and the ability of individuals
to access the government-recognised identity documents that meet
registration requirements. Where identification systems are not robust
or where national identity coverage is low, there is a risk that Capture
and Validate policies will exclude large sections of the population from
accessing mobile services in their own name – often those who are most
vulnerable or geographically remote.

The approach taken to both capture and validate a service. If the registry also holds an individual’s
customer’s identity details is dependent on the type biometric data, such as their picture or fingerprints,
of data that is stored in the government registry. the subscriber will need to be physically present
Where the government only holds an individual’s at the point of registration. Among the 11 countries
unique national identity number or other text-based explored through this research, the following
details, the subscriber’s details can be verified in in systems were found to be in place.
person, or, virtually, via a short-code or automated

Capture & Validate Non-Capture and Validate

Capture Capture
Biodata Biometrics
& Store & Share

Verifiable ID Indonesia Peru Thailand

Scheme
Ecuador Bangladesh
Uganda Pakistan
Senegal India
Malaysia

Non-Verifiable Ghana
ID Scheme

The Capture and Validate Landscape 5

 Understanding Capture and Validate KYC Processes:
Global Experiences, Challenges and Learnings

Capture and Validate: Biodata

Indonesia, Ecuador, Uganda and Senegal all operate the data is captured and the overall customer
a system which validates the subscriber’s identity experience. Indonesia and Ecuador operate virtual
card data (biodata) against a central database in identity validation – in Indonesia subscribers
real-time. In Malaysia, verifications of biodata are validate their identity details via a short code;
made against a central database in batches, rather in Ecuador subscribers use an interactive voice
than in real-time. There are significant differences response system.
between these countries with regard to how

Process:
Indonesia Short code 4444

Total population: • All SIM cards must be validated against the

268 million central database (DUKCAPIL)

Unique mobile subscribers: • The customer inputs a keyword, identity number

(NIK) and family card number (KK) via short code
75% to 4444 (different keywords for new vs current
Subscription: SIM)
96% pre-paid; 3% post-paid • MNOs pass the data to DUKCAPIL - the NIK & KK
data is validated in real-time
• MNOs send the MSISDN number to DUKCAPIL to
• 90% registered in national registry5 map each MSISDN registered to an identity
(DUKCAPIL)
• Max 3 SIMs per operator if registering via short
• NI card (KTP) includes unique identity code. If >3 SIMs required, e.g. for M2M (data),
number (NIK) + family number (KK) then the subscriber must register in store

Process:
Ecuador Interactive Voice Response (IVR)

Total population: • All SIM cards must be validated against the

16 million central registry

Unique mobile subscribers: • The customer inputs their identity or another

official document and calls the operator’s IVR
69% service
Subscription: • Identity is validated in real-time
77% pre-paid; 23% post-paid • MNOs must capture full name, address, identity
number

• 99% coverage of identity card6 (cedula) • MNOs must also link identity to IMEI handset
number
• Cedula includes unique number + picture
• MSISDN and IMEI must be registered to a single
identity to be validated

5. Unless otherwise noted, all data on national ID penetration in this report is based on the World Bank’s 2017 Global Findex survey, which asked adult participants to confirm whether
they possessed a National Identity Card. See: https://globalfindex.worldbank.org
6. ibid

6 The Capture and Validate Landscape

 Understanding Capture and Validate KYC Processes:
Global Experiences, Challenges and Learnings

Uganda, Senegal and Malaysia all require the prior to the national identity card being validated
physical presence of the customer at the MNO store. against national database.
In Uganda, biometric data is also validated locally,

Process:
Biometric validated locally; NID card against
Uganda national database

Total population: • Customer must be present at MNO centre with

38 million national identity document

Unique mobile subscribers: • Customers fill out a paper form and provide a
signature (for financial services KYC)
44%
• MNO scans national identity card and takes
Subscription: customer’s photo and fingerprints and compares
98% pre-paid; 2% post-paid the two; this first validation is performed locally
by the vendor
• MNO submits biodata on the card to central
• 81% coverage of national identity card7 database (NIRA) for real-time validation
(NIC) • MNO retains all details – photo, national identity
• NIC includes unique number (NIN) + document and biodata
picture / fingerprints • Max. 10 SIMs per identity (no check currently)

Process:
Senegal NID card validated (physical presence)

Total population: • Customers must be present at MNO store with

16 million national identity document

Unique mobile subscribers: • MNO takes a picture of the identity card, name,
address and date of birth, and submit to La
55% Direction de l’automatisation du fichier (DAF) for
Subscription: validation
99% pre-paid; 1% post-paid • Once validated, DAF sends back the number of
the identity card it has validated
• [SONATEL also conducts second internal check
• 72% coverage of national identity card8 that the picture of the identity card matches the
(NIC) identity number provided by DAF (validated
• NIC includes 2 numbers – new identity within 24 hours)]
number and previous identity number + • The MNO checks for SIMs registered to that
picture / fingerprints identity
• New regulations allowed for 3 SIMs per identity
(identity card and passport) for each operator
(3), i.e. potential total of 18 SIMs per person.

7. ibid
8. ibid

The Capture and Validate Landscape 7

 Understanding Capture and Validate KYC Processes:
Global Experiences, Challenges and Learnings

Process:
Malaysia NID card validated (physical presence)

Total population: • Citizens have to present their MyKad in person

31 million and register at a service provider outlet.

Unique mobile subscribers: • MNO scans MyKad with optical character

recognition (OCR) / card reader and data is
80% automatically uploaded to MNO system (no
Subscription: manual input) and stored (identity number, name,
66% prepaid, 34% contract address, date of birth and photo)
• MNO validates the subscriber’s MyKad against
the national registry in batches
• 94% coverage of national identity card9 • If match not confirmed, MNO must contact
(MyKad) subscriber for correct identity or deactivate
• MyKad includes unique numbers + • Customers can also purchase SIMs online using
advanced chip and biometrics their bank account as verified identity
• Maximum limit of 6 SIMs per identity

9. ibid

8 The Capture and Validate Landscape

 Understanding Capture and Validate KYC Processes:
Global Experiences, Challenges and Learnings

Capture & Validate: Biometrics

Peru, India, Pakistan and Bangladesh all operate function to the registry, managed by the MNOs
a validation process where, prior to issuing and/ and the regulator. In Bangladesh, for example, the
or validating a SIM card, the vendor captures a MNOs collaborated with the regulator to build the
subscriber’s identity card and fingerprints and Central Biometric Verification Monitoring Platform,
submits these to a central database for real-time which holds all identity data as well as MSIDSN (the
validation. In all cases, the central registry’s function phone number associated with a single SIM card)
is to verify that the identification information activity. In Pakistan, MNOs link into the Pakistan
submitted matches those on the register. Mobile Database, which was set up to enable
mobile number portability and enables MNOs
Some systems also verify the number of SIMs
and subscribers to check on the number of SIMs
registered against a single identity as part of the
associated with an identity.
registration process. This is generally a separate

Process
• All subscribers must present their identity card • On confirmation, subscriber’s identity data is
and have their fingerprints scanned stored by MNO / Regulator
• MNOs check SIM count (Bangladesh / Pakistan) • Biometric data is only used to query a
• identity card and fingerprints are validated subscriber’s identification and is not stored
against a central registry in real-time

Peru India
Total population: Total population:
32 million 1.36 billion
Unique mobile subscribers Unique mobile subscribers
72% 55%
Subscription: Subscription:
63% prepaid; 37% post-paid 93% pre-paid; 7% post-paid
• 98% coverage of identity card10 (DNI) • 90% coverage of identity programme
• DNI contains biodata + unique identity number (Aadhaar)
+ fingerprints • Identity data includes unique 12-digit number
and iris/fingerprint

Bangladesh Pakistan
Total population: Total population:
165 million 200 million
Unique mobile subscribers Unique mobile subscribers:
53% 46%
Subscription: Subscription:
98% pre-paid; 2% post-paid 97% pre-paid; 3% post-paid
• 83% coverage of identity document11 (NID) • 79% coverage of identity document12 (CNIC)
• Identity card contains unique number and • CNIC contains unique number + face /
face/fingerprint fingerprint

10. See: https://globalfindex.worldbank.org

11. ibid
12. ibid The Capture and Validate Landscape 9
 Understanding Capture and Validate KYC Processes:
Global Experiences, Challenges and Learnings

Non-Capture and Validate

Consultations with local stakeholders confirmed MNOs then share the biodata on the card with the
that Thailand and Ghana do not operate Capture regulator and store the details locally. Ghana does
and Validate systems. Thailand, which has a not have a single national registry, rather there
comprehensive national identity scheme with 99 per are several databases used for different functions
cent coverage,13 currently operates a ‘Capture and (e.g. driving licence, health card). Customers can
Share’ model. Customers must present their national register for a SIM by filling out a paper form using
identity document and have their picture taken various forms of identity in a dedicated MNO
in a dedicated MNO outlet, and vendors compare outlet or with a street vendor. Additional details
the subscriber’s live picture with the picture on on the KYC processes in each country are found in
their national identity card to validate locally. the Appendix.

13. ibid

10 The Capture and Validate Landscape

 Understanding Capture and Validate KYC Processes:
Global Experiences, Challenges and Learnings

Establishing a
‘Capture & Validate’
System
Case Studies Overview
Introducing or changing mandatory SIM registration processes is
logistically challenging for all parties involved, including consumers,
MNOs, retail partners, the regulator, the national registry and government.
The following case studies detail the experiences of MNOs in Pakistan,
Bangladesh, Peru, Uganda and Senegal as they established their respective
Capture and Validate systems, as described by subject matter experts.
Additional insights on the costs and benefits of these systems are found in
subsequent sections of this report.

