PRACTITIONER’S A DIGITAL STACK FOR NOTE TRANSFORMING SERVICE DELIVERY: ID, PAYMENTS, AND DATA SHARING1 FEBRUARY 22, 2022 Introduction Digital technologies are changing how Figure 1. The digital stack and its layers the world interacts and transacts. From opening bank accounts to parents enrolling their children in school and social safety Users / net programs verifying a new beneficiary, Beneficiaries to businesses applying for licenses, day- to-day activities are becoming increasingly automated and integrated. By moving beyond digitization (i.e., making digital what Use Cases already exists) to digitalization (i.e., making Common standards and open interfaces what exists better, empowered by digital technologies), countries are shifting toward Payments Trusted digital payments interactions and transactions that are streamlined, on-demand, paperless, cashless, data-empowered, and available remotely Digital ID Digital Stack over the internet from anywhere. Apart from Core Digital Trusted authentication Layers reducing costs and spurring innovation, this creates opportunities to make better services available to more people, such as by Data Exchange removing the need to physically go to offices Trusted data sharing during business hours to complete a paper form or to distribute cash for payments. To enable this, countries are reforming institutions, regulations and processes and building technology and infrastructure to facilitate trust between parties and to exchange information, payments, and other resources. 1 This note was prepared by Anna Metz, Georgina Marin, Jonathan Marskell, Julia Clark and Karol Karpinski under the guid- ance of Vyjayanti Desai and benefitted greatly from feedback provided by Harish Natarajan and Robert Palacios. It draws on inputs the team also contributed for the forthcoming book Disruptive Technologies for Sustainable Development and the World Bank Group’s “digital economy for all” conceptual framework. ID4D.WORLDBANK.ORG Digital stacks and their core layers—such as for identification (ID), payments, and data exchange—facilitate basic but widely useful functions at a societal scale, enabling better and more inclusive service delivery and innovation across multiple sectors. Sometimes called digital public infrastructure (DPI), these front- and back-end systems— provided by the government or in partnership with the private sector—serve as ‘rails’ that underpin digital transactions and connections for people, businesses, and governments, including service delivery and operations across the public and private sectors, including financial services, e-commerce, education, healthcare, transportation, social safety nets, taxation, and business and property registration. When built using open design principles, open interfaces, and open standards, they not only foster new public sector applications but also provide a foundation to catalyze private sector innovation and new markets. Digital public goods (DPGs)2 can promote greater country ownership, scalability, flexibility, and sustainability of digital platforms, as well as foster communities of practice and collaboration as the technology and experiences underpinning it become a shared resource. Connecting such systems or layers so they can work together and interoperate seamlessly—as part of a ‘digital stack’—creates enormous opportunities for digital government and value in the digital economy. ‘Stacks’ are a common concept in software development and consist of a set of components working together effectively and efficiently to execute an application and for data to flow. This means that ID, payments, data exchange and other layers—whether in the public or private sector—should be designed to be able to be built on top of each other, providing the benefits of economies of scale and creating opportunities for innovation (Figure 1). Examples of the ‘digital stack’ concept include the India Stack and Singapore’s National Digital Identity Stack. Similarly, Thailand’s PromptPay links national ID and payment systems to allow people people to link financial accounts with digital IDs to promote real time payments interoperability. The importance of a digital stack for inclusion and the public benefit became even more relevant with the COVID-19 pandemic, which unleashed a global health emergency and an unprecedented social and economic crisis. Countries that could rely on existing ID, payments, and data exchange layers were better equipped to mitigate the socio-economic impacts of the pandemic. Many countries have looked for new ways to rapidly expand and deliver government-to-person (G2P) payments, including by leveraging digital financial services and by building social registries or transitioning from centralized social registries to federated or virtual ones. Emerging evidence shows that countries that used digital ID and digital databases for delivery of these programs were able to cover 39 percent more beneficiaries than those that did not or were unable to.3 In addition, the importance of online service delivery has magnified the need for digital IDs that enable people to prove who they are to securely transact and access services over the internet.4 For instance, being able to identify and verify who needs assistance and deliver G2P payments with minimal face-to-face interaction represented a tremendous advantage. The same tools have been used by countries to more efficiently and equitably roll out and certify COVID-19 vaccinations. Despite rising demand and clear benefits, significant gaps and challenges remain in the deployment and effective utilization of digital stacks and their core components. These include inadequate data governance frameworks resulting in limited interoperability between information systems and databases, reduced data quality and accuracy, and insufficient safeguards for and trust in their use. Digital identity authentication mechanisms, particularly ones that can enable secure access to services and transactions remotely online, are still nascent in many low- and middle- income countries. Even obtaining a basic ID can be a struggle for many people, particularly the poor, the elderly, those living in rural areas, and persons with disabilities—as of 2018, an estimated 1 billion people do not have a foundational ID.5 Many more lack an ID that is fit-for-purpose in the digital age. Similarly, although the prevalence of digitized, large- value payment systems at the national level is now nearly universal, limited interoperability, coverage, accessibility, and 2 The Digital Public Goods Alliance defines digital public goods as open-source software, open data, open AI models, open standards, and open content that adhere to privacy and other applicable laws and best practices, do no harm by design, and help attain the Sustainable Development Goals (SDGs) 3 Barca V., Johnson D., & Palacios R. (forthcoming). Scaling up cash transfers during the COVID-19 pandemic: what might explain differences in coverage? Working paper. 