NRC and TPIN Checks in Account Opening: Where They Fit in Your Onboarding Workflow (Zambia)

Short answer: Zambian law requires banks to compare a customer's particulars with a photo ID such as the NRC, or another listed source; it does not require a check against the national register or INRIS, which the 2025 National Risk Assessment says was "not fully operational". A register check is allowed, not required. The TPIN is required: Income Tax Act s.45B lists account opening and holding at a bank.

This guide is for compliance, operations and digital teams at Zambian banks, microfinance institutions and savings and credit co-operatives (SACCOs) deciding where identity and tax-number checks sit in onboarding, and for anyone comparing identity-verification providers. This is a practical guide, not legal advice; confirm requirements with your supervisor (the Bank of Zambia or the Financial Intelligence Centre) or adviser. Checked against primary sources on 9 October 2026.

Creodata makes BAOS, account opening software for Zambia. BAOS does not check NRCs or TPINs itself; near the end we explain how it works beside the provider or process that does.

What is the NRC, and who issues it?

The National Registration Card (NRC) is issued under the National Registration Act (Cap. 126). The Act provides for a Chief Registrar and registrars (s.4) and applies to persons aged sixteen or more (s.3). The Chief Registrar keeps "a register of all persons in Zambia to whom this Act applies" (s.5(1)), and on registration the registrar issues "a national registration card in the prescribed form" (s.8(1)). The 2025 National Risk Assessment names the Department of National Registration, Passports and Citizenship in the Ministry of Home Affairs and Internal Security.

The National Registration Regulations 2019 (SI 34 of 2019) set the detail:

• Two cards. Form IA for citizens (the "Green Registration Card") and Form IB for non-citizens (the "Pink Registration Card"), each showing a photo, NRC number, names, date and place of birth, nationality, sex, date of issue, a machine-readable zone and a "Previous NRC Number" field (reg 3(2)).
• Biometrics. The applicant is photographed and the Registrar captures "10 rolled fingerprints and 10 plain fingerprints" (reg 4(1)).
• Numbering. For a person born in Zambia, the NRC number is "obtained from that person's birth registration" (reg 6(2)). A person who already held an NRC number "shall be issued with a new number and the previous number shall be indicated on the back of the new card" (reg 6(3)).

What changed with the chip NRC?

The National Registration (Amendment) Regulations 2021 (SI 80 of 2021) replaced the card forms. The new Form 1A ("National Registration Card", citizens) and Form 1B ("Non-National Registration Card") include a "Contact Chip", a serial number, a document number, a machine-readable zone and the "Previous NRC Number".

We found no instrument fixing a rollout date or a replacement deadline, and no provision declaring older cards invalid or giving the NRC an expiry date. What this means at account opening:

• Accept both card types. We found no cut-off for older cards, so check that your form, your provider and your branch checklist accept older cards and chip cards.
• Don't hard-code a number format. No text we read fixes the format, and SI 34 says re-issued cards carry new numbers. A format check catches typing errors but does not prove that a number exists.
• Capture the previous number. Both card forms have a "Previous NRC Number" field. Recording it helps you match a customer whose number changed on re-issue.
• Expiry. The FIC's 2019 banking guidelines say an ID used for CDD should not have expired (§3.1(a)). We found no expiry rule for the NRC itself, so confirm with your supervisor how your expired-ID check treats NRCs.

Do banks have to verify NRCs against INRIS or the national register?

No rule we found requires it. SI 54 of 2022, reg 7(1)(a), requires banks to compare the customer's particulars with "the individual's driving licence, passport or national identification document bearing the individual's pictorial image", or with another listed source: references, a Refugee Identification Card, a credit reference search, a utility bill, or "information which is obtained from any other independent source". That last item means a register check is allowed but not required. We found no Bank of Zambia or FIC instrument requiring an NRC database check.

