RDCPASS is the official national and international digital identity of the Democratic Republic of the Congo. With one API, you can confirm who a customer is, check them for risk and open their account, using data certified by the national register instead of self-declared details.
Developer? Read the documentationThe sandbox is free and needs no approval. Production access follows a review of your business and your application.
Verification
COD-2103-0214-4937Identity
…
Selfie
…
AML screening
…
8
identity and risk services on one platform
< 300 ms
median verification time
10,000
records per batch request
CDF · USD
Mobile Money, card or monthly invoice
Start from what you need to do
Choose a business goal to see which RDCPASS services get you there.
Replace paper forms and branch visits with a verified identity. Your customer enters their RDCPASS ID or document number, takes a selfie, and you receive certified KYC data you can rely on.
Recommended services
For small teams and national institutions
The same platform serves a two-person startup and a national bank. Only the billing model and support level change.
Launch verified onboarding without a compliance department, and pay only for what you use.
Verify millions of customers with batch processing, a monthly invoice and dedicated support.
Deliver services and aid to the right person, exactly once, with the identity citizens already hold.
Eight services on one integration
Every service shares the same authentication, the same KYC scope model and the same request modes. Most organizations start with one service and add others later.
Verify a person against their certified RDCPASS account and receive the data you are approved for.
Confirm that the person in front of the camera is the owner of the identity.
Check that a user meets an age threshold without collecting identity documents.
Let citizens sign in with their national identity and share only what they consent to.
Verify that a company is registered and find out who runs and owns it.
Screen people and companies before you onboard them, then keep watching.
Assess applicants who have no bank credit history, with their consent.
Report fraud cases to the national fraud desk and follow them to resolution.
Three example customer journeys
Three common flows, from the customer’s first tap to your decision.
Mobile money
Customer
Enters their RDCPASS ID in your app and takes a selfie
RDCPASS
Matches the selfie against the national register and returns basic KYC
Your business
Pre-fills the profile and opens the wallet at the right tier
Result: A verified wallet with no paperwork and no branch visit.
Microfinance
Your business
Identifies the applicant with KYC Validation
Customer
Approves the credit score request in their RDCPASS app
RDCPASS
Returns the credit score and the AML screening result
Your business
Decides on the loan with a complete, auditable record
Result: A same-day decision backed by consent and a full audit trail.
Online platform
Customer
Taps “Login with RDCPASS” and confirms with a face check
Customer
Chooses which details to share with you
RDCPASS
Sends the consented details and confirms the age threshold
Your business
Creates a verified account with no password to manage
Result: A verified, age-checked account in a single tap.
If you serve customers in the DRC, check them against the national register
RDCPASS is the official digital identity of the Democratic Republic of the Congo. Banks, telecom operators, fintechs, platforms and institutions that serve customers, users, merchants or partners in the DRC can check identities against it directly, instead of relying on foreign identity vendors or self-declared information.
Verify one customer in real time, or submit up to 10,000 records at once and receive the results by webhook.
Basic KYC comes with every match. Documents, addresses, biometrics and other data are subscribed to once, then selected per application.
Admins, developers, finance, compliance and marketing each get the access their job requires.
Top up a wallet with Mobile Money or card, or receive one monthly invoice in USD or CDF.
One identity layer for every sector that serves the DRC
From SIM registration to aid distribution, RDCPASS is the identity layer behind digital services in the Congo.
Register SIM cards to certified identities and block SIM-swap fraud.
Open accounts remotely, refresh KYC files in batch and keep evidence for BCC AML/CTF reviews.
Open wallets on a verified identity, lend on consent-based scores and report fraud when you find it.
Tie patient records, insurance claims and prescriptions to a certified identity.
Verify drivers, couriers and fleet operators, and issue named tickets.
Enrol students, check exam candidates and pay scholarships to the intended recipient.
From sign-up to your first verified customer
Create your organization
Sign up with your RDCPASS identity, invite your team and give each member the right role.
Build and test for free
Choose your services and KYC scopes, then test every flow in the sandbox with synthetic identities.
Complete due diligence
Submit your business review (governance) and your application review (security, scopes and testing).
