Digital Account Opening in Rwanda: BNR's 2025 Directive, NIDA Checks and the Single Digital ID

Short answer: BNR Directive No 43/2025 of 08/12/2025 (signed 17 December 2025) requires digital account opening in Rwanda to meet the same KYC standards as traditional onboarding, which "includes real-time identity verification using national ID systems", biometric authentication and document scanning "where applicable". It applies to online and electronic channels. We found no rule requiring NIDA checks for branch account opening.

This guide is for digital, product and compliance teams at banks, microfinance institutions, SACCOs and e-money issuers in Rwanda building or buying an online account-opening journey. This is a practical guide, not legal advice; confirm requirements with your supervisor (BNR, FIC) or adviser. Checked against primary sources on 9 October 2026.

Creodata makes BAOS, digital account opening software for Rwanda. BAOS does not check IDs with NIDA itself; near the end we explain how it works beside the provider that does.

What does BNR's Directive 43/2025 cover?

The cover title is Directive No 43/2025 of 08/12/2025 on digital credit, digital account opening and digital savings; the signature page says "Done at Kigali, December 17, 2025", and BNR's document list calls it the "Directive on Digital Financial Services". It came into force on signature (Art. 33).

It defines digital account opening as:

"the process of creating and activating a new account such as a bank account, investment account, or mobile wallet through online or electronic channels without the need for physical paperwork or in person interaction." (Art. 2(c))

It applies to "financial service providers engaged in the provision and facilitation of digital account opening, digital credit and digital savings services" (Art. 3(a)). Existing providers "offering digital credit and savings services" have 12 months from signing to align, to about 17 December 2026 by our count (Art. 31); that clause does not mention account opening.

What must a digital onboarding journey include?

Articles 4 to 6 set out the journey:

The platform design goes to BNR "for information upon public rollout", and BNR may request amendments or suspend it (Art. 4(7)). A provider that uses a FinTech partner "remains fully responsible and liable for the FinTech provider's actions" (Art. 29(4)).

What does "includes real-time identity verification" mean?

Article 5(5) reads:

"Digital account opening complies with the existing Know Your Customer (KYC) standards as traditional onboarding. This includes real-time identity verification using national ID systems, biometric authentication (e.g., facial recognition), and document scanning where applicable, for AML/CFT purposes."

Three points for policy writers:

• It is a standard for digital onboarding. We found no rule that imposes NIDA checks or biometrics on branch (face-to-face) onboarding.
• "Where applicable" matters. The text does not say every digital account needs facial recognition. Your policy should say which checks you run, and why.
• It sits on top of the AML rules. Every reporting person verifies a customer's name against an official ID number in an unexpired photo document (Law N° 001/2025 Art. 13(2)), and verifies non-face-to-face customers "in the same manner" as face-to-face ones, with controls against "single or multiple false applications" (FIC Regulations N° 002/FIC/2026 Art. 13). The Law also requires a risk assessment before launching a new delivery mechanism (Art. 25(2)(a)).

How firmly the national ID check is required depends on who you are and how the customer arrives:

If a digital account opens before every check is complete, the Law allows completion afterwards only on its conditions: as soon as reasonably practicable, essential not to interrupt business, and with the risks managed (Art. 16). Our KYC requirements guide for Rwanda covers that rule and the rest of CDD.

Who runs Rwanda's national ID, and how do relying parties connect?

The National Identification Agency (NIDA) was established by Law No 43/2011. Law N° 029/2023 governing population registration in the national single digital identity system refers only to "the competent authority" and never names NIDA. A bank that relies on SDID data is a "relying party" (Art. 2(p)).

What the 2023 Law says about relying parties:

• The SDID number or token is accepted "subject to authentication" in all transactions requiring proof of identity, even without the physical card (Art. 20).
• A relying party may request personal data from the system "for a legitimate, expressed and specific purpose", after telling the person what will be disclosed and getting their "prior consent" (Art. 21(3)).
• Online authentication uses the SDID number or token with biometrics, with or without biographic data; offline authentication matches the data in the card's QR code (Arts 22–23).
• The authority and each relying party "enter into a separate agreement" covering systems integration and authentication (Art. 30), and the authority keeps a register of relying parties (Art. 28(e)).
• Refusing an SDID card at a point of service without just cause carries FRW 2,000,000 to 3,000,000 for an organisation (Art. 33(2)).

We found no published relying-party fees, API specification, list of connected institutions or rules on licensed aggregators. In a 2019 presentation, NIDA said all banks were among 45 or more institutions connected to the population registry for real-time verification; that is NIDA's 2019 statement, not a rule.

Ask any verification provider whether its access rests on a relying-party agreement (Art. 30), how it records the customer's prior consent (Art. 21(3)), whether it handles SDID numbers and tokens as well as old ID numbers, and where the NIDA response is stored.

The Single Digital ID and the old ID card

Law N° 029/2023 separates the national identification number, the SDID number, the SDID number token (a privacy-protecting alternative the holder may use) and the SDID card, "a physical or digital credential" (Arts 2, 19). Don't treat the two numbers as the same. The SDID number "in conjunction with a successful authentication, is accepted as sufficient proof of identity" (Art. 17(3)), and a registered person need not carry the card (Art. 18(2)).

NIDA launched digital ID activities in the Southern Province on 3 November 2025, enrolled residents of the City of Kigali from 7 February to 4 April 2026, and was enrolling in Rusizi District in September 2026. Enrolment captures ten fingerprints, facial images and iris scans.

