Ghana's New Identity Law (L.I. 2523): What Every Business That Verifies Identity Must Do Before November 2026

On June 9, 2026, a regulation came into force that affects every organisation in Ghana that verifies the identity of a person during a transaction.

The National Identity Register (Amendment) Regulations, 2026 (L.I. 2523) — signed by the Minister responsible for the National Identification System, Hon. Muntaka Mohammed Mubarak — does three things every business owner must understand now:

1. Biometric verification is now mandatory — visual inspection of the Ghana Card is no longer legally sufficient proof of identity

2. Photocopying the Ghana Card is now prohibited — organisations can no longer request, retain, scan, or reproduce copies of the Ghana Card for identification purposes

3. Every organisation that verifies identity must integrate with the NIA's Identity Verification System Platform (IVSP) — not just banks. Every organisation.

If your business onboards customers, verifies employees, processes applications, or conducts any transaction that requires confirming someone's identity, you are now operating in a regulated environment — whether you are a financial institution, a hospital, a school, a logistics company, or a real estate firm.

What L.I. 2523 Actually Says: The Three Core Changes

1. Biometric Verification Replaces Visual Inspection

Under the previous framework (L.I. 2111, 2012), organisations were required to present the Ghana Card for identification. Biometric verification was only required 'when in doubt.' L.I. 2523 eliminates that optionality entirely. Biometric verification — fingerprint or facial recognition matched against the NIA's national database — is now the mandatory and only legally accepted method.

As NIA Executive Director Yayra Koku Deku explained:

The amendment was introduced after stakeholders identified weaknesses in the earlier framework. One of the deficiencies in our L.I. 2111 was that biometric verification would only be used when in doubt. That is no longer the standard.

2. Photocopying and Retaining Ghana Cards Is Now Illegal

This is the change most businesses have not yet absorbed. Your HR department can no longer photocopy a Ghana Card during employee onboarding. Your customer service team can no longer scan a Ghana Card and store the image. Your security desk can no longer retain a copy of a card as a visitor log. All of these practices are now prohibited under L.I. 2523.

3. Integration with the NIA Identity Verification System Platform (IVSP) Is Required

The NIA has built and operates the Identity Verification System Platform (IVSP) — the digital infrastructure through which organisations can conduct legally compliant biometric verification. Every organisation that verifies identity in the course of its operations must onboard to this platform.

Who Does This Law Apply To? The Honest Answer Is: Most Businesses

The Interior Minister was explicit: the law applies to banks, telecommunications companies, insurance firms, hospitals, schools, government agencies, and all organisations that verify identities during the course of their operations. Here is what that means across sectors:

• Financial Services — Banks, microfinance, fintechs, payment service providers: biometric verification now required at every identity-gated transaction

• Healthcare — Hospitals, clinics, pharmacies, health insurers: patient identity at registration must be verified biometrically

• Telecommunications — MTN, Vodafone, AirtelTigo: SIM registration and mobile money account opening require biometric verification

• Education — Schools and universities verifying student or applicant identity during admissions or examinations

• Real Estate — Agencies and developers verifying buyer or tenant identity: photocopying a Ghana Card as part of a tenancy agreement is now prohibited

• Human Resources — Every business verifying employee identity during onboarding: the standard HR practice of photocopying a Ghana Card is no longer compliant

• Legal and Professional Services — Law firms and notaries performing KYC verification for anti-money laundering obligations

• Logistics, Security and Facilities — Businesses verifying visitor or contractor identity at access points

The Transition Timeline: What You Need to Know Right Now

The law came into force on June 9, 2026. A structured transition period has been announced:

• Transition period: July 27, 2026 to November 2, 2026

• Purpose: To allow organisations time to procure equipment, integrate systems, and train staff

• Critical clarification from the Interior Minister: The transition period does not suspend any legal obligations under the regulations. The law is already in force.

This means organisations should have begun or completed their IVSP onboarding already. The November 2 deadline is the outer boundary — not the starting point. The NIA has directed all businesses and institutions to begin onboarding without delay.

What This Means for Your Business Systems

Your HR System

If your HR or payroll system stores Ghana Card scans as part of employee records, that practice is now non-compliant. Your system needs to record that biometric verification was completed through the IVSP — not store a copy of the card.

