OIM - IOM Digital Identity Toolkit (2025)

IOM DIGITAL IDENTITY TOOLKITThe opinions expressed in this publication are those of the authors and do not necessarily reflect the views of the International Organization for Migration (IOM). The designations employed and the presentation of material throughout the publication do not imply expression of any opinion whatsoever on the part of IOM concerning the legal status of any country, territory, city or area, or of its authorities, or concerning its frontiers or boundaries. IOM is committed to the principle that humane and orderly migration benefits migrants and society. As an intergovernmental organization, IOM acts with its partners in the international community to: assist in meeting the operational challenges of migration; advance understanding of migration issues; encourage social and economic development through migration; and uphold the human dignity and well-being of migrants. This publication adheres to the IOM Legal Identity Strategy which lays the foundation for supporting individuals, States, and governments to meet Sustainable Development Goals (SDG) Target 16.9 and Objective 4 of the Global Migration Compact for Migration. This publication was made through the support IOM’s Cooperation on Migration and Partnerships for Sustainable Solutions (COMPASS) initiative, designed to protect people on the move, combat human trafficking and smuggling and support dignified return and sustainable reintegration. The programme focuses on systemic changes that are critical to addressing the underlying causes of migrants’ vulnerability, gender equality and exclusion, including in humanitarian and fragile settings; supporting rights-based policies and legislation; equitable access to essential protection services; strengthening local partnerships for migrant inclusion and social cohesion; access to legal identity; reinforcing data-driven responses; and influencing social behaviours and norms. The programme is being implemented in partnership with 14 partner States.

Publisher: International Organization for Migration 17 Route des Morillons P.O. Box 17 1211 Geneva 19

Switzerland T el.: +41 22 717 9111

Fax: +41 22 798 6150

Email: hq@iom.int Website: www.iom.int This publication was issued without formal editing by IOM.

Required citation: International Organization for Migration (IOM) (2025). IOM Digital Identity Toolkit. Immigration and Border

Fax: +41 22 798 6150

Email: hq@iom.int Website: www.iom.int This publication was issued without formal editing by IOM.

Required citation: International Organization for Migration (IOM) (2025). IOM Digital Identity Toolkit. Immigration and Border

Governance Unit. IOM.

Coordination: Nelson Goncalves, Aijan Boronbaeva, Julia de Bresser, Isabella Dourado

Design: We2Co

ISBN 978-92-9268-996-4 (PDF)

© IOM 2025 Some rights reserved. This work is made available under the Creative Commons Attribution-NonCommercial-NoDerivs 3.0 IGO License (CC BY-NC-ND 3.0 IGO). For further specifications please see the Copyright and T erms of Use. This publication should not be used, published or redistributed for purposes primarily intended for or directed towards commercial advantage or monetary compensation, with the exception of educational purposes, e.g. to be included in textbooks.

Permissions: Requests for commercial use or further rights and licensing should be submitted to publications@iom.int. https://creativecommons.org/licenses/by-nc-nd/3.0/igo/legalcode

PUB2025/030/RIOM

DIGITAL IDENTITY

TOOLKIT

Florian Hoefleiii CONTENTS List of Tables vi List of Figures vi Abbreviations viii Introduction xi Part 1 1 1.1 Identity Management and Digital ID Context 2 1.1.1 Population register 3 1.1.2 Biometric information 5 1.1.3 Identity attributes 6 1.1.4 Population register and legal residents 7 1.1.5 Takeaway and summary 9 1.2 Identity Credentials 10 1.2.1 Identity credential types and formats 11 1.2.2 Digital credentials 17 1.2.3 Travel identity documents / travel credentials 18 1.2.4 Challenge for digital identity credentials and documents 19 1.2.5 Takeaway and summary 20

