DIGITAL PUBLIC INFRASTRUCTURE AND DEVELOPMENT: A WORLD BANK GROUP APPROACH DIGITAL TRANSFORMATION WHITE PAPER, VOLUME 1 MARCH 2025 DIGITAL PUBLIC INFRASTRUCTURE AND DEVELOPMENT: A WORLD BANK GROUP APPROACH A DIGITAL TRANSFORMATION WHITE PAPER, VOLUME 1 © 2025 The World Bank 1818 H Street NW, Washington DC 20433 Telephone: +1-202-473-1000 Internet: www.worldbank.org Some rights reserved. This work is a product of The World Bank. The findings, interpretations, and conclusions expressed in this work do not necessarily reflect the views of the Executive Directors of The World Bank or the governments they represent. The World Bank does not guarantee the accuracy, completeness, or currency of the data included in this work and does not assume responsibility for any errors, omissions, or discrepancies in the information, or liability with respect to the use of or failure to use the information, methods, processes, or conclusions set forth. The boundaries, colors, denominations, links/footnotes and other information shown in this work do not imply any judgment on the part of The World Bank concerning the legal status of any territory or the endorsement or acceptance of such boundaries. The citation of works authored by others does not mean the World Bank endorses the views expressed by those authors or the content of their works. Nothing herein shall constitute or be construed or considered to be a limitation upon or waiver of the privileges and immunities of The World Bank, all of which are specifically reserved. Rights and Permissions The material in this work is subject to copyright. Because The World Bank encourages dissemination of its knowledge, this work may be reproduced, in whole or in part, for noncommercial purposes as long as full attribution to this work is given. Cover photo: © Shutterstock, Inc. Used with the permission of Shutterstock, Inc. Further permission required for reuse. Cover Design: Duina Reyes Attribution Please cite the work as follows: “Clark, J., Marin, G., Ardic Alper, O.P., Galicia Rabadan, G.A. 2025. Digital Public Infrastructure and Development: A World Bank Group Approach. Digital Transformation White Paper, Volume 1. © Washington, DC: World Bank.” Any queries on rights and licenses, including subsidiary rights, should be addressed to World Bank Publications, The World Bank, 1818 H Street NW, Washington, DC 20433, USA; fax: +1-202-522-2625; e-mail: pubrights@worldbank.org. B TABLE OF CONTENTS Acknowledgements iii About iv ID4D iv G2Px iv Project FASTT iv Abbreviations v Executive Summary 1 I. Introduction 4 1. Motivation 4 2. Purpose & Scope 6 3. Organization 6 II. Understanding DPI 7 1. Defining DPI 7 2. DPI Ecosystem 16 3. DPI and Development 28 III. Building, Scaling, and Using DPI 33 1. Design 33 2. Implementation 45 3. Service Use Cases 48 IV. Key Lessons 55 1. Safety and Inclusion First 55 2. Focus on Outcomes, Not Technology 56 3. Users at the Center 57 4. Invest in People 58 5. It Takes a Village to Build Good DPI 58 V. Forward Look 63 References 65 DIGITAL PUBLIC INFRASTRUCTURE AND DEVELOPMENT: A WORLD BANK GROUP APPROACH i DIGITAL TRANSFORMATION WHITE PAPER, VOLUME 1 List of Figures Figure 1. Key benefits and challenges of DPI 5 Figure 2. DPI: Between hard infrastructure and service applications 7 Figure 3. Defining DPI at the World Bank Group 9 Figure 4. Foundational characteristics of DPI 10 Figure 5. DPI as digital building blocks 11 Figure 6. DPI for the public benefit 12 Figure 7. DPI versus a conventional approach to digitalization 15 Figure 8. Locating DPI within the digital ecosystem 16 Figure 9. Role of digital identity and electronic signatures 17 Figure 10. Role of digital payments 21 Figure 11. Role of data sharing 22 Figure 12. Example digital systems by sector 28 Figure 13. Potential impact: DPI versus a siloed approach 29 Figure 14. Potential impact: Core DPIs versus paper-based systems 30 Figure 15. Single IDP in a centralized model 35 Figure 16. Federated model 35 Figure 17. Decentralized approach 36 Figure 18. Types of clearing models in FPS 39 Figure 19. Data sharing models 41 Figure 20. Role of DPI in financial inclusion 50 List of Tables Table 1. Pros and cons of combining foundational and digital ID 34 Table 2. eIDAS levels of assurance for electronic signatures 37 Table 3. Potential role of private sector in DPI 43 List of Boxes Box 1. Example DPI definitions 8 Box 2. Kenya’s Big Data Platform for agriculture 10 Box 3. What DPI is not: Five common myths 13 Box 4. Digital identity, e-signatures, and digital signatures 19 Box 5. DPI in the context of fragility, conflict, and violence 32 Box 6. Open standards in fast payment systems 46 Box 7. DPI for