Frictionless e-KYC: Mobile Banking Onboarding in Nepal
Modernizing Digital Onboarding in Nepalese Mobile Banking: A Strategic Blueprint for Frictionless e-KYC
1. Executive Introduction
The digital transformation of Nepal’s macroeconomic landscape has accelerated at an unprecedented pace, driven by widespread smartphone penetration, falling mobile data costs, and a concerted push by the Nepal Rastra Bank (NRB) toward a digitized, cashless economy. With smartphone penetration reaching nearly 73% and the average cost of mobile data dropping significantly to approximately USD 0.27 per gigabyte, the foundational digital infrastructure required for universal financial inclusion is largely in place. Concurrently, digital payment infrastructures, such as the interoperable connectIPS and expanding Quick Response (QR) code ecosystems, have matured, processing increasing volumes of retail and interbank transactions. However, as commercial banks, microfinance institutions, and digital wallet providers deploy highly sophisticated mobile banking applications, a critical bottleneck persists at the very threshold of the user journey: the digital onboarding pipeline.
The onboarding phase, specifically the Know Your Customer (KYC) identity verification process, represents the highest point of friction in the digital banking lifecycle. In the context of Nepal, where user digital literacy varies and network reliability can fluctuate in rural areas, traditional paper-based mentalities applied to digital KYC flows severely constrain customer acquisition. Users are frequently subjected to exhaustive data entry requirements, rigid document scanning procedures, and opaque compliance delays. Industry data reveals that complex verification processes are responsible for staggering abandonment rates; globally, up to 70% of financial institutions report losing prospective clients due to inefficient onboarding, directly sabotaging marketing investments and user adoption metrics.
To remain competitive and compliant, Nepalese financial institutions must completely overhaul their digital onboarding architectures. This report provides an exhaustive analysis of the strategies required to minimize user experience (UX) friction while adhering to stringent domestic regulatory frameworks. By exploring the integration of Automated Data Extraction via Optical Character Recognition (OCR) fine-tuned for Devanagari script, the deployment of biometric liveness detection APIs to combat sophisticated deepfakes, and the structural implementation of tiered digital upgrades, this analysis constructs a blueprint for frictionless e-KYC. The ultimate objective is to transform regulatory compliance from a burdensome operational cost center into a seamless, automated enabler of rapid user growth and long-term financial engagement.
2. The Macroeconomic and Regulatory Mandate for e-KYC in Nepal
Any architectural modernization of a mobile banking application in Nepal must be strictly tethered to the regulatory mandates issued by the Nepal Rastra Bank (NRB) and the broader legislative framework governing data privacy, anti-money laundering (AML), and combating the financing of terrorism (CFT). The central bank actively issues and updates Unified Directives to commercial banks, development banks, finance companies, and payment service providers (PSPs) to ensure systemic stability and compliance with the Financial Action Task Force (FATF) standards.
Finance Calculator
Use this calculator to estimate repayments or growth before you compare providers.
2.1 AML/CFT Obligations and Customer Due Diligence
Under the Asset (Money) Laundering Prevention Act, 2064, and the subsequent Asset Laundering Prevention Rules, 2081, Nepalese financial institutions are legally obligated to maintain comprehensive Customer Due Diligence frameworks. The primary application of KYC is to verify customer identities using government-issued documents—such as the Nepalese Citizenship Certificate, National Identity Card, Passport, or Voter ID—to mitigate the risks of terrorist financing, money laundering, and financial fraud.
The regulatory apparatus demands integration with broader national monitoring systems. Financial institutions must implement ongoing monitoring of customer transactions and report suspicious activities via Suspicious Transaction Reports (STR) and Threshold Transaction Reports (TTR) to the Financial Information Unit (FIU) utilizing the goAML platform. Recent directives issued in Shrawan 2081 (mid-2024) have made comprehensive KYC mandatory for digital wallet companies processing transactions above basic minimums, explicitly aiming to combat financial crimes channelized through e-wallet platforms.