individuals. For many migrants, the absence of a recognized identity document can mean limited access to health care, education, employment and legal protections, exacerbating risks of exclusion and exploitation. DIS can contribute to addressing these challenges, though barriers remain. Issues such as limited access to technology, gender disparities and discrimination can restrict access to digital identity solutions, particularly among undocumented migrants and individuals in remote areas. Recognizing these realities, this Digital ID Toolkit encourages approaches that acknowledge and aim to mitigate these barriers, ensuring digital identity systems are accessible and inclusive. For migrants, the registration process – including the secure capture of biographical and biometric data – lays a foundation for inclusion, much like population registration, while accounting for the unique vulnerabilities and needs of mobile populations. This toolkit supports practical strategies for issuing identity documents with digital credentials in physical and/or digital formats, emphasizing that such processes should prioritize a human rights-based approach, addressing inequalities and safeguarding dignity. The IOM Digital ID Toolkit The IOM Digital Identity toolkit guides States in the introduction and implementation of a digital identity through accessible, adaptable strategies. It provides a brief theoretical background on digital identity systems, a credential and general framework, guidance for implementation and practical use case examples. Limitations Although the toolkit provides adaptable strategies and an overview of the digital identity management framework, the solutions may not fully address the unique legal, social and other requirements, including financial investments into digital technologies, of each Member State. Local contexts may require further customization, which could lead to complexity and added costs. In addition, the toolkit aims to support large-scale implementation, but scalability could be a challenge in countries with limited infrastructure or large populations lacking digital access. Therefore, the physical components, including issuing cards or tokens, may face logistical and distribution obstacles. The toolkit and its solutions provide an overview of digital identity management and demonstrate how digital identity functions, specifically in the context of border and identity management, with a focus on pure demonstration purposes. If there is interest in scaling

interpreted and validated in another. The foundation of this system is unique, as it is built on European Union legislation that applies uniformly across all its Member States. Establishing a comparable scheme in other regions is more likely to occur through bilateral agreements. The regulation traces its origins to the first European Union Signature Directive from 1999,13 reflecting a development period of 25 years leading to the current eIDAS regulation. A less complex alternative is an in-country implementation, which does not operate across borders and offers only limited cross-border functionality through bilateral agreements, such as the IOM use case described in Part 3 of this toolkit. ICAO PKD Another example is the ICAO PKD, a trust framework and trusted certificate exchange platform that operates across borders. The ICAO PKD enables countries to obtain digital certificates for verifying electronic passports, their digital credentials and ICAO VDS documents. IOM Digital Identity Toolkit 57ISO 22385 VDSIC trust framework To ensure security and interoperability, ISO standards define a method to centralize useful resources, such as the Manifest. These resources are organized in a Trust List, a signed XML file that inventories Trust Service Lists (TSLs). Each TSL lists authorized operators (TSOs) and authorized CAs and references the URL where the Manifest and public certificates can be retrieved during the verification process. Each element supporting the Otentik VDS (such as Trust List, TSL) is protected and signed by the TSO. To ensure service reliability, verifying the various elements of the Otentik VDS and maintaining the chain of trust is essential. To manage trust across a network of heterogeneous use cases and actors while preserving the sovereignty of trusted entities (such as States, the Otentik network), the concept of subnetworks of trust is necessary. The root of trust is established by the Otentik Trust Network, which provides a Trust List. This Trust List defines each subnetwork and identifies a management entity responsible for maintaining trust within its scope.