social protection in Zambia 49 Box 8. Impact of PIX and digital G2P payments on financial inclusion 51 Box 9. Role of DPI in Indonesia’s SatuSehat 52 Box 10. India’s AgriStack 53 Box 11. The role of different public sector stakeholders in a country’s DPI journey 60 ii ACKNOWLEDGEMENTS This paper was prepared by Julia Clark, Georgina Marin, Oya Pinar Ardic Alper, and Guillermo Alfonso Galicia Rabadan. Clément Gevaudan and Aishwarya Viswanathan prepared the additional country examples published in Volume 2 of this paper and referenced throughout. Many World Bank Group colleagues contributed important inputs to both volumes of this series, including Mohamed Almenfi, Boniface Okelo Akuku, Saniya Ansar, Karina Baba, Holti Banka, Adele Moukheibir Barzelay, Gunhild Berg, Luda Bujoreanu, Leyla Castillo, Luciano Charlita De Freitas, Nay Constantine, Stephen R. Davenport, Francesco Di Salvo, Marie Eichholtzer, Anette Bayer Forsingdal, Jacob Gahamanyi, Marelize Gorgens, Melis U. Guven, Sylvan Herskowitz, Serene Ho, Matthew Hulse, Abdallah Jabbour, Johanna Jaeger, Tim Kelly, Lewis Malike Kendeh, Zaki Khoury, Liana Korkotyan, Parvathy Krishnan Krishnakumari, Victor Kyalo, Claudio Machado, Viky Manaila, Jonathan Marskell, Ida S. Mboob, Claudia Carlisle Meek, Anna Metz, Andrea Monteleone, Ivan Mortimer-Schutts, Julian Najles, Marco Nicoli, Etkin Ozen, Maria Claudia Pachon, Nidhi Sunil Parekh, Thomas Piveteau, I Gede Putra Arsana, Nilima Ramteke, Douglas Randall, Marlon Rolston Rawlins, Constantin Rusu, Marc Schrijver, Kateryna Schroeder, Parmesh Shah, Arun Sharma, Venkat Bhargav Sreedhara, Maletela Tuoane, Christopher Tullis, Minita Varghese, Goran Vranic, Ambrose Wong, and Siegfried Zottel. The authors also wish to thank Ami Dalal, Spyridon Demetriou, and Harish Natarajan (World Bank); Kamya Chandra, Dan Abadie, and Tanushka Vaid (Center for DPI); Sarah Fischer (GovStack); Robert Opp and Keyzom Ngodup (UNDP); and Ana María Prieto (Central Bank of Colombia) for their valuable peer reviews and comments. Furthermore, this paper benefited greatly from earlier guidance and reviews provided by Christine Qiang, Peter Kusek, Harish Natarajan, Arturo Gutierrez, Arianna Legovini, Robin Mearns, Jean Pesme, Carlo Rossotto, Sofie Sirtaine, and Juan Pablo Uribe. The initial concept for this paper was developed by the cross-department Directors and Working Groups for the World Bank Group’s Identification and Development (ID4D) and Digitizing Government-to-Person Payments (G2Px) Initiatives. DIGITAL PUBLIC INFRASTRUCTURE AND DEVELOPMENT: A WORLD BANK GROUP APPROACH iii DIGITAL TRANSFORMATION WHITE PAPER, VOLUME 1 ABOUT ID4D The World Bank Group’s Identification for Development (ID4D) Initiative uses global knowledge and expertise across sectors to help countries realize the transformational potential of digital identification (ID) systems to achieve the Sustainable Development Goals. It operates across the World Bank Group with units working on digital transformation, social protection, health, financial inclusion, agriculture, governance, gender, legal, and research, among others. The mission of ID4D is to enable all people to access services and exercise their rights, by improving the inclusivity, design, and governance of ID and civil registration (CR) systems. ID4D makes this happen through its three pillars of work: (1) thought leadership and analytics to fill knowledge gaps; (2) global convening and networks to amplify good practices; and (3) country and regional action to support the implementation of trusted, inclusive, and responsible ID and CR systems. The work of ID4D is made possible with support from the World Bank Group, Gates Foundation, UK Government, French Government, Norwegian Agency for Development Cooperation, and Omidyar Network. To find out more, visit id4d.worldbank.org. G2PX The World Bank Group’s G2Px (Digitalizing Government-to-Person Payments) Initiative focuses on transforming government-to- person (G2P) payments to accelerate development outcomes, including financial inclusion, women’s economic empowerment, resilience, and government-wide efficiency gains. G2Px supports countries in modernizing their G2P payment ecosystems with recipient-centric frameworks and evidence-based guidance on sustainable and inclusive models. G2Px works through three reinforcing pillars of work: (1) thought leadership and analytics to build evidence and develop guidance; (2) country action to support countries in their modernization of G2P architectures; and (3) global convening and networks to share good practices. G2Px operates across the World Bank Group with units working on digital transformation, social