4 See, for example: “FranceConnect franchit le cap des 20 millions d’utilisateurs et se déploie sur le site de Pôle Emploi à partir de janvier 2021,” https://www.numerique.gouv.fr/espace-presse/franceconnect-cap-20-millions-utilisateurs/; and “Scaling up GOV.UK Verify to help during corona- virus,” https://gds.blog.gov.uk/2020/05/11/scaling-up-gov-uk-verify-to-help-during-coronavirus/ 5 World Bank. 2018. ID4D Global Dataset. https://id4d.worldbank.org/global-dataset 2 reliability of smaller-value payment systems still pose challenges in many countries. While the use of digital payments has steadily increased in recent years,6 globally 1.7 billion adults remain unbanked and, even among people with accounts, usage remains low as the acceptance of digital payments and access to a full suite of digital financial services remains constrained. As a result, many of the efficiency and economic empowerment gains remain unrealized. This note synthesizes findings from recent research, country case studies, and reports regarding the benefits, enablers, challenges, and good practices for implementing digital stacks and the systems that make up their backbone. Its primary focus is on three digital systems that are generally considered to be the core of a digital stack for individual-level transactions and service delivery: digital identification, digital payments, and trusted data exchange.7 8 It describes the mechanisms through which these layers of the stack—particularly when deployed together—contribute to better development outcomes, highlighting examples from across the globe, as well as challenges for their successful implementation. The aim is to draw attention to their transformational potential and to the impact additional investments in such systems and stacks (and related safeguards and enablers) can have for service delivery and public administration, for fostering economic opportunities, and for empowering individuals. Core digital systems for digital transformation and online service delivery To support seamless, user-friendly, cost-effective, secure, and trusted interactions, countries need appropriate digital systems—and connections between them—that, inter alia, promote offline and online authentication of identities and data, rapid and secure flow of payments, and responsible data exchange between systems and databases. While the specific type and architecture of these systems and layers will vary significantly by country, this section provides a brief overview of the typical functions and utility of each. Digital ID Trust in the identity of a person or entity is a cornerstone of many transactions in the public and private sectors. In today’s increasingly globalized and digital age, there is a pressing need for digital technologies that seamlessly allow people to prove who they are—both In-person and remotely—to facilitate trusted transactions within countries and across borders. With inclusive, trusted, and user-friendly digital ID systems and ecosystems, individuals can more securely and conveniently access services and transactions. Such systems and credentials can streamline processes for bank account opening or obtaining a loan, enable more rapid expansion of social protection programs including through faster processing of new beneficiaries, and create new opportunities for the secure, people-centric management of health9 and education records, as well as reduce the need for in-person visits and for paper documents across services and transactions. Leveraging other core digital layers and infrastructures, digital ID systems—i.e., those that provide digital mechanisms for verifying and authenticating identities and attributes—can underpin digital transformation and service delivery through several mechanisms, including: • Providing governments with data to design relevant programs, identify people who may need assistance, and rapidly scale services. ID systems and population registers often serve as a critical source of demographic and vital statistics, which are needed to support long-term planning, policy making, and new programs in areas such as public health and infrastructure. For instance, in the early 2000s, Thailand’s National Health Security Office (NHSO) 6 According to the 2018 Global Payments System Survey, cashless transactions per capita per year rose by 25 percent between 2015 and 2017 across a sample of 96 countries. 7 See, for example, Monetary Authority of Singapore. 2021. Foundational Digital Infrastructures for Inclusive Digital Economies. Singapore. https:// www.mas.gov.sg/-/media/MAS/Fintech/FDI/Foundational%20Digital%20Infrastructures%20for%20Inclusive%20Digital%20Economies.pdf 8 Of course, while these systems provide core services that can be used across sectors, they are not sufficient for digital transformation, which also requires significant investments in digital connectivity, access, and skills, as well as digitalized systems and services provided by governments and the private sector. 