[White Paper] Digital Identity: Infrastructure that changes everything

White Paper, IN Groupe

May 2026

Digital Identity: Infrastructure that changes everything

The secrets of countries that have achieved scale

ABOUT IN GROUPE

IN Groupe is a global leader in secure identity and trust services, specializing in identity solutions, secure transactions and digital services. Building on a longstanding history of partnership with governments, the group now also serves public and private organizations worldwide.

With deep expertise across the entire identity value chain, IN Groupe delivers solutions ranging from citizen ID to professional identity services, all in support of its core mission: providing every individual – whether citizen, consumer, or professional – with a secure identity in both the physical and digital worlds.

Following an ambitious growth strategy, the group acquired NETS e-ID and IDEMIA Smart Identity in 2025. With these latest additions to its portfolio of products and services, along with its affiliated brands, IN Groupe now provides comprehensive solutions that address all identity challenges faced by governments and public or private organizations.

The group employs 4,000 people across 40 countries, serving clients in approximately 130 countries. It operates a global network of 20 research and development centers, as well as 10 industrial sites, and generates annual consolidated revenue of nearly €1 billion.

IN GROUPE

38, avenue de New York, 75116 Paris, France

www.ingroupe.com

© IN Groupe 2026. All rights reserved. This white paper is provided for informational purposes only. The analytical conclusions represent IN Groupe’s own research and do not constitute the views of the UCL IIPP. Sources are cited as available at time of publication.

Foreword by the CEO

Societies and economies cannot function at scale without trust. And in the digital age, trust cannot exist without a sovereign, inclusive digital identity infrastructure. Every seamless transaction, every secure data exchange, every effective public service rests on this single foundation. Without it, Digital Public Infrastructure is a promise without a premise.”

AGNÈS DIALLO, Chairwoman & CEO, IN Groupe

The world is building a new layer of infrastructure. Not roads, power grids, or fiber networks - though those remain essential. It is building digital identity systems: the foundational architecture that determines how individuals prove who they are, which services they can access, and whether they are recognized as full participants in the digital economy.

Digital Public Infrastructure (DPI) is commonly defined around three pillars - digital identity (ID), digital payments, and data exchange. Of these, digital identity comes first. Without a trusted, interoperable ID layer, payments cannot be securely attributed, data cannot be responsibly shared, and the promise of e-government cannot be realized at scale.

Digital identity is the foundation.

This white paper comes at a moment of real momentum. Political consensus - from Kigali to Manila, from Copenhagen to New Delhi - has never been stronger. Today, one-third of countries have a fully operational digital identity system; another third is advancing toward it.

But consensus is not capacity. And capacity is not scale.

Our paper addresses a fundamental question: what separates countries that successfully build and scale digital identity systems from those that do not?

The answer is not technology. Or rather, not technology alone.

The leading countries are not those that chose the most advanced biometrics or the most sophisticated systems. Nor are they simply the wealthiest. The difference is more fundamental: they treat digital identity not solely as a government system, rather as an

economic platform - designed and deployed with the sectors that shape and facilitate people’s life everyday.

Our work with governments globally, reinforced by the analysis in this white paper, shows a consistent pattern. Systems can reach scale where ecosystem engagement is strong - where finance, health, education and telecommunications are not downstream users, but core partners from inception.

A country can have a state-of-the-art system and a robust legal framework - and still remain disconnected from its own economy. Technology and governance are the price of entry. Adoption is what determines impact.

This reframes the challenge. Digital identity is not primarily a technology agenda - it is a leadership one. It requires deliberate choices about design, institutional alignment, and real-world deployment from the outset.

We have seen both paths: systems that scale, and systems that stall. The difference is not what is built, but how it is embedded.

Technology follows vision. Infrastructure follows governance. Scale follows adoption.

This white paper is our contribution to the global conversation on how to get this right: building digital identity systems that are sovereign by design, inclusive by intention, and interoperable by default.

AGNÈS DIALLO

Chairwoman

& CEO, IN Groupe Paris, 30 April 2026

Executive summary

Digital identity is the foundation upon which Digital Public Infrastructure (DPI) is built. Without it, payments cannot be attributed to verified individuals, data exchanges cannot be authorized, and government services cannot be securely accessed. And, despite the availability of proven technology, most countries still struggle to deploy digital identity at scale - not due to the lack of tools, but due to the lack of clarity of what drives success.

This white paper closes that knowledge gap. Drawing on the most recent and comprehensive global dataset on digital public infrastructurecompiled by University College London (UCL) across 210 countries or territories, and 17 variables - we applied our own analytical framework to explore a single, central and critical question: what separates countries that have successfully built mature digital identity systems from those that have not?

Through rigorous statistical analysis, validated against our extensive experience working with governments around the world, we uncovered answers that challenge conventional wisdom. Our findings challenge conventional assumptions.

KEY INSIGHTS

• Only one-third of countries have reached digital identity maturity.

Only 33% of countries (69 of 210) qualify as “Leader”, with a complete digital identity stack. Nearly a similar share remains at a Nascent stage, with no functional digital identity system. Just another third is halfway to maturity: having developed either a solid technology infrastructure or a strong regulatory system.

• Technology and governance are both necessarybut not sufficient.

The defining differentiator is multi-sector deployment and ecosystem adoption: whether public and private sector actors can actively use the system at scale.

• Income does not determine digital maturity.

Thirteen low- and lower-middle-income countries have reached Leader status, demonstrating that governance choices outweigh GDP as the primary driver of digital identity excellence.

• Infrastructure sustainability risk: a significant share of systems operate without legal foundations.

Eighteen countries run digital identity systems without a legal framework - representing a structural risk to the system’s sustainability and citizen protection.

• Trust in the system remains the most critical barrier.

Ninety-four percent of Nascent countries lack any legal redress mechanism for citizens, creating a systemic barrier to adoption and scale.

• Africa illustrates both the greatest challenge and opportunity.

The continent combines high-performing Leaders with a large share of Nascent systems, reflecting significant disparities internally.

1.0

Why digital public infrastructure matters: the infrastructure of the 21st century

1.1 DIGITAL PUBLIC INFRASTRUCTURES TODAY ARE THE ROADS AND TELECOMS OF YESTERDAY

For most of the 20th century, the infrastructure investments that shaped a country’s economic trajectory were physical: transport, energy, and communication networks. These investments were not immediately profitable. They required long planning horizons, sustained public financing, and political commitment that extended beyond electoral cycles. The returns built progressively and then compounded over decades, as the private sector built on the foundations governments had laid.

Digital public infrastructure (DPI) occupies the same structural position today. The International Monetary Fund (IMF)1 has made this explicit: digital infrastructure should be treated like traditional infrastructure. Systems such as digital identity, payment rails, and data exchange layers are as foundational to 21st century economies as roads and power grids were to the 20th century. This is not a metaphor. It is an investment logic.

3-13% of GDP: economic value potential to be unlocked by DPI by 20302

12,7% Reduction of social fraud4 42–75% Rise of bank account ownership in low- and middle-income countries in 2024 driven by DID infrastructure3

1.2 THE THREE PILLARS OF DIGITAL PUBLIC INFRASTRUCTURE

In a foundational research paper, UCL IIPP DPI Map presents a normative framework that defines Digital Public Infrastructure around three core societal functions - establishing a global consensus on what DPI is and how it works 5

DIGITAL IDENTITY (DIGITAL ID)

A secure, interoperable system that includes digital authentication - not just enrollment - to access services provided by both public and private sector actors.

IIPP CRITERIA FOR DPI-LIKE STATUS:

Electronic/digital credential implemented

Authentication mechanism present (biometric or digital verification)

Minimum 2 operational sectoral use cases (KYC, government portal, or equivalent)

DIGITAL PAYMENTS

An interoperable, open-loop system that securely connects banks, payment rails, and front-end applications for end-users.

IIPP CRITERIA FOR DPI-LIKE STATUS:

Active payment system enabling real-time transactions

Operated wholly or partially by a central bank or public interest entity

SECURED DATA EXCHANGE

An interoperable system enabling individuals and public/private entities to exchange and digitally verify data with one another securely - eliminating redundant document submission and bringing trust in the system.

IIPP CRITERIA FOR DPI-LIKE STATUS:

Active system facilitating data exchange

Cross-sectoral scope, not limited to one ministry or department

National scale operation

The three pillars of DPI are not equally foundational. Digital identity is not simply one component among equals. It is the prerequisite for the other two. Without a trusted identity layer, payment rails cannot attribute transactions to verified individuals, data exchange cannot be authorized, and e-government services cannot be securely accessed. Remove the identity layer, and the entire chain collapses.

Eaves, D. and Rao, K. (2025).

DPI HAS A MEASURABLE IMPACT ON ECONOMY AND SOCIETY – FULLY EMPOWERED BY MATURE DIGITAL IDENTITY INFRASTRUCTURE

The evidence supporting DPI’s economic and social impact has matured significantly over the past decade. The returns are no longer theoreticalthey are documented, quantified, and replicable across geographies and income levels.