protection, agriculture, health, financial inclusion, payment systems, social inclusion, governance, research, gender, and data protection, among others. The work of G2Px is made possible with the support from the World Bank Group, Gates Foundation, Norwegian Agency for Development Cooperation, and French Government. To find out more, visit www.worldbank.org/g2px. PROJECT FASTT The World Bank is committed to accelerating the global adoption of Fast Payment Systems (FPS) through Project FASTT (Frictionless Affordable Safe Timely Transactions). Project FASTT focuses on the role and features of FPS, aiming to produce knowledge and provide technical assistance that centers on creating dynamic and interoperable systems facilitating financial inclusion. FASTT aims to accelerate implementations of FPS across the world, but also to create an enabling environment to promote usage (such as, conducive regulatory framework, value-added services such as QR codes and alias registries, consumer protection and fraud mitigation, and so on). Project FASTT is also intrinsically synergistic with ID4D, G2Px, and other initiatives, including collaboration with the World Bank Development Economics (DEC) on randomized studies to measure the impact of FPS on financial inclusion and women’s empowerment. The Project encompasses four main areas of activity: (1) data and research, (2) dissemination and advocacy, (3) capacity building, and (4) technical assistance and lending operations. The work of Project FASTT is made possible with support from the Gates Foundation. To find out more, visit fastpayments.worldbank.org. iv ABBREVIATIONS ACH Automated Clearing House ID Identification AI Artificial Intelligence ID4D Identification for Development Initiative API Application Programming Interface IDP Identity Provider B2G Business to Government ISO International Organization for Standardization BIS Bank for International Settlements LRIs Laws, Regulations, and Institutions CDPI Center for Digital Public Infrastructure MIS Management Information System CSO Civil Society Organization ML Machine Learning DGPA Digital Public Goods Alliance OECD Organization for Economic Co-operation DGS Digital Government Services and Development DPI Digital Public Infrastructure OSS Open-Source Software EMDE Emerging Markets and P2G Person to Government Developing Economies P2P Person to Person FASTT Frictionless Affordable Safe and Timely Transactions PFMIs Principles for Financial Market Infrastructures FMI Financial Market Infrastructure PSP Payment Service Provider FPS Fast Payment System RP Relying Party G2P Government to Person SOGI Sexual Orientation and Gender Identity G2Px Digitalizing Government to Person SSI Self-Sovereign Identity Payments Initiative UNCITRAL United Nations Commission on International GCP Global Challenge Program Trade Law GPFI Global Partnership for Financial Inclusion UPI Unified Payments Interface GRM Grievance Redress Mechanism VCs Verifiable Credentials HCD Human-Centered Design WB World Bank IADB Inter-American Development Bank WEE Women’s Economic Empowerment DIGITAL PUBLIC INFRASTRUCTURE AND DEVELOPMENT: A WORLD BANK GROUP APPROACH v DIGITAL TRANSFORMATION WHITE PAPER, VOLUME 1 EXECUTIVE SUMMARY This paper presents a one-World Bank Group (WBG) framework for understanding and implementing Digital Public Infrastructure (DPI) to accelerate safe and inclusive digital transformation. DPI is an approach to digitalization focused on creating private sector. Furthermore, successfully developing and “foundational, digital building blocks designed for the public deploying DPIs requires broader ecosystem enablers, including benefit.” By providing essential digital functions at society whole-of-society digital transformation strategies; legal and scale that can be reused across sectors, DPIs enable public and regulatory frameworks for data governance, protection, private service providers to build on these systems, innovate, and e-transactions; strong cybersecurity capacity; sound and roll out new services more quickly and efficiently. Common governance and oversight; and efforts to build digital literacy systems built as DPIs include digital identity and electronic and skills across the public and private sector. signatures, digital payments, and data sharing. However, to provide DPI functionality, these systems must embed The DPI approach differs from traditional digitalization efforts principles such as inclusion, openness, modularity, inclusivity, in a few ways, though there is no single model or blueprint user-centricity, privacy-by-design, and strong governance. for implementing DPI. DPI emphasizes shared, reusable building blocks, fostering