NBU BankID Preliminary Conformity Assessment

Project's Scope

SpearIT is pleased to announce that has undertaken the preliminary conformity assessment of Ukraine's BankID national electronic identification scheme, operated by the National Bank of Ukraine, in accordance with the eIDAS Regulation (EU 910/2014). This project sets the basis for the recognition of the Ukrainian national eID scheme among EU Member States with the substantial level of assurance (LoA Substantial), allowing Ukrainian citizens to access EU services of the public sector.

The journey started in December 2023, with the consortium of the accredited Conformity Assessment Body (CAB) QMSCERT, (Greece) - SPEARIT, (Estonia, Greece) - OBSERWATORIUM.BIZ, (Poland) winning the international tender issued by DAI to assist the National Bank of Ukraine.
This effort is supported by the Investment for Business Resilience Activity (IBR) of USAID (formerly, USAID Financial Sector Reform Activity).
IBR aims to transform the country’s financial sector into a well-functioning and competitive market that is aligned with European Union standards and integrated into international financial systems, while directly providing financing to enterprises for sustained economic growth.

Project's Objectives

The objective of this engagement is the early detection of any inconsistencies in the organizational, procedural and implementation aspects of the NBU BankID system, thus preparing for the formal conformity assessment pursuing mutual recognition with the EU.

In this context, SpearIT, having solid experience in eID projects under eIDAS Regulation, provided subject-matter expert services in eIDAS compliance and related areas, such as eID/AML KYC processes, electronic identity lifecycle & means management, electronic trust services, PKI and remote identity proofing.

Project's Output

The prpoject's output was a comprehensive preliminary conformity assessment report covering the operator/owner of the NBU BankID scheme and the participating banks as identity providers, setting the path forward to gaps elimination and further alignment of the scheme with eIDAS and ETSI requirements.
The assessment identified several elements that, if implemented, would bring the NBU BankID System into full compliance with the eIDAS requirements for electronic identification schemes under LoA Substantial, such as:

• defining and regulating the electronic identification service and means
• implementing rules for the use and management of electronic identification means
• clarifying requirements for user multi-factor authentication
• implementing participation termination plans for member-banks in the scheme
• conducting ad-hoc audits of subscribed identifiers
• implementing and routinely performing penetration tests
• implementing a life cycle policy for cryptographic keys used to encrypt personal data.

NBU BankID Status

NBU's BankID system is already available and successful at the national level, with NBU operating the central eID node with 38 Ukrainian banks participating as authoritative identity providers, 99 service providers consuming the BankID, enabling more than 30M digital identity transactions per year.

Through BankID, Ukrainian citizens can easily and securely access online services provided by:

• public entities and nongovernmental organizations
• banks and other financial institutions
• commercial institutions

For more information regarding the NBU BankID, visit: https://bank.gov.ua/en/bank-id-nbu