All five of these countries have

The number of mobile subscribers and active
established a Capture & Validate
SIM cards
system in the past three to four
years, which required them to
mobilise their entire subscriber The government objectives, particularly in terms of
base to verify their identity the national security situation
within a certain timeframe.
When the new SIM registration
The SIM registration processes already in place
process was implemented,
each country differed in
terms of the key factors that
influence the implementation The number of MNOs, market share and competition
approach, namely:

Subscriber access to the required identity documents

(coverage of the national identity registry)

Establishing a ‘Capture & Validate’ System: Case Studies 11

 Understanding Capture and Validate KYC Processes:
Global Experiences, Challenges and Learnings

Case Studies

Pakistan

Bangladesh
Senegal

Uganda
Peru

Pakistan
Context: A highly competitive market with five MNOs fighting for market
share. Terrorist incidents forced nationwide biometric re-registration of
200 million SIM cards in 91 days. The national registry was at 70 per cent
coverage. MNOs had only just started developing the network. The retail
networks were not tested.
Outcome: 108 million SIMs registered, 27 million active SIMs disconnected
Impact on MNOs: Very High

Bangladesh
Context: A highly competitive market, with four MNOs and one dominant
player (46 per cent consumer market share). Digitisation and addressing
the challenges of law enforcing agencies were the key drivers. Biometric
verification agreed. The national registry was at 80 per cent coverage
(population 164m). Nationwide biometric re-registration implemented in
150 days.
Outcome: 117 million active SIMs re-registered out of 131 million in 150 days
Impact on MNOs: High

12 Establishing a ‘Capture & Validate’ System: Case Studies

 Understanding Capture and Validate KYC Processes:
Global Experiences, Challenges and Learnings

Peru
Context: A steady market with 23 million unique subscribers and two
dominant MNOs. An established national registry already used for
verification services by other sectors (98 per cent coverage). Biometric
verification for new SIMs implemented in under two years. MNOs are
charged verification fees by the registry.
Outcome: Nationwide re-registration completed with minimal
customer losses
Impact on MNOs: Medium

Uganda
Context: A competitive market with 15 million unique subscribers, a limit of
15 SIMs and two dominant MNOs. High profile security incidents precipitated
changes to the system. Registration helped push the national registry from
30 to 70 per cent coverage. Biodata verification for new SIMs with a ban on
sales for three months.
Outcome: Re-registration resulted in 10 to 15 per cent customer losses
across all MNOs
Impact on MNOs: Very high

Senegal
Context: A steady mobile market with 12 million unique subscribers and
one dominant MNO. No high-profile security threats. Close collaboration
and consultation with government lasted over a period of three years. The
dominant MNO was instructive in removing biometrics as the approach.
Outcome: Nationwide re-registration complete with approximately 6 per
cent customer losses
Impact on MNOs: Low

Establishing a ‘Capture & Validate’ System: Case Studies 13

 Understanding Capture and Validate KYC Processes:
Global Experiences, Challenges and Learnings

CASE STUDY 1

Pakistan

The National Database and Registration Authority (NADRA) manages

the national identity register and issues the Computerised National
Identity Card (CNIC) and Smart National Identity Card (SNIC). Both
cards contain a unique identity number and the owner’s biometric data,
including fingerprints and picture. NADRA’s biometric database acts as a
platform for access to a range of government services, and also operates
a self-generating revenue model that charges institutions for use of their
database for identity verification. It is estimated that just under 80 per cent
of the adult population now has possession of a national ID card.14

Pakistan has seen phenomenal growth in mobile highlighted that the system was still ineffective
subscriptions over the last fifteen years, and the for law enforcement. Even with the reduction in
large-scale societal adoption and use of digital SIM allowance from 10 to five in 2012, there was
technologies has been a key driver of measurable still a large number of untraceable SIMs. In 2013,
economic, social and cultural value, including a government-led consultation came to the view
improved security and a greater capacity to that a validated physical presence was the only
tackle social issues.15 In 2009, the Pakistan way to reduce fraudulent registration. It was agreed
Telecommunications Authority (PTA) introduced that all new SIMs would be registered using a
the ‘short code 789’ process, which enabled MNOs Biometric Validation System (BVS), on the basis that
to validate subscriber’s identities against NADRA’s NADRA’s database – then covering about 70 per
database when activating a new SIM. Each customer cent of the population16 – was sufficiently robust.
was allowed to register 10 SIMs in their name, and The remaining 30 per cent of citizens would be
the number of active SIMs could be verified against required to obtain a CNIC in order to register for
the Pakistan Mobile Database (PMD). a SIM in their own name, potentially resulting in
their exclusion from mobile services.
The ‘short code’ years (2009-2014) provided
some degree of assurance that the subscriber’s
identity was authentic, but increasing criminal
activity and terrorist attacks in 2009 and 2014

14. See: https://globalfindex.worldbank.org

15. GSMA (2016) ‘Country overview: Pakistan - A digital future’

14 Establishing a ‘Capture & Validate’ System: Case Studies

 Understanding Capture and Validate KYC Processes:
Global Experiences, Challenges and Learnings

The PTA convened all MNOs to consider how to situations, it would be beneficial for national identity
address several critical issues, such as the limited authorities to have service agreements in place that
footprint of BVS devices and NADRA’s verification limit technical disruptions and system disruptions.
charges. At the time, NADRA was charging 45 The timelines for procuring and testing the BVS
rupees (approximately US $0.30) per validation; devices was also very short, which led to multiple re-
after MNOs challenged the fees they were reduced verification models and increased costs for MNOs.
to 23 rupees for biometric and CNIC validation, and The initial roll out of the system in cities obscured
10 rupees for biometric only. A terrorist incident in the problems found in the rural areas – in particular,
December 2014, however, forced the PTA to change electricity power outages meant the BVS devices
the directive from using BVS for the registration of were not always operational.
new SIMS to a nationwide re-registration exercise
Engaging and training the retailer network on the
for all existing SIMs starting in January 2015. The
new Capture and Validate process was also a huge
timeframe for re-registration was reduced from six
undertaking for MNOs, and the time needed for
to three months, and the directive became part of
completing this was severely underestimated. The
the National Action Plan, making it legally binding.
shortened timeframes led to inflated incentives
MNOs initially collaborated to support the re- for retailers and MNO staff conscripted to various
registration exercise, with each procuring 1,400 locations around the country. MNOs suggest that
devices for shared use. However, different priorities a minimum of nine months should have been
meant that these agreements eventually broke allocated for the re-registration exercise: three
down and the re-registration environment became months for the cities, another three months for
both costly and highly competitive. MNOs stopped suburban environments and three months for
selling new SIM cards for three months so that all rural/remote areas.
efforts could be put into supporting registration
Despite the cost to MNOs, the Government
– by mobilising retail networks, raising awareness
provided virtually no financial incentives and
amongst their customer base, and sending
operators continued paying SIM tax throughout
employees to all areas of the country to help with
the registration period. Stakeholders interviewed
activation. The government provided support
through our research suggested that government
on communications by leveraging nationwide
could have reduced the financial burden on MNOs
media channels, but ultimately MNOs found that
through the removal of SIM tax during the re-
raising awareness amongst customers was one of
registration exercise or by contributing resources
their biggest challenges, and the time required to
from the Universal Service Fund, which MNOs
achieve this was underestimated. As expected, the
contribute 1.5 per cent gross revenue every year.
competitive environment favoured the largest
operators who were able to leverage more By the end of the re-registration period, the five
resources and a larger retail network. mobile operators had biometrically verified an
estimated 108 million SIMs,17 and according to the
The shortened timelines and high volume of
PTA this number grew to 115 million SIMs by the
customer traffic also caused significant problems
following year (against 45 million unique CNICs).
with the API allowing MNOs to validate against
In total, an estimated 27 million active SIMs
NADRA’s database, resulting in frequent
were disconnected.18
downtime and an impact on MNOs ability to re-
register customers. MNOs suggested that in these

16. According to subject matter experts interviewed through this research project
17. GSMA (2016) ‘Mandatory registration of prepaid SIM cards: Addressing challenges through best practice’.
18. ibid

Establishing a ‘Capture & Validate’ System: Case Studies 15

 Understanding Capture and Validate KYC Processes:
Global Experiences, Challenges and Learnings

CASE STUDY 2

Bangladesh

In 2008, the National Identity Document (NID) was issued by the

Bangladesh Election Commission (BEC) to all Bangladeshi citizens aged
18 and above and resident of an electoral area. The card contains the
citizen’s unique number and biometric details, including fingerprints and
a photo. The BEC manages the NID database (NIDD) and provides KYC
validation to 115 entities for different public and private sector services.
19
Coverage of the NID is estimated to be at 83 per cent as of 2017.

Until 2014, recording and validating the details helped motivate engagement from MNOs. During
of new mobile subscribers in Bangladesh was initial consultations, the BTRC conducted a survey
complicated by the low coverage of official identity to assess the project’s potential for success, and
documentation. In that year, the government tried to predict impact on customer losses. The result
to push for verification of all SIM card holders of the survey – which predicted a potential 20 per
against the NID and discovered that over 60 per cent reduction in active SIMs – was considered
cent of customers had registered for a SIM with acceptable by stakeholders given that the process
a fake identity document. Consultations took would ensure that all mobile subscribers had an up-
place between law enforcement, the Bangladesh to-date identity registered against each SIM.
Telecommunication Regulatory Commission
It was agreed that MNOs would supply Biometric
(BTRC) and MNOs to find an effective solution,
Verification Devices to each of the 120,000 retail
and biometric validation – requiring the physical
outlets throughout the country, and initially MNOs
presence of the subscriber – was concluded as the
agreed that they would collaborate by sharing the
only viable approach.
cost of the devices and running a single technical
The project was designed and implemented by a platform. However, this consensus broken down and
dedicated team, led by the then State Minister of each operator had to build and pay for their own
Post and Telecommunication Division and executed system and scanning devices individually. The result
by the BTRC, the Association of Mobile Telecom was increased costs and shortened timeframes
Operators of Bangladesh (AMTOB) and MNOs. for device procurement and testing. The Central
There was also strong support from government, Biometric Verification Monitoring Programme
particularly the National Telecommunication (CBVMP) was conceived shortly after this to oversee
Monitoring Centre (NTMC), who felt incentivised the data flow, provide validation and control the
to reduce the amount of crime carried out over number of SIMs per person (maximum of 15) across
mobile networks. This close collaboration helped all operators. The platform was managed by BTRC,
address a myriad of technical, procedural, legal, but built and paid for by the MNOs. Validation fees,
societal, financial and commercial issues and notably, were set low at just one cent per request.

