Mobile money platforms, notably Kenya’s M-PESA, have significantly broadened financial access for the unbanked ( Vodafone Group, 2025). In Somalia, local mobile payment services such as EVC Plus by Hormuud Telecom and E-Dahab by Dahabshiil also play a crucial role in daily financial transactions. These platforms are widely adopted across the country, enabling users to send and receive money, pay bills, top up airtime, and access small-scale digital finance. Their accessibility—even in remote areas—has made them essential tools for driving financial inclusion in fragile settings.

The transformative impact of mobile money on financial inclusion has been extensively documented in Kenya. Jack and Suri (2014) found that M-PESA reduced transaction costs, improved risk-sharing among households, and enhanced financial resilience, particularly among low-income populations. These findings demonstrate the broader potential of mobile money platforms to promote inclusive economic participation and provide valuable lessons for other East African countries, including Somalia.

However, despite this progress, regional interoperability and regulatory inconsistencies continue to hinder cross-border financial integration ( East African Community Secretariat, 2024). The Eastern Africa Regional Digital Integration Project (EARDIP) aims to address these barriers by harmonizing payment systems and e-commerce regulations across the region ( World Bank, 2025).

In Somalia, digital finance is underpinned by the National ICT Policy & Strategy 2019–2024, which prioritizes affordable ICT access and digital literacy as prerequisites for financial inclusion ( Federal Republic of Somalia, 2019). Complementary reports, including the ICT Sector Investment Study ( Somalia Investment Promotion Office, 2022) and the World Bank Digital Economy Report ( World Bank, 2022), stress the importance of regulatory reform, public-private partnerships, and digital infrastructure investment to unlock inclusive financial services.

Launched in 2007, M-PESA remains the region’s most successful fintech innovation. With more than 60 million users across eight countries—including Kenya, Tanzania, Ghana, and Ethiopia—M-PESA enables mobile-based transactions such as money transfers, bill payments, and credit access through a network of over 660,000 agents ( Vodafone Group, 2025). Its success offers insights for replication and scaling across the Horn of Africa, particularly in fragile markets like Somalia.

Robust national ID systems are critical for secure identity verification and trusted access to public and private services ( World Bank, 2019a, 2019b). Countries such as Rwanda and Uganda have implemented successful digital ID frameworks through platforms like IREMBO and NIRA, which enable biometric-based authentication for a range of services ( Republic of Rwanda, 2015), ( Republic of Uganda, 2015).

Somalia’s National Identification Number (NIN) initiative seeks to emulate and localize these models by linking digital IDs with financial services. The National ICT Policy & Strategy 2019–2024 underscores digital identity as central to e-Government and financial inclusion ( Federal Republic of Somalia, 2019), while the National Communications Law 2017 ( Federal Republic of Somalia, 2017) and the Somalia Data Protection Act 2023 provide a legal basis for consumer protection, data privacy, and lawful processing of personal information in ID-linked services.

A major regulatory shift occurred in July 2025, when the Central Bank of Somalia (CBS), in partnership with the National Identification and Registration Authority (NIRA), mandated that all individuals must present a government-issued National ID to open or renew bank accounts, effective 1 September 2025. This directive establishes a standardized identity verification framework across all financial institutions and closes long-standing gaps in digital trust and user authentication ( Somali National News Agency [SONNA], 2025a).

As digital financial ecosystems expand, exposure to cyber threats—including fraud, data breaches, and system disruptions—also increases ( OECD, 2020). Weak cybersecurity frameworks can discourage user trust and limit the adoption of digital financial services. Regional initiatives such as the Eastern Africa Regional Digital Integration Project (EARDIP) emphasize the importance of strengthening cybersecurity and data governance across the EAC ( Federal Republic of Somalia, 2017).

In Somalia, earlier assessments identified major gaps in cyber readiness, prompting reforms and incident response planning ( Federal Government of Somalia, 2020). This has advanced with the Cybersecurity Law (2026), which establishes a national framework for protecting infrastructure, securing systems, and managing cyber incidents ( National Communications Authority [NCA], 2026a). The law also defines institutional roles and response mechanisms.

