President Tinubu Signs the NIMC Act 2026 to Repeal Obsolete 2007 Identity Architecture

On June 26, 2026, President Bola Ahmed Tinubu signed the National Identity Management Commission (NIMC) Act 2026 into law, closing a nineteen-year gap in Nigeria's identity management legislation. Designed to replace the obsolete NIMC Act of 2007, the 2026 statutory framework provides an updated, inclusive foundation for the federation’s digital public infrastructure. This article examines the new executive mandates linking biometric registries across state ministries, the statutory designation of NIMC as the Root Certification Authority, data privacy alignments under the Nigeria Data Protection Act, and the operational compliance liabilities facing private fintech, banking, and telecommunications companies.

Nigeria’s digital economy and internal security apparatus received an unprecedented structural upgrade. On June 26, 2026, President Bola Ahmed Tinubu officially signed the National Identity Management Commission (NIMC) Act 2026 into law, marking a clean break from nearly two decades of fragmented data governance.

The landmark legislation arrives amid intensive cross-ministerial reforms aimed at tightening borders and curbing financial crime. Announcing the presidential assent, Minister of Interior Dr. Olubunmi Tunji-Ojo revealed that the new law explicitly retools the state's capability to counter systemic threats, highlighting that coordinated law enforcement had already weaponized the harmonized identity database to track and apprehend active terrorism suspects. By codifying a secure, technology-driven ecosystem, the 2026 Act transitions Nigeria away from legacy paper documentation toward full digital trust infrastructure.

For 19 years, Nigeria’s foundational identity management strategy remained structurally frozen under the legacy NIMC Act of 2007. Written at a time when the domestic digital economy, mobile money networks, and cloud-hosted data pipelines were in their infancy, the 2007 law proved incapable of managing a country of over 200 million individuals. The consequences of this outdated framework were structurally severe. Major regulatory networks—including passport registries under the Nigeria Immigration Service, driver licensing portals, financial institution Know-Your-Customer (KYC) records, and telecommunications SIM card databases—operated in complete isolation from one another. This severe institutional disconnect fostered rampant identity theft, multiple fraudulent registrations, and deep vulnerabilities that were easily exploited by criminal and insurgent networks. The National Assembly fast-tracked the 2026 bill to provide an immediate statutory fix for these security loopholes.

The enactment of the NIMC Act 2026 shifts the Commission from a passive administrative registrar to the authoritative cornerstone of Nigeria's digital public infrastructure. The statutory architecture introduces four critical innovations: 1. Designation as the Root Certification Authority. The Act officially establishes NIMC as the Root Certification Authority for Nigeria’s National Public Key Infrastructure (PKI) and Digital Public Infrastructure (DPI). This structural mandate legalizes the Commission as the country's absolute regulatory anchor for cryptographic authentication, digital signatures, and electronic trust services across both public and private sectors. 2. Cross-Agency Data HarmonizationThe law strips Ministries, Departments, and Agencies (MDAs) of their isolated database protocols. NIMC is given sweeping statutory powers to compel and facilitate secure, real-time, interoperable data exchange. This directly resolves the long-standing friction between immigration passports, tax portals, and the foundational National Identification Number (NIN) database under the sovereign rule of "One Person, One Identity". 3. Enterprise Integration LiabilitiesFor the private sector—specifically banking institutions, fintech startups, and telecommunications operators—the Act delivers a highly dependable verification layer. While it slashes consumer onboarding costs and reduces exposure to SIM-swap scams and financial fraud, it increases corporate data handling liabilities. All enterprise entities executing NIN authentications must align their operations with enhanced cybersecurity and transparency rules. 4. Alignment with Data Protection Safeguards. To secure the expanded national database from leaks and unauthorized surveillance, the 2026 Act embeds strict privacy protections that directly mirror the Nigeria Data Protection Act (NDPA). The law establishes rigorous data-sharing guidelines, requiring strict access logs and independent audits whenever citizen biometrics are accessed by third-party platforms.

The NIMC Act 2026 is a definitive, overdue transformation of Nigeria's identity management landscape. By dismantling the archaic 2007 framework, the federal government has positioned secure digital identity as a critical tool for both national security and economic opportunity. The ultimate success of this legislative upgrade will depend entirely on NIMC's operational capacity to maintain secure data infrastructure and ensure that its unified database remains fully insulated from cyber threats and institutional misuse.