More than 800 million people worldwide lack official proof of identity. The number has declined, from over one billion in 2017 to 850 million in 2021 and approximately 800 million today. But the distribution is highly uneven. Over half are in sub-Saharan Africa. Over half are children whose births were never registered. And 2.8 billion people globally, many of them in Africa, do not have access to a digital identity that would allow them to transact online or verify their identity remotely.
These figures are typically presented as a development challenge, an input for SDG 16.9 (legal identity for all by 2030) and a barrier to public service delivery. For financial inclusion, this gap is critical and creates a regulatory trap that is hindering the expansion of Africa’s financial system. Without reliable identification, the compliance obligations that underpin every modern financial system, from customer due diligence to anti-money laundering controls, cannot function at scale. The consequence is not merely exclusion. It is a structural constraint on the capacity of African financial systems to supervise, intermediate, and grow.
Identity as a regulatory problem
Every financial institution operating in a regulated jurisdiction is required to verify the identity of its clients.[1] This obligation is non-negotiable. It derives from the FATF’s international standards on anti-money laundering and countering the financing of terrorism, which have been transposed into domestic law by virtually every African jurisdiction.
This implies that when a person lacks formal identification, their exclusion from the financial system is not a commercial decision by the bank or the mobile money operator. It is a regulatory constraint. Mobile money has partially circumvented this constraint through tiered KYC, where basic accounts can be opened with minimal documentation (in some jurisdictions, a phone number and a name). This is what enabled the rapid scaling. But tiered KYC creates what might be called an inclusion of limited scope, as the client can transfer and pay, but cannot save formally, cannot access credit, and cannot be fully identified for supervisory purposes. It is an entry point, not an endpoint. And even that entry point is fragile.
The SIM card illusion
The identity layer on which mobile money rests is the SIM card, and the SIM card’s identity foundations are weaker than the industry acknowledges. In theory, SIM registration links a phone number to a verified identity. In practice, the link is often tenuous. A study by Luhanga et al. (2023), based on interviews in Kenya and Tanzania, found that in low- and middle-income countries, 18% of SIM cards are registered under a third-party’s identity. Users routinely borrow IDs to register, memorise someone else’s ID number, break large transactions into smaller ones to avoid agent verification, or ask strangers to complete transactions on their behalf. In South Africa, a major telecom operator was found to accept SIM registrations with fabricated identity numbers. In Kenya, the Central Bank raised the alarm, noting that remote SIM onboarding had led to forgery of documents and identity theft.
The consequences are measurable. In Ghana, the Bank of Ghana’s 2024 Financial Stability Report recorded 15,673 fraud cases in the financial sector, the vast majority linked to mobile money, up from approximately 2,700 the previous year. The government responded by announcing that any Ghana Card linked to multiple fraud cases would be blocked, cutting offenders off from telecom services and public systems. In South Africa, telecom fraud cost R5.3 Bn (approximately USD290 M) in 2024, with SIM swap scams accounting for 60% of mobile banking fraud.
As a consequence, countries are tightening SIM registration precisely because the existing identity layer is inadequate for the financial services that now run on top of it. Mobile money was built on the assumption that a SIM card was a reasonable proxy for identity. At the scale of USD1.4 trillion in annual transactions, that assumption no longer holds. As Bradley Elliot (CEO at RelyComply) put it: “A SIM card is, effectively, a portable identity token. Once compromised, it gives attackers a back door into bank accounts, digital wallets, and high-risk transactional environments.”
The compliance trap
The identity gap creates what can be described as a regulatory trap. On one side, international AML/CFT standards require robust customer identification. The FATF’s guidance on financial inclusion explicitly recognises that its standards allow for simplified due diligence in lower-risk situations, and encourages risk-based approaches. But in practice, many jurisdictions implement AML/CFT requirements more strictly than the FATF demands, partly out of caution and partly because the consequences of being found deficient are severe.[2] As of February 2025, the FATF’s list of jurisdictions under increased monitoring includes Burkina Faso, Cameroon, the DRC, Kenya, Mali, Mozambique, Namibia, Nigeria, South Africa, South Sudan, Tanzania, Côte d’Ivoire, and Angola. Grey listing pushes domestic banks toward de-risking: tightening onboarding requirements, closing correspondent banking relationships, reducing exposure to customer segments perceived as higher-risk. The people most affected are precisely those who lack formal identification.
On the other side, loosening KYC requirements to broaden access creates real risks, as the fraud data from Ghana, South Africa and Kenya demonstrate. The FATF itself warns that financial exclusion drives people toward informal channels, where no monitoring exists and where money laundering risks are higher. The trap is genuine: strict compliance excludes; loose compliance exposes. Resolving this tension needs a strong identity infrastructure.
Digital identity, a game changer?
