The ID number was real. The person holding the Kenyan ID was not its owner. Here is how to verify one.

Picture the file. An eight-digit ID number, a name that matches, a photo of a card. The number is real. The account opens.

Then the account starts receiving money it should not, and you learn that the number belongs to a farmer three counties away who has never heard of you. Somebody else typed it in. Nobody checked who.

This guide covers the documents in circulation, what a regulated business is expected to check, the ways to verify a Kenyan national ID, and where each one stops.

The Kenyan IDs in circulation

The identity card is issued under the Registration of Persons Act (Cap. 107) (opens in a new tab). In the 2012 revised edition we read, the Act applies to Kenyan citizens aged eighteen or over (section 2), and a person registers within ninety days of turning eighteen (section 6). Every card carries a photograph, and the register behind it holds finger and thumb impressions (sections 5 and 9).

Two generations of card matter in practice.

• The second-generation ID card. This is the card most adults still carry. Under section 17 of the Act, a card stays valid until the Minister declares otherwise by Gazette notice, so expect these for some time.

• The Maisha Card and Maisha Namba. The Directorate of Immigration Services describes the Maisha Card as the third-generation national ID card (opens in a new tab), and the Maisha Namba as a lifelong registration number issued as a birth certificate number and later used to enrol for government services. That post, from September 2024, describes the card as a pilot. Check the current position before you write policy around it.

What a regulated business is expected to check

The Central Bank of Kenya says on its AML/CFT/CPF page (opens in a new tab) that it supervises compliance with the Proceeds of Crime and Anti-Money Laundering Act, 2009 and its regulations by commercial banks, microfinance banks, money remittance providers, forex bureaus, digital credit providers, payment service providers and others. For institutions licensed under the Banking Act, the detail sits in guideline CBK/PG/08 of the Prudential Guidelines (January 2013) (opens in a new tab).

• Identity is verified when a relationship starts, for occasional transactions, when there is suspicion, and when earlier information is in doubt (clause 5.6.3).

• Verification uses reliable, independent source documents, data or information (clause 5.6.5). For an individual, the minimum is an official record: a birth certificate, passport, national identity card or driver's licence (clause 5.6.5.1).

• Where there is no face-to-face contact, the procedures should confirm identity as robustly as face-to-face ones and guard against impersonation (clause 5.6.7.3).

• The checks must serve two purposes: that a person of that name exists, and that the applicant is that person (clause 5.6.7.4).

• If due diligence cannot be completed, the institution should not open the account, and should file a suspicious transaction report (clause 5.6.10).

This is the guideline as published on the CBK site as of October 2026. It is written for banks. Other licence types have their own rules.

The ways to verify a Kenyan ID, and what each proves

• The card itself. A capture of the front and back lets you read the printed details. It proves you were shown something that looks like a Kenyan ID. A good forgery, or a real card in the wrong hands, passes.

• The government record. Checking the number against the source record answers the first CBK question: does this person exist, and do the name and date of birth agree? It does not answer the second. ID numbers get shared.

• The machine-readable zone. Where a card carries one in the card-size format of ICAO Doc 9303, Part 5 (opens in a new tab), it is three lines with the issuing State's three-letter code in positions 3 to 5 of the first line and a composite check digit. The check digits are arithmetic. They show the zone was read correctly, not who printed it.

• The chip. On a card with an ICAO chip, a chip read proves the data was signed by the issuing state. A printed card cannot offer that.

• A face match with liveness. Comparing a live selfie with a trusted photo ties the applicant to the identity. This is the second CBK question, and the step most often skipped.

The mistakes that let fake or borrowed IDs through

• Matching the number only. A number in the record proves the identity is real. It says nothing about who typed it.

• Accepting a picture of a card. An image from a gallery or a photocopy tells you a card photo exists somewhere. Prefer a live capture.

• A face match against the wrong photo. Matching a selfie to the photo printed on the card proves the person resembles the card, and a forger controls that photo.

• A selfie with no liveness. Without it, a photo of a photo can stand in for the customer.

• Treating a borrowed card as low risk. The Act makes it an offence to use another person's identity card, or to let someone else hold yours with intent to deceive (section 14). The willing lender is still not your customer.

How Toden handles a Kenyan national ID, and where it stops

Kenya is one of five markets where Toden checks an ID against the source government database.

• The country is KE and the ID type is national-id. It is a document ID, so the customer captures the front and the back.

• The details are validated against the government record. A number the record does not hold comes back with identity_not_found, and details that disagree come back with gov_data_mismatch.

• A pass carries an assurance level. A Kenyan national ID checked against the government record reaches gov_db. Our piece on KYC assurance levels explains how to route on it.

• An expired document fails with document_expired by default.

Now the limits, stated as limits.

• Toden lists Kenya's national identity card among the cards with a readable chip, and holds Kenya's certificate. The chip step runs only in the React Native and Flutter SDKs. No browser can talk to the chip. See how e-passport chip verification works.

• A card with no chip, a phone with no NFC, or a chip that cannot be confirmed does not fail the verification. It rests on the government record, and the assurance level stays at gov_db. Only a chip proven to be tampered with fails.

• Do not assume the selfie was compared with a government photo. The selfie is compared with the strongest photo the verification holds, and the result's facialMatchSource says which one that was. A match against the photo printed on the card is weaker evidence and never raises the assurance level, so send those to a reviewer.

• Toden reports what the checks found. Your risk policy and your records remain yours.

Data protection in Kenya

Verifying an ID means handling an ID number, a face image and a government record. The Data Protection Act, 2019 (opens in a new tab) applies, and section 2 lists biometric data as sensitive personal data. A face comparison is technical processing of a physical characteristic, so we would plan for it to be treated that way.

• Registration (section 18). Controllers and processors register with the Data Commissioner where the prescribed thresholds apply. Processing sensitive data is one of the factors.

• Notice (section 29). Before collecting, tell people what is collected, why, who receives it and whether it is mandatory.

• Retention (section 39). Keep personal data only as long as the purpose needs, unless a law requires or authorises longer. Write down which law you rely on.

• Processors (section 42). A provider that processes data for you does so under a written contract and only on your instructions.

• Transfers (sections 48 and 49). Sending data abroad needs appropriate safeguards. Processing sensitive personal data outside Kenya also needs the person's consent.

Our overview of biometric data under African data protection law sets Kenya beside its neighbours.

This is not legal advice

This guide summarises public sources as we read them in October 2026. Rules change, and how they apply depends on your licence and products. Read the Acts and guidelines themselves and speak to counsel in Kenya before relying on it.

Want to see a Kenyan ID check end to end? Open a Toden workspace (opens in a new tab) and run one in the sandbox, or see KYC coverage by country.