Business models

Generating own revenue by charging user fees

ID providers primarily generate revenue through two mechanisms:

1. Charging public and/or private third parties (i.e., “relying parties”) for identity verification and authentication services

2. Charging individuals for certain luxury services, such as expedited processing or optional, advanced credentials

Such fees can offer some level of autonomy and help isolate ID authorities from short-term fiscal pressures (see Gelb & Diofasi Metz 2018). However, while fees may help ensure fiscal independence, and financial sustainability setting them too high may suppress demand and increase exclusion.

Because identity services are a public good—particularly with respect to foundational ID systems—most services should be free or with highly minimized fees, including:

• Basic credential services for the population: Charging fees to people for basic identity credentials creates a barrier to adoption. As stated in Principle 2, first copies of birth and death certificates should be free of charge, as should the initial issue of any credential that is mandatory—in law or in practice—to possess for accessing basic rights and services. If fees are charged for certain additional services (such as reissuance of lost credentials), rates should be reasonable, proportional to costs incurred, and transparent to the public. If any fees are to be charged, consideration should be given to subsidizing or waiving them for poor and vulnerable persons.

• Services for essential or mandatory functions: For essential government functions that rely on identity verification and authentication services, and/or for public and private sector use-cases where these are mandatory (e.g., for compliance with mandatory SIM registration regulations), the ID authority may hold a monopoly on identity verification and authentication services. In such cases, it is highly recommended that fees be free or minimized. In general, fees should be affordable both for large organizations and for smaller ones, particularly those that serve poor, rural, and other marginalized groups.

The primary users of authentication and verification services are other government agencies—e.g., service providers such as social protection programs, electoral commissions, justice departments, passport agencies, etc.—as well as banks, other financial service providers, mobile network operators, and other entities that need to fulfill KYC requirements. In some cases, these relying parties have dedicated secure connections to the central server and make queries in real time on an ongoing basis; in others, verification is done via web-based portals or APIs. Furthermore, some identity providers conduct large batches of verifications for specific purposes within a set time frame (e.g., periodic deduplication of a voter list before elections). Fees typically vary based on whether the relying party is a public or private entity, the type of data or query, and/or the volume of transactions.

Table 26. Example of fees for verification and authentication services

Source: Identity Authentication and Verification Fees: Overview of Current Practices. Note: Fees were converted from local currencies to USD using the applicable currency exchange rate on December 29, 2019 and are be subject to change.

Table 26 provides examples of different countries’ fee-charging policies and rates for verification and authentication services. These cases demonstrate that fees need not be uniform over time or across users or types of transactions—which can help reduce the burden for some users. Some options for price discrimination include:

• Pricing based on the user. To harness the utility of identity services across the public sector, most countries have opted for lower pricing for government agencies than private-sector users, with many providing free services for the public sector.

• Bulk pricing models. Identity providers, such as Peru, Panama, and Colombia, also offer bulk pricing discounts for frequent users of identity services. Argentina and Malaysia set different fees depending on the type of data requested, while Peru and Ecuador also vary fees based on whether authentication and verification services are performed online or via a hardwired database connection.

• Phasing in fees. To ensure rapid up-take by relying parties, one option is to initially wave fees or set prices extremely low, and later increase them if demand is sufficient. In India, for example, UIDAI initially kept all authentication services free to lower the barrier to entry for relying parties and has only begun charging relying parties in 2019.

Other important safeguards against overcharging include consultation with a diverse array of potential users as well as independent oversight and regulation. Given that ID providers often have a monopoly on verification and authentication services, a strong regulatory and oversight framework is necessary to help ensure that rates remain affordable and transparent, and that the ability to generate profits does not create perverse incentives for identity agencies. In Peru, for example, RENIEC’s prices are set equal to the cost of the service, as determined by an independent regulatory body. This periodic review has allowed the agency to adjust its fee structure over time, helping to keep prices low and credible. Fees for services to poor individuals are also free of charge and are subsidized by the central government.

Figure 18. Key considerations for charging fees for ID services

Inclusion	Data Protection	Sustainability	Responsiveness
Basic ID services for individuals (e.g., first credentials) should be free of charge, and other fees minimized; fees for authentication and verification should also be minimized to avoid these being pass on to users	Relying party services that involve data processing must be governed by a comprehensive legal framework to protect personal data and provide the ability of people to see who has accessed their data	Fees can help generate revenue for ID service providers as long as the prices are set at a low enough level to attract users	The process of setting and revising fees should be transparent and involve public and stakeholder consultations

Public-private partnerships

While the public sector will nearly always play a large role in providing government-recognized ID, the scope and mode of private sector participation will depend on the context, needs, and financing constraints. Beyond its role as a user of ID credentials and services—e.g., to fulfill KYC requirements—and a supplier of inputs for ID systems, the private sector can also be a valuable partner for the government in implementing the ID system itself. For example, where the private sector has technical expertise and operational efficiency that government entities lack, governments may outsource certain roles within the ID lifecycle to the private sector in order to reduce ongoing costs—e.g., to provide cloud storage services or a managed call center to handle grievance redress.