Economic Growth

• McKinsey estimates that extending full digital ID coverage could unlock economic value equivalent to 3–13% of GDP by 2030 across emerging economies; with the highest gains in countries that enable multiple high-value use cases and achieve broad population adoption.6

• India’s Aadhaar-UPI-DigiLocker stack is estimated to have the potential to unlock economic value equivalent to 6% of GDP by 2030 through efficiency gains, SME formalisation, and expanded financial participation.7

• Brazil’s Pix instant payment system contributed an estimated 0.3–0.5% of GDP annually in efficiency gains within three years of launch, while bringing 40 million previously unbanked citizens into the formal economy.8

• Estonia’s DPI stack saves an estimated 2% of GDP annually in administrative costs equivalent to 800 years of working time saved per year across a population of 1.3 million citizens.9

Financial Inclusion

• India’s Aadhaar eKYC reduced identity verification costs from $10–20 to $0.27 per transaction (World Bank, 2025). As of March 2024, UPI processed over 13 billion transactions per month. More recently, in August 2025, UPI crossed 20 billion monthly transactions. It is thought to have brought millions of people into the formal financial system.10

• In Nigeria, the mandatory linking of the Bank Verification Number (BVN) and National Identification Number (NIN) drove BVN registrations to 67.8 million by end of 2025. The policy directly contributed to a 51% drop in digital payment fraud losses from ₦52.3 billion in 2024 to ₦25.9 billion in 2025 (NIBSS, 2026).11

• Philippines’ PhilSys national digital ID system has reached over 89 million registrations as of late 2024, becoming a gateway to financial services for previously unbanked Filipinos, 8.4 million of whom were onboarded into the formal banking system directly at PhilSys registration centres. The Philippines’ digital economy accounted for 8.5% of GDP in 2024 (Philippine Statistics Authority), with digital identity as an enabling foundation.12

• In Togo, during the COVID-19 crisis, Togo’s Novissi program demonstrated that even a voter ID database when biometric and up to date can substitute for a full digital identity system in a crisis. Novissi used biometric voter registration data covering 93% of the adult population to screen eligibility and automatically credit mobile money accounts, distributing nearly $20 million to 15% of the Togolese population in three months.13

6 McKinsey Global Institute report Digital identification: A key to inclusive growth / April 2019

7 McKinsey Global Institute report Digital identification: A key to inclusive growth / April 2019

8 Banco Central do Brasil, WEF / 2024

9 PwC Estonia: the Digital Republic Secured by Blockchain / 2019 + Belfer Center 2023 Connected Digital Society: Paving Ways for country-Scale Digital Interoperability in Estonia

10 NPCI data / national payment corporation of india / UPI / 2025

11 NIBSS (Nigeria Inter Bank Settlement system) report BVN/NIN / January 2026

12 (Phillippine Statistics Authority) / national ID registration / 2025

13 Harvard Kennedy School’s Project on Digital Era Government / Novissi Program / 2022

Digital identity is commonly recognized as the lynchpin of a trusted DPI foundation, enabling reliable authentication and trusted interactions between individuals, governments, and businesses.” WORLD BANK, 202514

Public Service Efficiency

• Chile’s ClaveUnica national digital identity platform managed by the Civil Registry gives over 15 million citizens access to more than 1,600 public services through a single credential, representing 85% of all procedures in the National Registry. The COVID-19 pandemic stress-tested the system at scale: in 2020 alone, 4.2 million new users registered nearly as many as in the entire preceding three years demonstrating the resilience of sovereign digital identity infrastructure when citizens need it most.15

• Denmark’s national digital identity platform enables near-universal access to banking, healthcare, government services, and cross-border EU services from a single credential. Denmark’s public administration achieves among Europe’s highest citizen satisfaction rates, with digital services available 24/7 without physical presence.16

• In Estonia, 98% of Estonians file taxes online in under 5 minutes, enabled by X-Road data exchange linking employment, banking, and property data. The system processes over 100 digital transactions per citizen per year. Estonia has ranked #1 in the OECD’s Tax Competitiveness Index for 12 consecutive years.17

• India’s Ayushman Bharat Digital Health Mission: 834 million health IDs linked to Aadhaar, with 787 million patient records connected, reducing duplicate diagnostics and enabling any health facility to integrate once and access the full national health network (WEF, 2026).18

• Singapore’s Singpass reduced KYC onboarding costs for financial institutions by 80% (MAS), while enabling citizens to transact with 2,000+ government and private sector services through a single digital identity.19

In cases where DPI delivered economic and societal impact, the identity layer was not an afterthought - it was the foundation on which everything else was built. The United Nations frames the same logic through its Sustainable Development Goals (SDGs): digital ID supports legal identity (SDG 16.9), and the downstream benefits - payments improving social protection (SDG 1), data systems enhancing governance (SDG 17) - all depend on that foundation.

2.0

From identity to digital identity: the state of the world

2.1 WHERE DOES THE

WORLD STAND ON IDENTITY?

Before discussing digital identity, a more fundamental question must be asked: where does the world stand on identity itself? Digital identity cannot be built on a void. It must be built on top of an existing identity infrastructure - civil registration, birth certification, national records - and that foundation is far less solid than is commonly assumed.

people worldwide still lack any official proof of identity20

2.8B

peolpe have no access to secure digital identity services, even where systems nominally exist21

Gender Gap

women are disproportionately excluded - legal, social and mobility barriers block access in 23+ countries22

Worldwide, 800 million people still lack any form of secure legal identity, whether physical or digital. They have no ID card nor passport, which deprives them of the ability to vote, cross borders, open a bank account, or access formal healthcare or education services. The exclusion is not digital - it begins before any technology enters the picture.

Birth certificate coverage - the foundational precondition for any national identity system - remains deeply uneven globally. In many parts of Sub-Saharan Africa, as well as regions of South and Southeast Asia, access to such identification is still very limited. Without a birth certificate, there is no pathway to a national ID, no bank account, no electoral registration, and no digital identity.

Identity matters. It is the prerequisite to any form of participation in society.

In the digital era, physical documents retain essential relevance. Far from being opposed to digital identities, they often form their foundation of trust: passports and ID cards are used to validate the issuance of digital credentials, notably through NFC authentication combined with biometrics. Physical documents safeguard state sovereignty, ensure enhanced security for sensitive transactions, and preserve universal access for the one-third of the global population without reliable internet connectivity. The future is not about replacement but coexistence: physical and digital complement each other to provide a trusted, secure, and inclusive identity infrastructure.

2.2 THREE GENERATIONS OF IDENTITY INFRASTRUCTURE

Identity infrastructure is not binary: present or absent; physical or digital identity. Rather, it exists on a spectrum, from paper-based, physical documents to digital integrated wallets. Recognizing that identity is not a document but an infrastructure and assessing where a country sits on that spectrum is the first step toward understanding what its digital identity journey will look like. Drawing on our operational experience across 75 governments, IN Groupe observes three generations of identity infrastructure in the field of secure identity and trust services:

• First generation: Paper-based identity

Birth certificates, handwritten registers, and physical documents with no digital equivalent. This remains the reality for hundreds of millions of people across subSaharan Africa, South Asia, and parts of Latin America, and represents the starting point for most of the world’s population that does not have a legal identity.

• Second generation: Digitized physical identity – Physical identity integrating a chip with digital data

Machine-readable passports, chip-enabled national ID cards, national eID schemes, and biometric enrollment systems. These systems digitize the issuance, security, and verification of official identity documents and enable selected strong identity verification. They form the backbone of many early electronic identification (eID) schemes, allowing citizens to prove who they are at borders, government offices, or bank counters - and in some cases to authenticate to online public services. However, these solutions remain closely tied to physical credentials and centralised databases, and generally do not provide a flexible, user-controlled digital identity layer that can be reused seamlessly across sectors.

• Third generation: Fully digital identity / eID wallets

Verifiable digital credentials that citizens use to authenticate themselves online across multiple services and sectors. This is where DPI becomes possible. In this model, identity becomes a platform rather than a document: interoperable, portable, and trusted across public and private ecosystems. The most advanced identity systems provide verifiable digital credentials, often delivered through digital identity wallets such as the EU wallet. They allow individuals to store and manage their own identity data. Citizens can prove specific attributes - such as age, professional qualifications, or eligibility. This introduces a fundamental shift, where the focus moves from identifying the person (authentication) to allowing users to selectively disclose verified attributes, under what is known as privacy-enhancing technologies such as Zero-Knowledge Proofs.

Most of the world is in transition between the second and third generation. Europe is widely represented within the third generation. Much of Asia and Latin America is in active transition. Africa presents the most diverse range of starting points: from countries where civil registration remains below 35% to nations that have already built fully operational biometric digital identity systems at scale.

2.3 WHAT A MATURE DIGITAL IDENTITY STACK LOOKS LIKE

Based on our experience working with many governments globally - and validated by the analysis presented in this white paper - IN Groupe has developed a clear view of what separates digital identity systems that reach national scale from those that stall. A mature digital identity system is not a single product. It is an architecture of five interdependent layers. The first four define whether the system exists and can be trusted. The fifth determines whether it is actually used.