whole-of-society collaboration— World Bank Definition of Digital Public Infrastructure including strong involvement from the private sector—and embedding core principles such as openness, interoperability, Foundational, digital building blocks for the public benefit. data protection, and user choice. This contrasts with the fragmented approach where each sector develops its own isolated digital systems, leading to redundancy, inefficiency, essential functions interoperable inclusive & user-centric high costs. Implementing this approach in practice will look Norms Scope Specs society-scale open privacy-by-design public & private modular & minimalist strong governance different in each country or jurisdiction. Regardless of the model adopted, however, DPI requires strong and sustained more efficient & public and private improved protecting & political commitment, meaningful and frequent stakeholder engagement, institutional and technical capacity, and Goals rapid roll-out of sector innovation digital trust enhancing digital services & competition and adoption people’s rights and data comprehensive legal and regulatory frameworks, among other success factors. DPIs are part of a broader digital ecosystem and encompass The COVID-19 pandemic underscored the value of DPI, much more than technology. Although DPIs can be a key demonstrating that countries with existing DPIs were able accelerator for digital transformation, they do not exist in to deliver emergency assistance faster and more effectively. isolation. They rely on Digital Systems & Services various E-gov other apps, technology portals, Registries, enablers, MIS, and software A DPI approach—and for: - specific DPIs themselves—offer multiple Non-Tech Enablers service centers, Public & private sector data, such as broadband connectivity, devices, and data CivicTech Health Social protectioncenters Financial Agri Tax sector potential benefits. and For example, the availability of high-quality Safeguards systems, and apps built on or Covering DPIs, their use, and the and cloud, combined along with with DPI for the digitalization of systems across shared digital building blocks broader digital ecosystem can significantly improve efficiency service delivery and reduce costs of government and private sector service sectors. This often involves close integration with digital … DPI-specific laws, regulations, public service channels and platforms such as e-service providers, accelerating the development of new services. institutions, & governance DPI Identity & frameworks Foundationalhowever, applications; in contrast building blocks E-Signatures Payments Data Sharing to typical e-government It can also enable significant private sector innovation and for the public benefit to … Data governance & data approaches, DPI can be provided both by the public and competition, support digitalization across potentially further improving service quality and protection sectors Cybersecurity Energy Broadband PKI Data Centers AI & Public oversight, accountability, Technology Enablers & Devices & Cloud Big Data and feedback loops Foundations and boosters … for DPI deployment, use, DIGITAL PUBLIC INFRASTRUCTURE AND DEVELOPMENT: Digital skills A WORLD BANK GROUP APPROACH ICT industry innovation & literacy & jobs 1 DIGITAL TRANSFORMATION WHITE PAPER, VOLUME 1 more efficient & public and private improved protecting & Goals rapid roll-out of sector innovation digital trust enhancing digital services & competition and adoption people’s rights and data Broader DPI Ecosystem Digital Systems & Services E-gov apps, portals, Registries, MIS, and software for: - Non-Tech Enablers service centers, Public & private sector data, Health Social Financial Agri Tax and Safeguards CivicTech protection sector systems, and apps built on or Covering DPIs, their use, and the combined with DPI for broader digital ecosystem service delivery … DPI-specific laws, regulations, institutions, & governance DPI Identity & Payments Data Sharing frameworks Foundational building blocks E-Signatures for the public benefit to … Data governance & data support digitalization across protection sectors Cybersecurity Energy Broadband PKI Data Centers AI & Public oversight, accountability, Technology Enablers & Devices & Cloud Big Data and feedback loops Foundations and boosters … for DPI deployment, use, Digital skills ICT industry innovation & literacy & jobs efficiency, and helping to develop new services, developer • Inclusion and the digital divide: Addressing gaps in communities, and digital markets. By providing systems that connectivity, device access, and digital literacy, and focus on inclusion, public accountability,DPI