9 World Bank. 2018. The Role of Digital Identification for Healthcare: The Emerging Use Cases, Washington, DC: World Bank. http://documents1. worldbank.org/curated/en/595741519657604541/pdf/The-Role-of-Digital-Identification-for-Healthcare-The-Emerging-Use-Cases.pdf A DIGITAL STACK FOR TRANSFORMING SERVICE DELIVERY: ID, PAYMENTS, AND DATA SHARING 3 was able to rapidly increase healthcare coverage from 70 percent to full coverage by using its national population registry to identify individuals not yet covered by any existing scheme and enroll them into the subsidized Universal Coverage Scheme.10 Coverage is maintained and enrollment of newborns is automated through real-time integration between the civil registration system and the NHSO. • Making it easier for people to prove who they are and for service providers to verify basic attributes (e.g., name, date of birth, address) and eligibility. For example, in response to the COVID-19 pandemic, Argentina launched the Emergency Family Income program, cash transfer of AR$10,000 (~ US$150) to lessen income shocks from the pandemic for vulnerable segments of the population. Authorities were able to use the national ID system to facilitate online pre-registration and identity verification for the program. Application information was verified against the National Registry of Persons and cross-checked against data held by the National Social Security Administration and the Federal Administration of Public Income to ensure compliance with the income- and employment-related eligibility requirements for receiving the transfer. The benefits of digital identity verification can also extend to service delivery in the private sector. In India, the Aadhaar-enabled e-KYC (e-Know Your Customer) platform is estimated to have reduced the cost of the KYC process from Rs 40 (US$0.60) per customer to Rs 5 (US$0.07), making it easier for banks to expand their customer base, greatly boosting financial inclusion.11 • Allowing for more accurate authentication of beneficiaries or customers at the time-of-service delivery (e.g., when receiving cash or other benefits) or when initiating a transaction. In Pakistan,12 the biometric verification capability of the national ID system is used to ensure that cash transfers are directly reaching low-income female beneficiaries rather than their husbands or brothers, as had been common under the previous system. • Enabling the transition to remote, online service delivery. Digital ID systems are increasingly used to enable secure authentication in online contexts for a wide range of services and transactions, from opening an account, to enrolling in a social protection program, to registering a new business. For example, in the wake of the COVID-19 pandemic, several countries, such as Bangladesh and Brazil13 are relying on digital ID systems to enable remote bank account opening (e.g., identity authentication via selfies through a banking app). In Estonia, people can securely access over 600 services and transactions online using their digital ID, including filing taxes, signing documents, registering a company, and even voting. Similarly, Singapore’s SingPass digital ID enables access to more than 1,400 services offered by over 340 public and private sector organizations. Although the technologies, processes, and data used by modern ID systems will differ from country to country, there are several shared features that are important for digital ID systems and ecosystems to bring about these positive benefits, encapsulated in the ten Principles on Identification for Sustainable Development.14 Some key elements include: • Full accessibility so that everyone can obtain a proof of identity; • The ability to uniquely identify a person within a given context (i.e., no duplicate identities),15 for instance, to ensure that individuals cannot register multiple times to receive certain benefits or payments; • The ability to digitally verify and authenticate a person’s identity, using a suite of different tools and modalities that work for all parts of the population and are fit for both online and offline contexts and transactions involving varying degrees of risk; • Use of standards and design principles that allow for interoperability with other systems; and • Existence of strong governance and legal frameworks that promote inclusion, accountability, oversight, and trust. 10 World Bank. 2018. The Role of Digital Identification for Healthcare: The Emerging Use Cases, Washington, DC: World Bank. http://documents1. worldbank.org/curated/en/595741519657604541/pdf/The-Role-of-Digital-Identification-for-Healthcare-The-Emerging-Use-Cases.pdf 11 GSMA. 2016. The business case for payment banks in India. GSMA website. https://www.gsma.com/mobilefordevelopment/wp-content/up- loads/2016/12/GSMA_The-business-case-for-payments-banks-in-India_2016.pdf 12 https://www.pass.gov.pk/userfiles1/files/BISP%20final%20project.pdf 13 World Bank. 2020. COVID-19 G2P Cash Transfer Delivery. Country Brief: Brazil. https://pubdocs.worldbank.org/en/758401593464558927/World- Bank-G2Px-COVID19-Brazil-Brief.pdf 14 http://id4d.worldbank.org/principles 15 Uniqueness within a given system does not imply that there must be only one identity provider or system or a single permanent identifier (e.g., a unique ID number) used for all purposes in a country or jurisdiction. 4 Digital Payments Digital payments make the digital economy move, and the systems that underpin them are another core component or layer of the digital stack. By removing limitations associated with the use of paper cash, digital payments can empower citizens and businesses to transact when and how they wish, enabling them to easily make payments that in the past were difficult or outright impossible. For example, the availability of digital payments has completely transformed the market for domestic and international remittances. If their family back home urgently needs funds to pay an unexpected bill, migrants can wire the needed amount at any time of the day or night—and the money will be available to the recipient instantly. Digital payments are also critical for transactions between governments and people: globally, nearly a quarter of adults were receiving payments from the government—whether through public sector wages, pensions, or social assistance programs. Their large volume presents a huge opportunity for advancing financial inclusion and promoting the development of the digital ecosystem. Digital payments also make new business models possible and have enabled millions of micro-entrepreneurs across all continents to grow their businesses from home through e-commerce platforms. Digital payment systems increase convenience and create efficiencies. First, they enable users to make the same kinds of payments that they used to make with paper cash or checks, such as paying for groceries, rent, or tuition fees, but in a safer and more convenient way. Second, they make new kinds of