Nzika Wallet controversy! Who holds the keys to Malawi’s multibillion digital identity?

…Hong Kong-registered firm wins US$5m contract for Malawi’s ID registration kits
…Contract allows remote software support to registration equipment
…Same supplier built Malawi’s first biometric register in 2017
…Data protection regulations still unfinished as 13.5 million Malawians sit in national ID database

The machines that capture Malawians’ fingerprints and faces for the national ID will be supplied by a Hong Kong-registered company under a US$5.085 million World Bank-financed contract, Malawi24 has established. This is more than 27 percent than was intially estimated.

World Bank procurement records name the supplier as Laxton Limited, with an address in Tsim Sha Tsui, Kowloon, Hong Kong. The records list its supplier country as China. The company will supply, install, commission and maintain biometric registration kits for the National Registration Bureau (NRB).

Laxton is not new to Malawi. The same supplier provided the equipment that built the country’s first biometric register in 2017. The new contract comes as Malawians begin moving their identities onto their phones, bringing into focus not only who owns the data, but who has technical access to the systems that collect, process and store it.

A wallet on your phone

Homeland Security Minister Peter Mukhito launched the Nzika Digital ID Wallet in Lilongwe on 16 September, International Identity Day. He also announced that national ID cards issued from that day will no longer expire.

More than 22,000 people had signed up by launch day, according to the United Nations Development Programme (UNDP). The wallet holds digital national IDs and birth, marriage and death certificates. To sign up, a citizen needs a valid national ID and must pass a liveness check on a smartphone. Malawians abroad can enrol if they are already in the national database.

The NRB developed the wallet with UNDP under the Inclusive Digital Transformation for Malawi programme, with support from the European Union, Irish Aid and the Royal Norwegian Embassy.

UNDP says its technical partner was the United Nations International Computing Centre (UNICC), a UN technology body headquartered in Geneva. According to UNDP, UNICC designed the blockchain architecture and cybersecurity and led technology transfer and local capacity building. UNDP describes the system as secure and privacy-preserving.

More than 13.5 million Malawians are registered in the national ID system.

The US$5 million contract

The tender, reference MW-PPPC-489649-GO-RFB, sought 2,400 portable biometric registration kits for the NRB, including installation, commissioning and maintenance. The Public Private Partnership Commission (PPPC) runs the procurement under the Digital Malawi Acceleration Project (DMAP), financed by the World Bank.

A World Bank supervision report from November 2025 put the value of the kits contract at US$4 million. Malawi awarded the company US$5,085,053.74, about 27 percent more than it had estimated.

The same document lists the contract at US$1 million in another table. PPPC’s Chikondi Pinto said the US$4 million figure in Annex 5 was the estimated procurement value and that the US$1 million figure in Annex 1 was a typographical error.

Pinto said the estimate came from the World Bank Procurement Plan and was prepared for planning purposes rather than as a final contract price. Because the recommended amount exceeded that estimate, he said, World Bank prior review rules required the Bank’s clearance before the award could proceed, and the Bank cleared it at US$5,085,053.74 following competitive evaluation.

“The procurement was therefore not awarded solely on the basis of the original US$4 million estimate,” Pinto said. The tender was also delayed by a procurement complaint, which the World Bank report says was resolved on 17 November 2025. The financial bids were opened days later.

The PPPC confirmed a complaint was received and handled under World Bank procurement regulations, and that the Bank then cleared the procurement to proceed to signing. It said confidentiality requirements prevented it from identifying the complainant or disclosing details.

The March 2026 contract award gives Laxton’s address as 29-31 The Gateway, Tower 5, Harbour City, 15 Canton Road, Tsim Sha Tsui, Kowloon. Hong Kong company records show Laxton Limited was incorporated in February 2014 as Laxton Group Limited and changed its name in June 2024.

Laxton’s own website lists Laxton Limited as the group’s Asia-Pacific office, based in Guangzhou, China. The wider group is majority-owned from Japan. In June 2025, security printing company Dai Nippon Printing (DNP) announced it was taking a 75 percent stake in Rubicon SEZC, the Cayman Islands holding company behind Laxton Group. Laxton now describes itself as a DNP company.

The kits sit at one of the most sensitive points in the system: where a citizen’s fingerprints, photograph and personal details are captured. Malawi24 has seen no evidence that Laxton receives, stores or transfers Malawians’ biometric information outside the country.

What the maintenance contract allows

The PPPC told Malawi24 that the contract provides a two-year warranty covering remote software support, with local repair and replacement of kits from a site in Lilongwe. Failed kits must be replaced within four hours on working days.

Pinto said the population database is separate from the registration kits, and that the kits communicate with the relevant database through a secure virtual private network using encrypted communications.

She said remote access provided for the operation and maintenance of the kits is limited to the kits and their software, and does not provide access to population data held in the NRB database.

Pinto said the NRB, as data controller under the Data Protection Act, is responsible for compliance, and indicated the Bureau would confirm the position on remote access. The NRB has not done so.

The Commission declined to say which Laxton entity will provide the remote software support or from which country, and whether the Lilongwe maintenance site is run by Laxton, a subcontractor or the NRB. It said disclosure of the contract’s contents is subject to contractual and confidentiality provisions, and that it would release information appropriate for public release while protecting confidential and security-sensitive material.

