The Bangladesh Telecommunication Regulatory Commission (BTRC) has approved a six-month pilot to test SIM registration through face verification, officials said.
The move will be implemented as a Proof of Concept (PoC) under strict conditions and will apply only to new SIM registrations, the commission said, adding that the initiative will remain experimental and cannot be used commercially.
The proposal was submitted by the Association of Mobile Telecom Operators of Bangladesh, which will conduct the trial with technical support from Relief Validation Limited (RVL), a licensed Certifying Authority.
RVL operates under the government-controlled Controller of Certifying Authorities and provides digital certificates and identity verification services under the Information and Communication Technology Act, 2006.
Under the law, only licensed Certifying Authorities are authorised to conduct full identity authentication and issue digital signature certificates.
Liveness verification is designed to confirm that a SIM applicant is physically present before the device and not attempting fraud using printed photographs, recorded videos, three-dimensional masks, deepfakes or artificial intelligence-generated facial images.
The technology may function through two methods.
Under the passive method, the system analyses natural head movement, eye blinking, light reflection and skin texture.
Under the active method, users must follow on-screen instructions such as turning their head, smiling or reading numbers to confirm real-time presence.
Under the proposed process, customers will apply for SIM registration through a mobile operator’s application, which will capture images of the front and back of the National Identity Card and use optical character recognition to extract the applicant’s name, National Identity number and date of birth.
Using the National Identity number, the applicant’s official photograph will be retrieved from the Election Commission database. RVL will temporarily pull the image from the Election Commission portal for matching and will not retain it outside the approved regulatory structure.
The customer will then submit a live video or streaming selfie, which will be matched with the database photograph through RVL’s facial matching engine while simultaneously verifying that the image is live. The system also uses artificial intelligence to analyse ageing factors, enabling it to match current facial images with National Identity photographs that may be 10 to 20 years old.
If the images do not match, the process will stop immediately.
If they match, RVL will generate a digitally signed verification report containing the National Identity number, date and time of verification, a unique tracking number and the face-matching result.
The report will be transmitted to the Central Biometric Verification Monitoring Platform and the mobile operator.
The platform will verify the authenticity of the digital signature using RVL’s public certificate before the operator links the verified identity to the customer’s mobile number and approves the SIM registration.
For electronic SIM users, customers will be able to purchase and download the electronic SIM directly from the operator’s online portal after successful verification.
Alternatively, customers may activate a blank physical SIM through the same process or order an inactive SIM for home delivery and activate it later through the application.
During regulatory discussions, concerns were raised over data storage, hacking risks, misuse of three-dimensional printed masks and compliance with Election Commission guidelines.
The commission said necessary coordination and approval from the Election Commission will be required before wider implementation, and the proposed facial verification system must remain fully compliant with Election Commission conditions and directives.
RVL said that as a licensed Certifying Authority it is authorised to collect and store certain personal data, including National Identity number, name, date of birth, address, mobile number and email address under existing regulations.
To secure data, RVL is using RSA 3072-bit and elliptic curve cryptography 256 encryption technologies alongside hardware security modules.
Anti-spoofing systems, two-dimensional and three-dimensional mask detection, high-definition video replay detection and distributed denial-of-service protection are also in place, it said.
Each verification will carry a digital signature and audit trail for accountability.
The main data centre is located at Colocity in Mohakhali, while a disaster recovery site is being set up at the Hi-Tech Park in Jashore, and the system will be subject to periodic audits under Certifying Authority rules.
BTRC said the face verification system will operate in parallel with the existing fingerprint-based biometric verification and will not replace it at this stage.
Customer consent will be mandatory before collecting biometric information.
No facial images, videos or biometric templates can be permanently stored after the PoC ends, and such data must be securely deleted within the prescribed timeframe. Data transfer to third parties or outside Bangladesh will be prohibited.
The commission will require periodic technical and operational progress reports and may conduct audits, tests or inspections at any time.
It has reserved the authority to suspend or cancel the PoC immediately if security risks, legal violations or public interest concerns arise.
bKash and a very few other popular apps have already introduced the technology to ensure authentic registrations.