transactions possible. These include online payments for digital goods and services, such as mobile apps and in-app purchases. Third, they enable users to receive payments—including wages, social protection payments, and sales—remotely, which can then be cashed out, saved, or transacted at the time and place most convenient to them. This digitalization of payments can also reduce transaction and administrative costs for the payers as well, including the government and employers. Government-to-person (G2P) payments represent a significant share of government spending in developing countries. In social assistance, prior to the COVID-19 pandemic, cash transfers accounted for 0.7% of GDP and represented well over half (55%) of all spending on social safety nets.16 Thus, even small efficiency gains can have a significant fiscal impact for countries, particularly since cash distribution can be prone to leakage. Most importantly, from the perspective of the recipients, better payment mechanisms can be more convenient and accelerate development outcomes such as financial inclusion and women’s economic empowerment. For digital payments to thrive, it is important to also invest in robust physical and financial infrastructures. As with other core digital systems, digital payments require both the general physical IT and communications infrastructures, such as mobile and fixed broadband, availability of internet service providers, data centers, and backup facilities. In addition, they require specialized financial infrastructures: settlement services, clearinghouses and switches, and the underlying settlement infrastructures, which allow interoperability. “Fast payment systems” 17, which allow real-time transactions between different providers, build on this interoperability for seamless financial transactions. Currently 56 economies run such systems; eight more are in development. One of those, India’s United Payments Interface, every month processes over 1.5 billion transactions. However, having a digital payments system in place—including the necessary infrastructures—is just the first step. As mentioned above, 1.7 billion people still do not have access to an account and even among those who do, having a digital account may not lead to a tangible increase in opportunities or livelihood if it cannot be meaningfully used. This is where two other key ingredients matter: adequate account and payment instrument design and readily available access and electronic payment acceptance points. Fully functional accounts provide a gateway to other financial products and services that can be life improving for recipients, including savings, digital payments, remittances, insurance, and credit. However, a 2019 survey of 55 social assistance programs in developing countries found that only 49 percent of the digitized payments to accounts provided services other than cash out. Readily available access points, on the other hand, requires expanding interoperable financial access points where individuals can deposit, cash out, and most importantly, complete purchases, bills, and other payments with digital payment instruments. 16 World Bank ASPIRE database: https://www.worldbank.org/en/data/datatopics/aspire 17 https://fastpayments.worldbank.org/ A DIGITAL STACK FOR TRANSFORMING SERVICE DELIVERY: ID, PAYMENTS, AND DATA SHARING 5 Digital payments—or payments in general—benefit from network effects. The more individuals and businesses adopt them, the more useful they are for each individual user. This is an area where G2P payments, which are “high volume recurring payment streams” and include salaries, pensions, and social assistance payments, can contribute to reaching the market tipping point where usage and acceptance of digital payments are predominant. In the last decade, social protection payments have gradually shifted from manual (cash) to electronic payments, including direct deposits into bank and mobile money accounts. From 2014 to 2017, the proportion of G2P recipients receiving transfers into accounts increased from 56 to 62 percent in developing countries.18 This trend was further intensified by the COVID-19 pandemic. From an analysis of a subset of 155 social assistance programs that were established or expanded in response to COVID-19 across 58 developing countries, at least 132 programs (across 50 countries) have used digital payments. In countries where core layers of the digital stack such as digital payment systems as well as ID systems and structures to facilitate interoperability were already in place, scaling up digital G2P payments was relatively simple. For example, Colombia’s Ingreso Solidario—a new social assistance program reaching over 3 million families in response to COVID-19—relied on its digital stack and recent regulatory modernization supportive of digital financial services to offer social assistance payments through bank accounts and mobile wallets. The program not only used over 20 payment service providers (PSPs) to deliver the digital payments, but also incorporated tiered and remote customer onboarding and data sharing protocols between mobile network operators (MNOs), banks, and the Government to identify beneficiaries with existing accounts and facilitate account opening. Beneficiaries without an account were contacted via SMS and directed to open a mobile wallet from a list of PSPs (depending on their type of mobile phone) using only their national ID. The path to deeper financial inclusion19, interoperability and ubiquitous digital payment acceptance will differ by country, and policy makers will have to navigate the various interests involved carefully.20 To a large extent, reaching this goal is beyond the control of a single entity managing a specific G2P program but will require a whole- of-government approach instead. An increasing number of governments are trying to create this cash-lite ecosystem,21 and digitalizing G2P payments can help spur this shift. Trusted Data Exchange The ability of different databases, systems, and devices—both within and across organizations—to exchange or federate information securely and seamlessly is crucial for developing efficient, sustainable, resilient and useful digital ecosystems. Whether through infrastructure or interfaces (or both), trusted data exchange layers or systems are the conduit through which governments, businesses, and people can exchange data and queries. They contribute to more efficient, responsive, pro-active, and transparent government, including through integration of services and information, better-informed policy making, and more inclusive and participatory decision-making.22 They enable the realization of the ‘once only’ principle that people, businesses and other users should only have to provide certain information to government agencies once. Furthermore, by enabling federation of information, they remove the need for governments to try and centralize or aggregate information into a single database, which brings about inherent information security, data protection, and data accuracy risks. For the private sector, trusted data exchange facilitates e-commerce and digital businesses and provides opportunities for additional services. 