If you are building a product for Nigerian users, KYC conversations start with two eleven-digit numbers: the BVN and the NIN. They are not interchangeable, and picking the wrong one can exclude users or leave a gap in your checks.
BVN: Bank Verification Number
- Issued through the banking system. You get one when you register biometrics with a bank.
- It identifies a person across all their bank accounts.
- Anyone with a bank account normally has one. Someone with no bank account normally does not.
Use it when you are dealing with money: lending, wallets, payouts, account opening. It ties the person to the banking system.
NIN: National Identification Number
- Issued by the national identity authority (NIMC) to citizens and legal residents.
- Not tied to a bank account. People without a bank account can have one.
Use it when you need to identify a person who may not be banked: staffing and HR, telecom and utility sign-ups, community programmes, resellers and agents.
Which should you ask for?
| Your situation | Ask for |
|---|---|
| Lending or wallets for banked users | BVN |
| Onboarding sellers, riders, resellers or staff | NIN (or let the person choose) |
| High-risk accounts | Both, plus a selfie and liveness test |
| Unbanked users | NIN |
Many products let the applicant pick either number, which avoids turning away someone who has only one.
What a number check does and does not prove
A lookup tells you the number exists and that the name (and other details you send) match the record. It does not prove that the person typing the number is the owner. Anyone who knows or has found a number can type it. To tie the number to a person you need more signals:
- a selfie matched to the ID card photo the applicant uploads,
- a liveness test so the selfie is a live person,
- details that the genuine owner would know (date of birth and phone number are commonly required for a BVN check).
Also be clear about photos: some lookups return no photo, so there may be no official photo to compare a selfie with. If that is your provider's behaviour, tell your users and your compliance team, and compare with the card photo the applicant uploads instead.
Handle the data like a regulated identifier
These numbers are personal data under Nigerian data protection law. Practical habits:
- Encrypt the number at rest and show only the last four digits by default.
- Log every time someone reveals it.
- Record consent with a timestamp and the version of the wording.
- Delete data after the retention period you promised, and on request.
- Tell users what you check and why.
Calling a verification API
With IdentifyOrg (where I work), a NIN check is one call, billed only when the check completes:
curl -X POST https://api.identifyorg.com/v1/verify/nin \
-H "X-IdentifyOrg-Key: io_test_..." \
-H "Content-Type: application/json" \
-d '{ "nin": "12345678901", "first_name": "Adaeze", "last_name": "Okafor" }'
Use a test key first: it returns realistic responses without charging or contacting any third party. If you do not want to build the screens yourself, the same checks (plus selfie match, liveness and address) are available as a no-code verification link you send on WhatsApp or embed on your site. More detail: NIN verification and BVN verification.
Identity numbers and the checks available depend on the country. Outside Nigeria, phone, ID card reading, selfie match, liveness and address checks work; identity-number checks for other countries are being added.