1. Identity register: The authoritative source of truth. The database that links each person to their verified attributes: biometrics, name, date of birth, nationality, civil status. The register is the root of trust for everything else. Its integrity depends on how well it is connected to civil registration systems: a register built on unverified data will propagate errors at scale. This is why the identity register connection is not a technical detail - it is the foundation of the foundation.

2. Credential issuance: The citizen-facing layer. The production and issuance of a verifiable identity credential, whether physical (a card, a passport) or digital (a mobile wallet, a QR code, a verifiable credential on a phone). The credential is the interface between the register and the world. Its security depends on the integrity of the chip, the strength of the personalisation process, and the cryptographic architecture that protects it from forgery and tampering.

3. Authentication service: The economic engine of digital identity. Authentication is the real-time service that allows a bank, a hospital, a government agency, or a telecoms operator to verify - in seconds - that the person presenting a credential is who they claim to be. This is where digital ID stops being a document and becomes an infrastructure. The volume and variety of authentication transactions is the best measure of whether a digital identity system has reached scale.

4. Consent and data management: The trust layer. It is increasingly the most important differentiator between systems that citizens adopt and systems they resist. Consent and data governance determines what data is shared, with whom, for how long, and under what conditions. In the most advanced deployments, citizens can see every access to their data in real time, revoke permissions, selectively disclose, and seek recourse if something goes wrong. This is not a compliance requirement - it is the architectural feature that makes adoption voluntary rather than coerced.

5. Ecosystem: The differentiating layer - and the one most frequently missing. A system can have a perfect register, issue trusted credentials, authenticate in milliseconds, and give citizens full data control - and still reach a fraction of its potential if no external actor uses it.

Ecosystem activation means that banks accept the credential for KYC, hospitals link patient records to the national identity system, government portals require authentication through the national credential, and telecoms register SIMs against it. Without this layer, a digital identity system exists - but it does not function as infrastructure.

3.0 IN Groupe’s Digital Maturity Map: from Nascent to Leader

While a large amount of data on digital identity systems is available, it rarely explains the conditions that allow these systems to operate at scale. This white paper addresses this gap by answering a question of critical relevance to government leaders and practitioners: what distinguishes systems that have achieved scale and infrastructure status from those that have stalled?

This report analyzes the presence and characteristics of digital identity infrastructures across 210 countries. Its objective is to assess whether the key features required for a system to function at scale are in place. Countries that score highly, and are therefore classified as Leaders, demonstrate the legal, technological, and ecosystem conditions needed to enable widespread adoption.

Importantly, the report evaluates whether these enabling foundations existnot how effectively they operate in practice, nor whether adoption has actually occurred. A strong infrastructure is necessary but not sufficient: citizens may not enroll, institutions may fail to integrate the system, and trust may not emerge, even when legal, technical, and ecosystem frameworks are robust.

The 17 variables underpinning this analysis measure the presence and maturity of digital identity architectures, and whether they create the conditions for scalerather than the level of adoption achieved.

3.1 OUR METHODOLOGY

The UCL IIPP Working Paper23 gave us a rich starting point - 210 countries or territories, each assessed across 17 variables of digital identity maturity, from whether a credential exists to whether citizens have legal recourse when something goes wrong.

The 17 variables cover the full lifecycle of a digital identity system, for example whether a credential exists and whether it has been rolled out, whether biometrics are in use, whether there is an authentication mechanism, whether the system is linked to KYC processes and government portals, the regulatory and legal framework, data protection legislation, procedural safeguards, citizen redress mechanisms, terms of service, feeder system connectivity, ecosystem engagement by external actors, sectoral deployment, and data leak history.

Each country received a composite score out of 17, depending on whether the capability was absent, partial, or fully present. Rather than look at each variable in isolation, we wanted to understand the patterns - which combinations of capabilities tend to appear together, and what those groupings reveal about the underlying logic of DPI success. To do this, we applied a clustering algorithm that groups countries based on the similarity of their profiles across all dimensions simultaneously. Think of it as asking: which countries resemble each other most? And what does each group have in common that the others don’t?

We tested different numbers of groups and found that four groups offered the clearest, most meaningful picture: distinct enough to tell different stories, but not so granular as to lose the underlying patterns.

The four groups that emerged from this analysis tell a coherent story - one that we have found resonates immediately with practitioners and policymakers who know these systems from the inside.

Eaves, D. and Rao, K. (2025). Digital

3.2 FOUR SEGMENTS IN THE DIGITAL IDENTITY MATURITY JOURNEY

The analysis reveals three levels of maturity and four distinct profiles of digital identity development. What makes them interesting is not just where they scoreit is what they are missing. Each group not yet at the maturity level is defined by a characteristic gap that explains its current position and what would be required to move it forward.

33% of countries are Leaders (full digital identity maturity)

18% of countries are Technology focused (deployed but legally fragile)

13% of countries are Regulation driven (legal framework without ecosystem)

Source: IN Groupe Maturity Map©. Dataset: UCL IIPP DPI Map 2025 Q2 (210 countries, 17 variables).

IN Groupe

36% of countries are Nascent (have not yet started)

THREE MATURITY LEVELS AND FOUR CLUSTERS IN THE DIGITAL MATURITY JOURNEY

CLUSTER DESCRIPTION MATURITY LEVELS

C4 LEADER - n=69

M2 M3 M1

C2 TECHNOLOGY FOCUSED n=37 FULL MATURITY IN PROGRESS TO GET STARTED

Complete DPI stack: credential + authentication + regulation + legal equivalence + feeder systems + sectoral deployment + citizen redress. The benchmark for all.

> Key signal: 79% have feeder systems. 91% multi-sector deployment. 93% legal redress. 43% are European; 7 are African.

Tech deployed - but governance missing. 100% authentication, 78% sectoral deployment - but only 38% regulation, 19% procedural safeguards. A deployment that needs strengthening of legal scaffolding. Operationally active, legally fragile.

> Key signal: Largest geographic spread. 99% have a credential; only 7% have feeder systems. The governance gap opens here.

C1 NASCENT - n=77

C3 REGULATION DRIVEN n=28

Governance built - but the ecosystem doesn’t use it. 96% regulation, 82% feeder systems - but 0% ecosystem engagement and 0% sectoral deployment. A legal framework waiting for use cases.

> Key signal: Near-universal biometrics (94%) but only 55% sectoral deployment. The ‘tech without ecosystem’ trap.

Lack of functional digital ID system. Sometimes, presence of data protection law on paper. The system is missing authentication, regulation, and sectoral deployment. Most countries have essentially not started the DPI journey.

> Key signal: 0% have feeder systems. Minimal sectoral deployment. Legal and governance architecture essentially absent across all 17 variables. 34% of cluster is African.

Note: Definitions for all variables used in this analysis are to be found in Appendix 1.

3.3 WHERE DIGITAL IDENTITY STANDS TODAY:

THE GLOBAL PICTURE

Looking within each cluster gives us a global perspective on the stage of maturity of different regions and countries regarding digital identity infrastructure.

While Europe is by far ahead, Africa, Asia, and Latin America are where the next expansion of DPI will happen. By examining those who have achieved digital identity at scale, our study identifies the critical success factors that enable digital identity maturity and unlock its full potential.

• Thirty-three percent of the countries globally (69/210) have reached Leader status - the threshold where DPI becomes a true economic multiplier.

• Europe remains the overwhelming leader: 62% of European countries are in the Leader segment, and a further 27% are Regulation driven - 90% of European countries have strong governance.

• Africa is the most diverse continent: 13% are in the Leader segment (7 countries), while are 48% Nascent (26 countries). The gap represents both the largest challenge and the largest opportunity in global DPI.

• Middle East’s critical infrastructure remains low compared to its income levelsa structural governance deficit, not a technology one.

• Asia has the most diverse distribution: from India (Leader) to many Nascent countries - the highest variance continent.

Global distribution by cluster

IN GROUPE DIGITAL IDENTITY MATURITY MAP©

Note: Countries in light grey are where data is incomplete

Source: IN Groupe Proprietary analysis, based on UCL IIPP DPI Map Q2 2025. Survey covers 210 countries.

Regional breakdown by maturity cluster

4.0

What distinguishes digital identity Leaders from the rest: five key findings

The IN Groupe Digital Identity Map reveals not just where countries standit also highlights what distinguishes them. Five key findings uncover the specific patterns and paradoxes that explain the gap between digital identity Leaders and others.

FINDING 1

Technology and governance are both necessary, but not sufficient

What Leaders have that none of the middle clusters has is the convergence of three dimensions that qualify for digital identity maturity: technology, governance, and a live ecosystem in which external actors actually use the system.

Our radar comparison highlights a picture which is more nuanced than a simple technology-versus-governance contrast. The two middle clusters (Technology focused and Regulation driven) tell us that the features characterising both clusters can’t make it alone to maturity level.

One has deployed technology - full authentication, active sectoral use - but missing a strong legal scaffolding. The other has built a complete governance framework - regulation, legal equivalence, feeder systems, legal redress - but the ecosystem is not engaged: lack of external actors using the system, sectors have not deployed it. Countries in each of these stages risk to remain stall.