Complementing this, Somalia has operationalized the Somalia Computer Incident Response Team (SOMCIRT) as the national center for detecting and responding to cyber threats ( National Communications Authority [NCA], 2026b), marking a shift toward a more coordinated approach.

However, challenges remain, including limited technical capacity, shortage of skilled professionals, and weak institutional coordination. Addressing these gaps is essential to ensure secure digital financial systems and sustain public trust.

Although digital ID systems and financial technologies have been widely studied, few academic works focus on the intersection of ID systems and cybersecurity in fragile contexts such as Somalia. Regional strategies like the EAC E-Commerce Framework and Somalia’s e-Government Strategy Terms of Reference call for deeper research into public service digitization and citizen participation—areas still underrepresented in scholarly literature ( OECD, 2020).

At the base of the framework is Digital Identity, which serves as the primary mechanism for establishing “who is who” in the digital realm. In Somalia, this is operationalized through the National Identification and Registration Authority (NIRA) and its ecosystem of platforms: ▪

e-Aqoonsi: Provides biometric-based authentication (facial recognition and fingerprints) to ensure unique identity and reduce fraud. The platform allows citizens to access services remotely, including bank accounts, SIM registration, and welfare programs ( SONNA, 2025b; NIRA, 2024a).

The second pillar provides the legal scaffolding necessary to protect user rights and regulate the behavior of digital actors. Without enforceable laws, technological tools like digital IDs can lead to privacy concerns or data misuse. This study focuses on: ▪

The Data Protection Act (2023): This law establishes the legal basis for the lawful processing of personal information and creates the Data Protection Authority to oversee compliance.

The third pillar acts as the security guardrail, protecting the system from external threats and system disruptions that could otherwise erode public confidence. The framework identifies two critical components recently introduced in Somalia: ▪

Cybersecurity Law (2026): This provides the legal mandate for protecting critical national infrastructure and defines the institutional roles for managing cyber incidents.

Digital trust emerges through the systematic integration of three pillars as shown in Figure 1: Digital Identity as a technical anchor, ICT Policy as legal scaffolding for data rights, and Cybersecurity as a protective guardrail. This convergence facilitates Somalia’s transition to an inclusive digital financial ecosystem. Harmonizing these reforms with EAC standards and Vision 2060 enables expanded access to Sharia-compliant finance and remittances for marginalized groups. Thus, digital transformation establishes a trusted foundation for economic empowerment and national data sovereignty.

The researchers followed a qualitative, multi-method approach, combining semi-structured interviews with document analysis, to capture firsthand insights and policy trends shaping digital trust in Somalia, within the broader East African context.

a.

Semi-Structured Interviews

To capture nuanced perspectives on digital trust, fifteen key informants—including consultants, IT engineers, digital finance experts, bank staff, and civil society representatives—were interviewed between June 2025 and Jan 2026, via in-person and virtual formats using a conversational style with open-ended questions. To ensure the integrity and candor of the data, all participants provided informed consent regarding anonymity and confidentiality, with interviews held in neutral, private settings. Researchers’ bias was mitigated through the systematic documentation of reflections in detailed field notes. b.

Policy review

Primary interview data was triangulated with a rigorous review of foundational Somali legal and strategic frameworks. This included the National ICT Policy & Strategy 2019–2024, National Communications Law 2017, and ICT Regulatory Transformational Strategy 2023–2027. Critically, the review also examined the Data Protection Act (2023) and the Cybersecurity Law (2026) to evaluate the legal scaffolding of the digital ecosystem. These documents were analyzed alongside comparative features of other East African Community (EAC) national ID frameworks, as summarized in Table 1.

This study was conducted in accordance with established ethical principles for research involving human participants, including voluntary participation, confidentiality, participant autonomy, and responsible data management. The research was designed as a minimal-risk qualitative study based on expert interviews addressing digital trust, cybersecurity, and financial inclusion within the Somali context.

In accordance with the institutional research guidelines applicable to the authors’ affiliated institution, formal ethical approval was not required for this study, as it involved non-sensitive expert perspectives, did not include vulnerable populations, and posed no foreseeable risk to participants. Nonetheless, the study was conducted with strict attention to ethical responsibility, ensuring the protection, dignity, and rights of all participants throughout the research process.

