Bermuda's Digital ID Supplier Search: Where AI Helps

TL;DR

Bermuda is exploring a national digital identity system and qualifying potential suppliers. Questions close on 23 October; qualification responses are due at 10am Bermuda time on 27 November. The Government says it has made no implementation decision. AI could help check documents and detect fraud, but any system would need tests for mistaken matches, wrongful rejection and deepfake attacks. Start with a baseline: time ten ID checks by 19 October.

What happened

The Government procurement page was published on 2 October and lists 5 October as the issue date for the request for supplier qualifications, BNDI2026. It describes a potential single-provider public-private partnership. On 2 October, Minister of Economy and Labour Jason Hayward said the exercise was exploratory and did not commit Bermuda to implementation.

The qualification document covers identity proofing, authentication and digital wallets. It explicitly requires compliance with the Personal Information Protection Act 2016, independent security assessment and provisions for leaving the supplier. These requirements give evaluators a basis for asking bidders to show how the controls would work.

Hayward also promised public engagement as the work develops. Residents should look for those opportunities to ask how access would work without a smartphone. Bidders have a separate route: the procurement notice restricts their questions to the named RFSQ contact.

A second document sits beside it. On 26 August the Bermuda Monetary Authority sent stakeholders a letter (Document 2026-SL001) on its consultation about licensing digital identity service providers. It concluded that the potential of digital identity could be "more effectively realised through targeted enhancements" to the existing anti-money laundering and anti-terrorist financing rules than through a standalone licensing regime. It found "limited evidence of a sustainable commercial basis for developing a domestic DISP market under a standalone prudential licensing regime", where DISP is the Authority's term for a digital identity service provider. It also recorded respondents' view that reaching scale "may be particularly challenging in smaller jurisdictions where the costs of compliance, governance and ongoing operation are significant relative to the size of the market". The Authority will write supervisory guidance and says it may revisit its options.

The two documents do not contradict each other. The BMA is writing about banks, insurers and other regulated firms checking their customers. The notice is about a credential for everyone. I found no document that links them, and I do not claim the Government is ignoring its regulator. The BMA conclusion concerns a particular licensing proposal. It does not establish that a government-backed system would be unviable.

The numbers

Start with why anyone builds one. The World Bank's ID4D team estimated in its 2021 global dataset that just under 850 million people had no official proof of identity, around 1 in 9 people worldwide. Over half of them are children whose births were never registered, and over 90 percent live in low-income and lower-middle-income countries. I have no equivalent figure for Bermuda. I use the global one because it explains why governments, banks and aid agencies keep funding identity systems: a person with no proof of identity is shut out of services.

The next number is the one a bidder should be asked about. The US National Institute of Standards and Technology tested face matching at scale. Its December 2019 study covered 189 software algorithms from 99 developers, using four collections of photographs with 18.27 million images of 8.49 million people. For one-to-one matching, the kind a phone uses to unlock, NIST saw higher false positive rates for Asian and African American faces than for Caucasian faces, and "the differentials often ranged from a factor of 10 to 100 times, depending on the individual algorithm". For one-to-many matching, the kind used to search a database, it saw higher false positive rates for African American females. Not every algorithm did this, and the most equitable algorithms were also among the most accurate. The study tested 2019-era algorithms on US-held photographs. It did not test any single vendor's current product, and it did not test Bermudians.

Fraud has moved on since then. Gartner said on 1 February 2024 that by 2026 attacks using AI-generated deepfakes on face biometrics would lead 30% of enterprises to stop treating such identity checks as reliable on their own, and that injection attacks, where fake video is fed into the app instead of held up to the camera, increased 200% in 2023. Its fix is a combination of presentation attack detection, injection attack detection and image inspection. That is a forecast from an analyst firm, not a count of Bermudian cases.

Then the scale of the place. The 2016 census preliminary report put Bermuda's civilian non-institutional population at 63,779, which excludes 711 people in institutions, 138 people who were not sheltered or were homeless, and 4,637 overseas visitors. This is a historical population figure, not a current user count or a cost forecast. The qualification document says residents must not be charged for essential digital identity services. Bidders still need to explain how operating costs would be funded.

