The Examiner has more opinions than it has staff. We maintain unanimity in our facts, not the inferences we draw from them. This examination is no exception.
Sri Lanka’s digital identity, slated for launch next year, will be the biggest change in government service delivery since the introduction of paper. Opening bank accounts, accessing medical records, and obtaining birth certificates will all be possible with a few clicks on the phone.
Queuing up in government offices and running from desk-to-desk to access basic services will be a thing of the past.
This is all possible thanks to biometric identification — where the government can identify citizens via facial and fingerprint recognition. The project is scheduled to launch in April 2026.
But convenience is rarely free. The digital ID project has been shrouded in secrecy and controversy from the beginning. It isn’t clear what price we will be paying for the benefit of easy access.
The government is rolling out digital identity with India’s support for about half of the project cost, via a grant of approximately 10 billion rupees. But the terms of this agreement aren’t clear. The memorandum of understanding signed between the governments was never made public.
India’s involvement and the secretive agreement have led to criticism and concerns. Earlier this year, two petitions were brought before the Supreme Court seeking to abrogate the agreement. They were both dismissed last week.
In response to the controversy, the government has tried to assuage fears by stating that there will be no foreign access to the data. “Getting everyone on board,” has been the mantra of key figures like Hans Wijayasuriya, the government’s digital economy advisor.
But detailed information has been less forthcoming. Several entities, including The Examiner, tried and failed to secure copies of the MOU via the RTI law. We are currently appealing.
Even so, here’s what we do know about the project and how it’s going to be implemented.
The players
The system will be built by a master systems integrator, an Indian company. The tender was called by the National Institute for Smart Government, a non-profit set up by the Indian government via public-private partnership. The Institute is acting "on behalf of the Sri Lankan government."
It isn't abundantly clear who will ultimately pick the MSI. The Institute is the tender inviting authority, but when The Examiner spoke to a Sri Lankan government official acquainted with the procurement, he said the "Indian government" is selecting the MSI. It's unclear whether "Indian government" refers to the National Institute.
The integrator will “design, develop, supply, deliver, install, upgrade, modify and implement existing/required software, hardware and infrastructure,” according to the request for proposals.
Over 20 companies bid at the pre-qualification stage, but the winner isn’t yet known, said an inside source well-acquainted with the procurement process. Pre-selected bidders sought “clarifications about the logistics of operating in Sri Lanka,” and as a result the selection has been delayed. A winner was originally due by the first week of November. The government is yet to receive a revised timeline from India.
Meanwhile, the government is also looking for managed service providers to take over all “operational ownership” from the Indian systems integrator after the system is installed. A request for information was published earlier this year. The bid document is likely to be released in November.
The service providers must be local companies, and are expected to handle the entire digital ID operation, from end-to-end, for the next four years.
Whoever wins the service provider tender will hold great power and great responsibility; they will be in charge of all processes from auditing and legal compliance to access controls, security operations, and hardware management.
As far as government-issued digital IDs go, this level of service provider control is unusual. In many countries, the operational ownership of digital IDs is maintained by the state, with only some elements, like enrollment centres, cloud hosting, and software maintenance delivered by private sector players. While the request for information suggests private companies are welcome to bid, media reports state that the service will most likely be a “government-owned entity.” Nevertheless, at least one private company, NCINGA, has positioned itself as a potential bidder by obtaining essential MOSIP certification.
The Department of Registration of Persons will be the "data custodian."
The build
Regardless of who ends up being the master systems integrator and master service provider, it's certain that they will build the digital ID on the MOSIP tech stack, an open source architecture — essentially, thousands of lines of publicly available code. MOSIP-based digital IDs have been rolled out in India, Sudan, Philippines, and Morocco. They have ongoing engagements with over 27 countries.