Prior to participation, all respondents were fully informed about the objectives, scope, and academic purpose of the study, as well as the voluntary nature of their involvement. Participants were also informed that interviews would be audio-recorded solely for research and transcription purposes.

Informed verbal consent was obtained from all participants before each interview. Verbal consent was selected over written consent due to the specific nature of this research, which involved discussions of institutional, policy, and governance-related issues in Somalia. Many participants held professional positions in government or affiliated institutions, and requesting signed consent documents could create hesitation or perceived professional risk when expressing their views. Such formality could also affect the openness and depth of responses, which were critical for capturing authentic expert perspectives. Given that the study did not involve personal or sensitive individual data and relied on high-level professional insights, verbal consent was considered the most appropriate approach to ensure both ethical compliance and participant trust.

To ensure transparency and accountability, verbal consent was explicitly confirmed and documented at the beginning of each interview through audio recording and researchers’ field notes. Participants provided consent for participation, audio recording, and the use of anonymized data for academic research and publication.

Interviews were conducted in secure and neutral settings, and no personally identifiable information was included in the analysis or reporting of findings. Audio recordings, transcripts, and field notes were securely stored and accessed only by the researchers for academic purposes. Participants were informed of their rights, including the right to decline participation, refuse to answer any question, or withdraw from the study at any time without consequence.

Audio-recorded interviews were transcribed and systematically analyzed using NVivo software through a specialized two-phase coding process. First, thematic coding was applied to extract nuanced stakeholder perspectives on the “Three Pillars” of digital trust: identity authentication (e-Aqoonsi/HUBIYE), proactive cybersecurity (SOMCIRT), and public trust in Sharia-compliant financial systems. Concurrently, foundational policy documents—including the Data Protection Act (2023) and the Cybersecurity Law (2026)—underwent structural coding to map regulatory objectives against identified implementation gaps, specifically regarding data sovereignty and rural digital literacy. Finally, the synthesis of primary interview data and secondary policy analysis was triangulated with regional comparisons from the East African Community (EAC) to yield evidence-based, context-sensitive recommendations aligned with Somalia’s Centennial Vision 2060.

National ID systems are widely regarded as essential infrastructure for secure digital transactions across the East African Community (EAC) ( Gelb & Diofasi Metz, 2018; UNECA, 2019). In Somalia, the launch of e-Aqoonsi marked a significant turning point in accessibility; as noted by a Somali IT engineer in 2025, “The e-Aqoonsi app has enabled remote communities to obtain digital IDs without traveling to cities”. While biometric authentication and real-time verification through HUBIYE have enhanced institutional trust, stakeholder interviews indicated that public awareness of these capabilities remains notably low in rural areas.

A critical regulatory milestone occurred in July 2025, when the Central Bank of Somalia mandated the use of a government-issued National ID for all banking transactions, effective September 2025,. This directive standardized identity verification across the financial sector and addressed long-standing authentication gaps. Finally, the Certificate Delivery System (CDS) streamlines the issuance of official documents, utilizing digital signatures and QR codes to reduce opportunities for corruption and exclusion ( Gelb & Diofasi Metz, 2018; UNECA, 2019), ( NIRA, 2024a). Together, these platforms establish the technical “anchor” necessary for expanding financial inclusion and building a resilient digital economy.

The research highlights a critical shift from policy drafting to active legal enforcement, providing the “scaffolding” necessary to protect user rights.

The enactment of the Data Protection Act (Law No. 005/2023) and the establishment of a functional Data Protection Authority have created a legal basis for the lawful processing of personal information. This aligns Somalia with regional standards and addresses long-standing privacy concerns by introducing enforceable measures. Emphasizing the practical application of these protections, a NIRA staff member noted: “Consent features in the e-Aqoonsi app help build trust, but ongoing education is still needed”.

These reforms are central to Somalia’s Centennial Vision 2060, which prioritizes digital transformation as a means of governance and citizen empowerment. By placing institutional trust at the heart of economic development, the policy framework ensures that technology serves the broader goal of national stability. A Somali regulator underscored the importance of this human-centric approach, stating: “The success of e-Aqoonsi hinges not just on technology , but on whether citizens believe their data is safe and that the system works in their favor”.