CLUSTER DNA: NASCENT, TECHNOLOGY FOCUSED, REGULATION DRIVEN, AND LEADER PROFILES

C1 Nascent (n=77)

C2 Technology Focused (n=37)

C3 Regulation Driven (n=28)

C4 Leader (n=69)

ZOOM IN - FINDING 1

Technology and governance are necessary, but not sufficient

A country can have a state-of-the-art identity system and a complete legal framework — and still be disconnected from its own economy

ANALYSIS

The data reveals two distinct “in-between stages” in the path to digital identity maturity.

Technology-focused countries have deployed core capabilities - authentication and, in many cases, sectoral use - but lack the governance foundation. Only 38% have regulation in place, and just 19% have procedural safeguards. These systems are operational, but legally fragile.

Regulation-driven countries have built robust governance frameworks - 96% have regulation, 86% legal redress, and 82% feeder systems - yet miss the ecosystem engagement and sectoral deployment. The system exists on paper but is not used in practice.

These two groups sit at similar levels of overall maturity but face fundamentally different constraints. One has built technology without governance. The other has built governance without ecosystem activation. Both risk to stall in the middle.

Importantly, traditional indicators of maturity are not sufficient:

• Legal equivalence is near-universal among Leaders, yet high levels of legal equivalence alone do not drive adoption.

• Data protection laws are present in 44% of Nascent countries, but without implementation, they do not translate into functional systems.

The critical differentiators are clear:

Between Regulation-driven countries and Leaders: ecosystem engagement (0% vs. 100%) and sectoral deployment (0% vs. 97%)

Between Technology-focused countries and Leaders: regulation (38% vs. 97%) and procedural safeguards (19% vs. 97%)

KEY TAKEAWAY

Digital identity maturity is not achieved through technology or governance alone. It requires the convergence of three elements: technology, governance, and an ecosystem engagement.

KEY IMPLICATION

A Technology-focused country needs to work on its governance - more technology will not move it forward. A Regulation-driven country needs ecosystem activation - more regulation will not help either. These are opposite diagnoses requiring opposite interventions.

FINDING 2

The

hidden

accelerator: ecosystem adoption is the real game changer

Among all dimensions we explored, two variables alone separate countries with strong governance frameworks (mostly represented in the regulatory-driven cluster) from those that have reached Leader status: ecosystem engagement - whether banks, telecoms, health systems and other actors have formally integrated the digital identity infrastructure into their own operations - and sectoral deployment - whether citizens can actually use their identity across multiple services in daily life.

Countries with regulation, feeder systems - the core registries such as civil registration or population databases that supply authoritative identity data - legal equivalence, which gives digital identity the same standing as physical documents or signatures, and citizen redress mechanisms to correct errors and resolve disputes, have built everything the architecture requires. And yet, if the ecosystem does not adopt it - across public services, private sector actors, and everyday use cases - it will fail to serve the economy that actually needs it. This finding reframes the conversation for countries that are nearly there: the leap is not technical, and it is not legal. It is ecosystem activation.

ZOOM IN - FINDING 2

The hidden accelerator: ecosystem adoption is the real game changer

Ecosystem adoption and sectoral deployment are the defining variables at the top of the distribution

ANALYSIS

Two variables clearly separate countries with strong governance frameworks from those that have reached Leader status: ecosystem engagement and sectoral deployment.

Ecosystem engagement increases from 0% in Regulation-driven countries (C3) to 100% in Leader (C4) - a sharper distinction than any other variable.

Operational sectoral use follows the same pattern, rising from 0% to 97%, making these two factors near-perfect predictors of whether a system reaches scale.

The implication is clear: governance alone does not drive adoption. Many countries have built robust legal infrastructure - regulation, legal equivalence, feeder systems, and redress mechanisms - yet remain stalled because the ecosystem is not active.

The gap is not structural; it is operational. Systems fail to scale when ecosystem and sectors, such as banks, healthcare providers, telecommunications companies, and government agencies - do not integrate the credential into their day-to-day operations.

Feeder systems, regulation, and legal frameworks are largely in place across both Regulation-driven countries and Leaders. What distinguishes Leaders is that their systems are used - embedded across sectors and integrated into real-world economy and transactions.

KEY TAKEAWAY

A complete governance framework is the foundation - but not the finish line. Digital identity systems reach scale only when they are actively used across sectors and embedded in everyday economic activity.

KEY IMPLICATION

For countries with strong governance already in place, the critical question is not what to build next, but why existing systems are not being used.

Regulation-driven countries (C3) must focus on ecosystem activation: sectoral mandates, ecosystem onboarding, and incentive structures that drive adoption.

Technology-focused countries (C2) must strengthen governance: regulatory frameworks, legal safeguards, and institutional trust.

Progress depends on diagnosing the constraint correctly. These are distinct bottlenecks requiring different interventions.

FINDING 3

Income is not destiny: 13 low-income countries prove the leapfrog phenomenon

The conventional assumption in development policy is that digital infrastructure follows wealth - that countries build mature identity systems once they reach a certain income threshold. Our analysis challenges this assumption. The correlation between GDP and digital identity maturity is moderate at best: 55% of the variance in a country’s maturity score is explained not by income but by governance choices. What a country decides matters far more than what it earns.

Thirteen low and lower-middle income countries have reached Leader statusincluding seven African nations. They succeeded in spite of their constraints or challenging starting positions. In several cases, one might even argue that it is partly because of them: the absence of entrenched legacy systems created the freedom to design for the future from day one.

Distribution of countries by income class and digital identity maturity cluster (%)

ZOOM IN - FINDING 3

Income is not destiny: 13 countries prove the leapfrog phenomenon

The data challenges a common assumption: that digital identity maturity follows income.

ANALYSIS

While 50% of high-income countries have reached Leader status, 18% of lowand lower-middle-income countries have done the same.

Overall, only 55% of the variance in digital identity maturity is explained by income - the rest is driven by governance choices.

Thirteen low- and lower-middle-income countries have achieved Leader status, spanning Africa, Asia and Latin America. Leapfroggers include: Ethiopia, Nigeria, South Africa, Philippines.

Their success follows a consistent pattern.

Across all cases, five conditions are present:

• A national identity authority with a clear legal mandate.

• Early ecosystem integration across finance, telecommunications, and government services.

• Multi-sector deployment within a short timeframe.

• Strategic technology partnerships with embedded capacity transfer.

• Sustained political commitment beyond electoral cycles.

African countries are particularly instructive. In many cases, the absence of legacy systems created the flexibility to design modern, digital-first architectures from the outset.

KEY TAKEAWAY

DPI maturity is not determined by income - it is driven by deliberate governance choices and system design. The leapfrog is not an exception; it is a reproducible model.

KEY IMPLICATION

The relevant question is not whether countries can afford to build digital identity systems, but whether they can put in place the governance, partnerships, and political commitment required to scale them and build return on investment.

FINDING 4

The trust gap: legal recourse is the missing foundation of adoption

Trust in DPI ultimately depends on robust legal frameworks and accessible citizen redress mechanisms - which are almost universally absent of the Nascent cluster.

Our redress mechanism (ability for citizens to challenge, correct, or seek remedy for problems they experience with a digital identity system) analysis provides a powerful argument that human rights and governance matter for adoption, and therefore for scale.

Citizens are not refusing to enroll because they don’t understand the system. They are refusing because the system gives them no guarantee. No way to correct an error, or to challenge a decision. People need recourse if something goes wrong.

ZOOM IN - FINDING 4

The trust gap: legal recourse is the missing foundation of adoption

A critical barrier to digital identity adoption is the absence of legal protection for citizens.

ANALYSIS

Ninety-four percent (94%) of Nascent countries are missing legal recourse mechanisms, leaving citizens without any means to challenge errors, correct data, or seek remedy in case of misuse.

This figure rises steadily with maturity, reaching 98% in Leader countries, where legal protections are nearly universal.

The implications are structural. Where no recourse exists, citizens face the full risk of system failure with no guarantee of redress. In such environments, adoption is not a matter of awareness or communication - it is constrained by design. Low trust leads to low enrollment, and low enrollment prevents systems from reaching scale.

The transition from Regulation-driven to Leader status requires more than legal frameworks on paper. It requires both enforceable citizen protections and active ecosystem use.

Systems that lack recourse may achieve usage but fail to build trust. Systems that have recourse but lack adoption remain underutilized. Leaders succeed by combining both.

This is not a compliance issue. It is a matter of citizen rights embedded in system design.

KEY TAKEAWAY

Trust is built through governance and regulation. Systems scale when citizens have clear, enforceable protections.

KEY IMPLICATION

The priority is not to convince citizens to adopt digital identity, but to ensure the system protects them when it fails. Countries that invest early in legal recourse mechanisms create the conditions for trust - and, ultimately, for adoption at scale.

FINDING 5

Infrastructure sustainability risk: systems deployed without legal foundations are structurally fragile

Deploying a digital identity system without a legal framework is not a marginal risk - it is a structural one and a matter of sustainability. A system that is operationally live but legally undefined can be suspended by a single court challenge, reversed by a change of government, or rendered void by a constitutional challenge. Our analysis identifies 18 countries in this situation - 17% of all deploying nations. What makes this finding particularly striking is that the risk zone is not confined to countries at the start of their journey. It includes countries with sophisticated technology stacks, active sectoral deployment, and high adoption rates. They have built the system. They have not yet built the legal foundation beneath it.