19. See: https://globalfindex.worldbank.org

16 Establishing a ‘Capture & Validate’ System: Case Studies

 Understanding Capture and Validate KYC Processes:
Global Experiences, Challenges and Learnings

As in Pakistan, a key concern amongst MNOs The SAF was originally paper-based, which lead to
was the potential for re-registration to favour a number of problems. Retailers were incentivised
the dominant operator(s) with the technical to complete forms quickly, as commissions were
infrastructure and manpower to reach their based on the number of SIMs registered rather
customers quickly and more effectively than the than the accuracy of their form filling. The BTRC
smaller MNOs. As each SIM needed to be registered, estimated 30 per cent of forms were inaccurate or
it was considered likely that the ‘main’ numbers incomplete, potentially leading to fines of $50 per
would be registered first and other SIMs would be form. The forms also needed to be scanned so that
forgotten. To help alleviate these concerns, it was both soft and hard copies could be stored for ten
eventually agreed that the scanning devices would years, leading to warehouses and servers full of
be shared without discrimination. Initial tests of these details at considerable cost. In 2017, MNOs
the new SIM registrations exposed a host of issues successfully petitioned BTRC to allow electronic
with the validation process, with just 26 per cent of SAFs – these reduced costs, removed the threat
registration attempts successfully validated in the of fines, and ensured the process is frictionless
first month. However, after another four weeks of and transparent (each retailer is tracked and
testing the success rate had risen to 90 per cent. Re- accountable for each e-SAF).
registration was planned to start on 1 February 2016
As there was not full nationwide coverage of a
and complete by 30 April.
biometric NID, MNOs could register customers
Motivating the population to re-register was one using alternative identity documents, although the
of the biggest challenges faced by operators. SIM would be deactivated if they did not produce
This required MNOs to deliver extensive marketing the NID within six months. Corporate customers,
and communications activities for their customers, contract subscribers and foreigners were also
including putting on events, offering incentives and catered for. This level of planning and flexibility
even visiting customers door-to-door. There was, minimised the amount of SIM deactivations – just
as one operator said, ‘a complete shutdown of our 14 million out of a total of 131 million. According
operations to focus on this – we were so concerned to the BTRC, 84 million SIM cards (out of a total of
at losing customers that we threw every resource about 131 million) were re-registered by the end of
on [re-registration activities]’. The government April 2016. By the May deadline, another 12.5 million
provided extensive support to raise awareness of subscribers who were unable to complete the
the re-registration exercise, with ministers making registration process due to long queues or technical
televised appeals. However, the amount of time, challenges were also registered. In total, 117 million
effort and cost required to motivate the population SIMs had been re-registered according to BTRC; by
to register was underestimated by all parties – all accounts, this was an astonishing achievement
MNOs, the BTRC and government. As the deadline given the short time frame.
grew closer, the registration outlets became packed
Stakeholders suggest that MNOs still face some
and the NID database API was unable to cope with
challenges with the Capture and Validate process,
the demand. Seeing that many customers were left
such as mismatches with the NID database or
queuing in the heat for hours to ensure their SIMs
system downtime. MNOs noted two to three days
were not disconnected, the government extended
of downtime per month, which affect an estimated
the registration deadline by another month.
100,000 new SIM activations each month, and
The CBVMP requires retailers to fill out a SIM may ultimately lead to a reduction in tax revenue
application form (SAF) which records the for the government ($1.176 per SIM). MNOs would
customer’s name, address, date of birth, NID like to see higher levels of investment into the NID
number and expiry date. These details are checked database to address some of these issues and
against BTRC and the NID databases, and if currently contribute US $6,000 per month for the
both validations are correct a SIM card is issued. maintenance of CBVMP.
Verification must be in real-time and no biometric
data can be stored for data protection purposes.

Establishing a ‘Capture & Validate’ System: Case Studies 17

 Understanding Capture and Validate KYC Processes:
Global Experiences, Challenges and Learnings

CASE STUDY 3

Peru

The National Registry of Identification and Civil Status (RENIEC) is an

autonomous entity with a mandate to ensure that all Peruvians over the
age of 17 are on the national register and carry a national identity card
(DNI). The card contains the individual’s name, surname, date of birth,
marital status, voting number, a unique identification code number (CUI)
and their biometric information (fingerprint). By 2017, coverage of the DNI
was estimated to be at 98 per cent.20

The DNI is the primary identity document in Peru Investment in Telecommunications (OSIPTEL)
and is used for voting, government interactions directed that all mobile subscribers must re-register
(e.g. tax and social security) and commercial their SIMs by visiting a retail store and leaving a
identification (e.g. opening a bank account or paper copy of their identity document. The main
registering a mobile SIM card). All DNI data is driver for this decision was number portability –
centralised and stored at RENIEC, which charges until this time, customers were unable to retain their
a fee for each verification request against their mobile number when switching from one operator
database. In 2013, RENIEC started manufacturing to another as there was no way to verify their
electronic DNIs (DNI-e), containing a cryptographic identity – but the government also saw this as an
chip that allows for digital signatures and faster opportunity to enhance national security. OSIPTEL
processing of information. However, the platform required operators to keep hard and digital copies
enabling electronic delivery of government services of identity documents, and OSIPTEL would conduct
is not yet in place, and the DNI-e is both more spot inspections and issue fines if the record could
expensive and has a shorter lifespan than the not be found.
current DNI. Take up of the DNI-e card has been
In 2014, in an effort to further improve security, the
very slow and RENIEC has, reportedly, stopped
government directed that all customer identities
promoting the DNI-e card.
had to be validated against the RENIEC database,
SIM registration became mandatory in Peru in 2007, rather than only being stored. MNOs investigated
with MNOs asked to captured and store a copy of different approaches for this, with one MNO hiring
subscribers’ DNI when purchasing a new SIM. Two a third party to validate against RENIEC’s database.
years later, the Supervisory Agency for Private However, RENIEC disallowed this approach,

20. See: https://globalfindex.worldbank.org

18 Establishing a ‘Capture & Validate’ System: Case Studies

 Understanding Capture and Validate KYC Processes:
Global Experiences, Challenges and Learnings

and mismatches between MNOs’ and RENIEC’s cent of new SIM sales in the first month of re-
databases resulted in lines being suspended, often registration, and 15 per cent of sales overall during
for small typographical errors. the re-registration period due to technical problems.
In 2015, OSIPTEL began receiving complaints from Contrary to Pakistan and Bangladesh, there was less
the public about extortion calls, often from prison consensus among stakeholders in Peru concerning
inmates. This became a widely publicised issue, the value of implementing a biometric verification
leading the government to respond by introducing a system (BVS). Some noted that the BVS has
mandate for biometric validation. OSIPTEL directed raised the cost of SIM registration and required
that all mobile users must register their SIM cards operators to make considerable investments in
with operators by presenting their DNI and having technical infrastructure; these additional costs
their fingerprints scanned so that these details are, ultimately, passed on to the customer. For
could be validated in real-time against RENIEC’s instance, MNOs are charged a fee every time
database. During the validation process, RENIEC they attempt to validate customer details against
would reply to MNOs with the subscriber’s biodata, RENIEC’s database, and this cost increases if
including first name, last name, identity number, DNI biometric mismatches or technical challenges
expiry date and any restrictions (under age, criminal require them to attempt this validation multiple
record, etc). Mobile subscribers were allowed to times. Representatives from two MNOs estimated
register as many SIMs against their DNI as they that their organisations each paid about $3 million
liked, but needed special written permission when for validation fees in 2017. The following year, this
registering more than 10. fee was incorporated into Congress’ budget as it
was argued that the SIM registration exercise was a
The MNOs were given two years to implement
security issue and of national interest, and therefore
this directive. While OSIPTEL was involved in
should be finance by government. However, after
managing the relationship between RENIEC and
a successful appeal by RENIEC the fees were re-
operators during the 2014 validation phase, once
established, and MNOs have budgeted another $3-4
the directive to implement biometrics was given
million to cover fees in 2019.
these consultations ended and MNOs were left
to navigate re-registration activities on their own. Stakeholders also suggested that the use of
This involved building the infrastructure to enable biometrics has the potential to exclude some
real-time validation, as well as delivering nationwide segments of the population whose fingerprints may
campaigns to ensure all mobile subscribers were be worn or harder to scan and validate, such as
aware of the need to re-register. Operators were the elderly and those with manual jobs. Alternative
responsible for all associated costs, and received mechanisms suggested as being more inclusive,
little support and no financial incentives from such as facial recognition or simply face-to-face
the government. questions, are currently not allowed by law. Some
MNO representatives suggested that the BVS
RENIEC initially controlled the procurement
process can also impact sales volumes due to the
for the API integration and biometric scanners.
fact that it requires customers to be physically
This resulted in significant technical integration
present at a retail location. Overall, stakeholders
problems, and MNO stakeholders suggested that
interviewed were interested in exploring other
they would have preferred an open tender market.
digital solutions for customer validation, such
Insufficient time was also given to testing the
as those currently used by banks for their
technology prior to going live, and representatives
KYC processes.
from one MNO estimate that this affected 80 per

Establishing a ‘Capture & Validate’ System: Case Studies 19

 Understanding Capture and Validate KYC Processes:
Global Experiences, Challenges and Learnings

CASE STUDY 4

Uganda

In 2015, the National Identification and Registration Authority (NIRA)

launched a national registration programme to establish a national
identity register and issue all Ugandans with a national identity card
(NIC). The card contains a unique identity number (NIN) and biometric
data (fingerprints and picture). By 2016, coverage was at about 30 per
cent, but this rose sharply to 70 per cent in 2017 due to a directive by the
Uganda Communications Commission (UCC) that all SIM cards would be
deactivated unless registered with the NIC. As of 2017, the World Bank
21

estimates that 81% of Ugandans own a national identity card.