18 Asli Demirguc-Kunt, Leora Klapper, Dorothe Singer, Saniya Ansar, and Jake Hess. 2018. "Global Findex Database 2017.” https://globalfindex.world- bank.org/ 19 https://pubdocs.worldbank.org/en/230281588169110691/Digital-Financial-Services.pdf 20 CGAP (2018) provides good examples for Ghana and Uganda, while Cook and Raman (2019) provide a detailed account of competing interests and the regulatory response in India. See: https://www.cgap.org/sites/default/files/researches/documents/Focus-Note-Basic-Regulatory-En- ablers-for-DFS-May-2018.pdf; and https://www.cgap.org/sites/default/files/publications/2019_05_07_NPCI_Working_Paper_0.pdf 21 Good examples that include mandated reductions in fees for digital transactions and other incentives include India and Uruguay. 22 World Bank. 2020. Unraveling Data’s Gordian Knot: Enablers & Safeguards for Trusted Data Sharing in the New Economy. Washington, DC: World Bank. https://documents1.worldbank.org/curated/en/863831612427670947/pdf/Unraveling-Data-s-Gordian-Knot-Enablers-and-Safeguards-for- Trusted-Data-Sharing-in-the-New-Economy.pdf 6 This data exchange may involve multiple elements and layers of technology, including APIs, web services, service buses, cloud services, wired connections, and more. While digital IDs are critical for verifying who is accessing a service or participating in a transactions with a high degree of assurance, and digital payment systems help ensure that financial transactions can be conducted instantaneously and transparently, data exchange layers work as the connecting gears that allow these systems—and many others—to interoperate and exchange data with each other seamlessly. Increasingly, countries are looking to implement systems that not only allow for domestic but also cross- border interoperability to facilitate access to services, trade, and migration on a regional or continental level, such as through the European Interoperability Framework. Effective data exchange goes beyond technology and encompasses a broader ecosystem of standards, processes, regulations, and institutional arrangements. One notable example is Estonia X-tee, which allows more than 1,000 linked public and private databases and 1,700 services to automatically share information, reinforced by robust data governance frameworks and technical solutions to maintain confidentiality and accountability between data exchange parties.23 Estonia’s data exchange platform, combined with close to universal access to a digital ID for secure online authentication, has helped save citizens an estimated 2.8 million hours a year by replacing face-to-face interactions with the state with virtual ones.24 The underlying technology is available as X-Road, an open source software. Argentina has also adopted a federated data sharing model that connects data registers and has enabled the development of public services through its data interoperability system for the public sector. This system includes the Smart Judicial Investigation tool and the National Tax and Social Identification System (SINTyS), which coordinates database exchanges and single data requests at the national, provincial, and municipal levels to support better targeting and monitoring of social programs.25 Getting the right enablers, safeguards, and transparency mechanisms in place for data sharing is essential for realizing the development potential of data, ensuring that these opportunities accrue across diverse stakeholder groups, and securing certain rights of individuals in relation to their data. Without adequate safeguards, the potential for abuse increases. This may range from weak security of data transactions to the opaque collection and sale of personal data by third-party data brokers. Laws that facilitate digital transactions, data interoperability, and portability are also essential for enabling the legitimate transfer of data among different providers in an agile and seamless manner. Several countries have created a portal where individuals can log in and view their personal information and records of who has accessed their data and for what purpose. For instance, Estonia’s State portal allows citizens to manage how their data is shared at a granular level (e.g., which doctors can request which aspects of their health data). A growing number of countries are also shifting towards decentralized models of data management to provide individuals with greater control over their data. Examples include digital ‘lockers’ or ‘digital wallets’ containing digitally verified identity information and documents. In India, for example, DigiLocker enables important digitally certified documents, such as transcripts and diplomas, to be deposited, accessed, and shared via secure digital cloud storage linked to holders’ ID numbers. Storing data in digital wallets that can be verified against the data itself (e.g., through asymmetric cryptography) is also gaining traction, especially as standards such as Verifiable Credentials begin to emerge. The proposed European Union regulation on digital identity, for example, proposes a framework for wallets and verifiable credentials. These new decentralized models have potential to promote greater interoperability and portability of data, without compromising on trustworthiness, while also potentially reducing data protection risks. 23 The World Bank. 2021. World Development Report 2021: Data for Better Lives. Washington, DC: World Bank. https://www.worldbank.org/en/pub- lication/wdr2021 24 Vassil, Kristjan. 