Laxton lists offices in China, Portugal and the United States. The company did not respond to Malawi24’s questions.

Laxton’s decade in Malawi

In February 2017, UNDP awarded Laxton the contract for Malawi’s first mass biometric registration. The company delivered 2,000 registration kits, a central biometric record management system, in-country project management and training for NRB officers.

According to Laxton’s own account, four of its staff were based in Malawi for four years. It also established a service centre in Blantyre, which the company said in 2022 continued to provide technical support and hardware maintenance to government departments using the kits.

The same kits later registered more than eight million voters for the Malawi Electoral Commission, according to Laxton. In October 2018, UNDP handed the source code of the National Registration and Identification System (NRIS) to the NRB, giving the Bureau ownership of the system’s core software.

But ownership of source code does not by itself establish who can reach every device connected to the system.

Who can see the data?

The Malawi Government controls the NRIS, while foreign organisations provide equipment, financing and technical expertise. What has not been made clear is where the master National ID database and all its backups are physically kept, who holds administrator-level access to the different systems, and who controls the cryptographic keys used to protect them.

The Nzika Wallet adds another layer. Citizens enrolling in the wallet undergo a smartphone liveness check. Public information about the system does not establish where that verification is processed, or whether any information generated during it is processed outside Malawi.

UNDP says UNICC’s role included blockchain architecture and cybersecurity. There has been no public disclosure of what access, if any, UNICC retains once the system is in production. Asked where the wallet’s liveness verification is processed and what access UNDP and UNICC retain now that the system is live, UNDP referred the questions to the NRB.

Bigger than an ID on your phone

The wallet is one part of a much larger build. The World Bank approved DMAP on 27 June 2024. The first phase is US$70 million and remains the only confirmed financing. A further US$80 million second phase depends on the project’s progress and the availability of World Bank resources.

The biggest single planned procurement is a US$20 million expansion of the Government National Data Centre. As of November 2025, the centre hosted six ministry databases. When government met potential bidders in October 2025, stakeholders raised concerns about vendor lock-in.

The World Bank’s November 2025 report also lists further identity work heading to procurement. That includes an assessment of the NRIS and development of a national electronic “know your customer” system, known as eKYC, for public and private sector services. Another package covers mobile ID authentication and electronic signatures.

The Bomalathu data-sharing platform, built under the first Digital Malawi programme, is also being expanded to connect more government services. Taken together, the infrastructure allows identity to become the common link through which people are authenticated across a growing number of services.

For banks and government departments, that can make verification faster and reduce fraud. It also means information held in previously separate systems can increasingly be associated with the same individual through a common identifier. Who is permitted to make those connections, and what they receive when they do, therefore becomes as important as where the original National ID database sits.

A regulator still finding its feet

Malawi’s Data Protection Act No. 3 of 2024 came into force on 3 June 2024. It names the Malawi Communications Regulatory Authority (MACRA) as the Data Protection Authority. The Act classifies biometric data as sensitive personal data. Section 38 regulates the transfer of personal data outside Malawi, including requirements on the level of protection afforded to information sent abroad.

In November 2025, the World Bank reported that MACRA had appointed an acting Data Protection Commissioner and recruited staff from its own budget. Data protection regulations had been drafted, and DMAP funding was allocated to help operationalise the authority.

As recently as July 2026, MACRA was still consulting on the draft regulations, more than two years after the Act came into force. MACRA referred Malawi24’s questions to its head of data protection, Dan Chiwoni, who is yet to respond to our questions by the time of publication. The regulator has therefore not said whether it has assessed any cross-border processing linked to the identity infrastructure, or reviewed the Nzika Wallet’s data protection arrangements.

The gaps cut across the system. Government has not established publicly where every copy and backup of the National ID database is held. The NRB has not confirmed the extent of access permitted under the new maintenance contract, or whether remote sessions require its authorisation and are logged. There is no public account of where the wallet’s liveness verification is processed, or of every organisation with privileged technical access.

Malawi24 sent written questions to the National Registration Bureau, the Public Private Partnership Commission, Laxton, MACRA in its role as Data Protection Authority, UNDP Malawi, the United Nations International Computing Centre and the World Bank. The PPPC responded in detail. UNDP referred Malawi24’s questions to the National Registration Bureau, saying the Bureau was best placed to respond. The NRB acknowledged the questions and said they required input from its ICT team, but no response had arrived by the time of publication. MACRA referred the questions to its head of data protection, who did not respond. Laxton and the World Bank did not respond.

There is no evidence seen by Malawi24 that Malawians’ identity or biometric data is being improperly accessed or transferred outside the country. Yet, no one is willing to divulge details as to who has the technical ability to access it even after mjillions of public funds in US dollars have now exchanged hands.

A password can be changed after it leaks. A Malawian cannot change their fingerprints or face. More than 13.5 million people are already registered in the national identity database. Information and Communications Technology Minister Shadric Namalomba said at the launch that this represents about 99 percent of citizens aged 16 and above.

Malawians should not have to take the security of their identities on trust. They deserve to know who holds the keys.

This is Part One of Malawi24’s investigation, Who owns Malawi’s data? In Part Two, Malawi24 follows the US$5 million biometric contract and examines Laxton, the company now supplying Malawi’s biometric registration technology for the second time.