ZOOM IN - FINDING 5

Infrastructure sustainability risk: systems deployed without legal foundations are structurally fragile

A significant share of digital identity systems (17% of the deploying countries) is being run without the legal frameworks required to sustain them.

ANALYSIS

Eighteen countries or 17% of deploying countries operate digital identity systems without dedicated regulation, leaving millions of citizens without legal protection. These cases span income levels and regions, from African countries to uppermiddle- and high-income economies, as well as structurally complex systems such as the United States.

These systems are often technically advanced and operationally active, with sectoral integration already underway. The risk is not inactivity - it is fragility. Without a legal foundation, systems can be challenged, suspended, or reversed by courts or changes in government.

At the same time, the inverse pattern also exists: a group of countries has established regulatory frameworks but has yet to deploy systems at scale. This highlights a sequencing challenge: governance and deployment are not always advancing in parallel.

The core issue is misalignment. In some countries, technology has outpaced governance; in others, governance has outpaced implementation. Neither path leads to durable, scalable systems.

KEY TAKEAWAY

Digital identity systems cannot be sustained without a legal foundation. Governance must be built before - or alongside - deployment, not after.

KEY IMPLICATION

For countries with live systems but no regulatory framework, the priority is urgent: establish legal protections to secure system continuity and citizen trust.

Your system may be live and citizens enrolled, but without a legal framework, it remains vulnerable to challenge or suspension. The priority is not technical investment; it is establishing the legal foundations that ensure stability, protection, and continuity.

5.0

A deeper look at Africa: a continent of extremes

How do our key findings apply to Africa? The narrative of digital infrastructure in Africa has long been defined by what the continent does not yet have. Yet this narrative is changing - and changing fast. Today, Africa is home to some of the world’s most innovative DPI deployments, from Nigeria’s integrated NIN-BVN identity-finance24 stack to Rwanda’s ambitious digital-first identity program. As of 2025, 35% of African countries in our dataset have already implemented a digital identity system - and 33% more are in active pilot or planning phases. That means 68% of the continent is on a journey.

A LEAPFROG ADVANTAGE: A SOURCE OF INSPIRATION FOR COUNTRIES IN THE NASCENT STAGE

Africa is home to seven of the world’s digital identity Leaders among which: South Africa, Nigeria, and Ethiopia - countries that achieved the Leader-level despite resource constraints, and legacy infrastructure, driven by political commitment and smart architectural and technological choices. These countries prove the leapfrog phenomenon on the continent. But Africa is also home to 26 countries that belong to the Nascent cluster, making it the largest of any region represented in this cluster.

Africa’s greatest DPI asset might precisely be the absence of entrenched legacy systems: even countries starting with a challenging economic and structural baseline have an opportunity to break through by adopting digital-first design strategy, at relatively limited sunk cost. They could build identity infrastructure that is biometric from day one, mobile-first from day one, and interoperable from day one.

NOT ONE REALITY, NOT ONE CONVERSATION

Africa is not a single story. Our analysis shows a continent defined by extremes13% of African countries are Leaders while 48% remain in the Nascent segment.

The question for every African government is not “are we ready for digital identity?”. Rather, it is: “which of the four conversations are we in?”

FOUR CONVERSATIONS — AFRICA’S DIGITAL IDENTITY LANDSCAPE

CONVERSATION 1 - THE COUNTRIES AT THE LEADER LEVEL

Leaders include: South Africa, Nigeria, Ethiopia.

The conversation is at this stage about scaling and exporting. The model has been proven. The opportunity now is deepening: multi-sector integration, achieve cross-border interoperability, and become a reference and model to guide and inspire others in the region.

> “You have built it. Now how do you make it a standard for the region, beyond your borders?”

CONVERSATION 2 - THE REGULATION-DRIVEN COUNTRIES

These countries include: Benin, Ivory Coast, Madagascar.

The conversation is about ecosystem activation. Countries at this stage typically have built nearcomplete governance frameworks: strong regulation, legal equivalence, feeder systems connected, citizen redress mechanisms in place. What is missing is ecosystem engagement and sectoral deployment. The system exists and is legally sound. But banks, health systems and other sectors have not yet made it their own operational infrastructure. The risk is thinking the work is done because the architecture is complete.

> “You have built the framework. Now the question is: who is using it? Ecosystem activation is priority.”

CONVERSATION 3 - THE TECHNOLOGY-FOCUSED COUNTRIES

These countries include: Ghana, Mauritius, Morocco, Rwanda, Zambia.

The conversation is about sequencing and avoiding the technology-only trap. The countries at this stage are in the active building phase. The critical risk is deploying technology without the governance, ending up legally fragile or with isolated solutions. Deploying technology without legal framework or no citizen protections is likely to limit adoption and scale.

> “You have built the tech stack. It’s important to refocus efforts to create the legal framework that will support trust and adoption at scale.”

CONVERSATION 4 - THE NASCENTS

The conversation is about foundations, not systems. For countries at this stage, the starting point is setting up the foundational layer of identity itself: civil registration, birth certificate, and the legal framework that gives every person a verifiable legal existence.

> “You have the aspiration, you can start from the foundation: civil registration before digital credentials. Building digital on top of this will unlock the rest.”

AFRICAN LEADERS: INCOME IS NOT DESTINY

A CONTINENTAL AGENDA

The African Union’s Digital Transformation Strategy provides the continental policy framework for DPI convergence, creating a shared reference point for how digital identity, payments, and data infrastructures can evolve in a coordinated manner across the continent. Regional bodies such as ECOWAS, the East African Community, or SADC are now translating this vision into practice through interoperability frameworks that aim to allow identity credentials to be recognised across borders. This opens a significant opportunity to deepen regional integration by reducing friction for labour mobility, enabling trusted cross-border trade, and supporting regional financial integration for people and firms operating across multiple jurisdictions.

The question for Africa’s DPI builders today is to build in a way that leverages digital identity as a regional integration asset: maximising inclusion for mobile populations, minimising sovereignty risks through federated and nationally governed architectures, and deliberately creating the interoperability conditions that allow national systems to connect into coherent regional markets.

African countries: cluster positioning by income

6.0

Moving to action

6.1 SEVEN OPERATIONAL PRINCIPLES FOR REACHING DIGITAL IDENTITY MATURITY

The findings in Section 5 are not just descriptive - they are meant to guide action. Each key finding implies a design choice. Together, they converge on seven operational principles that help build mature and operational digital identity, successfully.

DESIGN

FOR

USE: MULTI-SECTOR DEPLOYMENT AND ECOSYSTEM ACTIVATION ARE ESSENTIAL

A system unused by its ecosystem is not infrastructureit is a credential waiting for a purpose

91% of Leaders have multi-sector deployment. Countries that bring sectors to the table before launch - not after - build systems that are used from day one.

A SECTOR IS A “NATURAL DPI PARTNER” WHEN THREE CONDITIONS ARE SIMULTANEOUSLY MET:

1. Identity dependency: identity verification is needed for private and public sectors to function efficiently: KYC in finance, patient records in health, SIM registration in telecoms, learner IDs in education.

2. Population scale: each sector reaches millions of citizens daily through day-to-day use cases.

3. Co-investment logic: shared DPI converts costs from fraud, inefficiencies, onboarding frictions into shared savings - creating a clear return on co-investment.

FOUR SECTORS (PRIVATE AND PUBLIC) ARE NATURAL PARTNERS FOR DIGITAL IDENTITY INFRASTRUCTURE TO SCALE UP AND DRIVE USAGE AND ADOPTION: FINANCE , TELECOMS, HEALTHCARE AND EDUCATION

• Finance: KYC (Know Your Customer features) and AML compliance are legal prerequisites, drastically reducing costs of fraud and identity verification.

• Telecoms: SIM registration is legally mandated in 150+ countries. Mobile operators are the phygital bridge to last-mile adoption.

• Healthcare: Health is the gateway use case that generates the strongest public legitimacy for enrollment.

• Education: World Bank ID4D-Findex 2024 identifies education as a primary sector unlocked by digital ID.

INTEROPERABILITY: DESIGN FOR CROSS-BORDER RECOGNITION FROM DAY ONE

Interoperability within the country is essential to facilitate ecosystem adoption and deployment. Domestic interoperability implies credentials issued by one authority are accepted across all sectors. To achieve this, common standards such as open APIs, as well as political will to align legacy systems are critical enablers. Estonia’s X-Road, connecting 900+ institutions, is a great example of such achievement.

While domestic activation is necessary - it is not sufficient. To achieve DPI-like levels, credentials must also work across borders. Cross-border interoperability means that credentials are recognised by other countries’ systems - enabling labour mobility, trade facilitation, and regional financial integration.

The European Union’s EUDI Wallet is a primary example of interoperability across borders. The eIDAS 2.0 regulation requires all EU member states to offer citizens a digital wallet enabling cross-border recognition of identity, driving licences, and professional qualifications from 2026.