be issued using a technically similar standard but managed within a separate trust framework. While both frameworks can be based on legislation governing digital documents and infrastructure, they should remain separately managed in terms of policy and trust. Keeping the trust framework for government entities separate – particularly for the issuance of Digital IDs – ensures a higher level of maintainability and establishes a clear trust anchor for citizens. Nevertheless, a trust framework for private entities can significantly enhance and enable broader digitalization across all areas of life. This toolkit focuses on the management of a trust framework used exclusively by government entities for the issuance of Digital IDs and documents. These documents can still be validated by government entities, private businesses and citizens. IOM Digital Identity Toolkit 581.6.5.3 STANDARDS FOR VISIBLE DIGITAL SEALS 14 ISO. ISO/IEC 18004:2024. Information technology — Automatic identification and data capture techniques — QR code bar code symbology specification (ISO, 2024). 15 ISO. ISO/IEC 16022:2024(en). Information technology — Automatic identification and data capture techniques — Data Matrix bar code symbology specification (ISO, 2024). To ensure the readability of VDS, the presentation of 2D barcodes follows common ISO standards such as ISO 1800414 for QR codes and ISO 1602215 for Data Matrix codes. These barcodes can store a considerable amounts of data – up to approximately 3,000 characters for QR codes, depending on the parameters used. Mobile phones and other barcode readers with cameras can process and read QR and Data Matrix 2D barcodes, which are then automatically converted to digital seal data. Figure 25. Visible Digital Seal 2D barcode standards The way data for digital seals or Digital IDs are encoded into a 2D barcode follows various standards. In some cases, the data representation in 2D barcodes is proprietary and linked to specific vendors. To maintain system independence from vendors and avoid reliance on proprietary technologies, international standards have been developed.

The way data for digital seals or Digital IDs are encoded into a 2D barcode follows various standards. In some cases, the data representation in 2D barcodes is proprietary and linked to specific vendors. To maintain system independence from vendors and avoid reliance on proprietary technologies, international standards have been developed. ICAO9303 Visible Digital Seal standard For travel documents such as passports, ICAO has specified a format and related use cases in the ICAO 9303 Part-13 standard, which includes visas, electronic travel approvals and temporary passports. ICAO’s approach is focused on travel-related use cases and does not specify general methodologies. The ICAO 9303 VDS standard utilizes the ICAO-PKD trust framework for signing the data used in VDS. The ICAO VDS is designed for compact barcodes in Data Matrix format. The data are fully binary, which can make interpretation challenging for some applications. While binary barcode data representation is part of the ISO standard for QR and Data Matrix barcodes, it is not widely implemented in many devices. The largest application of ICAO VDS is the Schengen Visa, with other use cases including Electronic Travel Authorizations (ETA). ▪Segment code up to 6x6

▪ISO/IEC 16022

▪1,5 Kbyte

▪ISO/IEC 18004

▪High Density ▪3 Kbyte Data Matrix QR Code JAB Code ▪ISO/IEC 23634 ▪Color 2D Barcode ▪Flexible block geometry ▪~10/12 Kbyte (or more) IOM Digital Identity Toolkit 59ISO-22376 VDS standard (Otentik VDS) Another international standard is ISO 22376, which specifies all aspects of a VDS standard in a comprehensive and systematic way. The standard supports multilingual characters and flexible data structures. The standard describes various use cases and a model for exchanging digitally signed VDS description manifests, along with a trust framework

and process the Manifest in a standard, deterministic way, adhering to the rules defined for each use case. Electronic signature Many steps allow to minimize the amount of space used by the data carrier and to maximize the amount of space available for data. As such, the Otentik VDS does not contain the certificate used for the signature nor the definition of the use case but contains identifiers allowing for their retrieval. IOM Digital Identity Toolkit 601.7 CHALLENGES FOR DIGITAL IDENTITY SOLUTIONS While Digital ID offers numerous advantages, such as reducing service costs and enhancing services for citizens and residents, its implementation presents several challenges that must be effectively addressed. These challenges span the entire implementation process, from meeting initial prerequisites to ensuring continuous improvement and maintenance of systems. The key challenges, as outlined in the toolkit, include:

1. Governance of Digital ID;

2. Legal framework and legislation;

3. Digital maturity and readiness of identity management and registration;

4. General digital infrastructure;

5. Scalability of technical Digital ID systems;

6. Use case planning and key applications;

7. Marketing and user participation

(onboarding rate);