Go live
Receive your production keys and mTLS certificate, choose prepaid or postpaid billing, and start verifying real customers.
A plain HTTPS API with samples in eight languages
Plain HTTPS and JSON, with request signing and payload encryption on every call. Every reference page has ready-to-run samples, and the sandbox returns the same fields as production.
Official SDKs
# Plaintext body shown — encrypt it per /docs/authentication before sending.
curl https://api.rdcpass.cd/v1/kyc/validations \
-X POST \
-H "X-RDCPASS-Key-Id: key_live_8f2a1c0e9b" \
-H "X-RDCPASS-Timestamp: 1790417700" \
-H "X-RDCPASS-Nonce: 6f1c9b2e-4a3d-4e11-9c7a-2d8e5f1b0a44" \
-H "X-RDCPASS-Signature: 3f7a9c...e21d" \
-H "Content-Type: application/json" \
-d '{
"reference": "cust-0001",
"identifier": {
"type": "rdcpass_id",
"value": "COD-2103-0214-4937"
},
"match": {
"full_name": "Kabeya Mwamba Tshisekedi",
"date_of_birth": "1988-04-12"
},
"purpose": "customer_onboarding",
"scopes": [
"kyc.documents.primary",
"kyc.phone_numbers"
],
"document_delivery": "signed_url"
}'{
"id": "kyc_8d2f6a1c93",
"object": "kyc_validation",
"livemode": true,
"reference": "cust-0001",
"status": "completed",
"result": "verified",
"certified_account": true,
"identifier": {
"type": "rdcpass_id",
"value": "COD-2103-0214-4937"
},
"match": {
"full_name": "match",
"date_of_birth": "match",
"age": "not_provided",
"score": 0.98
},
"account": {
"rdcpass_id": "COD-2103-0214-4937",
"status": "active",
"certified": true,
"created_at": "2025-03-14T09:22:41Z",
"level_of_assurance": "LOA3"
},
"kyc": {
"basic": {
"full_name": "Kabeya Mwamba Tshisekedi",
"first_name": "Kabeya",
"last_name": "Tshisekedi",
"date_of_birth": "1988-04-12",
"age": 38,
"gender": "male",
"nationality": "COD"
},
"documents": {
"primary": {
"type": "passport",
"number": "OB1234567",
"issued_at": "2022-06-01",
"expires_at": "2027-05-31",
"issuing_authority": "Direction Générale de Migration",
"status": "valid",
"image": {
"content_type": "image/jpeg",
"url": "https://files.rdcpass.cd/d/9f2c41e8b7a3?sig=Qm9fX2t5Y19zaWc&exp=1790418002",
"expires_at": "2026-09-26T10:20:02Z"
}
}
},
"phone_numbers": [
{
"number": "+243812345678",
"operator": "Vodacom",
"is_primary": true,
"verified": true
},
{
"number": "+243991234567",
"operator": "Airtel",
"is_primary": false,
"verified": true
}
]
},
"scopes_applied": [
"kyc.basic",
"kyc.documents.primary",
"kyc.phone_numbers"
],
"scopes_withheld": [],
"purpose": "customer_onboarding",
"created_at": "2026-09-26T10:15:02Z"
}Security for a national identity register
RDCPASS holds identity data for every citizen of the DRC, so every layer below is mandatory. Each one is enforced before a request reaches our application code.
Every production connection is mutually authenticated. Your application presents a client certificate before any request data is read.
Stops: Unknown or impersonated clients
Each request is signed with your secret key and carries a nonce and timestamp.
Stops: Tampered and replayed requests
Request and response bodies are encrypted end to end, independently of TLS.
Stops: Data exposure in transit
Applications receive only the data they are approved for, for a declared purpose, and every access is logged.
Stops: Over-collection and misuse
Security disclosures
Report a vulnerability
Found a vulnerability in our API, our documentation or your own integration? Tell us. We investigate every credible report, and we would rather hear about a problem from you than from an incident.
Read our security practicesWhen you report
Create your organization and start testing today. For volume pricing or a large deployment, talk to our team first.