The 2025 National Risk Assessment describes INRIS as linking civil registration and national ID issuance and creating "a centralized biometric enabled national database", but says that "at the time of the NRA the INRIS project was not fully operational". Its action plan lists completing INRIS, "Integrate banking systems with INRIS" and an "Electronic centralized Know Your Customer (KYC) database". These are planned actions, not legal duties. Don't tell customers or your board that banks "must verify NRCs against INRIS", or that banks are connected to it.

How do third parties get access to the national register?

The National Registration Act s.5(2) lets the Chief Registrar provide extracts from the register "(a) to any public officer acting in the exercise of his official duties; (b) to a person authorised by the Minister in writing on payment of such fee as may be prescribed". Regulations may prescribe the fees (s.14(h)); we could not read the fee schedule.

We found no primary source on an NRC verification API, an online NRC verification service, licensed aggregators or per-query fees. If a provider offers "NRC verification online", ask:

• What is the source of the check, and how is your access authorised under s.5(2)?
• Do you handle older cards, chip cards and re-issued numbers?
• Where is the data processed and stored?

Remote opening, selfies and biometric data

Non-face-to-face opening is a high-risk factor (SI 54 Second Schedule Part II para 3(c)). FIC Act s.18 requires due diligence "no less effective than where the customer appears in person", and "additional documentary evidence or supplementary measures to verify or certify the documents supplied by the customer". No provision names a remote-verification method, so your policy decides whether to use a selfie, liveness or video check, and records why.

Those checks handle biometric data, which the Data Protection Act 2021 treats as sensitive personal data (s.2). Section 70(3) says sensitive personal data "shall be processed and stored in a server or data centre located in the Republic". Section 71(4)(b) allows a transfer with the data subject's explicit consent, and the two provisions sit uneasily, so take advice before using a provider that processes selfies outside Zambia.

Is a TPIN required to open a bank account in Zambia?

Yes. Income Tax Act s.45B(1) says listed institutions "shall require a tax payer identification from any person, applying for anything listed, or engaged in the types of transactions listed". The Income Tax (Amendment) Act 2016 added "Account opening and holding" for a financial institution, and the 2017 Act changed that to "bank or financial institution", from 1 January 2018. Furnishing a false number is an offence (s.45B(3)).

The Bank of Zambia's CB Circular 05/2020 (24 January 2020) told commercial banks that new accounts must comply, failing which "the account should not be opened", and that corporate account holders must fully comply. ZRA had advised that existing accounts should not be blocked or closed for lack of a TPIN "until further notice".

The 2025 National Risk Assessment calls it "CB Circular No. 5 of 2022", but the Bank of Zambia's listing has no such circular; cite 05/2020. A later circular, CB Circular 22/2023, requires the resident party's TPIN on cross-border transactions reported on the e-BoP portal, and says transactions "should not be processed" without it.

Who has a TPIN, and are there exemptions?

A TPIN is issued to "(a) a corporate person or unincorporate body of persons; and (b) an individual who has attained the age of sixteen years" (Income Tax Act s.2, from 1 January 2023; the age was eighteen before). Section 45(1) says: "A person shall obtain a taxpayer identification number from the Authority." A partnership obtains its own (s.45(2)).

We found no exemption for non-residents, minors or low-value accounts in s.45B or the amending Acts. So don't tell customers a TPIN is only for business accounts, or that non-residents are exempt. Children under 16 cannot hold a TPIN, and the Bank of Zambia's student-account circular (CB Circular 04/2014) does not mention one; how the rule applies to children's accounts is unsettled, so confirm with the Bank of Zambia.

For businesses registered with PACRA after 2020, ZRA says the TPIN is generated on PACRA registration. The name "TPIN certificate" appears only in the bank checklists we read.

How is a TPIN checked?

For bodies corporate, SI 54 reg 7(1)(b)(ii) asks the bank to verify by "reviewing the tax payer identification number issued by the Zambia Revenue Authority and other information contained in the Register of companies or other relevant register". We found no ZRA verification channel prescribed for banks. Record what you checked it against, such as the certificate the customer gave or PACRA's register data. Company documents are covered in our guide to corporate account opening requirements in Zambia.