Your Customer Onboarding System

If your business onboards customers and requires identity verification, your onboarding workflow must now include a biometric verification step through the IVSP. This means API integration with the NIA's platform.

Your CRM and Customer Records

Customer records that currently include scanned Ghana Card images must be reviewed. Retaining those images is now prohibited. Your CRM or customer database must transition from storing card copies to storing verified identity status confirmed through the IVSP.

Your ERP System

ERP systems that can integrate with external APIs — such as ERPNext — are well-positioned to connect directly with the NIA's IVSP to record verification status as part of vendor, customer, and employee records without storing prohibited card copies. Supplier and vendor onboarding processes that require identity verification need updated workflows.

Your Access Control Systems

Physical access control systems that use Ghana Card visual inspection or photocopying for visitor management need to be upgraded to biometric verification, including reception desks, security gates, and visitor management systems at corporate offices and warehouses.

What Happens If You Don't Comply?

The NIA Executive Director was direct about the consequences of non-compliance. Institutions that fail to comply risk:

• Financial penalties

• Suspension of access to the NIA Identity Verification System Platform — meaning the institution can no longer conduct legally compliant identity verification

• Possible termination of access to IVSP — a permanent exclusion from Ghana's national identity infrastructure

Citizens also have a role to play. The Interior Minister actively encouraged Ghanaians to refuse requests to photocopy or merely visually inspect their Ghana Cards where biometric verification is required. Your staff may soon face pushback from informed customers — creating both regulatory and reputational risk.

L.I. 2523 in the Context of Ghana's Broader Digital Regulatory Framework

L.I. 2523 is the third major regulation in 2026 that collectively defines a new digital compliance environment for Ghanaian businesses:

• January 2026: Bank of Ghana mandatory Ghana Card directive for all banking transactions (BG/GOV/SEC/2025/36)

• March 2026: Bank of Ghana Cyber and Information Security Directive (CISD 2026) — mandatory cybersecurity framework including data localisation requirements

• June 2026: L.I. 2523 — mandatory biometric identity verification for all organisations that verify identity

• April 2026: Ghana National AI Strategy (2025–2035) — national framework for responsible AI deployment in financial services and beyond

Together, these regulations signal a clear direction of travel: Ghana is building a digital economy infrastructure that prioritises data sovereignty, verified identity, and cybersecurity resilience.

What Your Business Should Do Right Now: A Practical Action Plan

Step 1: Audit Your Identity Verification Practices

List every point in your business where you currently verify someone's identity — employee onboarding, customer registration, vendor KYC, visitor access. For each: is a Ghana Card being photocopied or scanned? These practices are now non-compliant and must be replaced.

Step 2: Begin NIA IVSP Onboarding Immediately

Visit the NIA's official channels and begin the onboarding process for the Identity Verification System Platform. The NIA has committed to providing technical support. Do not wait until October — the November 2 transition deadline is the outer boundary, not the starting line.

Step 3: Update Your Systems and Workflows

Work with your ERP, HR, CRM, and customer management system providers to update verification workflows. Replace document-copy-based verification with IVSP-integrated biometric verification. Record verification status — not card images — in your systems.

Step 4: Train Your Staff

Every employee who currently handles identity verification needs to understand what the law now requires and what it prohibits. Staff asking customers to photocopy their Ghana Cards are creating regulatory and reputational risk for your organisation.

Step 5: Review Your Data Storage Practices

If your systems currently store Ghana Card images — in HR files, CRM records, or customer databases — those images should be reviewed and handled appropriately. Continuing to store prohibited data after the regulation came into force is itself a compliance issue.

Identity Verification Is Now a System Problem, Not Just a Process Problem

L.I. 2523 does not just change a procedure. It changes the infrastructure requirement for doing business in Ghana. Visual inspection and photocopying were analogue processes. Biometric verification through the IVSP is a digital process — and a digital process requires digital systems capable of integrating with it.

Businesses that treat this as a simple policy update will find themselves with a compliance gap the first time they need to demonstrate that their verification processes meet the legal standard.

Businesses that treat this as a systems and infrastructure question — updating their ERP, HR, CRM, and customer management platforms to integrate verification workflows with the IVSP — will emerge from the transition period with a compliant, auditable, and efficient identity verification capability.

The deadline is November 2, 2026. The law is already in force. The question is not whether your business needs to act. The question is whether your systems are ready to support the action required.