Beyond Europe, the African Union’s digital identity frameworks, the ECOWAS regional biometric passport ecosystem, and ASEAN’s digital economy frameworks are moving towards the same goal. Countries that do not design for domestic activation and cross-border recognition simultaneously risk building a nationally complete but regionally incompatible system - and paying double to retrofit it later.

GOVERNANCE MATTERS

Sovereignty begins with an institutional choicenot a procurement

The finding is unambiguous: countries in the Leader cluster have regulation (97%); legal equivalence (90%), procedural safeguards (97%), data protection (90%), redress mechanism (82%) that create trust. Legal frameworks and transparent governance are essential.

WHAT THIS MEANS IN PRACTICE:

• Establish a national digital ID authority with a clear legal mandate, autonomous budget, and institutional continuity that outlasts electoral cycles - before issuing any technology RFP.

• The governance model choice (centralized vs. federated) determines interoperability, sovereignty, and long-term flexibility. 66% of top-tier systems use centralized governance for digital ID. This is a deliberate architectural choice, not a default.

• Funding model is an essential decision, before investing in any technology. Our analysis of 210 countries confirms that no Leader-level digital identity system is funded exclusively by the private sector. Public funding or public-private partnership is the universal model. Governments that treat identity infrastructure as a procurement exercise rather than an investment decision consistently underinvest in the legal and governance architecture that makes the system durable - and overpay for the technology that sits on top of it.

INCLUSION BY DESIGN 800M people without identity is not an option

For low/lower-middle income countries that have reached Leader status, the common thread is not income: it is deploying it in everyday life. Countries that design for the hardest-to-reach populations first build systems that perform better at population-level than those designed for the median connected citizen.

FIVE INCLUSION DESIGN REQUIREMENTS MUST BE INTEGRATED BEFORE DEPLOYMENT:

• Multiple enrolment pathways - digital, assisted digital, and in-person - for different connectivity and literacy levels.

• Accessible interfaces - multiple languages, audio/visual accessibility, offline fallback capabilities.

• Biometric alternatives - iris or facial recognition where fingerprint capture is unreliable (elderly, manual workers).

• Gender-responsive design - ensuring women can obtain identity documentation independently. To reach DPI level, identity system - physical or digital - should seek to correct the gender exclusions at population scale.

• Civil society oversight - independent bodies monitoring inclusion outcomes before exclusion becomes systemic.

BUILD TRUST IN THE SYSTEM

Citizen trust is an output of designnot the result of a communication campaign

The 94% of Nascent countries have zero citizen redress. The single strongest variable correlating with digital identity adoption is the presence of a legal mechanism giving citizens recourse when something goes wrong.

A SYSTEM THAT PEOPLE WILL TRUST RESTS ON FOUR PILLARS:

• Legal frameworks - defining data rights, limiting state access, establishing clear enforcement mechanisms.

• Technical safeguards - end-to-end encryption, separation of the identity layer from the data exchange layer (enforced by technical architecture, not just by policy).

• Independent oversight - bodies with real enforcement powers and adequate resourcing, not advisory committees.

• Citizen control - the ability to see who has access to their data, when, and why.

For example, Estonia’s data tracker is not a communication tool - it is an architectural module.

RETAIN ARCHITECTURAL SOVEREIGNTY

Open source or open standards vs. proprietary is not an ideological question - it is a sovereignty question

The open-source or open-standards vs. proprietary question is not primarily about cost or capability. It is about who controls the country’s infrastructure - and for how long. The technology choices are decisive on key elements of the sovereignty framework, determining who masters the data, whether interoperability is achievable, independence towards vendors and data portability.

FOR COUNTRIES ASPIRING TO IMPLEMENT DIGITAL IDENTITY INFRASTRUCTURES, THE KEY POINT IS TO RETAIN OWNERSHIP OF THE ARCHITECTURE, THE DATA, AND THE ABILITY TO EVOLVE.

• Open-source platforms like MOSIP or open standards like OSIA offer full architectural ownership and a sovereignty hedge - the government controls the roadmap.

• Certified proprietary components offer security guarantees and cross-border compliance that open source alone cannot always provide.

• The most capable deployments combine both. What is incompatible with sovereignty in either case is vendor lock-in.

TWO ACTION COURSES TO REINFORCE ARCHITECTURAL SOVEREIGNTY:

It’s essential to secure architectural and technology choices that :

• Unify fragmented sources of credentials;

• Ensure that your platform will accomodate for the missing governance layers: allowing legal equivalence to be added, or the integration of citizen redress mechanisms;

• Reinforce domestic and cross-border interoperability and boost your ecosystem deployment.

CHOOSE TECHNOLOGY AT THE RIGHT MOMENT: WHAT YOUR CLUSTER TELLS YOU ABOUT WHERE TO START

The technology question is not “what is available?”it is “what does our current position require, and what must we build now to avoid higher costs later?”

What your cluster position tells you

Nascent – One foundational decision before any other: choose an architecture you can govern and evolve. The risk is not choosing the wrong algorithm - it is locking into a vendor before you have the governance capacity to manage the relationship.

Technology focused – The technology works in these countries. The problem lies elsewhere. The investment priority is not a new stack - it is ensuring the existing one can be governed, certified, and connected to the cross-border frameworks it will need to join.

Regulation driven – Governance is in place in these countries. The question becomes: does the architecture support the APIs sectors need to connect? Is it compatible with the interoperability frameworks (EUDI Wallet, ECOWAS) that will determine the real-world value of the credential?

Leader – The question is no longer how to build - it is how to stay ahead. Is your cryptographic architecture post-quantum ready? Is your biometric matching certified for the next generation of cross-border frameworks? Are your credentials compatible with ISO/IEC 18013-5 and eIDAS 2.0?

DESIGN YOUR FUNDING MODEL CAREFULLY

Sustainability begins with financing architecture, not technology choice

The funding question is essential, part of the governance model, and must be carefully thought through. The question of who pays, who owns, and who operates must be resolved before any technology partner is selected.

The most sophisticated digital identity systems in the world share one characteristic that is rarely discussed: their funding model was designed with the same rigour as their technical architecture. Denmark’s digital identity platform is co-financed by the banking sector because the banks benefit directly from shared KYC infrastructure. Estonia’s X-Road is publicly funded because data exchange is a public good that no single sector can appropriately own. India’s Aadhaar cost $1.5 billion to buildand generates $11 billion per year in subsidy savings alone. In every case, the return on investment is clear.

Three funding models to consider, driven by the stage digital identity maturity:

• Public seed funding: Digital identity is a public good - its returns are diffuse, its beneficiaries are universal, and its governance must remain sovereign. Government should retain the financing of its foundational identity infrastructure, not giving it all to a private actor whose interests may diverge from the public interest over time.

• Public-private partnership: As the system matures, the sectors that benefit most directlyfinance, telecoms, healthcare - have a quantifiable economic interest in co-investing. The financial sector saves on KYC costs. Telecoms reduce fraud. Health systems eliminate duplicate records. Structuring these co-investment arrangements before deployment - not after - is what transforms a government identity program into a self-sustaining DPI ecosystem.

• Multilateral financing : The World Bank ID4D program, UNDP, bilateral development banks, and regional institutions are actively financing digital identity infrastructures as a means to accelerate credible development strategies. For example, Madagascar’s World Bank-financed IDMS program demonstrates a relevant approach: a sovereign architectural plan, a local partnership for skills transfer, and multilateral financing removing the budget barrier.

Digital identity succeeds when the state invests in the core infrastructure, while allowing both public and private actors to use it.

6.2 WHAT’S NEXT: TAKE A LOOK AT YOUR DIGITAL IDENTITY PATH

Moving from Nascent to Leader: digital identity maturity step by step

Each cluster transition requires a different type of investment.

The path to Leader status is not a single linear staircase. European Leaders mostly came via C3. Asian and African Leaders (India, Philippines) mostly came via C2. Both paths work - but only if the missing half is eventually completed.

There are two distinct middle stages requiring two opposite interventions. Rather, we identified two possible paths to Leader status:

• The C2 path - Technology-first are operationally active and legally fragile. They need governance and should seek to build the regulatory framework around the ecosystem.

• The C3 path - Governance-first are countries that built the full regulatory framework before activating. They need ecosystem deployment: sectoral mandates, external actor onboarding, trust contracts with citizens.

Both paths seek to reach the same destination: C4 Leader stage requires technology, governance and ecosystem, all converging.

TWO PATHS TO REACH DIGITAL IDENTITY MATURITY

TWO DEVELOPMENT PATHS TOWARDS MATURITY: TECHNOLOGY OR GOVERNANCE

Digital identity maturity development matrix

Each country scored on: Tech axis (digital auth, biometrics, KYC, gov auth, sectoral use, ext. governance) & Governance axis (regulation, legal equivalence, procedural safeguards, redress, terms of service, data protection, feeder systems)

FROM NASCENT TO LEADER Two digital identity maturity development paths: technology or governance

&

If you would like to know more about where your country sits on our Digital Identity Maturity Map, contact us at: media@ingroupe.com

7.0

Countering four myths about digital identity

7.1 WHEN FOUR NOS BECOME YES

Governments that hesitated to invest in digital identity have done so for four common reasons. Each, when examined against the evidence, turns out to be a myth - not because the concern is illegitimate, but because the data consistently suggests a different direction.