The NRB has actively encouraged the transition toward Centralized KYC (C-KYC) systems, aiming to leverage the emerging National Identity Card database and the Nagarik App to create a unified, interoperable digital identity layer across the financial sector. The National Identity Card, which contains a biometric smart chip storing a national identity number, photographs, fingerprints, and iris scans, is positioned to replace legacy forms of identification, though widespread adoption remains a transitional process.
| Regulatory Framework | Core Mandate | Implications for Mobile Banking Onboarding |
|---|---|---|
| Asset (Money) Laundering Prevention Act, 2064 | Mandates strict Customer Due Diligence and continuous transaction monitoring. | Requires collection of high-fidelity identification data, including three-generation familial details (father, mother, grandfather). |
| NRB Unified Directives (Payment Systems) | Establishes operational parameters and transaction limits for PSPs and digital wallets. | Imposes a transaction cap (historically NPR 5,000 per day/month) for accounts lacking full KYC verification. |
| goAML Reporting Mandates | Requires the submission of Suspicious Transaction Reports (STR) and Threshold Transaction Reports (TTR). | Onboarding systems must accurately capture ultimate beneficial ownership and PEP (Politically Exposed Person) status for real-time screening. |
| Individual Privacy Act 2075 | Protects personal data, biometrics, and financial information against unauthorized processing. | Demands explicit, granular user consent during onboarding and strict cryptographic protection of data at rest and in transit. |
2.2 Data Privacy and the Protection of Biometric Information
As banks digitize the KYC process, they trigger the rigorous compliance requirements of Nepal’s Individual Privacy Act 2075 and the Individual Privacy Regulation 2077. Article 28 of the Constitution of Nepal explicitly guarantees the right to privacy regarding personal data, which the Privacy Act operationalizes by defining biometric data, financial information, and citizenship details as highly sensitive personal information.
The collection, processing, and storage of facial biometrics and identity documents via a mobile application require explicit, informed consent from the user prior to data extraction. Furthermore, penal code provisions (Sections 293–298) mandate severe penalties—including up to three years of imprisonment and fines of NPR 30,000—for the unauthorized disclosure or processing of professional confidential information. To navigate this legally fraught environment, the architecture of the mobile banking application must ensure that personally identifiable information (PII) is encrypted both in transit (using protocols such as TLS 1.3) and at rest, ideally utilizing Hardware Security Modules (HSMs) for advanced cryptographic key management. The failure to implement these data protection standards not only invites regulatory penalties but also severely degrades institutional trust in the event of a data breach.
3. The Economics of UX Friction and Onboarding Abandonment
The transition from a regulatory imperative to a consumer-facing digital product introduces a critical tension between comprehensive compliance and seamless user experience. The onboarding funnel is undeniably the most fragile segment of the customer lifecycle. Designing a system that blindly maximizes data collection without regard for cognitive load directly destroys shareholder value.
3.1 The Psychology and Cost of Abandonment
Research analyzing the onboarding behaviors of banking customers reveals that complex verification processes account for nearly 45% of total client abandonment, with specific KYC and anti-money laundering documentation challenges driving one in five users away entirely. In mobile environments, users operate on a strictly limited “effort budget.” A process requiring excessive manual typing on small screens, repeated physical document scanning due to obscure system errors, or unclear compliance demands quickly exhausts this budget.
Empirical studies indicate that the average mobile fintech onboarding sequence involves roughly 14 individual screens, requires 16 mandatory fields, demands 29 clicks, and takes up to six minutes to complete. When an application exceeds these parameters, drop-off scales exponentially. Research demonstrates that 68% of consumers have abandoned a financial services application mid-onboarding, a metric that has steadily worsened as institutions bolt on additional compliance checks without optimizing the user interface.
When users abandon the application, the financial institution absorbs a total loss on the Customer Acquisition Cost (CAC). For modern digital platforms and neobanks, CAC includes substantial digital marketing expenditures, referral bonuses, and direct promotional incentives. If an institution spends heavily to acquire a user, only to lose them at the identity verification stage, the unit economics of the business model rapidly deteriorate.
If conversion from a free user to a fully verified, transacting borrower stalls, the CAC payback period can stretch dangerously beyond 24 months, fundamentally threatening institutional profitability.
3.2 The Critical Activation Window
The financial consequences of onboarding friction extend beyond initial abandonment; they directly impact the long-term lifetime value (LTV) of the customer. Product analytics indicate a highly restrictive temporal window for user activation: approximately 76% of users who successfully convert and execute their first transaction do so within the first seven days of account creation.