As shown in Table 1, while Somalia has historically lagged behind East African Community (EAC) peers like Kenya and Rwanda, its recent legislative surge has significantly narrowed the regulatory gap,. However, challenges remain as cross-border interoperability and recognition of digital credentials currently remain in the “planned” phase rather than being fully active.

The transition from a “reactive” to a “proactive” security stance is marked by the introduction of institutional safeguards designed to protect critical infrastructure. As a cybersecurity expert reported during the research: “Without a proactive cybersecurity policy, we’re always reacting to threats like phishing and SIM swaps”.

Legislative and Operational Launch: The Cybersecurity Law (2026) provides the legal mandate for securing information systems, while the Somalia Computer Incident Response Team (SOMCIRT) serves as the operational center for detecting and responding to national cyber threats. This shift allows Somalia to complement regional efforts within the East African Community (EAC), where countries have made significant strides in establishing CERTs and consumer protections.

The Data Sovereignty Concern: A recurring theme in stakeholder interviews is the risk associated with foreign-hosted data systems, which leaves the digital ecosystem vulnerable to external data misuse. An advisor at the Ministry of Communications and Technology emphasized that: “Ongoing efforts toward data localization, including the development of local data hosting infrastructure, are expected to strengthen national cybersecurity by reducing reliance on foreign-hosted systems and improving control over sensitive information”. Experts emphasized that until Somalia develops local data centers, its national sovereignty remains directly impacted by this technical reliance.

The findings suggest that digital trust in Somalia is not merely a byproduct of technology but is built through the alignment of these three pillars. As summarized in Table 1, Somalia has successfully matched its EAC peers in biometric and mobile ID capabilities. However, the study concludes that the final step toward a resilient digital economy requires moving from foreign hosting to local data sovereignty and ensuring that rural citizens believe their data is safe through ongoing education. As a Somali regulator emphasized: “The success of e-Aqoonsi hinges not just on technology, but on whether citizens believe their data is safe and that the system works in their favor”. This trust is further reinforced by transparent “consent features” within platforms like e-Aqoonsi, which NIRA staff noted “help build trust, but ongoing education is still needed”.

A comparative review indicates that Somalia has historically trailed its East African peers in data protection, cybersecurity regulations, and cross-border interoperability (see Table 1). While nations such as Kenya ( NIRA, 2024b), Uganda ( Republic of Rwanda, 2015), ( Republic of Uganda, 2015), Rwanda ( Republic of Rwanda, 2015), the Democratic Republic of Congo (DRC) ( World Bank, 2019a), ( World Bank, 2019b), and Tanzania ( Somalia Investment Promotion Office, 2022), ( Gelb & Clark, 2013) are actively piloting interoperable digital ID systems, Somalia’s regulatory environment remained in a developmental drafting phase for a prolonged period.

However, the enactment of the Data Protection Act (Law No. 005/2023), the establishment of a functional Data Protection Authority, and the approval of the Cybersecurity Law (2026) have significantly reinforced the legal scaffolding and security guardrails necessary for institutional trust ( IDTechWire, 2025; NIRA, 2024a, 2024b, 2024c; SONNA, 2025a). This legislative progress establishes a robust foundation for personal data management, though Somalia remains the only regional actor identified as utilizing foreign data hosting rather than local infrastructure.

Despite the technical and legislative milestones achieved through the three-pillar framework, research findings identify six critical implementation gaps that hinder the full realization of digital trust in Somalia. ▪

Infrastructure Inadequacy: Rural regions continue to face significant deficits in digital infrastructure, which restricts access to online identity services and limits the equitable distribution of financial tools.

The study concludes that while Somalia shows significant promise in digital identity transformation, its overall cybersecurity readiness and legal enforcement mechanisms still lag behind its EAC neighbors. As a Somali regulator underscored, the ultimate success of these initiatives hinges not just on technology, but on whether citizens believe their data is safe. Addressing these systemic gaps is essential to move from “digital potential” to a resilient, integrated, and inclusive digital economy.