Welcome to ID Tech’s digest of identity industry news. Here’s what you need to know about the world of digital identity and biometrics today:
New Developments Show Growing Agreement on What to Verify About AI Agents if Not How
The financial and regulatory sectors are moving quickly to address the risks posed by undeclared automated software, as highlighted by growing alignment on AI agent verification requirements following the U.S. Office of the Comptroller of the Currency’s first framework for assessing how banks manage uncontrolled agents. Driven by a reported 750 percent surge in agentic traffic and the launch of tools like Meta’s Muse, major financial institutions including JPMorgan Chase and Wells Fargo have blocked unauthorized agents while modifying customer contracts to shift liability for agent-initiated actions, prompting vendors like LexisNexis Risk Solutions, Zetrix AI, Shufti, and Descope to launch competing “Know Your Agent” and delegated credential services designed to uniquely identify and authenticate bots before they execute transactions.
Unico Launches Human Token a Persistent Identifier Derived From a Selfie and Cuts 25 Percent of Staff
Brazilian identity verification provider Unico has introduced the Human Token persistent identifier technology, which converts a selfie into a unique, privacy-preserving alphanumeric sequence without retaining names, faces, or document numbers, just as the company lays off 175 employees in a global restructuring effort. Already deployed across Latin America, Asia, and Africa, the technology combines liveness detection with biometric matching to prevent repeat fraud and account takeovers without requiring large centralized databases, arriving as the firm consolidates 11 acquisitions into a unified platform while leveraging AI to offset the 25 percent reduction in its engineering workforce.
Nigeria Seeks Third Extension of 430M Digital ID Project as Enrollment Partners Go Unpaid
The World Bank has published a restructuring paper revealing that Nigeria is requesting a third extension for its $430 million Digital Identification for Development project, seeking to push the closing date to December 2027 amid unpaid arrears to enrollment partners and $196 million in undisbursed financing. Tasked with reaching a target of 180 million National Identification Numbers, the National Identity Management Commission currently faces a 59-million-person enrollment gap and must drastically increase monthly registrations, all while managing severe delays in deploying the open-source National Identity Management System 2.0 and the unintegrated NINAuth digital authentication platform.
Breach at Japanese Email Vendor Exposes Addresses From My Number Card Booking Systems
A major cybersecurity incident at Japanese email delivery firm Arara has exposed email addresses linked to the My Number Card system, affecting residents across multiple municipalities who used the TKC-managed booking software to schedule national ID card pickups. The broader October breach saw attackers infiltrate 97 servers and compromise data from approximately 380 contracting companies, potentially exposing 77 million email addresses along with names and phone numbers, which the attackers subsequently weaponized to distribute over 7 million fraudulent credit card phishing messages before Arara suspended its messaging service.
Spain AEPD Finds One to One Facial Check for Remote Onboarding Can Pass GDPR Tests
The Agencia Española de Protección de Datos has issued regulatory guidance confirming that a one-to-one facial verification system for remote customer onboarding can satisfy GDPR requirements for suitability, necessity, and proportionality. Responding to a financial firm seeking to replace manual visual checks, the Spanish data protection authority ruled that generating and immediately destroying temporary biometric references to compare a live video against an identity document carries substantially lower risk than permanent database identification and is legally permissible, provided the automated system mitigates impersonation fraud more effectively than human review and offers users a viable, non-biometric alternative for consent.
Yubico Unveils YubiID to Tie Identity Checks to Credential Enrollment and Recovery
Authentication hardware provider Yubico used its inaugural YubiNation user conference in San Francisco to introduce the YubiID credential enrollment and recovery service, entering early access to help distributed enterprises securely verify employee identities when issuing or replacing security keys. Designed to integrate with existing platforms like Microsoft Entra and Okta alongside identity verification partners such as Clear and Nametag, the subscription service aims to close security gaps at the IT help desk level while the company separately announced a public beta for a post-quantum-ready YubiKey supporting NIST-standardized cryptographic algorithms.
hashID Launches App That Checks Age From an ID Chip and Answers Only Yes or No
Spanish developer Desteba Productions has launched the hashID mobile application for privacy-preserving age verification, utilizing NFC technology to read the cryptographic chip inside e-passports and national ID cards without relying on facial estimation or centralized databases. Available now on the App Store ahead of the EU’s December 2024 digital wallet deadline, the free software processes the issuing state’s embedded data to deliver a strict binary “yes or no” response to requesting platforms, ensuring that no names, birth dates, or photographs are transmitted or stored, while simultaneously supporting OpenID Foundation-certified digital credential issuance and end-to-end encrypted messaging.
Ghana Starts Enforcing Biometric Ghana Card Checks Plans Yes or No App for Small Businesses
Ghana’s National Identification Authority has deployed enforcement task forces to ensure all registered institutions strictly utilize biometric verification for the Ghana Card, officially outlawing the retention of photocopies or visual inspections following the expiration of a regulatory grace period. Under the National Identity Register (Amendment) Regulations, 2026, non-compliant organizations face prosecution, fines up to GH¢24,000, and permanent disconnection from the verification platform, while the NIA is simultaneously developing a simplified “yes or no” mobile verification application to help small businesses and individuals securely comply with the mandate without requiring full technical integration.
Kuwait Orders Two Factor Authentication on Low Wage Salary Accounts to Curb Fake Payments
The Central Bank of Kuwait has issued a sweeping mandate requiring mandatory two-factor authentication for low-wage salary accounts to combat wage manipulation and fictitious employer payments. Taking effect December 31, the regulation forces local banks to use two distinct verification elements personally linked to the employee—distinct from standard app logins—for any transaction over 25 Kuwaiti dinars involving private-sector workers earning 300 dinars or less per month, alongside strict monitoring requirements for suspicious withdrawal patterns designed to ensure vulnerable laborers retain control over their compensation.
Cyberlinks and Hancom Group RAUMSOFT Form Japan Joint Venture for AI Face Verification
Japanese IT firm Cyberlinks and South Korean software distributor RAUMSOFT have established a joint venture named Raum Japan to deploy AI face verification services across Japan’s financial and municipal sectors. The partnership will distribute the HancomAUTH facial recognition platform—featuring advanced liveness detection and deepfake countermeasures—and integrate it with Japan’s public personal authentication service (JPKI) and the My Number Card infrastructure, positioning the venture to capture market share ahead of a planned April 2027 revision to the nation’s Act on Prevention of Transfer of Criminal Proceeds regarding remote customer identification.
–
By the ID Tech Editorial Team