IPRS and KRA PIN Checks in Account Opening: Where They Fit in Your Onboarding Workflow (Kenya)

Short answer: An IPRS check confirms that the ID number, serial number and name a customer gives match the government's central registration database; a KRA PIN check confirms that the name on the PIN matches. For banks, CBK's 2025 CDD guidance gives both as examples, not requirements. The PIN itself is required: tax law lists opening a financial-institution account as a transaction needing one, with non-residents exempt.

This guide is for compliance, operations and digital teams at Kenyan banks, microfinance banks (MFBs), PSPs and SACCOs deciding where identity checks sit in onboarding, and for anyone comparing KYC API providers. This is a practical guide, not legal advice; confirm requirements with your supervisor (CBK, SASRA) or adviser.

Creodata makes BAOS, account opening software for Kenyan banks. BAOS does not run IPRS or KRA lookups itself; near the end we explain how it works beside the provider that does. Checked against primary sources on 8 October 2026.

What is IPRS, and who runs it?

The National Payment System Regulations 2014 define the Integrated Population Registration System (IPRS) as "a centralized database holding registration data from various Kenyan government agencies, which is located in the Department of Immigration Services or such other department as the government may determine" (reg 2). Other instruments call it the Integrated Population Registration Service.

The Auditor-General's report on the State Department for Immigration and Citizen Services, for the three months to 30 June 2023, lists oversight of IPRS among the State Department's core functions. It treats IPRS as a directorate in its own right, separate from the National Registration Bureau, and records 65 agencies connected to it, without naming them. Check for any later reorganisation before naming a department in a contract or policy.

How does an institution get access to IPRS?

The access route we found in primary law is LN 69 of 2016, the Kenya Citizens and Foreign Nationals Management Service (Charges for use of Information from the Register) Regulations:

• Application. "A person who wishes to access information from the Register for the purpose of verification of details concerning an individual or for any other purpose shall apply to the Cabinet Secretary, in writing" (reg 3(1)).
• Fee. "A person granted access to the Register shall pay a fee of five shillings per record searched" (reg 3(3)).
• Agreements. The Cabinet Secretary, advised by the IPRS Director, may agree with a person to provide information from the National Population Register (reg 4).

We found no rule on "licensed IPRS aggregators", no later change to the fee, and no published list of institutions with direct access. If a provider runs the lookup for you, ask how its access is authorised under these Regulations, and confirm the arrangement with your supervisor.

Does CBK require IPRS checks?

For banks, no rule we found requires them. CBK's 2025 Guidance on Customer Due Diligence lists them among its "Examples of Customer Verification" (Table 3):

• National ID: the ID number, serial number and name match IPRS.
• Passport: IPRS confirms that the national ID number on the biodata page matches the holder.
• KRA PIN: the name on the PIN matches on the KRA website.
• Also listed: cross-checking names, date of birth and photograph against the ID, a facial-recognition selfie, and a video call.

The table makes none of these mandatory. The legal duty is to verify identity "using reliable, independent source documents, data or information" (POCAML Regulations 2023, reg 14(2)(a)). But CBK rates digital onboarding "medium to high" risk if not properly verified (Table 4), so for a remote journey a registry check is one clear way to show proper verification. Our guide to CBK's CDD guidance covers the rest.

The wording differs by sector:

For SACCOs, see our SACCO member onboarding guide.

Is a KRA PIN required to open a bank account in Kenya?

Yes, under tax law. The Tax Procedures Act First Schedule, "Transactions for which a PIN is required", lists "(11) Opening accounts with financial institutions and investment banks", and s.13(1)(b) requires the PIN on the documentation for such a transaction.

Two qualifications:

• Non-residents. Since the Finance Act 2026, a non-resident person is exempt from the PIN requirement when opening an account with a financial institution or investment bank (s.12(5B)). Your form needs a non-resident path, not a hard stop on an empty PIN field.
• The AML wording is softer. The POCAML Regulations treat an individual's PIN as optional, "if such a number has been issued to the customer" (reg 15(2)(h)), and CBK says "where available" (para 3.3.1). For legal persons the PIN is required (reg 16(1)(h)). For individuals, the tax rule is the one that requires it.

Groups are not settled. The tax text does not say how the rule applies to unincorporated groups, and bank practice differs: KCB's Tuungane chama account page states that no group KRA PIN is required, while I&M Bank's chama checklist asks for a KRA PIN for each signatory. See chama and group account opening.

The new ID card and the unique personal identifier ("Maisha Namba")

"Maisha Namba" is the popular name; the 2024 Rules never use the word "Maisha". The legal basis is:

• Registration of Persons Act s.9A, inserted in 2018, which set up the National Integrated Identity Management System, including "to assign a unique national identification number to every person registered in the register".
• The Registration of Persons (Amendment) Rules, 2024 (LN 154 of 2024), in force from 1 October 2024 according to Kenya Law. New rule 3 makes the identity card a polycarbonate electronic card or a card sealed in a plastic envelope, which "may be presented in a digital or virtual form" and "remains valid pursuant to section 17 of the Act"; the expiry date on the polycarbonate card "relates to the electronic functionality of the card". New rule 7 has the Principal Registrar adopt the unique personal identification number issued under the Births and Deaths Registration Act, or allot other index letters and serial numbers, as the identity number.

What this means at account opening:

• Don't hard-code a number format. No primary text we found sets the length or format of the new number. A format check catches typing errors, does not prove a number exists, and must accept the numbers on cards being issued now. Test it.
• Read the expiry date carefully. The date on the polycarbonate card relates to its electronic functions, while validity follows s.17 (rule 3(3)–(4)). If your checklist rejects any ID past its printed expiry date, review that with compliance.
• Plan for digital presentation. Rule 3(2) allows the card in digital or virtual form; your non-face-to-face policy (reg 9) should say how you verify it.