If the KYC process traps the user in a “pending verification” state for 24 to 72 hours—which remains a common Service Level Agreement (SLA) for institutions relying on manual backend reviews—the probability of long-term activation plummets. A user who creates an account but never makes a deposit, sends a payment, or completes a first transaction is functionally equivalent to an abandoned application; the acquisition budget is spent, but the resulting revenue is zero. Therefore, instantaneous, automated verification is not merely a convenience feature; it is a fundamental requirement for maximizing user activation within the critical seven-day window.
| Onboarding Metric | Industry Benchmark | Financial Implication for Institutions |
|---|---|---|
| Abandonment Rate | 68% - 70% of users abandon complex KYC flows. | Total loss of Customer Acquisition Cost (CAC); wasted marketing expenditure. |
| Average Completion Time | 6 minutes; 14 screens; 29 clicks. | Exceeding these thresholds causes exponential increases in user drop-off. |
| Activation Window | 76% of successful first transactions occur within 7 days. | Manual reviews taking 24-72 hours severely suppress final activation rates. |
| Post-Onboarding Churn | Up to 34% of new checking accounts become inactive in year one. | Fails to generate expected Lifetime Value (LTV) to offset initial CAC. |
4. Tiered Digital Upgrades and Dynamic Flow Routing
To surgically mitigate onboarding drop-off without violating NRB directives, the mobile banking application must implement a “Tiered Digital Upgrade” architecture. This strategy relies heavily on progressive profiling, dynamic flow routing, and context-aware micro-nudges to distribute friction across the user lifecycle rather than front-loading it at the point of initial download.
4.1 Implementing Progressive Profiling
Rather than forcing the user to complete an exhaustive, maximum-friction KYC process immediately upon application installation, the system should allow for instantaneous account creation with minimal friction. This relies on the regulatory allowance for low-limit accounts. The NRB permits digital wallets and financial applications to operate with restricted functionalities—specifically capping transactions at NPR 5,000 per day and per month—for users who have not completed exhaustive identity verification.
The onboarding funnel should be structured into distinct tiers. In Tier 1 (Instant Access), the user provides merely a mobile number, completes a One-Time Password (OTP) verification, and inputs their basic name. This process takes seconds and immediately grants access to the application’s core dashboard, allowing the user to experience the interface, view potential digital lending offers, or check interest rates.
Once the user is securely inside the ecosystem, the application utilizes dynamic flow routing to prompt upgrades contextually. For example, if the user attempts to execute a fund transfer exceeding NPR 5,000 or apply for a digital loan, the application intervenes with a frictionless prompt requesting a document upload. Because the user now has a highly specific, immediate motivation to complete the task, their tolerance for friction is significantly higher.
4.2 The Verification Tiers
The structural architecture of a Tiered Digital Upgrade system operates as follows:
| Verification Tier | Required User Input | System Action | Authorized Transaction Limits |
|---|---|---|---|
| Tier 1: Basic (Instant) | Verified Mobile Number, OTP validation, Basic Name entry. | Instant account creation; core app features and dashboards unlocked. | Strictly capped at NPR 5,000 per day and per month (Regulatory limit). |
| Tier 2: Standard (Automated) | Document upload (Nepali Citizenship or NID), OCR extraction, selfie liveness capture. | Inline automated verification; zero manual review if AI confidence threshold is met. | Moderate limits; standard interbank transfers, wallet top-ups, and utility payments enabled. |
| Tier 3: Enhanced (Dynamic) | Proof of address (utility bill), income source declaration, enhanced video KYC. | Triggered dynamically for high-risk profiles or requests for high-value credit. | Maximum regulatory limits; full access to digital lending and cross-border capabilities. |
By separating the parameters required to establish a basic relationship from those required to transact at high volumes, the bank effectively secures the user’s initial commitment. Furthermore, institutions can leverage integrations with the Nagarik App or the centralized National Identity system to allow users to pull verified credentials directly from government databases, entirely bypassing manual uploads for users who possess established digital identities.
5. Automated Data Extraction (OCR) for Nepalese Identity Documents
The crux of automating the transition from Tier 1 to Tier 2 lies in eliminating manual data entry. Requiring users to manually type their 16-digit citizenship number, issuance district, birth date, and full three-generation familial lineage on a mobile keyboard introduces massive UX friction. Furthermore, it results in high typographical error rates, which subsequently cause automated backend matching algorithms to fail, forcing the application into a costly manual review queue. Optical Character Recognition (OCR) solves this, but parsing Nepalese identity documents presents profound technical and linguistic challenges.