22

Mandatory SIM registration in Uganda began in 2015 At the time, the national registry was not ready
with a requirement for all new mobile subscribers to for large scale validation. Although the directive
provide their NIC or NIN to MNOs, who then verified helped incentivise citizens to register for a CNIC
these in batches against NIRA’s database. Because (causing coverage to rise sharply to 70 per cent)
the national identity scheme’s coverage was limited NIRA’s database contained a lot of information
at the time, the system was difficult to implement that was out of date or inconsistent. In addition,
and customers without an NIC were forced to NIRA’s technical capacity could not meet the NIC
acquire SIMs through other people. It was also verification demands from MNOs, who were under
difficult to enforce a law that limited the number intense pressure to quickly re-register millions of
of SIMs registered per identity to 10, as there was their customers or risk losing them to competitors.
no means of counting active SIMs across all of the There was a ‘total shutdown’ of regular business for
operators. In 2017, a high-profile murder led the UCC all MNOs during this period. By the end of 2017, the
to issue a directive that all MNOs must register all UCC claimed 98 per cent re-registration across a
active SIM cards against a valid identity within nine subscriber base of 23.5 million.
months, or risk having the SIM deactivated. MNOs
After other high-profile murders at the end of 2017
introduced a short code for customers to provide
and in 2018, the Government and MNOs agreed that
their NIC, which MNOs would validate through NIRA.
a new Capture and Validate system was necessary,

21. World Bank (2017) ‘The State of Identification Systems in Africa’

22. See: https://globalfindex.worldbank.org

20 Establishing a ‘Capture & Validate’ System: Case Studies

 Understanding Capture and Validate KYC Processes:
Global Experiences, Challenges and Learnings

requiring the NIC cardholder to be validated in- MNOs organised their sales networks. Consultation
person using biometrics. The new system was and collaboration with UCC on such directives at the
rushed into service in March 2018 when UCC banned outset would allow more time for strategic planning.
all new SIM sales, compelling MNOs to launch
Limited NIC coverage continues to be a problem,
another full-scale re-registration process without the
especially among those who are poor or live in
necessary time for planning and testing. MNOs were
rural areas, which means that those without a
given 90 days to get their systems up and running
NIC must continue to turn to family and friends
but, in effect, strict timelines were self-imposed
to register a SIM on their behalf. MNOs also report
to limit the ban’s impact on business. One MNO
that the NIRA API is regularly down and mismatches
reported that the ban affected up to 10,000 new
occur frequently, with some representatives
SIM registrations per day, and despite largescale
estimating a 10 per cent failure rate. Stakeholders
nationwide campaigns operators lost between 10
insist that the national registry needs to be better
to 15 per cent of their customer base during this
funded and resourced if the process is to be fully
phase. This had a significant impact on revenues,
operational and meet the requirements expected
which MNOs think this could have been mitigated
by law enforcement agencies. The current biometric
if they had longer timeframes to plan effective
validation process also continues to impact MNOs’
registration campaigns, and phased these across
operational costs, as they must employ full time
different territories.
staff to check the data they collect and quickly
UCC and NIRA procured the initial batch of verify this against the card details. Biometric
biometric devices and sold them to the MNOs, verification also places a significant burden on the
and the quick turnkey API solution developed by MNO in terms of network capacity and storage; 64-
NIRA led to considerable issues with connectivity bit images are data heavy and this raises particular
and downtime. Sufficient lead times for MNOs issues when uploading outside of the main
to develop and test their own infrastructure in urban environments.
conjunction with NIRA would have led to better
Interestingly, representatives from two MNOs
performance and a reduction in hardware costs.
reported that they currently use paper forms for
UCC also issued two other important directives: SIM registration as this allows them to capture the
first, that all SIMs must be registered in brick and customer’s signature, fulfilling the KYC for mobile
mortar outlets (street vendors were no longer financial services. Both MNOs then capture and
permitted); and second, that all airtime had to be store a digital copy of the form, the identity card
procured and sold electronically (airtime via scratch and the biometrics of the subscriber. This amounts
cards was banned). Therefore, all new SIMs are to a considerable amount of data and server
now registered at service centres where an agent capacity. MNOs would like for the electronic SIM
scans the NID card, takes a photo of the subscriber, registration process to meet the KYC requirements
and verifies the two locally. The card data is then for the provision of mobile financial services, and
sent to NIRA for real-time validation, and the MNO there is an expectation that when the National
retains all registration details (biodata on card, Integration Plan comes into force and services
fingerprints and photo). The directive that MNOs are accessed through a digital signature, the KYC
can only register SIMs through bricks and mortar compliance process will be considerably less
outlets has led to significant changes in the way burdensome on MNOs.

Establishing a ‘Capture & Validate’ System: Case Studies 21

 Understanding Capture and Validate KYC Processes:
Global Experiences, Challenges and Learnings

CASE STUDY 5

Senegal

In October 2016, the Senegalese government started a national identity

programme to move all citizens to a biometric identity card managed by
La Direction de l’automatisation du fichier (DAF). The card contains two
numbers – the individual’s previous identity number and the new card
number, plus biometric data (fingerprints). The card can be used for public
services, including voting, healthcare, tax and passport, as well as free
movement within ECOWAS, a community of 15 states in West Africa. By
October 2017, coverage of the new identity card was at 72 per cent,23 but
over four million citizens were still not registered.

23. See: https://globalfindex.worldbank.org

22 Establishing a ‘Capture & Validate’ System: Case Studies

 Understanding Capture and Validate KYC Processes:
Global Experiences, Challenges and Learnings

In 2007, MNOs were required by the ARTP well established and had sufficient time to build up
(Regulation Authority for Telecommunications its capacity to cope with the demand for real-time
and Post) to validate the address and identity of verifications required from MNOs.
all new using their identity card, and then store
In 2016, the ARTP directed that all MNOs had nine
these details. At the time, there was no limit on the
months to register all their customer SIM cards and
number of SIMs per person, which led to multiple
validate their identities against the DAF database.
instances of fraud. In 2013, at the request of external
MNOs were responsible for developing the
law enforcement, the government convened ARTP
integration with DAF database, and each developed
and the MNOs to discuss a technical solution for
their own proprietary system, with one operator
real-time identity validation.
developing its own internal verification system
From 2013 to late 2015, different approaches for in order to provide a secondary check on their
the Capture and Validate system were considered, retail network.
including the use of biometrics. MNOs pushed back
The ARTP and MNOs shared the costs of
on the use of biometrics, however, believing this
communicating with the population that they had
system would be too costly when weighed against
to re-register their SIMs in person. By November
the level of security the government required.
2016, operators were required to deactivate any
Close collaboration between the government,
SIM cards that were not registered. One operator
regulator and MNOs ensured that the agreed
reported losing approximately 6 per cent of active
approach – using biodata only – could be met by
SIMs, but the noted that the cancellation of these
both MNOs and the national identity authority,
lines produced significant savings. The registration
and the presence of a dominant single operator
process is now fully digitised and does not place
has led to negotiations that balance government
much of a burden on the network. However, the
requirements for security with the commercial
current registration process does not fulfil the KYC
interests of MNOs. With no pressing security needs,
requirements for mobile financial services, as these
a considerable amount of time – just under three
require a separate application.
years – was allocated for planning, development and
testing the new system. The national registry was

Key Learnings 23
 Understanding Capture and Validate KYC Processes:
Global Experiences, Challenges and Learnings

Key Learnings

Capture and Validate Implementation

The experiences of MNOs across the 11 research countries show that when
implementing a new registration system, there are various factors that
all governments, regulators and MNOs need to consider. The manner in
which these factors are planned for and addressed can either facilitate
the implementation and relieve some of the impact on MNOs, or vice
versa. Across all countries, the following key learnings emerged:

Cross-Sector Collaboration and Consultation:

When Capture and Validate systems are implemented through cross-sector collaboration and
with strong backing and support from government, a wide range of technical, procedural,
legal, societal, financial and commercial challenges can be overcome effectively. Working
closely at the outset of re-registration drives, setting shared objectives, and providing a clear
rationale for implementing the new system will also help to engage and motivate MNOs.
In Senegal, the impact of the new Capture and Validate system on MNOs was minimal,
as consultations continued for two years until an agreement was reached that balanced
government requirements for security with the commercial interests of MNOs. Meanwhile,

24 Key Learnings
 Understanding Capture and Validate KYC Processes:
Global Experiences, Challenges and Learnings

the creation of a core project team led by the regulator worked well to direct the project and
facilitate negotiations in Bangladesh and Pakistan. In Bangladesh, the Director General of the
regulator led the project alongside the head of AMTOB, the organisation representing the
MNOs. This team, in conjunction with MNO management, devised the overall strategy, planned
the implementation and helped to ensure the MNOs’ voices were heard by government. In
Pakistan, the regulator played an important role lobbying government helping to reduce
NADRA’s fees and getting acceptance that MNO could make use of the identity data they
already held.

Government Incentives and Support:

Governments supported MNOs in several of the research countries by delivering nationwide
communications campaigns that were designed to encourage consumers to re-register their
SIMs. Other government incentives, however, were less forthcoming. Local stakeholders
often felt that the government could do more to support these programmes, especially
in circumstances where the overriding objective was to improve national security. MNOs
suggested a number of ways financial support could have helped them better navigate
the implementation of these systems, including a reduction in SIM tax for the period of re-
registration; receiving a contribution from government funds earmarked for social purposes; or
a relaxation of any verification fees. In Pakistan, MNOs won a small concession and verification
fees were reduced over the re-registration period. In Peru, no concessions were won over the re-
registration period but, in 2018, the government acknowledged that SIM registration does have
a public purpose and (temporarily) absorbed the fees.

Industry Collaboration:
Collaboration between MNOs can offer significant benefits during the implementation phase,
including economies of scale in device procurement, faster technical integration through
knowledge sharing, and a reduction in business downtime through more integrated customer
activation. Negotiating with government as a single united team will also be more effective
than engaging as individual entities. Collaboration is not necessarily easy, however, as SIM
re-registration mandates can be seen by some organisations as an opportunity to gain a
competitive advantage. In Bangladesh and Pakistan, there was a valid concern that the re-
registration process would favour operators with more resources and a larger retail network, as
this would enable them to reach the widest number of subscribers. However, evidence from the
five focus countries suggests that where there are two or more MNOs with similar market share,
‘going at it alone’ does not confer any advantages in terms of customer acquisition.

Project Planning & Timelines:

With the exception of Senegal, shortened timelines and incomplete project planning caused
major problems for MNOs. Hardware procurement decisions require time for testing, particularly
in an environment where thousands of devices or scanners will be rolled out. In Pakistan, lack
of testing time, particularly outside of the cities, led to procurement of multiple devices and
increased costs. In Uganda and Peru, procurement was initially controlled by the regulator and
national identity registry. This approach resulted in ongoing technical problems and left MNOs
with no time to develop and test their own equipment. Stakeholder interviews suggest there
would be a preference for open market tenders with longer lead times for testing. In Peru,
one MNO estimated that 80 per cent of new SIM sales were affected in the first month of their
registration programme and 15 per cent of sales overall during the registration period due to
technical problems.