How NRC and TPIN checks plug into your onboarding record

Whoever runs the checks, they are one step in a longer record:

1. Capture. The applicant, or staff, enters the ID type and number (and any previous NRC number), the TPIN and the other s.16(4)(a) particulars.
2. Check. Staff compare the particulars with the photo ID; your provider runs any register, selfie or liveness step your policy calls for.
3. Compare. A reviewer resolves mismatches, such as a changed NRC number, and decides.
4. Record. The file shows what was checked, against which source, by whom, when, and the result.
5. Keep. Account files and identity documents are kept for "not less than ten years after the business relationship has ended" (FIC Act s.22(2)(a)).

If you rely on a third party for CDD, notify the FIC immediately with the reliance details (SI 54 reg 11(2)); you keep "the ultimate responsibility for compliance" (FIC Act s.17(4)). The full list of KYC rules is in our KYC requirements guide for Zambia.

Where BAOS fits

Whatever system you use, check that it records the ID type and number, the previous NRC number, the TPIN, the source of each check and the reviewer's decision, and that it can run where Zambia's data protection law lets you store the data.

BAOS is the account-opening workflow that sits beside your identity-verification provider and your core banking system. BAOS does not check NRCs against the national register or INRIS, or TPINs with ZRA. No Zambia template ships: your team builds the personal, business, group and joint forms in the no-code form builder and adds the NRC and other Zambian ID types to the option sets. BAOS checks passport and phone number formats; it has no NRC or TPIN format check. It also does not run selfie, liveness or face-match checks, screen against lists, rate risk or book the account in core banking.

The checks come from your provider or your own process, and staff record the review in BAOS, verifying documents one at a time or a whole application at once. Reviewers claim an application, approve or reject it, then record the account number once the core banking system opens the account, and every workflow action is recorded with who, what role, when and from which address.

Hosting. Data Protection Act s.70(1): "A data controller shall process and store personal data on a server or data centre located in the Republic." BAOS has two deployment options: from Azure Marketplace into your own Azure subscription, in the Azure region you choose, or on-premises in your own data centre, installed and supported by Creodata. Azure has no region in East Africa (the nearest are South Africa North and South Africa West), so where your data must stay in Zambia, choose the on-premises deployment. The Enterprise AI features run on Azure AI services, so that processing is not in Zambia, and the Bank of Zambia requires prior approval for material outsourcing and offshoring. See how BAOS works in Zambia, the BAOS product page for plans, and our AML compliance software buyer's guide for Zambia for the screening side.

Frequently asked questions

Is NRC verification against INRIS mandatory for Zambian banks?

No rule we found requires it. SI 54 reg 7(1)(a) requires comparison with a photo ID such as the NRC, or another listed source, and allows information from any other independent source. The 2025 National Risk Assessment says INRIS was not fully operational and lists bank integration as a future action.

Can NRCs be verified online?

We found no primary source on an official online NRC verification service. The Chief Registrar may give register extracts to persons the Minister authorises in writing, for a fee (National Registration Act s.5(2)), so ask any provider how its access is authorised.

Are older NRCs still valid for opening an account?

We found no provision declaring older NRCs invalid. SI 80 of 2021 prescribes a chip card, and SI 34 of 2019 says re-issued cards carry a new number with the previous number on the back. Accept both card types unless your supervisor tells you otherwise.

Do I need a TPIN to open a bank account in Zambia?

Yes. Income Tax Act s.45B lists account opening and holding at a bank or financial institution, and BoZ CB Circular 05/2020 says new accounts without a TPIN should not be opened. TPINs are issued from age 16. We found no exemption for non-residents.

Does BAOS check NRCs or TPINs?

No. BAOS captures the ID and TPIN details on your published form and records the staff review. The checks come from your identity-verification provider or your own process.