India’s experience offers the most documented example of how digital identity transforms financial inclusion at scale. The Aadhaar system, which provides a unique biometric identifier to over 1.3 billion residents, enabled eKYC:[3] electronic identity verification that is instantaneous, remote, and costs a fraction of manual processes. Combined with the Pradhan Mantri Jan Dhan Yojana (PMJDY) programme, which opened over 500 million bank accounts, Aadhaar made it economically viable for financial institutions to onboard customers who would otherwise have been too costly to serve. The World Bank’s Global Findex reports that in low-income countries, 35% of adults who received a government payment opened their first account specifically to receive it. Identity enabled the payment; the payment created the account; the account created the financial history.
The relevance for Africa is not that Aadhaar should be replicated, but that it demonstrates the principle that digital identity makes KYC scalable. Without it, every customer verification is manual, costly, and excludes the populations furthest from formal documentation. With it, the regulatory compliance that is currently a barrier to inclusion becomes a facilitator. This applies to both dimensions explored in the earlier articles in this series. For mobile money supervision, digital identity would allow regulators to know who the 21 million users of Wave actually are, reducing fraud and enabling risk-based oversight rather than blanket restrictions. For the transition from mobile money to banking, discussed in the second article, digital identity would prevent the mechanical narrowing of the client base at the point of KYC transition, because users would already possess verifiable credentials.
It is achievable. African countries wouldn’t be starting from scratch. The World Bank’s ID4D initiative has mobilised approximately USD1 Bn for identification projects in 30 countries, 23 of them in Africa. In West Africa, interoperable identity platforms are being developed for over 200 million people. Ghana’s Ghana Card, now mandatory for SIM registration and linked to the national digital identity system, is one of the most advanced implementations on the continent. Rwanda, Kenya and Nigeria have all invested in national ID systems with varying degrees of digital capability. Some structural gaps persist though. The first is financing: the estimated cost of addressing Africa’s identification needs is approximately USD6 Bn. The second is institutional governance. Identity systems in Africa are typically managed by ministries of the interior or civil registration authorities, with limited coordination with financial regulators. This means that the systems are not built with financial compliance in mind, and may not support real-time verification, may not be interoperable across borders, and may not integrate with the digital onboarding processes that mobile money and neobanks require. The third is trust. Data protection frameworks in Africa are still emerging. The tension between financial regulators, who need more data for KYC, and data protection authorities, who seek to limit its circulation, is to be addressed. And populations that have experienced state surveillance or data breaches have legitimate reasons to be cautious about biometric registration.
Before fintech, before banking, identity
The three articles in this series have traced a connected argument. The first showed that mobile money has transformed financial inclusion in Africa, but that the prudential framework governing it has not kept pace with the volumes it now processes. The second showed that when mobile money operators seek to become banks, the transition fails at the point of regulatory compliance: the client base narrows because the KYC requirements of banking are more demanding than those of mobile money, and the funding base that results is structurally fragile. This third article identifies the root cause: the absence of reliable, scalable identity infrastructure.
Identity is the foundational layer of financial regulatory infrastructure. Without it, mobile money cannot be properly supervised at scale. Without it, the transition from mobile money to banking cannot preserve the breadth of inclusion that mobile money achieved. Without it, regulators are trapped between exclusion and exposure. And without it, every fintech innovation, however elegant, operates on a foundation that is weaker than it appears.
The investments required are substantial but quantifiable. The institutional reforms are feasible: bringing financial regulators into the design of identity systems, building interoperable digital ID frameworks that support eKYC, and resolving the tension between compliance and privacy through clear, enforceable data protection frameworks. The question is not whether Africa can afford to build this infrastructure. It is whether it can afford not to.
References
Luhanga, E., Sowon, K., Cranor, L.F., Fanti, G., Tucker, C. & Gueye, A. (2023). User Experiences with Third-Party SIM Cards and ID Registration in Kenya and Tanzania. ACM Conference on Computer-Supported Cooperative Work and Social Computing.
[1] KYC (Know Your Customer): regulatory requirements that oblige financial institutions to verify the identity of their clients before opening an account or conducting transactions. These obligations derive from international AML/CFT (Anti-Money Laundering / Countering the Financing of Terrorism) standards set by the FATF. ↩
[2] FATF grey list (officially: jurisdictions under increased monitoring): countries identified by the FATF as having strategic deficiencies in their AML/CFT frameworks. Grey listing can trigger enhanced due diligence requirements from correspondent banks, reducing access to international financial networks. ↩
[3] eKYC (electronic Know Your Customer): digital identity verification that allows institutions to authenticate a customer remotely, using biometric data or a digital ID linked to a national registry. In India, Aadhaar-based eKYC reduced the cost of customer onboarding from approximately $5 to $0.50 per verification. ↩