5.1 The Challenge of Devanagari Script and Physical Degradation
Nepalese identity documents—particularly legacy paper-based Citizenship Certificates—are highly heterogeneous. They often feature complex, noisy background patterns, watermarks, faint ink, varied font types, and a frequent mixture of machine-printed and handwritten text. Document degradation due to aging, creasing, or poor lamination further exacerbates the difficulty of optical extraction.
Moreover, the Devanagari script itself possesses unique topological characteristics that severely confound traditional, legacy OCR engines designed primarily for Latin scripts. Devanagari characters are structurally connected by a continuous horizontal headline (the shirorekha), and semantic meaning is heavily altered by complex vowel modifiers (matras) attached above, below, or alongside characters, as well as by conjunct consonants where half-characters merge with full characters. Standard OCR engines that rely on strict, pixel-level character segmentation frequently fail because attempting to mathematically separate overlapping matras and conjuncts from the shirorekha results in severe character corruption, yielding unacceptably high Character Error Rates (CER) and Word Error Rates (WER).
5.2 Advanced Vision Pipelines: YOLOv8 and Sequence-Learning Models
To achieve frictionless, high-accuracy data extraction, the mobile banking application must discard legacy segmentation-based OCR approaches in favor of a hybrid deep-learning pipeline combining state-of-the-art object detection with sequence-to-sequence text recognition.
The most successful architectural approaches utilize the YOLOv8 (You Only Look Once, version 8) algorithm for primary text detection and Region of Interest (ROI) localization. When a user captures a photograph of their citizenship card, YOLOv8 does not immediately attempt to read the text; rather, it identifies the spatial bounding boxes of specific target fields, such as “Name,” “Citizenship Number,” “Date of Birth,” and “Issuing District,” deliberately ignoring background noise, official seals, and the user’s photograph. This model has demonstrated extraordinary efficacy, achieving a mean average precision of 99.1% for text detection on the front of Nepali citizenship cards and 96.1% on the back.
Once YOLOv8 isolates and crops these specific ROIs, the image patches undergo rigorous preprocessing to standardize the input. This includes grayscale conversion, contrast enhancement, severe noise reduction (often utilizing Contrast Limited Adaptive Histogram Equalization, or CLAHE), and morphological reconstruction to repair faint or broken strokes caused by physical document degradation.
The preprocessed patches are then fed into an optimized recognition engine, such as a highly customized PyTesseract model or, more effectively, a Convolutional Recurrent Neural Network (CRNN) utilizing Connectionist Temporal Classification (CTC) loss. The CRNN-CTC architecture represents a paradigm shift for Indic scripts because it predicts a sequence of characters directly from the holistic image features without requiring individual character segmentation.
By treating the text line as a continuous sequence, the network elegantly bypasses the insurmountable difficulties of segmenting shirorekha and matra overlaps, resulting in dramatically lower error rates.
| OCR Pipeline Stage | Technology Utilized | Function and Mechanism for Nepalese Documents |
|---|---|---|
| Document Framing | Edge-Computing UI | Guides the user to capture a glare-free, highly focused image without requiring a manual shutter tap; rejects blurred frames instantly. |
| Region of Interest (ROI) Detection | YOLOv8 | Detects bounding boxes for specific fields (Name, ID Number, DOB) while ignoring background noise and seals; achieves >99% precision. |
| Image Preprocessing | CLAHE & Morphological Reconstruction | Enhances contrast, removes shadows/glare, and repairs faint strokes in degraded legacy citizenship certificates. |
| Text Recognition | CRNN with CTC Loss | Transcribes Devanagari sequences without requiring character-level segmentation, successfully navigating shirorekha and conjunct complexities. |
5.3 NFC Data Extraction for ePassports and Advanced Identity Cards
While OCR handles legacy visual documents, the application must also be forward-compatible with cryptographically secure digital documents. The Department of Passport in Nepal issues ePassports that comply with the International Civil Aviation Organization (ICAO) Document 9303 standard. These passports contain a contactless Radio Frequency Identification (RFID) chip storing the user’s high-resolution biometric photograph and demographic data.