The old ID system remains valid "for a period not exceeding four years" from the Law's publication on 15 June 2023 (Art. 38(2)), which by our count means until about mid-June 2027. Expect both old and new credentials at onboarding until then. We found no BNR or FIC instrument on accepting SDID credentials at account opening.

The Law describes the identification numbers only as "randomly generated, unique, and permanent". We found no primary text setting a length or format, so don't hard-code one in form validation.

Biometrics: sensitive data and high-risk AI

Under the data protection law, "sensitive personal data" includes "genetic or biometric information" (Law N° 058/2021 Art. 3). Your collection notice must cover, among other things, "the existence of automated decision making, including profiling" and any transfer outside Rwanda (Art. 42).

BNR's AI Guidelines (No 52/2026, June 2026) define a "High-Risk AI System" to include any AI system that "performs biometric identification", or that "determines or materially influences customer eligibility, pricing, or access to financial products" (Art. 2(m)). They apply to financial institutions' material AI uses, including third-party AI (Art. 3). If your provider's face match uses AI, plan for it to fall in that category.

Where must the data be stored?

Article 50 of Law N° 058/2021 says:

"The data controller or the data processor stores personal data in Rwanda."

Storage outside Rwanda "is only permitted if the data controller or the data processor holds a valid registration certificate authorising him or her to store personal data outside Rwanda", issued by NCSA, which runs the Data Protection and Privacy Office. Transfers abroad need NCSA authorisation, the data subject's consent or another Art. 48 ground, and a written contract with the recipient (Arts 48–49).

BNR treats "cloud services operated by service providers as a form of outsourcing", expects the institution to keep the encryption key, and requires approval before outsourcing material activities (Regulation N° 49/2022 Arts 20–21). We found no BNR rule that primary data must stay in Rwanda, but the Art. 50 storage rule still applies. Azure has no region in Rwanda or elsewhere in East Africa.

Language on the platform

Rwanda's official languages are Kinyarwanda, English and French, with Kiswahili added in 2017. BNR's consumer protection Regulation N° 55/2022 requires information in a language the consumer is conversant with or has chosen among the official languages, including through "electronic tools" (Art. 18), and the KFS is presented in the official language the consumer chooses (Regulations N° 90/2025 Art. 6). Directive 43/2025's fines schedule lists "Failure to comply with the language requirements for the platform and digital documents" at FRW 500,000 for banks.

Where BAOS fits

Whatever you buy, a Rwandan digital journey needs consent and a KFS before the application; real-time ID verification through authorised NIDA access; a record of what was checked, when and with what result; controls against false applications; a confirmation summary and post-opening notice; and a settled storage location.

BAOS is the account-opening workflow that sits beside your identity-verification provider and your core banking system. Applicants apply online through the customer portal, or staff capture the application for them, with autosave and resume-anywhere drafts. No Rwanda template or ID-type list ships: your team builds the forms in the no-code form builder and adds Rwanda's ID types to the option sets. Format checks ship for the KRA PIN, Kenyan ID, Tanzanian TIN, passport and phone numbers only. Forms can carry English and Swahili text, but not Kinyarwanda or French, and the staff interface is English.

BAOS does not check IDs with NIDA, and does not run liveness, selfie or face match: those come from your verification provider, and staff record the review in BAOS. Reviewers claim an application, verify documents and approve or reject it, then record the account number once the core banking system opens the account. On the Azure deployment, applicants get an email at each key step; BAOS does not send SMS and has no USSD channel or mobile app. It keeps no timestamped consent records and produces no KFS, so plan how you evidence consent and KFS receipt. Every workflow action is recorded with who, what role, when and from which address.

You can run BAOS from Azure Marketplace into your own Azure subscription, in the Azure region you choose, or on-premises in your own data centre, installed and supported by Creodata. With no Azure region in East Africa (the nearest are South Africa North and South Africa West), Azure storage is outside Rwanda, which needs NCSA's certificate under Art. 50. Where your data must stay in Rwanda, choose the on-premises deployment. The Enterprise AI features run on Azure AI services in East US 2 or Sweden Central, so AI processing is not in Rwanda. See BAOS for Rwandan institutions and the BAOS product page, and our corporate account opening guide for Rwanda for business customers.

Frequently asked questions

Does BNR require NIDA verification for every account?

No rule we found does. The Directive says digital account opening "includes real-time identity verification using national ID systems" (Art. 5(5)), and e-money issuers must verify through NIDA's database or independent sources (Regulation N° 54/2022 Art. 9). For branch accounts, the Law's photo-ID verification rule applies (Art. 13(2)).

Is facial recognition mandatory for digital account opening in Rwanda?

Not in every case. The Directive lists biometric authentication "(e.g., facial recognition)" with document scanning "where applicable". Biometric data is sensitive personal data, and AI that performs biometric identification is "high-risk" under BNR's AI Guidelines.

How does a bank get access to NIDA for online ID verification?

Law N° 029/2023 Art. 30 requires a separate agreement between the authority and each relying party. We found no published fees, API terms or aggregator rules, so ask any provider how its access is authorised.

Are old Rwandan ID cards still valid for opening an account?

Yes, for now. The old system stays valid for up to four years from 15 June 2023, until about mid-June 2027 (Law N° 029/2023 Art. 38(2)).

Can customer data from digital onboarding be stored outside Rwanda?

Only with a valid NCSA registration certificate authorising storage outside Rwanda (Law N° 058/2021 Art. 50). BNR also treats cloud as outsourcing, and material outsourcing needs its approval (Regulation N° 49/2022).