“No Trust” - Myth: Our citizens don’t trust digital identity systems. They fear a risk of surveillance and data breach.

Our findings reveals something precise about the relationship between trust and adoption. It shows that the presence of legal redress mechanism is a necessary condition to move outside the Nascent cluster up to the Leader status. While 94% of Nascent countries have no redress mechanism, 74% of C2 countries have one, 96% of C3 countries and 98% of C4 countries. Countries with no legal recourse show structurally limited adoption, regardless of how good their technology is. Citizens are reluctant to enroll when the system offers no guarantee, safeguard, or avenue for redress.

Trust is not a precondition for DPI - it is an outcome of digital identity infrastructure designed with transparency. Estonia built its eID in a post-Soviet surveillance state. The solution was architectural: separate the identity layer from the data exchange layer, give citizens a data tracker showing every access to their records, and build legal redress into the system from day one. 99% adoption followed.

> Trust is not built with communication campaigns. It is built with legal and technical architecture - and it is the condition for reaching population at scale.

“No

Skills” - Myth: We don’t have the technical capacity to build or maintain a national digital ID system.

Every Leader country used external partners for at least one transition - none built entirely in-house. Sovereign DPI means retaining ownership of architecture, data, and governance - not building every component internally. Our data and own work supporting countries building capabilities confirm that the skill gap is primarily a governance design gap: the countries that stall are not those with the least technical capacity, but those that tried to build without a legal mandate or feeder system strategy.

> IN Groupe’s Digital Identity Maturity Map outlines which skills are needed at each transition.

“No Money” - Myth: We cannot afford to invest in digital identity at scale.

Our data suggests that countries with resources constraints have punched above their weight and developed leading digital identity infrastrcutures. India’s Aadhaar cost $1.5B to build and generates $11B/year. The World Bank, IMF, UNDP, and bilateral donors have all made DPI a priority investment.

> The question is not whether a country can afford to invest. It is whether it can afford not to.

“No Need” - Myth: We already have an identity system. It works. Why invest in digital?

Most use cases remain physical. There is a conflict of resources between physcial and digital investments. It’s important to understand the economic impact and value of digital, and to create new use cases that drive usage and adoption. Relying on existing systems slows digital adoption and creates a missed opportunity for economic growth and scale.

> Prioritizing digital use cases to demonstrate value and drive adoption can unleash important economic and social potential.

7.2 A CALL TO ACTION

The digital identity infrastructure built today will serve populations for decades. It will determine who is included and who is left behind. It will shape the relationship between citizens and their states for a generation.

That is why it must be built right.

IN Groupe is committed to support and help build the digital identity infrastructure that makes a difference for nations: sovereign by design, inclusive by intention, and interoperable by default.

Appendices

APPENDIX 1: DEFINITIONS

17 variables explored by IN Groupe

IDENTIFICATION & SYSTEM STATUS

Source: IN Groupe analysis. Dataset: UCL IIPP DPI Map 2025 Q2.

Claim of digital ID

Country publicly claims a digital or electronic ID system

Status of implementation

Stage of the ID lifecycle: planned/piloted or rollout

Collects or uses biometric data

System obtains and processes individuals’ biological/behavioral characteristics

Whether a country publicly claims to have a digital or electronic ID system, determined by the use of the terms “digital” or “electronic ID” in official sources (government websites, regulations, policies) or credible secondary sources (news sites, multilateral organisation reports). Binary Yes/No.

The stage of the ID system’s life cycle, drawn from official or secondary sources plus evidence that the system is running (e.g. an operational dedicated website). Planned/Piloted: intentions announced or testing underway, no evidence of national rollout. Rollout (formerly “Implemented”): officially announced full implementation or strong evidence the system is operational nationwide.

Whether the system obtains individuals’ unique biological or behavioural characteristics (e.g. fingerprints, facial images, iris scans) and processes that information for identification, authentication, security, or personalised services. Determined from official sources or secondary reporting.

LEGAL & REGULATORY FRAMEWORK

Regulation for digital ID

Regulation or policy specifically addressing digital ID exists

Identity act codifies digital ID legal status

Identity act gives the digital ID formal legal recognition

Whether a regulation or policy document specifically addresses the digital ID system. Includes formal acts and policy documents. Note: terms and conditions or privacy policies from a digital ID website, and Data Protection Acts, are NOT counted for this indicator. Determined by the presence of, or mention of, the regulation in official or secondary sources.

Whether the identity act (or secondary legislation) formally codifies the legal status of the digital ID — i.e. grants it the same legal standing as physical identity documents. Determined by explicit language in the act or secondary sources confirming legal recognition of the digital credential.

Identity act sets procedural rules

Act or secondary policy establishes procedures for enrolment, data management, and issuance

Identity act clarifies feeder documents

Act defines the role of primary identity documents in establishing digital ID

TECHNICAL CAPABILITIES (INTEROPERABILITY)

Digital authentication function

System can digitally verify a user’s identity

Whether the digital ID has clear processes for enrolment. Determined by the explicit mention, in the digital ID regulation, of mechanisms for registration, data management, and/or the issuing of credentials. Maps to Measuring DPI Framework indicator 3.2: “Procedural rules for the ID (enrolment, data processing, issuing credentials, etc.) are established.”

Whether the legal or regulatory framework defines how primary identity documents — such as birth certificates, passports, or driver’s licences (called feeder documents) — are used to establish or authenticate a person’s identity when issuing or updating a digital ID. Determined from the act text or secondary sources.

Whether the digital ID system includes a digital authentication function — i.e. the ability to verify a user’s identity electronically. Determined from official system descriptions or credible secondary sources confirming the existence of this capability.

Enables KYC for service provision

System supports Know Your Customer (KYC) packet collection by service providers

Whether the digital ID system allows Know Your Customer (KYC) packet collection. KYC involves electronically verifying a person’s identity to assess customer risk, typically by allowing service providers to access profile details from the ID authority’s database. Determined by the use of the term “KYC” in official sources or secondary reporting. Maps to Measuring DPI Framework indicator 1.2.

Authentication via government portal

A government portal exists through which the digital ID can be used for authentication

Whether the country has a governmental portal that can be used for authentication purposes. Determined either by the direct presence of a website with this function, or through secondary sources confirming its existence. Maps to the interoperability attribute of the Measuring DPI Framework.

GOVERNANCE, ACCOUNTABILITY & REDRESS

Legally binding redress mechanism

Mechanism exists for users to lodge complaints about the digital ID system

Whether the digital ID system includes a redress mechanism for user complaints. Determined by explicit mention in the digital ID regulation or Data Protection Act, or by the existence of a customer service system. Three possible values: (1) Customer service mechanism — helpdesks, email, phone, digital forms; (2) Legally binding mechanism — explicit statutory redress in the regulation or DPA; (3) Both — customer service plus a legally binding mechanism. Maps to Measuring DPI Framework indicator 2.5.

Personal data terms publicly available

Collection, storage, and sharing terms for personal data are publicly disclosed

Data handling terms

The system specifies procedures for data subjects to access, review, edit, and delete their ID data

National Data Protection Act exists

Country has enacted a national data protection law

Whether the terms for personal data collection, storage, and sharing by the digital ID system are publicly available. Determined by the presence of such terms in the digital ID regulation, on official websites, or in the Data Protection Act, as confirmed by official or secondary sources.

Whether the digital ID system details the procedures through which data subjects can access, review, edit, and/or delete their identity data. Determined by the explicit mention of such mechanisms in the digital ID regulation or on the digital identity website. Maps to Measuring DPI Framework indicator 4.1: “Processes to access, review, edit and delete one’s ID data are transparent.”

Whether the country has a national Data Protection Act (or equivalent comprehensive data protection legislation). Determined by the presence of, or explicit reference to, such legislation in official sources or secondary reporting. Binary Yes/No.

Processes to notify of data leaks

Data Protection Act includes rules on notifying individuals about personal data breaches

Whether the country’s Data Protection Act contains explicit rules on notifying individuals (and/or the general public) about personal data leaks or breaches related to the ID system. Determined by the explicit mention of such notification rules in the Data Protection Act. Maps to Measuring DPI Framework indicator 3.3: “There exists a process to notify individuals and general public about personal data related to ID system leaks or threats.”

ADOPTION & EXTENSIBILITY

Use by ≥1 external entity

Digital ID infrastructure is used by at least one entity other than the identity manager sonal data are publicly disclosed

Whether the digital ID infrastructure is utilised by at least one external entity - i.e. an institution other than the primary identity authority - for purposes such as authentication, verification, or service delivery. Determined by explicit references in official sources or secondary reporting to use cases beyond the identity manager itself.

Two or more sectoral use cases

Digital ID is actively used across two or more sectors beyond citizen identification

Whether the digital ID infrastructure is utilised across multiple sectors (e.g. banking, healthcare, telecoms, social welfare, education). Determined by explicit references in official sources (government websites) or secondary sources (news outlets, reports) to use of the digital ID system by institutions other than the identity manager, or to use cases beyond simple citizen identification.