2016. “Estonian e-Government Ecosystem: Foundation, Applications, Outcomes”. World Development Report 2016 Background Paper. http://pubdocs.worldbank.org/en/165711456838073531/WDR16-BP-Estonian-eGov-ecosystem-Vassil.pdf. 25 World Development Report 2021. A DIGITAL STACK FOR TRANSFORMING SERVICE DELIVERY: ID, PAYMENTS, AND DATA SHARING 7 Digital Stacks Connecting digital systems as stacks can foster open ecosystems that unlock exponential value for people, businesses, and governments. While each of the types of digital systems described above can have significant benefits individually, their interlinkages and complementarities create opportunities for more features and innovation. For example, a digital ID can be used in concert with a data exchange platform to allow a data subject to provide or revoke their consent to sharing certain data when accessing a service online. Similarly, many countries are allowing people to link a digital ID to a financial account, with the ID serving as a proxy address for receiving real-time payments and providing added assurance or trust in the identity of the intended recipient. Emerging approaches to managing data, such as decentralized identity and data fiduciaries, further highlight the importance of trusted digital IDs to be able to associate the right information with the right data subject and allowing them to exercise control. Digital stacks are characterized by common standards, open interfaces, data interoperability, and complementary functionalities. These elements allow the different layers to communicate and interoperate in a seamless and predictable fashion. The exposure of standardized and open application programming interfaces (APIs) enables wider participation to consume those APIs (e.g., for identity authentication or to trigger a payment), and promotes innovation and competition, which leads to better products and services for end-users. A useful example is Singapore’s NDI Stack, which publishes its API specifications and thus allows developers—whether individual or working for government agencies or businesses—to use a sandbox to experiment, build, and test applications quickly and easily.26 The India Stack is another example of a digital stack working at a societal scale and across sectors. It comprises interfaces between the Aadhaar digital ID system, the Unified Payments Interface (UPI), the Data Empowerment and Protection Architecture (DEPA), e-Sign, and Digi-Locker, allowing the public and private sectors to build their services on top of these digital layers (see Figure 2). The Stack has significantly streamlined the delivery of public services, and revolutionized many processes in the financial services sector. Moreover, it has enabled the creation of sectoral stacks, such as National Health Stack, which was launched in 2020 to underpin information standardization, data portability, telemedicine, and other services. Figure 2: India Stack Provide a modern privacy Open personal CONSENT LAYER data sharing framework data store Game changing electronic playment systems IMPS, AEPS, CASHLESS LAYER INDIA STACK and transitions to cashless economy APB, UPI Rapidly growing base of paperless Aadhaar e-KYC, PAPERLESS LAYER systems with billions of artifacts e-Sign, Digital Locker Unique digital biometric identity with Aadhaar card PRESENCE-LESS LAYER open access of nearly a Billion usres Mobile Aadhaar JAM Jan Dhan, Aadhaar, Mobile Source: Adapted from iSpirit. 26 https://api.singpass.gov.sg/ 8 Digital stacks as well as their individual layers can be transformative for service delivery across multiple sectors and areas of development and catalyze new opportunities for people, businesses, and governments. However, they can be complex to implement, and country experiences to date highlight some important risks and challenges, including: • Exclusion and limited accessibility • Low trust and lack of data protection and privacy safeguards • Inadequate or unsustainable technology choices Exclusion and limited accessibility Despite large gains in Internet connectivity and access to digital devices over the last two decades, barriers to accessing and making full use of digital systems and stacks persist. For instance, even as many governments have digitalized their ID systems in recent years, this has not necessarily meant a progression from administrative databases to true platforms for service delivery, nor towards more advanced uses such as cross-border recognition. Moreover, as noted above, an estimated 1 billion people do not have proof of their legal identity27 due to a variety of legal, economic, and administrative barriers to accessing foundational ID systems, including civil registries. Without the physical forms of government-recognized ID that typically underpin digital ID, these people risk being left behind. Similarly, there are gaps in the accessibility of digital payments. Globally, one in three adults don’t have a bank or mobile money account, which are the gateway to leveraging the benefits offered by digital payment systems. In addition, even among people with accounts, there are deficits in terms of digital and financial capability as well as trust to make full use of it. Merchant acceptance is also a constraint, especially among micro, small, and medium retailers, with globally only 37 percent of the payments they receive being made digitally.28 Merchants have their own barriers to adopting digital payments, including their own digital and financial capabilities, low value propositions by payment service providers, high fee structures, and limited connectivity, among others. More broadly, as identification, payments, and service delivery are digitalized and moved online, it is critical to ensure that people with limited digital literacy and access to the Internet are not left behind. Inadequate data protection Collecting, storing, and sharing personal data raises data protection and privacy risks that need to be tackled via a multi-pronged approach. Inherent in the processing of personal data—e.g., for ID systems, trust services, financial transactions, data repositories, interoperability layers, and public and private sector applications—are risks associated with privacy violations, data, and identity