What this means in Bermuda and the Caribbean

Bermuda sits in the North Atlantic. Its procurement still raises questions familiar to Caribbean governments considering digital identity. Jamaica's 2019 court challenge is a historical example: the Jamaica Observer reported that Prime Minister Andrew Holness said about US$1.3 million of a US$68-million IDB loan had been spent, with identification accounting for about 20 per cent of the loan. That episode shows why legal authority matters; it does not describe Jamaica's current NIDS status. Bermuda's qualification document already names PIPA and asks suppliers about legal readiness. The question is how those duties will be implemented and checked.

I apply the method I call People First, Problem Second, AI Last. A test we suggest is to write the human need and the problem in two sentences each without the word AI. The need: a Bermudian opening a bank account, renewing a licence or signing a lease wants to prove who they are once, without queueing or handing over a pile of paper. The problem: proof today sits in separate paper and card checks held by separate organisations, and the BMA's own letter records stakeholders asking for clearer guidance on using digital ID to identify and verify customers. Neither sentence needs AI. AI belongs at the points where checking is slow or fraud is likely, and I list those next.

A second method applies to the contract itself. I call it Extracted Intelligence: data about a community leaves as raw material and returns, if at all, as a product the community must buy. An identity operator could gain access to sensitive usage records, depending on the design. That is a risk to examine, not an established fact about a system that has not been built. Bermuda already asks for data portability and exit arrangements. Evaluators should test whether those terms would let the Government move providers without losing records or interrupting access. For related reading, see our article on citizenship by investment and AI vetting.

What AI can do for residents and banks

The first job is the check itself. Software can read a passport or driving licence, compare the photo with a live selfie and test the document for tampering, in seconds instead of a branch visit. The BMA says respondents saw "enhanced customer experience, operational efficiency, stronger security" in digital identity. I have no Bermudian timing data, so I treat the speed-up as our inference and make it the first thing to measure.

The second job is explaining. A language model can turn a bank's onboarding rules into plain steps and answer "why was I asked for this again?" at midnight. The risk is a confident wrong answer, so it should quote the rule and link to it, and a person should handle exceptions. Older residents and people with no smartphone need a counter and a person, and the contract should say so.

For banks, insurers and trust companies the BMA's planned guidance is the opening. The Authority says regulated firms stay responsible for deciding whether a digital ID solution is "sufficiently reliable, independent and appropriate" for the risk. That is a testing job, and AI can help with it: use synthetic test documents and consented photographs in an authorised test environment, then record which checks fail. Do not submit fabricated identities to a live public service.

What AI can do for the Government and the supplier

Fraud prevention is on the notice's own list of functions. Pattern detection across credential issuance is where AI earns its place: ten credentials requested from one device in an hour, the same photograph under different names, a sign-in from a new device a minute after a password reset. A model flags them and an officer decides. Ask for the false alarm rate and the review process. An incorrect alert can delay a legitimate customer; whether it blocks access depends on what the system does next.

An identity wallet needs access controls and audit records appropriate to the sensitive information it handles. It need not hold money or medical records to expose someone to harm. A model can read the supplier's audit logs and flag unusual access, such as one staff account viewing 400 records in an afternoon. Again the model flags and a person decides.

The Government can ask any bidder to put six things in writing. Accuracy figures for face matching, by group, measured on a sample that includes Bermudians, with the sample size. A live-face check that covers injection attacks as well as printed photos. Data kept in Bermuda unless a resident agrees otherwise. Residents able to see who looked at their record. Logs and source code escrow handed over at the end of the contract. A fallback that works without a phone. These are questions for the evaluation and contract stages. Their cost and feasibility need to be assessed before a commitment.

What to do this week

These are suggested first checks for compliance and procurement teams. The sample sizes are starting points for discussion, not evidence that a system is secure or statistically fair.