Key Learnings 25
 Understanding Capture and Validate KYC Processes:
Global Experiences, Challenges and Learnings

Many MNOs also underestimated the amount of time and effort required to train staff on how to
implement the new Capture and Validate processes, and to motivate customers to re-register.
In Pakistan and Uganda, for instance, MNOs ‘shut down’ many of their business operations for
nearly three months as employees were sent to all areas of the country to support customer
activations. Despite these efforts, large numbers of customers did not register in time, and their
SIM cards were deactivated. Ensuring appropriate timeframes and alternative processes are in
place will also minimise the risk of excluding those without the required documents.

National Identification Coverage and Database Capacity:

To help prevent disruptions, citizens need access to the requisite national identity documents,
and the national registry must contain up-to-date and accurate information. In Uganda, re-
registration activities were conducted when only 70 per cent of the population had access to
a national identity card, which means that a significant number of subscribers were forced to
use another person’s identity to acquire a SIM. MNOs in Bangladesh, on the other hand, were
permitted to register customers using alternative identity documents, so long as they produced
the NID card within six months of registration; this was an effective strategy resulting in just 14
million deactivations out of a total of 131 million SIM subscriptions.

In all countries, the national identity registries struggled to cope with the volume of verifications
requested by MNOs, resulting in regular downtime and loss of sales revenue. Data mismatches
were also common, particularly when validating customers’ biometrics. In Peru, this increased
the cost to MNOs as they are charged for every verification attempt and no alternative process
is permitted. MNOs would like to see governments invest in the national registry so it has the
resources and capacity to meet the needs of subscribers and MNOs.

Weighing the Need for Biometrics vs Biodata:

Extensive consultations took place in Bangladesh and Pakistan on the subject of biometric
verification. Although MNOs were initially against the use of biometrics due to the high upfront
costs, all parties eventually came to a consensus that biometrics were the most viable route due
to the prevalence of fake identities in the market. There is less consensus among stakeholders in
Peru concerning the value of implementing a biometric verification system (BVS). Some noted
that the BVS has raised the cost of SIM registration, and also had the potential to exclude some
segments of the population whose fingerprints may be worn or harder to scan and validate.
There is a preference for KYC processes that do not require a customer to be physically present,
and look at KYC processes used by banks as worth exploration.

Leveraging Know-Your-Customer Processes:

If MNOs are to leverage the new system for digital identification, they need regulators from
other sectors to agree that the KYC processes are satisfied through this new SIM verification
process. This was achieved in Pakistan, where the Financial and Telecoms regulators agreed
that that KYC would be satisfied for a mobile wallet, thereby having an immediate positive
effect on the financial inclusion agenda. Similarly, in Uganda two MNOs decided to combine
the application for SIM registration and financial services on the same application form (in
effect, the addition of a signature). This has added considerable time, resource and cost to
the process – MNOs conduct their own validation in addition to the national registry – but it
means customers do not have to sign up separately for a mobile wallet account. Stakeholders
in Bangladesh, meanwhile, noted that Capture and Validate processes have given the mobile
number as much credibility as an ID validation tool as the actual NID. Banks and other financial
services providers recognise this, and have voiced interest in linking into CBVMP and using SIMs
as one element of their KYC processes.

26 Key Learnings
 Understanding Capture and Validate KYC Processes:
Global Experiences, Challenges and Learnings

Benefits to MNOs
Across all five of the focus countries, there was consensus amongst
stakeholders that the new Capture and Validate system had delivered a
number of important benefits. This includes:

Improved Database Management:

MNO representatives agreed that the verified registration information provided by Capture and
Validate systems has resulted in cleaner customer databases, and that these can help operators
manage their customer relationships more effectively and offer more appropriate products
and services. However, customers’ ability to register multiple SIMs against a single identity
document and other cultural factors means that profiling the actual mobile user, rather than
just the registered user, remains difficult. In Pakistan, as in many other countries, many SIMs
are registered by the (typically male) head of household, who passes the SIMs on to family
members. In this context, individual customer profiling becomes more challenging and restricts
MNOs’ ability to generate incremental revenue through personalised services, especially those
targeted at women.

Improved Tracking and Customer Authentication:

In Bangladesh, Pakistan and Uganda, new platforms have been developed by the
telecommunications regulator to provide greater visibility over a mobile subscriber’s identity
and mobile activity. These new digital platforms contain valuable data that could be used to
validate an individual’s identity, and there was interest among stakeholders to use these as
additional KYC authentication services to improve access to financial and government services.
The Pakistan Mobile Database currently provides subscriber verification services to individuals,
banks and government departments, including the tax authority and financial regulator. In
Bangladesh, there is interest from banks to use the Central Biometric Verification Monitoring
Programme platform as part of the KYC verification process. MNOs in Peru voiced a reluctance
to test new ways of leveraging identity data to market new services to customers without
permission, due to strict data privacy regulations.

Key Learnings 27
 Understanding Capture and Validate KYC Processes:
Global Experiences, Challenges and Learnings

Streamlined Process and Improved Customer Experience:

In Senegal and Bangladesh, the move from paper-based to digital SIM registration applications
has improved the speed and efficiency of the KYC process, and has reduced MNO costs
related to scanning, uploading heavy images, and storing both soft and hardcopy registration
documents. Capture and Validate registration processes have also improved the customer
on-boarding experience. Jio, an MNO in India, has seen phenomenal growth in user acquisition
using the Aadhaar database for verification, with the on-boarding process taking just 30
minutes. Interviewees in India described the SIM registration process before Aadhaar as
‘confusing and burdensome’; customers were required to bring various documents to complete
registration and SIM activation could take up to 72 hours.

Reduction in Small-Time Criminality:

The majority of interviewees noted that the Capture and Validate system had greatly enhanced
MNOs’ ability to trace SIMs back to a unique individual (as well as to a specific vendor) – a
key security objective for government and law enforcement. Some MNO and government
representatives anecdotally reported a reduction in the level of crime, in particular what was
referred to as ‘small-time’ criminality. While no hard empirical and published data was available
to support these assertions, stakeholders pointed to a reduction in consumer complaints and
lower numbers of investigations into particular types of crimes. In Pakistan, Bangladesh and
Uganda, hoax calls and mobile money fraud has reportedly been reduced (anecdotally, up to 80
per cent in Uganda and Bangladesh) and in Peru, the regulator reported a decline in extortion
calls via mobile.

Rationalising the retail network:

Capture and Validate systems have required many MNOs to rethink their retail network strategy,
after new legislations mandated that they complete all new SIM registrations in dedicated MNO
stores or through selected franchise outlets. In Uganda, this ‘bricks and mortar’ strategy was
mandated by the regulator and brought into effect quite quickly; in Bangladesh and Pakistan, a
phased approach was allowed given the size of the retail network and the need to equip each
store with scanners and devices. The impact of these changes in each country has been positive
overall, resulting in more transparent and accountable processes, strengthened back-end
systems and better trained sales channels.

28 Key Learnings
 Understanding Capture and Validate KYC Processes:
Global Experiences, Challenges and Learnings

Economic Impact on MNOs

The benefits of Capture and Validate systems, as outlined in the previous
section, can be costly for MNOs. In each of the focus countries, operators
were expected to cover all costs associated with implementing the new
system and most saw reductions in their customer base – for some
operators, this reduction was significant. MNO representatives participating
in this research were not always able to provide detailed information
related to the total investments made or ongoing operational expenditure
(which is updated regularly and difficult to extrapolate). Therefore, the
figures below are indicative estimates of the investment required by a
single operator in these countries with a retail network and subscriber base
as specified.

The amount of capital investment made by MNOs – for example to purchase scanners,
other devices, and servers – varied according to the size of the organisation’s retail network,
subscriber base and whether biometrics or biodata was required. MNOs in Peru, Bangladesh,
Pakistan and Uganda were all required to invest in registration devices and biometrics scanners;
in Senegal alone, MNOs were only required to purchase devices that helped validate biodata.
Operational expenditure depends largely on training requirements, data capture and storage
needs (text and/or images) and verification fees. Notably, the operational costs after the new
registration system have reportedly decreased in most countries.

Key Learnings 29
 Understanding Capture and Validate KYC Processes:
Global Experiences, Challenges and Learnings

Peru Bangladesh Pakistan Uganda Senegal

Retail Outlets 8,000 25,000 50,000 12,000 3,000

Unique Subscriber Base 15m 40m 40m 11m 9m

Average Revenue Per Customer

$3 $2 $2 $2 $2
(ARPU)

Total Investment per Operator $5-10 $15-25 $25-35 $5-10

<$1 million
(Estimated) million million million million

Cost Allocations

Scanners, devices,
servers, retailer training, 35% 65% 50% 80% 70%
customer activation

Data Platform 5% 5% 5% 10% 10%

Verification Fees 60% 5% 10%

SIM Tax 25% 35%

Internal Verification 10% 20%

Increase/Decrease in costs since new system in place

Administration/Transaction
Increase Decrease Decrease Same Decrease
costs

Compliance costs Decrease Decrease Decrease Increase Decrease

Penalties Decrease Decrease Decrease Same Decrease

Implementation of the new Capture and Validate system resulted in customer losses to most, if
not all, operators. These were largely expected, but perhaps not to the extent seen in Pakistan
and Uganda, where there was a large amount of SIM redundancy as well as deactivations. In
Pakistan, operators reported losses between 10 and 20 per cent; in Uganda loses of around
13 per cent were experienced. Re-registration activities did tend to disproportionately benefit
MNOs with the largest market share, but perhaps not to the extent that the smaller MNOs
feared, particularly in Bangladesh.

30 Key Learnings
 Understanding Capture and Validate KYC Processes:
Global Experiences, Challenges and Learnings

Current and Future Opportunities

Currently, with the exception of Pakistan, MNO representatives engaged
through the research indicated that their organisations are not currently
leveraging Capture and Validate identification processes, or their improved
customer databases, to offer new identity-linked services to customers.
However, all MNOs voiced interest in working with the GSMA and other
partners to explore how new business or partnership models could help
them achieve this, and there is also a clear appetite to learn from ‘best
practice’ approaches used in other countries.