theft, cyberattacks, misuse, and discrimination. The emergence of new technologies and the increased collection and use of personal data by state and non-state actors compound these concerns and bring new threats. Building a digital stack, therefore, requires strong legal and regulatory environments, standards and frameworks, privacy- and security-enhancing design measures, advanced cyber resilience and security measures, and a high-capacity digital workforce (i.e., digital skills) to mitigate these risks. Inappropriate technology choices In some cases, systems intended to work together as a stack have failed to fulfill their promise or interoperate seamlessly with other layers and systems because their design and technology choices were unsuitable for priority use cases and context. In this context, vendor and technology lock-in resulting from limited local implementation capacity, compressed planning and implementation timelines, suboptimal procurement processes, and technology-driven (vs. needs- or outcome-based) design and implementation all represent important challenges. When technologies are driving the design of a system, it can result in the adoption of architectures and solutions that are ill-suited to local needs and context and limit adaptation as needs and use cases evolve over time. Without sufficient time and resources 27 World Bank. 2018. ID4D Global Dataset. https://id4d.worldbank.org/global-dataset 28 World Bank. 2016. Innovation in Electronic Payment Adoption: The case of small retailers. https://openknowledge.worldbank.org/han- dle/10986/24700 A DIGITAL STACK FOR TRANSFORMING SERVICE DELIVERY: ID, PAYMENTS, AND DATA SHARING 9 dedicated to assessing needs and options and investing in building local technical and operational capacities, countries may become fully dependent on and locked in by vendors who provide and operate the technology infrastructure. Such arrangements can inhibit interoperability across systems and are also often associated with unsustainable costs and expensive upgrades for individual systems. Good practices and guidance for implementation There is no one model for designing or implementing digital stacks, but it is possible to identify some good practices and guidance. Implementing such good practices can help ensure that stacks and the systems integral to their effective functioning can transform the experience of people and businesses and contribute to improved service delivery in both the public and private sectors while overcoming the risks and challenges noted above. These include: • Building systems and services using outcome- and context-based design. Key decisions regarding the design, rollout, and use of digital systems and stacks should be driven by context and goals. Technology choices should be based on a thorough analysis of the country’s constraints and a clear understanding of what problem these systems will solve and who will use them, as well as what their primary applications will be (e.g., improve targeting of social protection programs, improving financial inclusion, facilitating e-services, etc.). • Designing digital systems and stacks with and around the needs of people and other users. People should be at the heart of a digital economy and government, yet front- and back-end service delivery systems and applications are often designed with little input from those they are designed to serve. The same is often true for public and private sector institutions and firms that rely on these systems for their business processes. Multi-stakeholder engagement and public and civil society consultation and education during the planning phase and throughout implementation is crucial for understanding and mitigating barriers to access, designing solutions that are user friendly, reducing exclusion and cost, increasing digital literacy around personal data management, and improving trust in these systems. • Ensuring coordination and a holistic approach to integration. Implementing digital stacks touch on many sectors, ministries, levels of government, private companies, and non-governmental organizations, each with different operation needs and priorities and the adoption of shared standards and frameworks across participating institutions. It thus requires a clear, strategic vision, high-level political champions, and a well-coordinated approach to ensure buy-in and mobilization among different stakeholders. • Adopting strong and agile legal, regulatory, and operational frameworks. ID systems, payment systems, secure data processing, as well as related government and private sector applications require enabling environments— including laws, policies, and operational procedures—that protect individual data, consent, and rights, minimize security risks, provide clear mandates and accountability, ensure equality of access to services, and reflect the digital age. This should include a clear and cross-cutting strategy for cyber security and data protection laws and “privacy and security by design” measures that adhere to international principles and standards. It also requires robust and resourced institutions capable of enforcing the rules and offering people responsive and effective redress. • Strong technical architecture that leverages DPGs—including open source and open standards—to the extent possible, to foster ownership, innovation, interoperability, and scalability. Countries should use open principles to design and operate core digital systems—where such systems are closed, they risk vendor and technology lock-in and can stymie innovation. Conversely, using open standards and interfaces can enable governments, businesses, and individuals to easily build new applications on top of these digital assets. • Investing in capacity building and skills. Significant investment in skills is needed for an efficient adoption of technology. Adopting and adapting digital systems and stacks for service delivery will require governments to have a mix of appropriately skilled administrators, contract managers, systems engineers, data scientists, cybersecurity specialists, and IT maintenance staff. Governments will need to invest in capacity building and clearly define strategies to support skills development and retention. Additional high-level guidelines for implementing digitally enabled systems