1. Time ten customer ID checks at your firm, from first contact to account ready, and log how many needed a second visit or call. Finish by 19 October. That is your baseline, and any vendor's claim of faster onboarding should be set against it.
2. Ask every digital ID vendor in writing, before 13 November, for face-matching false positive and false negative rates by demographic group, with the sample size and where the photographs came from. Treat an answer with no figures as unknown accuracy.
3. Test your own live-face check in an authorised test environment with 20 attempts using consented images, including a printed photo, a screen photo and a replayed video. Investigate any pass before deployment. Passing this small test does not establish security or cover digital injection attacks.
4. Check the procurement timetable. Bidders must direct questions to Mark Neale at mcneale@gov.bm by 23 October and register their interest. Ask how privacy duties, access logs, supplier exit and access without a smartphone would work. The submission deadline is 10am Bermuda time on 27 November; check for amendments.

Where this can go wrong

Mistaken identity has two different forms. A false positive matches two different people; a false negative fails to recognise the same person. Both can cause harm, but the consequences depend on the service. The NIST figures above concern false matches and cannot be used as rejection rates. Ask for both measures by demographic group, sample sizes and a practical route to human review. The study did not establish how any proposed system would perform for Bermudians.

Deepfakes are the second. A system built to catch a photo held up to a camera can miss fake video injected into the app, and Gartner's 200% rise in injection attacks shows where criminals went. The guardrail is the three-part defence Gartner describes, tested by someone who is not the vendor.

The third risk is lock-in and data access. The qualification document already includes PIPA, security assessment and exit requirements. Reviewers need evidence that the design meets them: who can access records, what gets logged, how long data is retained and what happens when the supplier changes. Exclusion also needs attention. Keep a usable route for people without a phone, passport or steady connection.

The weakest part of this argument

The official qualification document and the minister's statement clarify several points that a newspaper summary leaves open. No implementation decision has been made, and privacy and exit requirements are already specified. I still do not have bidder proposals, a final contract or data showing that digital identity would shorten Bermudian onboarding. NIST's study and Gartner's figures come from elsewhere and earlier years. They help frame tests; they cannot substitute for local results.

Questions readers ask

When does the Bermuda digital identity bid close?

Qualification responses are due at 10am Bermuda time on 27 November 2026. Questions close on 23 October. The official timetable and contact rules govern bidders, and the Government may amend the dates. This stage does not commit Bermuda to implementing a system.

Is there a licensing regime for digital identity providers in Bermuda?

Not for now. On 26 August 2026 the Bermuda Monetary Authority said it would not create a standalone licensing regime for now and would write supervisory guidance within the existing anti-money laundering rules instead. It added that it may revisit alternative options and consult on the guidance, so the rules for a national provider are still open.

Can AI face matching treat some groups worse than others?

Yes, and the size depends on the algorithm. In its 2019 test of 189 algorithms, NIST found one-to-one false positive rates for Asian and African American faces that often ranged from 10 to 100 times those for Caucasian faces. NIST also found the most equitable algorithms were among the most accurate, so ask each bidder for its own figures.

Can a deepfake get past a selfie check?

It can, if the system only checks that a live face is in front of the camera. Gartner reported that injection attacks rose 200% in 2023, where fake video is fed straight into the app, and said defence needs presentation attack detection, injection attack detection and image inspection together. A system that has only the first is exposed.

Which Bermuda privacy law applies to a digital ID?

Bermuda's Personal Information Protection Act 2016 came into full effect on 1 January 2025. The qualification document expressly requires PIPA compliance. Bidders must explain how their proposed approach would meet those duties; a future contract will still need precise responsibilities and controls.

What happened to Jamaica's national ID?

Jamaica's courts rejected its National Identification and Registration Act. In May 2019 Prime Minister Andrew Holness said only about US$1.3 million of a US$68-million IDB loan had been spent, with the identification part about 20 per cent of the loan, according to the Jamaica Observer. He said the Government would return with legislation meeting the court's parameters.