In Pakistan, MNOs have already embraced The GSMA Digital Identity programme has
opportunities to leverage KYC processes to improve established that MNOs with access to verifiable
access to public and private sector services. customer data are well-positioned to champion the
During the national SIM re-registration drive, an development of reliable ‘economic identities’.25 In
agreement was reached between the Financial this case, the term ‘economic identity’ is used to
Regulator and the Telecoms Regulator that the describe a form of functional identity, which tend
KYC criteria for opening a mobile wallet would be to evolve out of a single use-case (similar to voter
satisfied through the new Capture and Validate IDs, health records, or bank cards) with the potential
process. This has had a very positive impact to for use across sectors. MNOs can help establish
the financial inclusion agenda; as documented economic identities by collecting, sharing and
by the GSMA,24 this agreement allowed MNOs to collating a wide range of customer data from their
open new mobile money wallets for customers own databases, as well as from external sources.
at the same moment their SIMs were being re- These digital profiles are built on the understanding
registered. The value that mobile money services that MNOs, formal financial institutions and other
can bring to the financially excluded, and women service providers would be better able, and more
in particular, is clear; through partnerships with the willing, to extend services to customers if they were
Benazir Income Support Programme (BISP) and able to validate their official identity, as well as their
CARE International, Telenor’s Easypaisa service has shifting, dynamic needs and economic situation; this
helped overcome cultural and logistical barriers by could be done by authenticating relevant credentials
bringing financial services to local corner shops, such as their income, occupation, gender, mobile
enabling women to register and receive their cash transactional histories, credit histories, approximate
disbursements without having to travel to a bank. location and eligibility for government services.
Other services offered in Pakistan that require Ownership of both official and economic identities
identity authentication include health cards (health would therefore provide customers with greater
insurance and information offered by Zong) and access to mobile money services, government
Internally Displaced Person cards to support subsidies, targeted information, formal financial
refugee relief. products, and other valuable services that improve
their livelihoods and well-being.

24. GSMA (2017) ‘Understanding the Identity Gender Gap: Insights and opportunities for mobile operators to help close the divide’
25. GSMA (2018) ‘Digital Identity for Smallholder Farmers: Insights from Sri Lanka’

Key Learnings 31
 Understanding Capture and Validate KYC Processes:
Global Experiences, Challenges and Learnings

Developing an Economic Identity

Source of Customer
Services
Information

Subscriber Platform Mobile Financial

Services

• Savings and loans products

Customer Relationship • Mobile money payments
Management (CRM) • Credit scoring
• Social cash transfers
MFS Platform
(transaction, income, loan,
bill payment data) Other Value Added
Economic Services
Identity
Credit Scoring Algorithms Platform • Weather, health or livelihood
information
• Insurance
Third Party Data • Educational services
(social and commercial • Business-related discounts from
partners, government, etc.) third-parties

Many MNOs in the research countries were engaging businesses. With this in mind, developing a data-
in the sponsorship of new businesses, generally driven ‘economic identity’ – leveraging data sources
through tech hubs which develop new applications from MNOs and other partners – could be an initial
in sectors such as transport, microfinance, health first step, likely using a mobile financial service
and agriculture. MTN Uganda has opened up its package as the ‘anchor’ product. These services
mobile money service via an API for developers, were of significant interest to small-scale businesses,
while Sonatel in Senegal supports a range of and the wider data model of interest to MNOs and
applications, such as Firefly, a community transport other service providers. Business owners were also
service, and MaTontine, a mobile-based automated keen to share their identity information if it could
microfinance platform. In March 2019, GSMA help them become more productive, particularly
conducted research in urban Nigeria to explore how with suppliers, distributors, and customers.
MNOs could help catalyse the growth of smaller-
There is also interest among MNOs to explore how
scale enterprises through the provision of identity-
Capture and Validate systems can be leveraged
linked services. Discussions with business owners
to open access to services provided by other
confirmed that they feel marginalised by many
institutions, such as government or financial service
formal financial institutions, highlighting a real need
providers, with higher-tier KYC requirements. For
for an identity platform that gives entrepreneurs
this to take place, regulators will need to agree
more credibility among service providers and better
that the identification of the subscriber has been
access to the resources they need to grow their

32 Key Learnings
 Understanding Capture and Validate KYC Processes:
Global Experiences, Challenges and Learnings

validated in such a way that it satisfies the KYC Finally, an estimated one billion people do not
criteria for that sector. In Senegal, for instance, have access to official forms of identification,26
biodata verification is not considered to be sufficient and the most significant ‘identity gaps’ are found
for accessing mobile financial services (MFS), which in the same locations where mobile connectivity
means that subscribers must apply separately for in and mobile agent networks continue to scale. This
order to access these services. In Uganda, MNOs are indicates that MNOs are well-placed to provide
allowed to supplement the standard SIM registration national governments and other ecosystem players
process so that the subscriber also becomes with the opportunity to leapfrog inefficient, paper-
eligible for opening a mobile wallet. In Bangladesh, based identity registration systems and offer more
the new SIM registration process has begun to inclusive methods of providing unique identities to
establish the idea of ‘my SIM is my identity’, but the underserved. In Nigeria, the National Identity
the industry has been, so far, blocked from access Management Commission has published an
to MFS. The situation does look to be progressing, advertisement inviting private sector entities to
however. According to interviewees, banks and formally express their interest to become licensed
other financial service providers recognise the high partners to support citizen enrolment into the new
level of assurance provided by the SIM registration digital ID programme.27 This policy paves the way
process and have started to explore how to link into for MNOs in Nigeria – and hopefully elsewhere – to
the central database (CBVMP) as an authenticating play a much more hands-on role in accelerating the
factor. MNOs have also started to make inroad digital identity ecosystem and offering additional
into MFS by partnering with banks and insurance services to their (newly identified) customers.
companies, offering their network as access points.

26. See: http://id4d.worldbank.org

27. National Identity Management Commission. See: www.nimc.gov.ng/docs/adverts/EOI_nimc_Ecosystem.pdf

Key Learnings 33
 Understanding Capture and Validate KYC Processes:
Global Experiences, Challenges and Learnings

Conclusion

This report has confirmed that nine out of the 11 countries selected for this
research operate a ‘Capture and Validate’ SIM registration system. This
approach, which can be delivered virtually (via short-code or interactive
voice response) or by the subscriber submitting their details in person,
provides a number of benefits to MNOs. These include a more streamlined
process resulting in a better on-boarding experience for consumers, and a
reduction in administration, transaction and compliance costs.

In some countries, implementing the change to a Five countries have moved to a system where the
Capture and Validate system has been relatively subscriber must validate themselves and their
straightforward and has had a minimal impact identity card using a combination of biometrics
on MNOs and their operations. In others, where and biodata. The additional layer of biometric
the implementation timeframe was short and verification has improved accountability within the
the national registry lacked sufficient coverage, SIM registration systems, which are the least likely
the impact on MNOs and customers has been to suffer from identity fraud or compliance abuse.
significant. The impact on MNOs was felt particularly However, some stakeholders noted that biometric
strongly in Uganda and Pakistan, where up to 30 per systems raise both implementation and operational
cent of the population lacked access to a national costs for MNOs, and also have the potential to
identity document at the time of re-registration, and exclude some segments of the population whose
the system had to be implemented in a very short fingerprints may be worn or harder to scan and
period of time. In all situations, government support validate. In countries where Capture and Validate
(which might include financial incentives or mass systems are likely to be mandated, it is important
communications campaigns) and industry-wide that MNOs work proactively with government
collaboration can help mitigate the impact on MNOs. to help weigh the benefits of biometric versus
biodata systems, and ensure that a balance is struck
In all countries, the national identity registries
between the government’s security requirements
struggled to cope with the volume of verifications
and the commercial interests of MNOs.
requested by MNOs, resulting in regular downtime
and the potential loss of sales revenue. Data The research has supported GSMA’s assertion that
mismatches were – and in some cases remain – Capture and Validate processes give the highest
common, particularly when validating customers’ level of assurance that the registered individual ‘is
biometric details; this is a particularly costly who they claim to be’, which mitigates the incidence
challenge for MNOs in Peru, who are charged for of fraud and offers new opportunities for mobile
every verification attempt. MNOs would like to see to be used as a digital identity when accessing
governments invest more in the national registry value added services. MNOs in Pakistan have set
so that it has the capacity to meet the needs of the precedent for realising these opportunities.
subscribers and MNOs. Harmonising SIM registration requirements with
KYC requirements for accessing MFS has meant

34 Conclusion
 Understanding Capture and Validate KYC Processes:
Global Experiences, Challenges and Learnings

MNOs are now delivering financial services to a ‘legal identity for all’. There is a clear need for
large parts of the population who were previously governments, the development community, and
unbanked. This has generated incremental revenue the mobile industry to work together to address
for MNOs and opened up the potential for a range the barriers that prevent millions of individuals
of new products and services. In other countries, from accessing official proof of identity and
where regulatory harmonisation has not taken benefitting from life-enhancing mobile services
place, MNOs have not yet been able to take that are registered in their own name. The GSMA
advantage of these opportunities, though MNOs in Digital Identity team is committed to supporting
Bangladesh are making progress in getting access focused research and advocacy efforts, coupled
to mobile financial services. As countries move with in-country demonstration projects, to create
towards greater accountability in SIM registration more enabling environments where the needs of
processes, particularly in Africa, MNOs could see underserved groups are better catered for. This
the investment required to implement a Capture involves advocating for and exploring various unique
and Validate process as a means to opening up new roles that its mobile network operator members can
revenue-generating services, rather than simply play in bringing the benefits of digital identity to the
a financial burden imposed by government to poorest and hardest to reach individuals around the
enhance security. world. If you are a GSMA member, policymaker or
other organisation seeking to pursue digital identity
Only 11 years remain to meet the 2030 United
solutions for the urban poor and other underserved
Nations’ Sustainable Development Goals (SDGs),
populations, please contact the Digital Identity team
and in particular SDG 16.9 which aims to provide
at [email protected].

