NIDA Verification in Account Opening: Where It Fits in Your Onboarding Workflow (Tanzania)

Short answer: Tanzania's AML Regulations make the national identity card issued by NIDA the primary ID document for account opening, but checking the card with NIDA is written only into "enhanced verification". Institutions that want to use NIDA data apply to NIDA, sign a data-sharing contract and pay TZS 500 per successful query for a citizen, or USD 1 for a legal resident or refugee (GN 96 of 2023).

This guide is for compliance, operations and digital teams at banks, microfinance institutions and SACCOS in Tanzania deciding where NIDA checks sit in onboarding, and for anyone comparing identity-verification providers. This is a practical guide, not legal advice; confirm requirements with your supervisor (the Bank of Tanzania, TCDC for SACCOS, or the FIU) or adviser. Checked against primary sources on 9 October 2026.

Creodata makes BAOS, account opening software for Tanzania. BAOS does not query NIDA itself; near the end we explain how it works beside the provider that does.

What does NIDA issue?

NIDA issues the national identity card and the National Identification Number (NIN) under the Registration and Identification of Persons (General) Regulations, 2014 (GN 271 of 2014), made under Cap. 36. The 2023 amendment (GN 96 of 17 February 2023) sets what the card face shows: photo, NIN, names, sex, signature, card type, date of birth and the "expiry date of identity cards in case of legal residents', refugees' and stateless persons".

So since February 2023, only non-citizens' cards carry an expiry date; the 2014 text listed one for every card.

What does the law require, and what does it allow?

The national ID is the primary document; checking it with NIDA is part of enhanced verification. Don't write "banks must verify every customer online against NIDA" into your policy as a legal rule.

Who gets enhanced verification? Moderate-risk customers get detailed or enhanced verification (reg 7(2)(b)). High-risk customers, and any customer whose risk has not been determined, get enhanced due diligence, which includes it (reg 7(2)(c), 7(3)). Your policy can apply NIDA checks more widely.

Remote onboarding. Reg 9(j) treats a customer who is not physically present, "without proper safeguards", as an increased risk. No text names a required remote method; a check with the issuer is one safeguard your policy can name.

Practice. In 2019, ESAAMLG assessors found medium and large banks' systems linked to the NIDA database (Mutual Evaluation Report, June 2021, paras 255 to 258). That describes practice, not a rule.

Our KYC requirements guide for Tanzania covers the ID rules and timing in full.

How does an institution get access to NIDA data?

GN 96 of 2023 added reg 17A to the 2014 Regulations:

1. Apply. "A person who intends to use information under the custody of the Authority shall make an application to the Authority, in a prescribed form, for authorisation to use such information" (reg 17A(1)).
2. Due diligence. NIDA may carry out due diligence and accept or reject the application, giving reasons for a rejection within fourteen days (reg 17A(2), (4)).
3. Contract. An accepted applicant "shall enter into a data sharing contract with the Authority" (reg 17A(3)). The contract covers rights and obligations, terms of use, periodic inspection of infrastructure integrated with NIDA's network, and fees.
4. Suspension. NIDA may suspend use for non-payment or breach (reg 17A(5)).

Fees (Second Schedule, "Use of information under the custody of Authority"):

Security agencies pay no fees (reg 16(4)).

NIDA's verification channels

NIDA's data-sharing page (in Swahili; our summary) describes three channels:

• Common Interface Gateway: system-to-system checks using the NIN, fingerprints and questions.
• Secure Portal: an institutional account whose staff verify customers by asking questions drawn from NIDA's system. If you are looking for a NIDA verification portal for branch staff, this is the channel NIDA describes.
• Offline verification: card readers with a NIDA-issued SAM card that read the card's chip without a network.

NIDA's steps: a letter to the Director General with your regulator's business licence and a network design showing where your server is located; evaluation and technical consultation; the contract and a test environment; sign-off and billing; then NIDA monitors operation and supports the API.

We found no licensing rule for KYC aggregators and no published API specification, and NIDA's page names no aggregators. If a provider runs NIDA checks for you, ask how its access is authorised.

Questions to ask an identity-verification provider

• Access. Do you hold your own data-sharing contract with NIDA, and which channel do you use?
• Biometrics. Do you check fingerprints? Biometric data is sensitive personal data under the Personal Data Protection Act (s.3). Processing it needs prior written consent, unless it is necessary to comply with another written law, such as AML CDD (s.30).
• Location. Where is the data processed? Sending personal data outside Tanzania needs a permit from the Personal Data Protection Commission, applied for on Form No. 7 (GN 449C of 2023, reg 20). Controllers and processors must also register with the Commission (PDPA s.14).
• Results. How do you report partial matches, and can reviewers see why?
• Downtime. What happens when NIDA is unavailable? The Act allows opening before verification only under proven low risk (s.16(1)(d)), so agree a fallback with your supervisor.
• Decision. BoT's Outsourcing Guidelines 2021 bar banks from outsourcing the determination of compliance with AML and KYC norms for opening accounts (para 10(b)), so keep the decision on each result with your own staff.

What about older cards with a printed expiry date?

AML reg 8(1)(d) requires suspension of an account whose identification document "has expired". Citizen cards issued before the 2023 amendment can carry a printed expiry date, and we found no primary text that settles whether they remain valid after it: GN 96 of 2023 changed what new cards show, with no transitional provision.

So don't write either "old cards are invalid" or "cards never expire" into your policy. Agree the approach with your supervisor, record the decision on each file, and track expiry dates on non-citizens' cards, which carry one.