8. Business model and financing.

1.7.1 GOVERNANCE OF THE DIGITAL ID Digital ID is a relatively new concept in the country and plays a crucial role in its broader digitalization efforts. It serves as a cross-cutting initiative that interacts with various government digital services and platforms, particularly those responsible for civil registration and the issuance of traditional identity documents such as e-passports and ID cards used for travel. Unlike traditional identity documents, the legal and regulatory framework for Digital ID systems is often underdeveloped or not explicitly defined, as these technologies evolve alongside their implementation. The success of a Digital ID system largely depends on the governance model and the distribution of responsibilities within the Government. Governments must decide whether to integrate Digital ID within existing infrastructure or create a dedicated entity such as a government-owned semi-private organization. This decision must account for the specialized technical expertise

The success of a Digital ID system largely depends on the governance model and the distribution of responsibilities within the Government. Governments must decide whether to integrate Digital ID within existing infrastructure or create a dedicated entity such as a government-owned semi-private organization. This decision must account for the specialized technical expertise required, which is in high demand from both public and private sectors. The governance model must support the recruitment and retention of skilled resources while ensuring balanced oversight across the involved government entities. Doing so is particularly important when Digital ID is part of a federated identity (SSO framework. Digital ID governance should also be backed by strong legislation, ideally covering mandates such as digital signatures and PKI operations. A well-defined governance structure is essential for clarifying the responsibilities of the agency or government entity tasked with implementing and managing the Digital ID system. Coordination among various government bodies may pose political challenges, but these can be mitigated by establishing supporting laws, policies and clearly defined roles and responsibilities for Digital ID implementation, management and operation. While creating a new entity to oversee Digital ID is not mandatory, doing so is often the most effective solution. Extending the mandate of an existing authority may introduce complexities, leading to delays and increased costs. The governance approach should be tailored to the country’s context, considering its governance structure and historical factors. Typically, the entity responsible for implementing Digital ID is created at the top level of government. Once governance is established, the next critical step is to develop a comprehensive Digital ID road map and implementation framework, which includes assessing the country’s digital maturity, existing infrastructure and planning for practical use cases. Careful planning and coordination are vital for the successful rollout of Digital ID systems, ensuring alignment with the nation’s digital transformation goals. IOM Digital Identity Toolkit 611.7.2 LEGAL FRAMEWORK AND LEGISLATION The legal framework presents a considerable challenge, as it demands specialized expertise that may not always be readily available, as well as the approval of legislative

nation’s digital transformation goals. IOM Digital Identity Toolkit 611.7.2 LEGAL FRAMEWORK AND LEGISLATION The legal framework presents a considerable challenge, as it demands specialized expertise that may not always be readily available, as well as the approval of legislative bodies or other relevant decision-making authorities. Establishing this framework begins with a thorough understanding of the existing regulations governing digitalization within the country. These regulations must be reviewed and augmented to support the implementation of a Digital ID system effectively. A comprehensive legal framework can be initiated with a general act that addresses the digitalization of government processes. This act can then be supplemented by detailed bylaws and policies tailored to the specific needs of Digital ID implementation. Integral to this framework is the governance structure, as previously outlined, which serves as a critical factor in ensuring the success and sustainability of the Digital ID system.

1.7.3 DIGITAL MATURITY

AND READINESS OF

IDENTITY MANAGEMENT AND REGISTRATION A key prerequisite for successfully implementing a Digital ID system is the country’s digital maturity and the readiness of its identity management and registration systems. Digital maturity begins with the registration of legal identities and life events such as births in a civil registry. The percentage of the population with registered legal identities is a key indicator, as participation in a Digital ID system is impossible without this foundational step. The next stage is the maturity of identity management. Digital IDs are typically issued to individuals who have reached the legal age defined by the country’s regulations, commonly 18 years but possibly varying (in some countries, 16 or 21 years). A critical indicator of readiness is the proportion of the population registered in a national database, which assigns unique ID numbers or similar identifiers. The system must also support biometric data capture and deduplication processes to ensure unique identities. 17 IOM, Migration Management Digital Maturity Assessment Report - Armenia (Geneva, IOM, 2023). Biometric databases are essential for guaranteeing identity uniqueness and enabling biometric verification.