Interim High Court orders against the rollout were set aside in February and August 2024. We found no final judgment on the petitions, and no CBK or SASRA instrument on the new card or number at account opening, so confirm your approach with your supervisor.

Is the old ID card still valid?

Yes, until the Cabinet Secretary says otherwise. Registration of Persons Act s.17: "Every identity card issued under this Act, whether or not expressed to be valid up to any particular date, shall continue to be valid up to such time as the Cabinet Secretary may by notice in the Gazette declare". The only such declaration we found, LN 47 of 2009, ended the validity of cards issued before 30 October 1995. In its August 2024 ruling, the High Court recorded the government's sworn evidence that issue of second-generation cards ceased from 14 November 2023, so expect customers to present both card types, and make sure your form and provider accept both.

How an ID-verification provider's checks plug into your onboarding record

Whether you buy IPRS and KRA checks as a KYC API or run them through your own process, they are one step in a longer record:

1. Capture. The applicant, or staff, enters the ID type and number, the KRA PIN (or a non-resident flag) and the other KYC details.
2. Check. Your provider or process runs the lookup: ID number, serial number and name against IPRS; the name against the KRA PIN; any selfie or video step your policy calls for.
3. Compare. A reviewer resolves mismatches, such as names in a different order or spelling, and decides.
4. Record. The CDD file shows what was checked, against which source, by which provider or person, when, the result and the reviewer's decision.
5. Keep. CDD records and "the results of any analysis undertaken" are kept for at least seven years from the end of the transaction or relationship (POCAMLA s.46(4); reg 42).

Questions to ask a provider:

• How is your IPRS access authorised under LN 69 of 2016?
• Do you handle both old and new ID cards, and the new identity number?
• How do you report partial matches, and can our reviewers see why?
• Where is the data processed, and what will you give us for our data protection impact assessment?
• What happens when IPRS or KRA is unavailable? Reg 25(4) allows verification to finish after opening only under the conditions it sets, and CBK's guidance speaks of CDD "prior to opening an account" (para 3.2), so agree a fallback with your supervisor.

Data protection. The Data Protection Act requires a notice before collection, including whether collection is voluntary or mandatory (s.29), and a legal obligation is a lawful basis (s.30(1)(b)(ii)). Biometric data is sensitive personal data (s.2), and high-risk processing needs an impact assessment (s.31(1)), which matters for selfie checks.

Responsibility. If you rely on a third party for CDD under reg 33, you remain ultimately responsible (CBK CDD para 4.5).

Company and beneficial-ownership checks against BRS are a separate step; see beneficial ownership at account opening and the business account opening documents checklist.

Where BAOS fits, and what it does not do

BAOS is the account-opening workflow that sits beside your identity-verification provider and your core banking system. BAOS does not query IPRS or KRA itself. It validates the KRA PIN and Kenyan ID number formats as they are typed, and captures the ID details, KRA PIN and other KYC data on your published form, such as the Kenya personal, corporate or chama template.

The IPRS and KRA lookups come from your provider or your own process, and staff record the review in BAOS. Reviewers claim an application, verify documents, and approve or reject it, and every workflow action is recorded with who, what role, when and from which address. On the Enterprise plan, an AI pre-check cross-checks the name, registration number, KRA PIN and CR12 directors on Kenyan documents: an advisory pre-check, not a verification.

BAOS also does not run selfie, liveness or face-match checks, check BRS, screen against lists, rate risk, or book the account in core banking; staff record the account number once the core banking system opens it. See BAOS in Kenya for how the Kenya templates map to CBK and SASRA rules, the BAOS product page for plans, and our account opening software buyer's guide for Kenya for how to choose.

Frequently asked questions

Is IPRS verification mandatory for banks in Kenya?

No rule we found makes it mandatory for banks. CBK's 2025 CDD guidance gives IPRS checks as an example of verification (Table 3); the duty is to verify against reliable, independent sources (reg 14(2)(a)). The only written IPRS requirement we found is for PSPs' e-money customer registers (NPS Regulations reg 12(2)).

How do banks get access to IPRS?

The route in law is a written application to the Cabinet Secretary, with a fee of KES 5 per record searched (LN 69 of 2016, reg 3). We found no rule on licensed aggregators. If a provider runs the check, ask how its access is authorised.

Do I need a KRA PIN to open a bank account in Kenya?

Generally yes: the Tax Procedures Act lists opening an account with a financial institution as a transaction that needs a PIN (First Schedule item 11). Non-residents have been exempt since the Finance Act 2026 (s.12(5B)). How the rule applies to chamas and other unincorporated groups is not settled.

Can banks accept the new ID card (the "Maisha card") at account opening?

The new polycarbonate card is the identity card issued under the Registration of Persons Act (LN 154 of 2024, rule 3), and a national identity card is one of the official records POCAMLA s.45(1A)(a) lists. We found no CBK or SASRA instrument specific to it, so set the detail in your policy and confirm with your supervisor.

Is the old ID card still valid for opening an account?

Yes. Under Registration of Persons Act s.17, an ID card stays valid until the Cabinet Secretary declares otherwise in the Gazette, whatever date it shows.

Does BAOS check IDs against IPRS or KRA?

No. BAOS validates the KRA PIN and Kenyan ID number formats as they are typed, captures the KYC data on your form and records the staff review. The lookups come from your identity-verification provider or your own process.