APPENDIX 2: METHODOLOGY

Overview

This annex documents the statistical methodology underlying the IN Groupe Digital ID Maturity Map, as presented in the white paper Sovereign by Design: Building Digital Identity at Population Scale. It is intended for readers who wish to understand the analytical foundations of the four-cluster segmentation, assess its robustness, or reproduce its results.

The analysis applies K-means clustering to the UCL IIPP DPI Map 2025 Q2 dataset - 210 country records assessed across 17 dimensions of digital identity maturity. The resulting segmentation underpins all five key findings, the four maturity profiles, and the eight operational principles presented in the main report.

1. Data source and scope

The primary data source is the UCL Institute for Innovation and Public Purpose (IIPP) DPI Map, 2025 Q2 edition - the most comprehensive publicly available dataset on digital public infrastructure, covering digital identity, payments, and data exchange systems across 210 countries or territories.

The unit of analysis is the country-level DPI system. After consolidation (detailed in Section 2), the final dataset comprises 211 country records.

The analysis maps the legal, technological and ecosystem foundations of digital identity systems in 210 countries. Rather than evaluating performance or uptake, it asks a more upstream question: are the building blocks in place for a system to operate at scale? Countries identified in the “Leader” cluster are those where the regulatory, technical and ecosystem prerequisites for widespread adoption have been established. This analysis provides a statement about the readiness of the digital identity infrastructure, not its outcomes. Enrollment may lag, institutional integration may falter, and public trust may prove elusive even when the underlying architecture is robust. Across 17 variables, the assessment captures the maturity of the infrastructure in place, not the scale of adoption achieved in a given country.

The 17 variables used in this analysis are, for the most part, binary or ordinal indicators of presence. Each captures whether a given capability, legal provision, or institutional arrangement exists within a country’s digital identity ecosystem, not the degree to which it is used, the quality of its implementation, nor the extent to which the population has adopted the system it enables. Variables such as the existence of a redress mechanism, a data protection act, or a government authentication portal indicate that the conditions for a functioning system are in place. They say nothing about enrolment rates, transaction volumes, or citizen trust.

All 17 variables were treated as equally weighted inputs to the clustering algorithm, reflecting our view that no single dimension of the framework is structurally more important than another in determining cluster membership. This methodological choice means the resulting maturity profiles capture the shape of a country’s institutional and technical infrastructure (a necessary precondition for scale) without purporting to measure adoption itself. Researchers seeking to assess real-world uptake would need to supplement this framework with data sources such as enrollment statistics, service integration rates, or citizen survey data.

n = 77

C2 TECHNOLOGY FOCUSED C1 NASCENT

n = 37

C3 REGULATION DRIVEN

n = 28

C4 LEADER

n = 69

The UCL IIPP dataset provides the raw data. All cluster assignments, analytical conclusions, and maturity profiles are IN Groupe original work - not published by or attributable to IIPP.

2. Data consolidation process

The raw dataset was enriched to improve completeness and analytical robustness:

• Missing values were filled using verified secondary sources, with all modifications recorded.

• Vanuatu was added to correct an omission in the base dataset.

• Italy was split into two entries — Italy_A (SPID) and Italy_B (CIE) — to reflect the two parallel national digital identity systems operating simultaneously. Both cluster as Leader; this affects the European count but not the overall distribution.

3. The four clusters

The four clusters were labelled based on their structural characteristicswhat capabilities are present, what is systematically absent, and what intervention is implied. The labels reflect qualitative archetypes, not purely quantitative rankings.

No functional digital ID system nor sectoral deployment. Close to half of the countries have no digital credential. Most lack legal redress mechanisms. The data protection law that appears on paper is often the only governance element present.

Technology deployed without governance. All have authentication, and more than two thirds have sectoral deployment - but only 38% regulation, 19% procedural safeguards. Operationally active, legally fragile. First intermediate mode.

Governance built without ecosystem activation. 96% regulation, 82% feeder systems, 86% legal redress - but lack of ecosystem engagement nor sectoral deployment. A framework waiting for use cases. Second intermediate mode.

Complete stack: technology + governance + ecosystem activation. 100% ecosystem engagement, 97% sectoral deployment and regulation, 82% legal redress. 43% European; 10% African. 13 low/ lower-middle income countries.

Source: IN Groupe K-means analysis v2. Dataset: UCL IIPP DPI Map 2025 Q2 (211 countries, 17 variables).

4. Treatment of small states and territories

All 210 entities in the dataset represent a country or a territory, including microstates and territories associated with larger nations. This decision was made to preserve completeness of the global landscape and avoid arbitrary filtering bias.

Post-analysis testing confirmed that these entities almost systematically cluster into Nascent (C0) and that their inclusion or exclusion does not materially affect the clustering structure of other countries. They can be excluded in downstream analyses without affecting core results.

APPENDIX 3: SOURCES

Primary data source: UCL Institute for Innovation and Public Purpose (IIPP), DPI Map 2025 Q2. Fetter, J., Rao, K., and Eaves, D. (2025). 2025 State of Digital Public Infrastructure Report. IIPP Policy Report 2025/06. ISBN: 978-1-917384-39-1.

Eaves, D. and Rao, K. (2025). Digital Public Infrastructure: a framework for conceptualisation and measurement. UCL IIPP Working Paper 2025-01.

IN Groupe original analysis: K-means clustering (sklearn, k=4, n_init=20, random_state=42) applied to IIPP DPI Map 2025 Q2 consolidated dataset (211 countries). StandardScaler normalisation. Silhouette score 0.352 at k=4. All cluster assignments and analytical conclusions are IN Groupe proprietary work. Full methodology in Appendix 2.

Supporting Sources:

GSMA / Telecom Review Africa 2025 - telco-led DPI contributions to African GDP

World Bank Digital-in-Health / JHU 2024 - efficiency gains from foundational ID in healthcare

World Economic Forum - India DPI, Brazil Pix, financial inclusion evidence base

UNDP DPI Programme Reports 2025

OECD Digital Government Policy Framework 2024–2025

Footnotes:

1 IMF: Finance & Development: The Debt Reckoning; Digital infrastructure / March 2026

2 McKinsey Global Institute report, Digital identification: A key to inclusive growth / April 2019

3 World Bank: The Global Findex Database: Connectivity and financial inclusion in the digital economy / 2025

4 BCG Closing the Trillion-Dollar Gap in Public Payments / December 2025

5 Eaves, D. and Rao, K. (2025). Digital Public Infrastructure: a framework for conceptualisation and measurement. UCL IIPP Working Paper 2025-01

McKinsey Global Institute report Digital identification: A key to inclusive growth / April 2019 7

McKinsey Global Institute report Digital identification: A key to inclusive growth / April 2019 8

9

Banco Central do Brasil, WEF / 2024

PwC Estonia: the Digital Republic Secured by Blockchain / 2019 + Belfer Center 2023 Connected Digital Society: Paving Ways for country-Scale Digital Interoperability in Estonia

NPCI data / national payment corporation of india / UPI / 2025 11

NIBSS (Nigeria Inter Bank Settlement system) report BVN/NIN / January 2026

(Phillippine Statistics Authority) / national ID registration / 2025

Harvard Kennedy School’s Project on Digital Era Government / Novissi Program / 2022 14

World Bank / Digital identity: building the foundations of digital public infrastructure in Lebanon / 2024 15 Invest Chile – OECD / report on Chile’s digital identity strategy / 2025 16

Agency for digital government / Numbers and statistics - eIDAS & crossborder /2025 17 Tax Fourndation & OECD / Estonia tax rates & ranking / 2025

18

World Economic Forum (WEF) / How India proves health and didigtal health are the world’s best investments / January 2026 19 OECD OPSI/ Singapore’s National Digital Identity - Singpass / 2022 20 World Bank & ID4D Global ID Coverage Estimates / 2025 21 World Bank & ID4D Global ID Coverage Estimates / 2025

22

World Bank & ID4D ; Global Dataset ; Global ID Coverage Estimates / 2021

23 Eaves, D. and Rao, K. (2025). Digital Public Infrastructure: a framework for conceptualisation and measurement. UCL IIPP Working Paper 2025-01.

24

The Federal Government of Nigeria has issued a directive requiring all bank account holders to link their Bank Verification Number (BVN) and National Identification Number (NIN) to their accounts, as part of efforts to enhance financial security and transparency across the nation.

Acknowledgements:

AGNÈS DIALLO

Chairwoman & CEO, IN Groupe

CÉCILE KOSSOFF

Group Chief Brand, Marketing, Communication & Sales Excellence Officer

MATHIS FOURNIER

Analyste Marketing Marché, Marketing & Sales Excellence

LOUISE SAPORITO

Visual identity & Design Officer

Key contacts:

YANN HAGUET, EVP France & Denmark Yann.HAGUET@ingroupe.com

OLIVIER CHARLANES, EVP Africa, Asia and Middle East Olivier.charlanes@ingroupe.com

JACQUES VAN ZIJP, EVP Europe Jacques.van-zijp@ingroupe.com

Digital Identity: Infrastructure that changes everything. The secrets of countries that have achieved scale

April 2026

Copyright © 2026 IN Groupe. All rights reserved. www.ingroupe.com