How to Add KYC to Your Nigerian App: Verifying NIN, BVN and Faces the Compliant Way

Picture this. Ada downloads your lending app on a Tuesday evening, types her details, and asks for a ₦50,000 loan. You have never met her. You can't see her face, check her ID card, or call her bank.

So how do you know she is who she says she is?

That question is what KYC is about. It stands for Know Your Customer, and it is simply the set of checks you run to make sure the person on the other side of the screen is real, is who they claim to be, and is allowed to use your service. If you run a fintech, a loan app, a marketplace, a savings platform or anything else that handles money, you need it. Regulators expect it, and your own bank and payment partners will ask about it.

The good news is that in Nigeria the building blocks already exist. Let's walk through them.

The three things a good KYC flow checks

Think of it as three questions you ask, in order.

1. Is this identity real? The person gives you a number, either a BVN or a NIN, and you check that it exists and that the name and date of birth match what they told you.

2. Does it belong to this person? Anyone can type in someone else's number. So you ask for a selfie and compare it with the photo attached to that identity.

3. Is a real person in front of the camera right now? Someone could hold up a printed photo, or replay a video. A liveness check catches that.

Most teams do step one and stop. That is the easy part, and it is also the weakest. Phone numbers, BVNs and NINs leak all the time. A face is much harder to borrow.

Step 1: Check the number

You send the number to a verification API and you get an answer back in a few seconds. With IdentifyOrg, checking a BVN looks like this:

POST /v1/verify/bvn
{
  "bvn": "12345678901",
  "phone_number": "08012345678",
  "first_name": "Adaeze",
  "last_name": "Okafor",
  "date_of_birth": "1992-04-15"
}

You don't have to send the name and date of birth, but you should. When you do, we compare them with the records and send back a match result and a confidence score. That saves you from writing your own name-matching code, which is harder than it sounds (think "Chukwuemeka" vs "Chukwu Emeka"). NIN works the same way, using nin, first_name and last_name.

The full request and response are in the API reference.

Step 2: Match the face to the ID photo

Once the number checks out, you have a photo on record for that person. Now ask the user for a fresh selfie and compare the two using the face match endpoint. You upload both images and get back a similarity score and a yes or no.

You decide how strict to be. A small wallet app can accept a looser match than a lender releasing large loans, so the threshold is yours to set.

Step 3: Make sure someone is really there

Here is the catch with face match. If an attacker has a photo of Ada, a face match will happily say "yes, same person." It compares two images. It has no idea whether a human took one of them a second ago.

A liveness check fills that gap. It asks the person to do a few random things, like blink, turn their head or smile, and it also analyses the picture for signs of a screen or a printout. You get back a score from 0 to 100. We go deeper on this in Fake accounts, replayed selfies and deepfakes.

What about data protection?

This is the part many teams worry about, so let's keep it simple.

Nigeria's main law here is the Nigeria Data Protection Act (NDPA) 2023, which is overseen by the Nigeria Data Protection Commission (NDPC). It builds on the older NDPR. A BVN or NIN counts as personal data. A face scan used to identify someone is treated as sensitive personal data, which means you need to be more careful with it.

You don't need a law degree to get the basics right. Here is what it comes down to:

• Know why you're collecting it, and say so. For KYC, the reason is usually a legal duty or the contract you're entering into. Put that plainly in your privacy notice.
• Only collect what you need. Don't ask for both BVN and NIN just because you can. Don't keep ID photos "just in case."
• Decide how long you'll keep it, and then actually delete it on schedule.
• Protect it. Encrypt it, and limit who on your team can see it.
• Have a plan for when things go wrong. The NDPA expects you to tell the Commission within 72 hours if there is a serious breach.
• Check whether you need to register. Organisations that process a lot of data have registration duties.

This is general information, not legal advice. For your own situation, speak to a Nigerian data protection professional.

On our side, we make the job a little lighter. IdentifyOrg stores the result of a check (verified or not, match or not, the score), not the personal details that came back from the data source, unless you choose to keep them. Uploaded documents are deleted after processing unless you opt to retain them, and biometric data isn't kept after the session ends. The less you hold, the less you can lose.

Keep it short, or people will drop off

Every extra screen costs you customers. A few things help:

• Start verifying the number in the background while the user takes their selfie.
• When something fails, say exactly what went wrong ("the name doesn't match the BVN") rather than a vague error.
• Use test keys while you build. They return realistic responses without charging you or touching live records.

Where to start

Create a free account, grab a test key, and run a BVN check from the dashboard to see what comes back. Then wire up the three steps: the number, the face match and the liveness check. Once you're happy, review your privacy notice, switch to a live key, and you're set.

You can also browse everything we offer on the products page.