However, not all PPPs have been successful, and such arrangements require sufficient oversight capacity, detailed planning, and safeguards to ensure that data collection and identity creation meets the standards set out by the ID authority, that personal data is secure and not misused, and that the system meets the overall goals and requirements set forth by stakeholders. This might include, for example:

• A mandatory authorization process for any companies and their agents involved in the ID system

• The requirement that private-sector provider be located within the country

• Government-retained ownership and control over any data collected and stored by the private sector provider on behalf of the ID system

While there are potential benefits from PPPs to implement an ID system, there are considerable risks regarding their sustainability, unnecessary creation of fees that could lead to exclusion, and potential vendor or technology lock-in. These risks can be mitigated through careful design of the PPPs and transparent, competitive, and accountable procurement processes. Build-operate-transfer models, for example, may create a dependency on a particular vendor if knowledge and resources are not effectively transferred to the government. Likewise, consideration must be given to how the revenue stream for a private partner (e.g. fees for credentials or authentication) could lead to exclusion as discussed above, and the incentive of profits for such concessions could undermine the objectives of an ID system (i.e. to act as a public good to expand access to services).

As discussed more fully in Digital Identity: Public and Private Sector Cooperation, private-sector partnerships could take a number of forms, including but not limited to:

• Service agreements. In the service agreement model, the government contracts with a private firm or firms to undertake a specific role in one or more stage of the digital identity lifecycle. In such cases, firms could receive revenue directly from users or from the government on a performance basis. Whether or not these agreements meet the common definition of a public-private partnership (PPP)—i.e., a “long-term contract between a private party and a government entity, for providing a public asset or service, in which the private party bears significant risk and management responsibility, and remuneration is linked to performance”—depends on the extent to which they are long-term partnerships that require significant investment on the part of the private actor.

• Build-operate-transfer (BOT) and concessions. BOT and concession partnerships are ones in which the private sector is solely or primarily in charge of building and operating a project, usually for a fixed concession period. These are considered PPPs according to standard definitions, as the contracts bundle together many services and entail significant risk and financing on the part of the private party. In these cases, contracts are often awarded to a single contractor or consortium, project costs and outputs are predetermined, and payment is performance-based and can include a fixed set up cost. Revenue generated by the ID system is allocated between the private and public sectors according to the contract. In BOTs, for example, revenue may go to the government, who then pays the private partner. In concessions, the private partner collects revenue directly and then pays a portion of this to the government.

For PPP schemes to attract private sector participation, good policy and credible incentives are needed to offer an enabling environment with a level playing field, a competitive marketplace, a deterministic model for the return of investment, and a system of mutual guarantees. Because each country context is unique, and a thorough analysis of this context is necessary before adopting a specific partnership model, including careful consideration of the following factors:

• Government oversight capacity. All foundational ID systems require significant public sector capacity. Even where governments are not building and managing ID systems in-house, they must clearly define the roles and responsibilities of different actors and provide the legal and regulatory framework to establish trust and protect privacy and personal data. For partnerships, special legislation may be required—and strong governance practices are necessary—to oversee project implementation and enforce regulations. In contrast, traditional public procurement projects involve well-known and often simpler contracts. However, projects where government officials are involved in operating ID systems—such as in public procurement—may also require significant technical knowledge transfer.

• Private sector capacity and activities. The extent to which digital ID and authentication services are already commercially available and interoperable will dictate potential public and private sector use cases and cooperation. The private sector must also have the capacity to provide trustworthy digital identity, offering the same standards of privacy and security protection as those provided by the state, for similar services and in compliance with national privacy regulations (along with international conventions, where applicable, national sovereignty and governance principles). For example, there is a difference between those companies that are bound by national legislation and privacy frameworks and companies that operate globally but are not obligated to adhere to local privacy laws.

• Legal and ethical issues. There may be risks associated with transferring management of a national-level ID system to a private company under certain partnership arrangements. For example, private ownership of public data may not be legal, advisable or socially acceptable, particularly if stored outside the country. For liability reasons, for example, it is generally important for governments to lead the delivery of civil registration, even though these can be facilitated by private sector entities.

• Sustainability and pricing. Practitioners should consider the overall estimated costs of the project, estimated volume and demand of digital public services, and the revenue-generating potential for participants. In addition, pay-per enrollment pricing schemes should be structured to incentivize universal coverage for the target population in order to avoid a scenario where certain groups are excluded because registration agents only have an incentive to cover easy-to-reach populations.

• Vendor and technology lock-in. In any arrangement, practitioners should structure contracts to help leverage private sector expertise and innovation while enabling interoperability and the long-term flexibility of the system to change technologies and vendors.

Figure 19. Key considerations for private-sector partnerships in ID systems

Inclusion	Reliability	Data Protection	Sustainability
Where registration is outsourced, fee structures should incentivize universal coverage, including of remote and hard-to-reach populations.	Clear standards and oversight mechanisms must be in place to ensure quality in implementation.	Private companies involved in the ID system must be trusted and subject to national laws regarding privacy and data protection.	RFPs should be structured in a way that ensures competition and avoids vendor and technology lock-in.