include the Principles of Digital 10 Development,29 created and endorsed by over 300 organizations. These principles highlight the need for, inter alia, user-centered design, understanding a country’s or community’s existing ecosystem, designing with scale and sustainability in mind, and using an approach that incorporates open standards, open data, open source, and open innovation. For a more specific framework related to the design and implementation of ID systems, the Principles on Identification for Sustainable Development, which have been created and endorsed by over 30 organizations, provide a helpful reference. The Principles speak to ensuring full accessibility, fostering a service-oriented and sustainable system design, and putting in place governance arrangements that foster trust and accountability and safeguard people’s rights. Beyond the Principles, the ID4D Practitioner’s Guide30 synthesizes and distills good practices and provides a starting place for policy makers to consider the appropriateness of specific design choices in their particular contexts. There is also a wealth of resources to guide policy makers and practitioners in the deployment of inclusive and effective payment systems. These include the report “Payment aspects of financial inclusion,”31 which sets out principles for achieving improved access to and usage of transaction accounts, as well as the comprehensive framework described in “Developing a comprehensive national retail payments strategy.”32 Additional guidelines and best practices on developing the new generation of real time retail payments referred to as “Fast Payment Systems” or “Instant Payments” are described in “Building Faster Better: ....” and “Considerations and Lessons Learned for the development and implementation of fast payment systems”33 One of the main-use cases of the digital stack that can lead to long-term development outcomes is the digitization of G2P payments. The G2Px paper on “Next Generation G2P Payments: Building Blocks of a Modern G2P Architecture” (forthcoming) describes the goals that an ideal G2P architecture should strive to achieve and the characteristics of its building blocks (Figure 3). Figure 3. Next Generation G2P Architecture Infrastructure Products and Market Design Inclusion and Empowerment P I LLAR S Multiple programs Shared infrastructure is Availability of Access points Received in a fully Enabling Designed for recipients with and payments interoperable and seamlessly choice of payment are numerous functional account that is uses beyond their needs, barriers and streams plug into supports various programs and service provider and widely adequate for recipients cash-out preferences in mind shared infrastructure financial service providers. accessible with simple onboarding Cash-out DE S I G N P R I N C I P LE S PROGRAM PSP ATM Option A Access Point Traditional bank account Electronic PROGRAM payments PSP Agent Access Recipients Option B Point Mobile Money Account Remittances & transfers PROGRAM PSP Bank Access Option C Point Savings Central Sectoral Account Treasury Databases Directory B UI LD ING B LO CK S System & Systems Communication Recipient Protection & Literacy & Grievance Redressal Bank & Non-Bank PSP Participation Distribution Networks PSPs Model and Access Points ID System National Trusted Data Payments System Sharing Data Protection Gender Lens & Cybersecurity Accounts & payment Payment Acceptance instruments Networks Cross-cutting building blocks Connectivity 29 https://digitalprinciples.org/ 30 https://id4d.worldbank.org/guide 31 World Bank. 2016. Payment aspects of financial inclusion (English). Washington, DC: World Bank Group. http://documents.worldbank.org/curat- ed/en/806481470154477031/Payment-aspects-of-financial-inclusion 32 World Bank. 2012. Developing a comprehensive national retail payments strategy. Washington, DC: World Bank Group. http://documents.world- bank.org/curated/en/839121469729131991/Developing-a-comprehensive-national-retail-payments-strategy 33 https://fastpayments.worldbank.org/resources A DIGITAL STACK FOR TRANSFORMING SERVICE DELIVERY: ID, PAYMENTS, AND DATA SHARING 11 ABOUT ID4D AND G2PX ID4D combines global knowledge, cross-sectoral expertise, financial and technical assistance, and partnerships to help countries realize the transformational potential of digital ID and civil registration ecosystems. The goal is to accelerate inclusive growth and the achievement of a wide range of development outcomes by enabling all people to access more and better services and exercise their rights. Today, ID4D is supporting 49 countries and shaping more than US$1.5 billion in pipeline or committed financing for the implementation of digital ID and civil registration ecosystems in 35 of them. ID4D has become a thought leader and knowledge hub on why ID matters for development, how to build Good ID and civil registration ecosystems, and tracking of impact and progress. The initiative comprises parts of the World Bank Group working on digital development, social protection, health, governance, gender, social inclusion, legal, financial sector development, private sector development, regional integration, data, and forced displacement. A High-Level Advisory Council of eminent persons support advocacy and provide strategic guidance, and a technical experts group of experienced practitioners provides leading-edge advice. To find out more about ID4D, visit id4d.worldbank.org G2Px was launched in early 2020 in partnership with the Bill & Melinda Gates Foundation. The initiative contributes to the broader agenda of improving government-to-person (G2P) payments through digitization, with the objective of shifting the G2P digitization paradigm beyond program-specific efficiency gains to one that simultaneously accelerates critical development outcomes such as financial inclusion, women’s economic empowerment, and government fiscal savings. Through G2Px, the World Bank Group seeks to establish a framework, develop good practices, and provide upstream technical assistance to radically improve G2P payments globally. The initiative will help build a global movement ensuring that all G2P programs aim and design for broader inclusion and empowerment outcomes through a focus on digitization. To find out more about G2Px, visit worldbank.org/g2px 12