Conclusion 35
 Understanding Capture and Validate KYC Processes:
Global Experiences, Challenges and Learnings

Appendix 1
Additional Country
Case Studies
Ecuador
Population: Smartphone Penetration:
16 million 54%
Mobile Penetration (unique subscribers): Subscription:
69% 77% prepaid; 23% contract

The Cedula de Identidad is the official national must be registered against a single identity to be
identification credential in Ecuador, issued by the validated and this data is stored by the MNO.
Civil Registry. It includes the biometric data of
MNOs were responsible for developing the system
each cardholder. Citizens can use their national
that automatically records the identity number
identity card to travel within the country, register
and connects to the civil registry for validation.
for a passport and for voting. Ecuadorians of all
In addition, MNOs had to invest in largescale
ages are eligible to obtain a Cedula de Identidad
communications to ensure everyone validated their
at cost of $5. Ecuador has a comprehensive
SIM card. This was supported by the Minister of
identification system in place with 99 per cent of the
Telecommunications, who declared that, if people
population registered.28
do not register, the lines and the devices could be
In 2011, the Telecommunications Regulation and blocked even outside the country (agreements for
Control Agency (CONATEL) made SIM registration cooperation were under negotiation with Colombia
mandatory in Ecuador. Citizens can use their identity and Peru).
or other official documents for registration and can
Overall, MNO representatives think the new system
activate the SIM calling the operator automated
has been positive and brought about some benefits:
service. The operator validates the identity against
a clean database has meant better targeting of
the Ecuadorian Civil Registry in real-time. MNOs
promotions and new products; phone theft has been
are obliged to capture the full name, address,
reduced (anecdotally by 50 per cent); and national
identification number and the year of issue; they
security has been improved overall. However,
must also link the identity details to the user’s
there is some concern about the introduction of
handset IMEI number and store the details for five
biometrics, which they believe add more to costs
years. Since 2012, all citizens have been required
and operational inefficiencies than it does to
to register their IMEI number with Arcotel (the
security. No new services have been developed on
regulator), which hold an IMEI blacklist of all lost and
the back of this identity validation process so far.
stolen devices. Both the SIM and the IMEI number

28. See: https://globalfindex.worldbank.org

36 Appendix
 Understanding Capture and Validate KYC Processes:
Global Experiences, Challenges and Learnings

India
Population: Smartphone Penetration:
1.36 billion 46%
Mobile Penetration (unique subscribers): Subscription:
55% 93% prepaid; 7% contract

In 2010, India launched a programme called Only new SIMs would require this validation and
Aadhaar, the world’s most ambitious national all existing SIMs based on Aadhaar e-KYC would
identity project. The Aadhaar is a unique 12-digit be safe and not discontinued.35 MNOs responded
number issued by the Unique Identity Authority of by suggesting a CAF to be embedded with live
India (UIDAI), available to all residents at no cost photographs and scanned image of Proof of Identity
and valid for life.29 Among other things, the Aadhaar or Proof of Address ensuring it stayed a completely
number enables residents to open a bank account, digitised process. There has been no resolution
get a driver’s license and apply for a passport. to date.
As of December 2017, the UIDAI have registered
Timelines for re-registration were tight but MNOs
more than 1.2 billion30 people on the database –
did benefit from some cost sharing of biometric
approximately 89 per cent of the population.
devices as customers could re-register at any
SIM registration has been mandatory in India since operator outlet. No government incentives were
2005 but, until 2017, it was seen as inefficient and given. MNOs are very positive about the SIM re-
time-consuming. Customers had to bring various registration system against Aadhar and believe it
documents and the SIM might not be activated has realised a number of benefits:
for up to 72 hours. In 2017, the Department of
• A clean database
Telecommunications (DoT) issued a directive that all
new and existing SIM cards must be verified against • Reduction in fraud (the previous paper-based
the Aadhaar registry. Mobile operators needed to system was open to abuse with duplicate / fake
comply in full by 6 February 2018.31 identities registering for additional SIMs)
All mobile subscribers needed to visit a MNO • A more streamlined process – no need to process
retailer to complete biometric SIM registration. and verify multiple documents – against Aadhaar
New customers must complete a Customer it is fully digital and validation is in real-time.
Acquisition Form (CAF). In addition to sharing their • The system has facilitated on-boarding new
Aadhaar number, customers also have to have their customers. Jio – a new operator – has acquired
fingerprints and/or iris scanned using a biometric 218 million new customers (end of 2018) primarily
reader. These details are then validated against the from marginalised communities where residents
UIDAI database via an online portal.32 If the identity previously lacked identity.
is confirmed, the MNO agent requests UIDAI to
send a One Time Password (OTP) to the customer’s MNOs are concerned that the new ruling from the
mobile number. The process is fully digital and a SIM Supreme Court will mean a return to the old system,
can be activated in 30 minutes. Each customer can which will increase costs from 15 per person—the
register for a maximum of nine SIM cards. current cost of e-KYC verification—to 100 per
person for a physical KYC. The offline process could
On 26 October 2018, the Supreme Court stipulated also take 24-36 hours.36 MNOs are very cautious
that it was no longer a requirement of the operators about leveraging customer data for promoting new
to validate users’ identity using Aadhaar.33 MNOs services and products due to recent changes to
were instructed to accept other documents, such as privacy regulation.
a driving licence, passport and voter identity card.34

29. Wharton Fintech (2017) ‘Your guide to UPI — the world’s most advanced payments system’.
30. See: https://uidai.gov.in/aadhaar_dashboard/
31. According to Government of India, see: dot.gov.inhttp://dot.gov.in/sites/default/files/Re-verification%20instructions%2023.03.2017.pdf?download=1
32. Ibid
33. Ibid
34. The Economic Times (2018). ‘Aadhaar not mandatory for mobile SIMs, you can submit other documents too’.
35. NDTV (2018) ‘Centre Explains How Top Court’s Aadhaar Verdict Impacts Mobile Users’.
36. LiveMint (2018) ‘How telecom companies will verify new users without Aadhaar’.

Appendix 37
 Understanding Capture and Validate KYC Processes:
Global Experiences, Challenges and Learnings

Ghana
Population: Smartphone Penetration:
30 million 50%
Mobile Penetration (unique subscribers): Subscription:
54% 37 98% prepaid38; 2% contract

In 2006, the National Identification Authority (NIA) around the country). All SIM vendors are required
was set up to implement a national registration to capture the name, address, identity document
39
programme and issue national identity cards. In and MSISDN and store these – either on paper or
2008, NIA was given authority to collect personal electronically. MNOs are required to collect and store
and biometric data and ensure the protection of these forms, which can be accessed on request by
40
privacy and personal information. A resident of law enforcement agencies and the courts.
Ghana aged 15 and above must obtain a national
The requirement to collect and store paper
identity. Each card is valid for 10 years and contains
registration forms is considered expensive and
a personal identity number, personal details and
serving little purpose in terms of traceability and
biometrics in a machine-readable 2D-barcode.
supporting law enforcement. MNOs have begun
The objective of the NIA was to harmonize all to develop capabilities to validate identity against
identity systems and oversee a national database, other databases, such as voter identity and
communications networks, security and card national health insurance cards, and anticipate that
41
production systems. However, although 11 million government will mandate identity validation at
citizens were registered in 2009, the programme some point.
has since disintegrated with the cards being rejected
42 MNOs see significant opportunities in developing a
by some banks and state institutions. Today, no
robust identity framework, particularly for mobile
single government database based on a single
financial services and e-commerce. MNOs are fully
identity exists yet in Ghana, rather there a number
behind implementing robust KYC processes for SIM
of different databases which provide validation for
registration as this could facilitate access. Currently,
different services, such as social welfare, health
a customer is required to enter two distinct
insurance, electoral services and driving licences.
records for mobile money and SIM registration.
The National Communications Authority (NCA) Views differ on whether validation against a
is responsible for regulating the mobile industry single national database or a more open identity
the National Identity Register regulations (2012) framework will work best. The former option has
state that an identity card is mandatory for SIM given rise to a lot of discussion around data privacy
43
registration. Enforcement, however, has varied over and protection. The latter option would involve
the past six years, with the NCA issuing a number of greater interoperability between databases but
directives to MNOs to register their customers’ SIM seems to some, given the nascent state of the
cards with varying degrees of success. Currently, national identity programme, the option that is
customers can register a SIM with different identity most workable.
certificates in dedicated operator stores as well as
via street vendors (there are c.13,000 street vendors

37. GSMAi
38. http://prepaid-data-sim-card.wikia.com/wiki/Ghana
39. See: Ghana National Identification Authority Act, 2006 Act 707
40. ibid
41. See: https://www.nia.gov.gh/faq.html
42. GhanaWeb (2018) ‘National ID cards ready, to be issued from May 28 – NIA’
43. NATIONAL IDENTITY REGISTER REGULATIONS, 2012

38 Appendix
 Understanding Capture and Validate KYC Processes:
Global Experiences, Challenges and Learnings

Indonesia
Population: Smartphone Penetration:
268 million 90%
Mobile Penetration (unique subscribers): Subscription:
75% 44 96% prepaid; 4% contract

All Indonesians over the age of 17 must hold a Kartu In October 2017, the Ministry of Communication
Tanda Penduduk (KTP), the Indonesian identity card. and Information Technology (MOCIT) via the
The card contains a unique number (NIK) consisting regulator (KOMINFO) required that all SIM cards
45
of 16 digits and recent legislation has stipulated (new and current) must be validated against the
that this is now a lifetime card. The KTP is issued, DUKCAPIL database using a combination of the
and all data held, by the Population and Registration NIK and Kartu Keluarga. The customer must input a
Service Agency (DUCKAPIL) under the Ministry of keyword, identity Number and family card number
Home Affairs. In addition to the KTP, each family is via a short code to 4444. MNOs pass the data to
required to have a Kartu Keluarga (KK), a card that DUKCAPIL and they validate the NIK & Family card
holds all the details of family members, managed by data in real-time. MNOs send the MSISDN number
DISDUKCAPIL (local registry). to DUKCAPIL during the validation process in order
to map each MSISDN registered to an identity. Both
In 2011, the Ministry of Home Affairs launched
MOCIT / KOMINFO and DUKCAPIL have access to
a nationwide programme to issue an electronic
the registration data. The process is the same for
identity card (e-KTP) to all Indonesians. The e-KTP
new registrations and re-registration of current
contains multi-model biometrics (fingerprints, face
46 cards, just the keyword is different. The current limit
and iris) and is valid for life. The intention is that
for SIMs is 3 per operator per identity if registering
citizens will be able to access services with just one
via the short code. If more SIMs are required, e.g.
card. By 2013, the biometrics details of 173 million
47 for M2M (data), then the subscriber must register in
people were registered with DUCKAPIL. According
store.
to an Interior minister who was interviewed for this
project, 97 per cent of the population in 2019 is All mobile subscribers were required to re-register
registered in the national civil registry database. their SIM by 28 February 2018 or suffer service
suspension. On 28 February, over 200 million
Until 2017, any citizen wanting a SIM card would text
SIM were re-registered. In March, KEMKOMINFOR
in their identity details via the SMS short code 4444.
blocked 100 million unregistered prepaid SIM
The data would be held by the MNO and the SIM
cards with activity restored if accounts registered
would be activated. The MNO was obliged to submit 49
by 1 May 2018. By April 2018, 245 million SIMs
a report on customer data every three months
were registered.
to the Indonesia Telecommunication Regulatory
Authority (BRTI) and a subscriber could register
48
10+ card.

