Strengthening Digital Public Infrastructure in Somalia

Somalia has built more digital public infrastructure in the past eighteen months than in the prior decade: a national digital identity system enrolling toward a 15 million target, an interoperable instant payment network linking banks and mobile money, a Data Protection Act with implementing regulations, and a Cybersecurity Law establishing a national incident-response authority. The frameworks the reform agenda once called for now largely exist. The gap has shifted from design to delivery: inclusive access to the identity system remains limited by connectivity and digital literacy, security-audit transparency for the identity platform has drawn scrutiny since a 2025 data breach, and interoperability between the three major systems, identity, payments and cybersecurity, is being built as parallel workstreams rather than a coordinated whole. This brief recommends treating implementation and integration, not further framework-building, as the priority for the next phase.

Eighteen months ago, Somalia's digital public infrastructure agenda was mostly aspirational: a mobile-money-driven private sector had outpaced a public sector without a national identity system, an interoperable payment network, or a data protection law. That is no longer an accurate description. The National Identification and Registration Authority has enrolled more than a million citizens and integrated over two dozen public and private services with the national ID. The Central Bank's Somalia Instant Payment System has been live since January 2025 and is expanding toward fourteen banks and eight mobile money providers. Parliament passed a Data Protection Act with implementing regulations approved in January 2026, and a Cybersecurity Law the same month. The policy question has moved from whether Somalia will build this infrastructure to whether it is being built in a way that reaches the people it is meant to serve, and whether the pieces are secure and interoperable enough to be trusted with citizens' identity and financial data.

Three parallel initiatives now anchor Somalia's digital public infrastructure. First, identity: the National Identification and Registration Authority's HUBIYE verification platform, the e-Aqoonsi mobile ID app, and a Certificate Delivery System together form a biometric identity architecture backed by fingerprint and facial recognition data linked to a national identification number, built with $75 million in World Bank financing under the Somalia Crisis Recovery Project. More than a million citizens had enrolled as of November 2025, against a target of 15 million by 2029, and the national ID became mandatory for passports in September 2025 and for domestic travel from January 2026. Second, payments: the Somalia Instant Payment System, built on ISO 20022 messaging standards and operated by the Somalia Payment Switch, a partnership between the Central Bank and thirteen commercial banks, launched in January 2025 to enable real-time transfers across banks, mobile wallets and point-of-sale terminals, with integration into the Pan-African Payment and Settlement System planned before the end of 2026. Third, the legal and security framework: the Data Protection Act, passed in 2023 with implementing regulations approved by the Council of Ministers in January 2026, and the Cybersecurity Law, passed the same month, which designated the National Communications Authority as lead cybersecurity authority and established the Somalia Computer Incident Response Team.

Each of these three initiatives has outpaced what a brief written even a year ago could reasonably have called for, but each carries a distinct implementation gap that framework-building alone will not close. On identity, Biometric Update reported in April 2026 that the e-Aqoonsi app was still not reaching citizens inclusively, hampered by poor connectivity and digital illiteracy, and that scrutiny of the platform's security posture had intensified after Somalia's e-visa system, a related but separate government platform, was breached in November 2025, exposing personal data belonging to an estimated 35,000 applicants. NIRA has published a privacy policy for e-Aqoonsi, but there is little public information on independent security audits, technical standards, or breach-reporting procedures for a system that now holds biometric data on over a million citizens and is expanding toward fifteen million. On payments, the Instant Payment System's own trajectory, from thirteen founding banks toward fourteen banks and eight mobile money providers on one interoperable network, is close to the kind of unified rail the original version of this brief called for; the remaining question is whether government-to-citizen and citizen-to-government payment flows, the use cases most relevant to public service delivery rather than commercial transactions, are prioritised in that expansion or left for later. On the legal and security framework, Somalia now has a Data Protection Act, implementing regulations, and a Cybersecurity Law, addressing the two gaps the original brief identified as most urgent. What it does not yet have is evidence that these three initiatives, identity, payments and cybersecurity, are being coordinated as a single interoperable system rather than three well-funded parallel programmes that happen to share a citizen base.

• Continue current trajectory: let identity, payments and the legal/security framework mature independently under their existing implementing agencies (NIRA, the Central Bank, the National Communications Authority), with coordination handled informally as needed. Lowest near-term cost, but risks exactly the fragmentation and duplicated citizen-facing touchpoints Somalia's digital economy already shows signs of.
• Prioritise inclusive access over expansion, slowing new enrolment targets to invest in offline and low-connectivity access channels, agent networks, and digital literacy programming for e-Aqoonsi before pushing toward the 15 million target. Addresses the access gap directly, at the cost of slower progress toward universal coverage.
• Prioritise security-audit transparency, requiring NIRA and the Somalia Payment Switch to publish independent security audit summaries and formal breach-notification procedures under the new Cybersecurity Law, before further scaling either system. Directly responsive to the post-e-visa-breach scrutiny, at some short-term reputational cost in acknowledging current gaps.
• Establish a single digital public infrastructure coordination mandate spanning NIRA, the Central Bank and the National Communications Authority, with joint technical standards and a shared roadmap, rather than three agencies each nearing completion of their own piece on their own timeline.

• Establish a standing inter-agency digital public infrastructure coordination body spanning NIRA, the Central Bank and the National Communications Authority, with a published joint roadmap, rather than treating identity, payments and cybersecurity as separate agency-owned programmes that happen to touch the same citizens.
• Require NIRA to publish independent security audit summaries and a formal breach-notification procedure for e-Aqoonsi and HUBIYE under the new Cybersecurity Law, treating this as a precondition for continued enrolment growth rather than a response to the next incident.
• Fund offline and low-connectivity access channels, community enrolment agents, USSD-based fallback options, and digital literacy programming, as a funded line item within the identity rollout, not an afterthought to the 15 million target.
• Prioritise government-to-citizen and citizen-to-government payment flows, social transfers, tax payments, fee collection, in the next phase of Instant Payment System expansion, so the interoperable rail serves public service delivery and not only commercial transactions.
• Publish an annual public progress report against the 2029 enrolment target and the 2026 PAPSS integration date, so implementation can be tracked against specific commitments in the same way this brief recommends for the electoral process.

The version of this brief written a year ago would have recommended Somalia establish a national digital identity framework, introduce a data protection law, and build an inter-agency coordination unit. Two of those three now exist in some form; the third, genuine coordination across identity, payments and security rather than three parallel programmes, remains the gap. Somalia's digital public infrastructure agenda has succeeded at the harder problem, building the frameworks, faster than most comparable states manage. What determines whether that investment translates into inclusive, trusted public services is now a narrower and more tractable set of questions: who gets left out by connectivity and literacy gaps, whether the platforms holding biometric and financial data can demonstrate they are secure, and whether the pieces already built are made to work as one system rather than three.