The risk profile of KYC data
Fintechs collect a staggering amount of sensitive data during onboarding: Bank Verification Numbers (BVNs), National Identity Numbers (NINs), government-issued IDs, and biometric facial scans. This data is highly liquid on the dark web because it enables comprehensive identity theft and account takeover across the entire financial ecosystem.
NDPA Compliance
The Nigeria Data Protection Act (NDPA) classifies much of this KYC data - especially biometrics - as Sensitive Personal Data, requiring stringent protection and explicit consent.
Insider Threat
A significant risk vector for BVN exposure is internal. Customer support or operations staff with over-permissioned access to administrative dashboards can exfiltrate identity data.
API Exposure
Poorly secured internal APIs or BOLA vulnerabilities can allow an attacker to enumerate and download KYC records for thousands of users.
Securing the identity pipeline
Encryption at rest and in transit
It is unacceptable to store BVNs, NINs, or cleartext ID document URLs in a database. Implement strong encryption at rest (e.g., AES-256) for the database columns storing these identifiers. Ensure that all transit, both externally to third-party providers and internally between microservices, is protected via TLS 1.2+.
Strict access logging and audit trails
Log each staff view of customer KYC data. Record the staff account, time, source device or network, customer record, purpose, and action. Protect the log from changes and review unusual access during a CBN IT audit or incident.
Data masking and least privilege
Customer support agents usually only need the last four digits of a BVN or NIN to verify a user. Implement data masking on internal dashboards so the full number is never displayed unless absolutely necessary, and only to authorized compliance personnel.
Are your KYC API endpoints exposing sensitive customer data?
Book an API Security TestSecuring third-party KYC integrations
Most Nigerian fintechs do not perform KYC entirely in-house; they rely on specialized providers like VerifyMe, Smile ID, or Youverify, which in turn connect to the NIBSS BVN Validation Service or NIMC.
- API Key Security: Store the API keys for your KYC providers in a secrets manager, not in your source code. If these keys are compromised, attackers can rack up massive API bills and potentially access your customers' verification history.
- Data Minimization: Only send the exact data required for verification. Do not pass unnecessary PII to the third-party provider.
- Vendor Due Diligence: Conduct regular vendor risk assessments on your KYC partners. Ensure they hold relevant certifications (ISO 27001, NDPC compliance) and review their incident response SLAs.
How pentests target KYC
During an assessment, our engineers specifically target the KYC upload and retrieval endpoints. We test for Broken Object Level Authorization (BOLA) to see if User A can view User B's uploaded ID document, and we attempt to upload malicious files (like malware disguised as an image) to test the robustness of the document processing pipeline.
Related reading
Blog: Why Nigerian Fintechs Are Targeted · NDPR Privacy Checklist
Guides: NDPR/NDPA Compliance Guide
Services: Authentication Security
Frequently asked questions
Can we store full BVN and NIN numbers in our database?
While you often need to store them for compliance and operational purposes, the NDPA and CBN require that this sensitive data be protected. Storing them in plain text is a significant vulnerability; they must be encrypted at rest, and access should be strictly controlled and logged.
How does the NDPA classify biometric data?
Under the NDPA 2023, biometric data (like facial recognition scans used in KYC) is classified as 'Sensitive Personal Data'. Processing it requires explicit consent and heightened security measures compared to standard PII.
Are we liable if our third-party KYC provider is breached?
Yes. As the Data Controller collecting the information from the customer, you hold primary responsibility under the NDPA. You must ensure your KYC vendors (Data Processors) maintain adequate security controls through contractual agreements and vendor risk assessments.