Proof of address and local-government letters

• The AML rule. The Regulations require an address, not an address document. Without a physical address, the neighbourhood, locality or village, town or city, district or region and country will do (reg 2).
• The 2009 guidance. The FIU's verification guidelines suggest documents such as utility bills, bank statements, a letter from a public authority or a lease. They were issued under the revoked 2007 Regulations and don't name ward or village executive officers.
• Where these letters appear in law. Ward or village letters appear in primary texts in three places, none about bank accounts: as photo ID for mobile-money cash-out (Electronic Money Regulations 2015), as a reference letter for registering a Tier 4 community group (Microfinance Act 2018 s.28(2)(d)), and in NIDA registration, where a residence introduction letter from the local government is a mandatory attachment to the citizen form.
• Bank practice. Some banks accept, or ask group signatories for, a letter from the ward or village executive officer or the local government authority. ESAAMLG's 2019 visit also found banks accepting a letter from the ward secretary.

Whether you ask for a letter is a policy choice; the law does not require one.

How do TIN and NIN fit together?

• The link. Since 1 January 2023, the Commissioner General must issue a TIN to every citizen registered with a NIN, and connect each TIN with a NIN (Tax Administration Act s.22(2), (5)). No TIN is issued unless the Commissioner General is satisfied of the applicant's identity (s.24(4)).
• Individuals. The AML Regulations' basic personal information does not include a TIN. The tax law's Third Schedule lists financial institutions for "All contracts" without naming account opening (s.25(2)), so don't tell customers a TIN is mandatory for every account.
• Entities. The Regulations ask for a TIN "where applicable". The NIN also appears in company filings, such as each first director's NIN (Companies Act s.15(2)(a)), and in business-name statements (Business Names Act s.6(1)). See corporate account opening requirements in Tanzania.

How a NIDA check plugs into your onboarding record

1. Capture. The applicant, or staff, enters the ID type and number and the other basic personal information.
2. Check. Your provider, or your own NIDA channel, runs the check. Record which channel: gateway, portal or offline card reader.
3. Compare. A reviewer resolves mismatches, such as names in a different order or spelling.
4. Record. The file shows what was checked, against which source, by whom, when, the result and the decision, plus the expiry date for cards that have one.
5. Keep. KYC files are kept for at least ten years from the end of the relationship (AMLA s.17(1)(b)).

In Zanzibar, the AMLPOC Regulations, 2022 also accept the Zanzibar resident identity card as a primary document, and a customer who has lost all documents presents a police loss report and their NIN or Zanzibar resident number (reg 8(1)(a), (5)).

Where BAOS fits

Whatever system you use, check that it records the ID type and number, the verification level, the provider and channel, the result, the reviewer's decision and expiry dates. Our bank account opening software guide lists wider criteria.

BAOS is the account-opening workflow that sits beside your identity-verification provider and your core banking system. BAOS does not check IDs with NIDA, and it does not check BRELA or TRA. The "Tanzania personal account" template offers the NIDA national ID, passport, voter's ID and driving licence as ID types, with TZS income bands, proof of residence, and an optional TIN certificate and introducer letter. Set the proof-of-residence field to match your policy, since the law requires an address, not a document. The template is a starting point that your team reviews against the 2026 changes before publishing. BAOS validates Tanzanian TIN, passport and phone number formats as they are typed; a format check catches typing errors, not whether a number exists. Forms can carry English and Swahili; the staff interface is English.

The NIDA result comes from your provider or your own channel, and staff record the review in BAOS, verifying documents one at a time or a whole application at once. Reviewers claim an application, verify documents and approve or reject it, then record the account number once the core banking system opens the account. Every workflow action is recorded with who, what role, when and from which address, and BAOS lists every person who needs screening once each.

BAOS does not run liveness, selfie, face-match or fingerprint checks, screen against lists, rate risk, or book accounts in core banking. Screening runs in your screening tool, such as Creodata's AML software for Tanzania; for reporting to the FIU, see goAML for Tanzania.

BAOS runs from Azure Marketplace into your own Azure subscription, in the Azure region you choose, or on-premises in your own data centre, installed and supported by Creodata. Azure has no region in East Africa (the nearest are South Africa North and South Africa West). BoT's 2023 cloud guidelines bar hosting mission-critical systems, as BoT determines them, outside Tanzania, and data transfers abroad need a PDPC permit. Where your rules keep data or systems in Tanzania, choose the on-premises deployment. The Enterprise AI features run on Azure AI services outside Tanzania.

See BAOS in Tanzania for how the templates map to Tanzanian rules, or the BAOS product page for plans.

Frequently asked questions

Is NIDA verification mandatory for opening a bank account in Tanzania?

We found no text requiring every bank to query NIDA for every customer. The national ID is the primary document (GN 397 reg 8(1)(a)); checking it with the issuer is part of enhanced verification (reg 2). Your policy can require it more widely.

How much does a NIDA verification cost?

TZS 500 per successful transaction for a citizen and USD 1 for a legal resident or refugee, under the Second Schedule added by GN 96 of 2023. A written certification or confirmation of identity costs TZS 20,000.

How do banks get access to NIDA's verification system?

Apply to NIDA for authorisation, pass its due diligence, and sign a data-sharing contract (reg 17A). NIDA describes three channels: a system-to-system gateway, a secure portal for staff, and offline card readers.

Can a customer open an account without a NIDA card?

Only in the listed exceptions: a non-citizen or non-resident who cannot get the card, a person the law bars from holding one, a lost card with a police loss report, or a low-risk customer (reg 8(1)(b)).

Does BAOS verify IDs with NIDA?

No. BAOS captures the ID details on your published form, validates TIN, passport and phone formats, and records the staff review. The NIDA check comes from your identity-verification provider or your own NIDA channel.