system must also support biometric data capture and deduplication processes to ensure unique identities. 17 IOM, Migration Management Digital Maturity Assessment Report - Armenia (Geneva, IOM, 2023). Biometric databases are essential for guaranteeing identity uniqueness and enabling biometric verification. Mandatory biometric data include high-quality live-captured photographs, fingerprints and optionally, iris scans. Systems capable of managing multimodal biometrics provide stronger identity assurance. Digital maturity is reflected in the effective operation of an identity management system and the enrollment of a significant portion of the population. Without a robust identity management system and related registry, implementing a Digital ID system carries a high risk of failure. To assess readiness, IOM offers a Digital Maturity Assessment Tool17 as part of its efforts to support the digitalization of identity management of Member States. This tool helps evaluate a country’s preparedness by considering factors such as population enrollment, registration systems and digital infrastructure. Both identity management systems and digital infrastructure are critical for the successful deployment of a Digital ID system. 1.7.4 GENERAL DIGITAL INFRASTRUCTURE The overall digital maturity of a country reflects the availability of infrastructure that enables citizens, residents and government entities to implement and access digital services effectively. The IOM Digital Maturity Toolkit provides a comprehensive assessment framework to generate a digital maturity indicator. One critical factor is the availability of internet connectivity and the penetration of smartphones among the legally eligible population. However, challenges persist in certain regions, particularly among older demographics or those residing in remote areas. Prior to implementing a Digital ID system, a thorough assessment should be conducted to determine the proportion of the population that can be effectively reached. Even in regions with lower digital maturity, a Digital ID system can still deliver significant benefits. For remote areas, where traditional services often require residents to travel long distances to access government facilities, a Digital ID system can enhance accessibility and efficiency. This capability underscores IOM Digital Identity Toolkit 62the transformative potential of Digital ID systems in

ID system can still deliver significant benefits. For remote areas, where traditional services often require residents to travel long distances to access government facilities, a Digital ID system can enhance accessibility and efficiency. This capability underscores IOM Digital Identity Toolkit 62the transformative potential of Digital ID systems in bridging service gaps and fostering inclusivity, even in less connected regions. 1.7.5 SCALABILITY AND USABILITY OF DIGITAL ID SYSTEMS The implementation of a Digital ID system and its associated IT infrastructure demands a strong focus on functionality and usability to ensure seamless user experience and successful delivery of the intended use cases. Software performance and use case testing are critical in this regard, as malfunctions or errors can lead to user frustration and broader negative consequences. Issues such as adverse media coverage, unfavourable online reviews, political backlash or outright rejection of the system by users can significantly undermine the initiative, potentially resulting in partial or complete failure. A key aspect of usability is ensuring the scalability of the system to handle an increasing number of users without compromising performance. While a system may function well with a limited user base during its initial stages, it may face serious challenges during peak usage periods. For instance, government deadlines can cause significant surges in usage, as seen during the rollout of COVID-19 passes in some countries where high demand led to system slowdowns or crashes. Proper predictive analysis and planning, supported by scalable IT architecture and sufficient resources, are essential to mitigate such risks and ensure smooth system operation during peak times. Service availability is equally critical, requiring the infrastructure to function reliably across the entire country, including remote and poorly connected areas. The system’s bandwidth requirements must align with the slowest available internet connections to include as many users as possible. Applications or websites requiring large data transfers, such as high-resolution images or graphics, may become unusable in regions with weaker internet connectivity, thereby excluding certain populations. By optimizing the system for use under all available communication circumstances, the risk of excluding users in remote or less-developed