To provide the ultimate frictionless experience, the mobile application should integrate Near Field Communication (NFC) reading capabilities. Instead of relying solely on optical extraction of the Machine Readable Zone (MRZ), the app prompts the user to tap their ePassport against the back of their smartphone. Utilizing protocols such as Basic Access Control (BAC) or Password Authenticated Connection Establishment (PACE)—derived from scanning the printed MRZ—the application securely unlocks and reads the data directly from the RFID chip. This guarantees 100% data accuracy, completely bypasses the limitations of optical glare or lighting, and provides an unforgeable, high-resolution portrait for subsequent biometric liveness matching.
From a UX perspective, whether using OCR or NFC, the extraction process must happen inline—meaning the user is never redirected away from the core onboarding flow. The extracted data must populate instantly into the form fields, allowing the user to simply confirm the accuracy rather than type it from scratch. This deliberate inversion of effort—from manual “data entry” to automated “data confirmation”—is the single most effective intervention for reducing cognitive load and UX friction during the identity verification phase.
6. Biometric Liveness, Facial Verification, and Fraud Prevention
Extracting high-fidelity text from an identity document establishes who the person claims to be. The second, equally critical step in remote e-KYC is proving that the person physically holding the mobile device is indeed that exact individual, and that they are a live, responding human being rather than a spoofed artifact. This is achieved through 1:1 biometric facial matching between the selfie captured by the device’s front-facing camera and the official portrait extracted from the identity document or NFC chip. However, facial matching algorithms alone are highly vulnerable to presentation attacks and synthetic identity fraud.
6.1 Presentation Attack Detection (PAD) and ISO/IEC 30107-3
As financial institutions digitize, fraudsters continuously attempt to bypass biometric checks using Presentation Attacks. A Presentation Attack Instrument (PAI) is a physical artifact presented directly to the camera sensor. These range from rudimentary printed photographs or digital images displayed on secondary tablet screens (2D attacks) to highly sophisticated 3D silicone masks, latex prosthetics, and hyper-realistic mannequins.
To defend the mobile banking application against this vector, it is mandatory to integrate robust, certified Liveness Detection. Global biometric security standards dictate that the liveness detection algorithm must be independently tested and certified against the rigorous ISO/IEC 30107-3 standard by an accredited laboratory, such as iBeta Quality Assurance.
| iBeta Certification Level | Attack Sophistication | Examples of Attack Instruments (PAIs) | Required Defense Efficacy (ISO 30107-3) |
|---|---|---|---|
| Level 1 | Basic | High-res printed photos, paper cutouts, video replays on mobile/tablet screens. | 0% Attack Presentation Classification Error Rate (APCER) against simple 2D PAIs. |
| Level 2 | Substantial | 3D curved paper masks, latex/silicone face masks, life-like resin prosthetics. | ≤ 1% APCER; successfully detects subtle texture, material, and depth anomalies. |
| Level 3 | High | Targeted, hyper-realistic artifacts with curated lighting/motion environments. | Near 0% APCER; strict Pass/Fail under intense adversarial testing conditions. |
Liveness detection architectures can be implemented either actively or passively. Active liveness requires the user to perform specific, randomized gestures—such as smiling, nodding, turning their head to varying degrees, or blinking upon command. While historically effective, active liveness introduces severe UX friction. Users in varied lighting conditions, public spaces, or those with minor physical limitations often fail these challenges due to algorithmic timeouts, leading directly to frustration and onboarding abandonment.
Passive liveness represents the absolute modern standard for frictionless UX. It requires absolutely no action from the user; they simply position their face within an on-screen oval and look at the camera for a fraction of a second. The underlying deep-learning AI analyzes micro-texture variations in human skin, subtle involuntary movements (such as micro-expressions and blood flow pulses), and the differential reflection of ambient light across 3D facial surfaces to instantly determine true liveness. Passive liveness preserves the integrity of the fast-track onboarding funnel while maintaining strict ISO 30107-3 Level 2 security standards.
6.2 Camera Injection Attacks and the Deepfake Threat
While ISO 30107-3 rigorously secures the physical sensor against physical presentation attacks, a rapidly escalating and highly dangerous vector in financial crime is the Camera Injection Attack. In an injection attack, the fraudster systematically bypasses the physical camera hardware entirely. Utilizing device emulators, rooted smartphones, or virtual camera software, the attacker intercepts the data stream between the mobile operating system and the banking application, injecting a pre-recorded video or a highly sophisticated AI-generated deepfake directly into the application’s processing pipeline. Because the injected media never passes through a physical lens, presentation attack sensors cannot detect physical artifacts like screen glare, pixelation, or mask edges.