44. GSMAi
45. Indonesian Government directive, 2006
46. Population and Development Review (2017) ‘Identity Systems and Civil Registration in Asia’
47. Planet Biometrics (2012) ‘Indonesia ID project makes stunning progress’
48. See: https://jdih.kominfo.go.id
49. ibid

Appendix 39
 Understanding Capture and Validate KYC Processes:
Global Experiences, Challenges and Learnings

Malaysia
Population: Smartphone penetration:
31 million 95%
Mobile Penetration (unique subscribers): Subscription:
80% 66% prepaid, 34% contract

In September 2001, the National Registration undertook nationwide communications to alert

Department of Malaysia (NRD) introduced MyKad, consumers that they needed to bring their card for
the national identity card, making it compulsory50 registration for a new SIM.
for all citizens aged 12 and above. The card is based
MCMC has asked that MNOs provide MCMC with
on a unique series of digits and the NRD is the sole
the identity numbers attached to the new SIMs so
authority in charge of issuing the NRIC numbers.51
they can be validated against the national identity
The advanced chip and biometric technology allow
registry. These are validated in batches and, where
its users to access government services, including
there are inconsistencies, MNOs must re-validate
driving, travel, healthcare, e-cash (a reloadable cash
with the subscriber or deactivate. Citizens can also
purse accepted at government agencies, petrol
purchase a SIM online if paying by a bank account
stations), public transport. The card can also double
as a bank account provides sufficient KYC details for
up as an ATM card at designated banks52 and a
SIM card validation. MNOs have mixed views over
loyalty card at several retail outlets.53
the effectiveness of the current system. Whilst they
In 2006, the Malaysian Communications and have benefitted from a clean-up of their database
Multimedia Commission issued guidelines that (c.80 per cent accuracy, reportedly) there are still
all SIM cards should be registered. In 2013, opportunities for fraud and, with a five SIM limit
these guidelines were updated, directing that a per operator, MNOs still find it difficult to identify
subscriber’s identity should also be verified. At accurately each mobile user.
the time, subscribers could present their identity
MNOs expect that real-time validation against the
in person at the MNO store or could provide their
national registry is likely to come online in the next
identity number via USSD.
year or so. MNOs see a lot of value in validating the
In 2016, MCMC directed that all registrations should identities of all SIM subscribers – in terms of national
be auto populated by a card reader or via biometrics security, reducing fraud and identification / profiling
and manual input was no longer permitted. Citizens of customers. In particular, MNOs value the potential
have to present their MyKad in person and register to assess a customer’s credit rating and promote
at a service provider outlet. MNOs were required to additional services through this identity verification
procure MyKad readers and/or Optical Character process. There are some concerns that the move to
Readers and store the details on the card, including a real-time verification system could be costly for
name, identity number and address. All the costs MNOs and they would like other federated systems,
for hardware and registration applications were such as those used in the US / UK, to be considered.
to be borne by the MNOs. MNOs and Government

50. See: http://www.jpn.gov.my

51. See: http://research.omicsgroup.org
52. PPC (2015) ‘MyKad: Is Malaysia ahead of the game?’
53. GSMA (2018) ‘Digital identities: Advancing digital societies in Asia Pacific’

40 Appendix
 Understanding Capture and Validate KYC Processes:
Global Experiences, Challenges and Learnings

Thailand
Population: Smartphone penetration:
69 million 92%
Mobile Penetration (unique subscribers): Subscription:
86% 70% prepaid, 30% contract

In 2015, the Thai government implemented the In late 2017, NBTC introduced biometrics, directing
smart identity card program with the aim of that a subscriber’s facial picture should be captured
providing citizens with access to a wide range and matched with the image on the identity card
of public services via a single identity. The card to validate the subscriber was also the identity
contains biometric data (fingerprint + facial) and is cardholder. NBTC updated their application with
mandatory for all citizens aged 7+. The Bureau of image processing software that automatically
Registration Administration (BRA) is responsible for compared the subscriber’s face with the biometric
national identity cards54 supported by the Ministry data on the identity card. Operators updated
of ICT. According to the BRA, 97 per cent of the their applications so that staff could compare the
population is registered.55 subscriber’s image with the image on the card
and validate manually. Once the biometric match
In June 2014, following terrorist incidences involving
is confirmed, and all the biodata data is captured
unregistered SIM cards, the National Broadcasting
by the operator and shared with NBTC, the SIM is
and Telecommunications Commission (NBTC) made
registered and activated. From 2018, NBTC asked
it mandatory for operators to register SIM cards on
operators to report on the number of identities with
their networks. NBTC provided operators with a
more than five SIMs.
mobile application that captured the MSISDN and
a picture of the subscriber’s identity card. This data The impacts on MNOs include:
was uploaded to NBTC and the SIM then activated.
• Developing the proprietary application and
NBTC sent the identity number and an image of the
training staff is seen as significant.
Thai identity card back to the operators. Registration
was a nationwide exercise, which revealed that, • The speed at which SIM sales take place has
out of the 90 million prepaid active SIM cards, only slowed which has impact on overall total sales.
about six million had been registered.56 • Collecting user biodata in operator centres has
Operators were unable to capture subscribers’ led to improved targeting for these customers
biodata and offer promotions using the NBTC • However, large numbers of customers are still
application and so developed their own. These registered by vendors using the NBTC application,
replicated the NBTC process but used a card reader which provides no customer biodata. Operators
to unpack the biodata contained on the card, i.e. still have to conduct CRM campaigns to capture
first name, last name, address and date of birth. this data
These applications were rolled out gradually to
operators’ dedicated stores. The vendor network – • Operators admit that the previous system was
about 15,000 across the country – continued to use open to criminal activity and concede that
the NBTC system. the new system has tightened up security.
Overall, operators argue that government has
benefitted from the new SIM registration rather
than operators.

54. See: www.cdg.co.th

55. See: https://globalfindex.worldbank.org
56. Thailand Guru: ‘Mobile Phone Number SIM Card Registration in Thailand’

Appendix 41
 Understanding Capture and Validate KYC Processes:
Global Experiences, Challenges and Learnings

Appendix 2:
Research Methodology
The GSMA identified 16 countries that were thought to operate ‘Capture
and Validate’ systems. Of these, 11 countries were selected to be part of this
research: Bangladesh, Ecuador, Ghana, India, Indonesia, Malaysia, Pakistan,
Peru, Senegal, Thailand and Uganda. The research was conducted in two
phases:

Phase 1: Desk research

Desk-based research was conducted to provide A total of 13 expert interviews with at least
a detailed overview of the key stakeholders, one MNO was conducted in each country. The
institutions, regulations, legislation, systems and expert/local knowledge was used to validate the
processes that contribute to the C&V system in each available published information, which can often
of the following countries: Ecuador, Peru, Ghana, be incomplete or inconsistent. At a minimum one
Senegal, Uganda, Bangladesh, India, Indonesia, stakeholder interview was conducted in each
Malaysia, Pakistan and Thailand. This included a country (by phone or skype).
review of all published material relating to SIM
registration in the 11 countries, including reviewing A debriefing session was used to review the initial
published material in English, French, Bengali, findings from the desk research and reach a final
Bahasa Indonesian and Spanish. agreement on which five countries (and local
stakeholders) would be targeted in Phase 2 of the
project. The recommended countries included: Peru,
Bangladesh, Pakistan, Uganda and Senegal.

Phase 2: In-country face to face research

Between January and March 2018, face-to- The expert interviews allowed the researchers to
face discussions with MNOs, regulators and collect more reliable data on the impact of these
other stakeholders were held in each of the five initiatives, develop a more rigorous analysis of the
selected countries: commercial benefits and costs associated with these
processes, and develop recommendations for other
• Peru: Telefonica, Claro, OSIPTEL
MNOs based on lessons learned.
• Bangladesh: Robi, Grameenphone, Banglalink,
Our thanks to: Telefonica Ecuador; MTN Ghana;
Teletalk, Bangladesh Telecommunication
GSMA India; Ooredoo Indonesia; Yes and Celcom
Regulatory Commission, Association of Mobile
(Malaysia); True (Thailand); Robi, Grameenphone,
Telecom Operators
Banglalink, Teletalk (Bangladesh); Bangladesh
• Pakistan: Telenor, Jazz, Zong, PTA Telecommunication Regulatory Commission, Nurul
• Uganda: MTN, Africell, Sure, Uganda Kabir (Association of Mobile Telecom Operators
Communications Commission, National in Bangladesh); Major General Md. Emdaul Ul Bari
Information Technology Authority (ex-Director General, BTRC); Telenor, Jazz and
Zong (Pakistan); Pakistan Telecommunication
• Senegal: Sonatel Authority; Telefonica Peru, Claro (Peru); Sonatel
(Senegal); MTN Uganda; Africell (Uganda); Uganda
Communications Commission; National Information
Technology Authority (Uganda).

42 Appendix
gsma.com
GSMA HEAD OFFICE
Floor 2
The Walbrook Building
25 Walbrook
London EC4N 8AF
United Kingdom
Tel: +44 (0)20 7356 0600
Fax: +44 (0)20 7356 0601