Abstract

National identity systems lie at the heart of every government’s identity management infrastructure. In Bangladesh, the National Identification Number (NID) has emerged as the primary credential for citizen identification, yet its integration with the financial sector—particularly for electronic Know Your Customer (e-KYC) compliance—remains fragmented, inconsistent, and vulnerable. This study investigates the effectiveness of the NID as a single authentication identifier for customer onboarding in Bangladesh’s banking and non-banking financial institution (NBFI) sector. We conducted semi-structured interviews with ICT heads and technically responsible personnel across 61 banks and 35 NBFIs, supplemented by a structured questionnaire survey covering six key dimensions: single authentication ID usage, e-KYC service operations, onboarding challenges, personally identifiable information (PII) handling, identity theft exposure, and agent banking practices. A mixed-methods analytical approach was applied, combining quantitative survey responses with qualitative thematic coding. Our findings reveal sixteen distinct vulnerabilities and operational gaps grouped into three categories: identity theft, privacy vulnerabilities, and technical vulnerabilities. Notably, the majority of institutions rely on manual, paper-dependent verification processes; the Bangladesh Election Commission (BEC) API constitutes a single point of failure for onboarding verification across hundreds of organizations; and a significant proportion of banks retain NID data beyond its intended purpose. Despite these challenges, we demonstrate that a Federated Identity Management (FIM) system built on the existing NID infrastructure is technically feasible and would substantially reduce administrative burden, improve security, and enable seamless cross-sector identity federation.

This work is licensed under a Creative Commons Attribution 4.0 License.