tokens, may face logistical and distribution obstacles. The toolkit and its solutions provide an overview of digital identity management and demonstrate how digital identity functions, specifically in the context of border and identity management, with a focus on pure demonstration purposes. If there is interest in scaling the technical solution, it should be mutually agreed upon with IOM. The toolkit provides theoretical and practical approaches to digital identity, while stressing the importance of implementing robust data privacy and security measures. For countries with weaker data protection laws or limited cybersecurity resources, ensuring data safety may be difficult, posing a risk of identity theft, misuse or privacy violations. Furthermore, it is worth noting that the toolkit may not fully account for the complexities of integrating new digital identity systems with existing government systems and databases. Therefore, the implementors should consider the importance of smooth integration of the digital identity solution. Overall, the toolkit offers a valuable starting point but may need to be adapted, resourced and supported extensively to overcome these limitations for widespread and effective use. IOM Digital Identity Toolkit xiiPart 1: Digital Identity Overview This section introduces digital identity fundamentals, technologies and best practices for government implementation. It outlines how digital identity management should be structured, including key services and use cases. Over the last decade, many countries have adopted Digital Identity Frameworks, offering insights into effective approaches and challenges. Successful projects are examined to identify critical factors for policy and technology implementation, as well as best-use cases that highlight how digital ID can support government services and enhance access to e-government services. This part concludes with a description of these key technologies and use cases, drawn from lessons learned in existing implementations. Basics of digital identity and the best practices from several case studies • Understanding of Digital Identity • Use-cases of Digital Identity and Key Benefits • Challenges for Digital Identity Solutions • Key concepts and technology

• Digital Identity Management Framework
• Best Practices for Digital Identity Management

Part 2: Digital Identity Implementation Guidance

for user onboarding. Simplicity in the initial features and functionality is critical, as overly complex or non-intuitive interfaces can discourage adoption and create barriers for first-time users. By linking the Digital ID to a straightforward yet essential service, users are more likely to engage with and adopt the system. Once users are onboarded, the Digital ID platform can evolve through automatic updates and the introduction of new services. The first-use experience is pivotal; users need to immediately recognize how Digital ID simplifies their lives. This positive initial experience helps build trust, fosters adoption and highlights the tangible benefits of the system, ultimately supporting the broader goals of the initiative. IOM Digital Identity Toolkit

631.7.7 MARKETING AND

USER PARTICIPATION

(ONBOARDING RATE) Monitoring the performance of Digital ID systems and defining KPIs are crucial to assessing system usage and user acceptance. If acceptance is low and users fail to perceive clear personal benefits from using Digital ID, the system will struggle to gain traction and achieve widespread adoption. To address this challenge, supporting the implementation of a Digital ID with a well-planned marketing and information campaign is essential. This campaign should be closely aligned with KPI outcomes, initially focusing on user onboarding rates and early usage patterns. A primary objective during the initial phase is to ensure users install the Digital ID app on their smartphones. Once onboarded, the first-use experience becomes critical. A negative user experience at this stage can undermine adoption efforts. If negative feedback is identified, the system must be promptly adjusted and the media campaign should communicate these improvements in a positive and reassuring manner to rebuild user trust. One strategic opportunity to introduce users to Digital ID is during the issuance of new national ID cards. This provides a natural entry point for users to engage with the system. Linking the Digital ID to national ID cards can streamline the onboarding process and enhance authentication through integrated features. However, doing so requires careful coordination between the Digital ID rollout and the national ID card programme.

implementation costs (CAPEX) can be substantial, while the return on investment is often gradual. In addition, ongoing operational costs (OPEX) must be sustained, requiring funding through government budgets or an internal business model. While CAPEX may sometimes be covered by grants or external funding, OPEX demands continuous budgetary support to ensure long-term sustainability. Implementing a business model that involves direct service-based payments from citizens often discourages adoption, as it creates a barrier to usage. Some countries have experimented with charging citizens for digital signatures or authentication services, but these models tend to limit user adoption and fail to deliver the widespread cost-reduction benefits that Digital ID systems can achieve. To address these challenges, governments may explore various funding s