Consequently, an onboarding system can hold an iBeta ISO 30107-3 Level 2 certification and still remain completely defenseless against a deepfake injection attack. To comprehensively address this vulnerability, European regulatory bodies and global standards organizations have established new frameworks, notably the CEN/TS 18099 standard (and the forthcoming ISO/IEC 25456), which explicitly govern Injection Attack Detection (IAD). Modern e-KYC platforms must utilize multi-frame capture analysis to examine unnatural stability and temporal inconsistencies inherent in injected deepfakes, ensuring that synthetic media is flagged before the account is provisioned.
7. Cryptographic Device Integrity and App Attestation
Defending against camera injection attacks and maintaining data privacy under Nepal’s Individual Privacy Act requires security measures that operate far below the application layer, interacting directly with the mobile device’s core operating system and cryptography hardware. The mobile banking app must continuously and autonomously monitor the integrity of its runtime environment.
This foundational security posture is achieved by implementing App Attestation APIs provided natively by the operating systems: Google Play Integrity (which supersedes SafetyNet) for Android devices, and App Attest (leveraging DeviceCheck) for iOS devices.
When the user initiates the KYC process, the mobile app requests an integrity verdict from Google or Apple servers. These services perform deep, cryptographic evaluations of the hardware and software environment to verify two critical factors:
- The device is a genuine, unrooted, and non-jailbroken physical smartphone, rather than a manipulated emulator or virtual machine running on a fraudster’s server.
- The banking application itself is the genuine, unmodified binary installed directly from the official App Store or Google Play Store, proving it has not been tampered with, repackaged, or injected with malicious virtual camera hooks.
The resulting attestation payload is cryptographically signed by Apple or Google and must be validated exclusively by the bank’s backend servers, preventing any possibility of client-side spoofing. Furthermore, this attestation must be inextricably linked with Transport Layer Security (TLS) Pinning (or Certificate Pinning).
TLS pinning embeds the exact cryptographic hash of the bank’s legitimate server certificate directly inside the mobile app’s compiled code. When the app transmits the highly sensitive extracted OCR data, PII, and biometric facial vectors to the server, it explicitly refuses to connect if the server’s presented certificate does not match the pinned hash.
This absolute safeguard prevents Man-in-the-Middle (MITM) attacks, ensuring that a bad actor operating on a compromised public Wi-Fi network cannot intercept, view, or alter the KYC payload in transit. By combining App Attestation, TLS 1.3 pinning, and JSON Web Token (JWT) nonces, the bank forces the attacker into an impossible scenario: they must simultaneously forge a valid signed request, defeat certificate pinning, hold an unexpired JWT, spoof Play Integrity, and stay under rate limits on a non-rooted device. This defense-in-depth architecture secures the frictionless UX without compromising regulatory compliance.
8. Strategic Conclusions and Future Outlook
The digital modernization of the Know Your Customer pipeline is no longer merely a regulatory compliance exercise governed by the Nepal Rastra Bank; it is a critical determinant of commercial viability, user retention, and market share acquisition in Nepal’s highly competitive financial sector. By aggressively minimizing UX friction during the vulnerable account creation phase, institutions directly lower their Customer Acquisition Cost (CAC) and drastically improve the likelihood of capturing the user within the vital seven-day activation window.
The structural implementation of a Tiered Digital Upgrade path directly aligns with NRB transaction directives while elegantly honoring user psychology, requesting friction only when the user is motivated to unlock specific, high-value financial utility. Moving forward, the widespread adoption of specialized vision AI models—particularly YOLOv8 paired with sequence-learning CRNN-CTC architectures fine-tuned specifically for the topological complexities of the Devanagari script—will entirely eliminate the need for manual data entry, seamlessly bridging the gap between physical identity cards and digital databases. When applied in tandem with NFC-based ePassport reading, data extraction reaches absolute fidelity.
Crucially, the deployment of passive biometric liveness detection, fortified by OS-level app attestation (Play Integrity/App Attest) and cryptographic TLS pinning, will secure the perimeter against both rudimentary presentation attacks and advanced, AI-generated deepfake injection vectors. As Nepal continues to advance initiatives like the National Identity Card and the Nagarik App, banking systems built on these frictionless, interoperable, and cryptographically secure architectures will not only achieve immediate competitive advantages but will also serve as the primary engines accelerating the nation’s transition toward comprehensive, universal digital financial inclusion.