ENABLES data privacy…and POTENTIAL ensuring accessibility BENEFITS of DPI for marginalized and vulner- protection, and user control, DPI’s public benefits orientation able groups. can improve consumer experiences and empowerment, the Identity & • Data privacy and protection: Ensuring robust safeguards quality of services and data, and online trust and security. e-signature Interoperable, efficient to protect personal data and user rights. Examples of potential benefits across include: sectorsdigital improve facilitate enable & scalable DPI Data sharing individual access,  Mitigating • Cybersecurity: government cyberbusiness private operational risks and threats. products, services, convenience & services competition & payments:, Faster, • Government-to-person (G2P) transactions more and trust • Deployment and procurement: empowerment lock-in and & efficiency  Avoiding innovation efficient, and inclusive delivery across of socialsectors benefits, reducing Payments ensuring effective contract management and sustain- costs and leakages. ability over time. • Financial inclusion: Increased access to financial services, particularly for marginalized populations, through reduced Successful DPI implementation requires a multi-faceted CHALLENGES & RISKS TO MITIGATE approach: costs and improved accessibility. lock-in, legacy lack of capacity, exclusion for those misuse or • Health: Improved healthcare delivery, disease surveillance, systems • Prioritizing poorand inclusion:  Embedding safety resources, or data with low digital mismanagement and public access, interventions health skills, quality and not institutional literacy through interoperable of personal data protection, security, and accessibility into the design of fit-for-porpuse inertia health information systems and secure payments. DPI systems. This includes robust legal and regulatory • Agriculture: Enhanced access to services, data-driven frameworks, privacy-enhancing technologies, and proac- decision-making, climate resilience, and efficient markets tive engagement with civil society organizations (CSOs). for farmers. • Focusing on outcomes, not technology: Adopting a use-case or service-design approach, starting with a However, there are also important challenges and risks thorough assessment of needs and prioritizing impactful associated with DPI implementation: applications. This requires stakeholder consultations, data-driven decision-making, and regular feedback loops. • Legacy systems: Overcoming institutional inertia and integrating DPI with existing systems. • Putting users at the center: Employing human-centered design (HCD) principles throughout the DPI lifecycle, 2 including user research, co-creation, prototyping, piloting, CSOs, and other stakeholders. This includes establishing and iterative design. This ensures that DPIs are user-friendly, clear roles, responsibilities, and coordination mechanisms. accessible, and meet the needs of diverse populations. By leveraging the opportunities presented by DPI, countries • Investing in people: Building capacity within government, can accelerate their digital transformation journeys and the private sector, and among citizens through training achieve more inclusive and sustainable development. The and digital literacy programs. This is crucial for the long- World Bank Group is committed to supporting this crucial term sustainability and effectiveness of DPI initiatives. endeavor. The WBG’s new Global DPI Program will address • Adopting a whole-of-society approach: Fostering collab- key knowledge gaps and support countries in building safe, oration among government agencies, the private sector, inclusive, and transformative DPI. DIGITAL PUBLIC INFRASTRUCTURE AND DEVELOPMENT: A WORLD BANK GROUP APPROACH 3 DIGITAL TRANSFORMATION WHITE PAPER, VOLUME 1 I INTRODUCTION “With a few taps on their mobile phone, remote area workers in India can apply for social benefits to be paid directly into their bank account and electronically sign an application for a loan. In Thailand, farmers can receive fertilizer subsidies into a bank account linked to their identification (ID). In Singapore citizens and residents can conduct almost any transaction end-to-end online, no matter where they are, from registering a birth to filing taxes and opening a new business. These services are made possible through innovations catalyzed by digital public infrastructure.” – World Bank (2024a). 1. MOTIVATION principles around inclusion, data protection, and user-centricity, and advocates for strong safeguards to ensure that no one is left behind. Digital public infrastructure (DPI) is an emerging approach to achieve fast, efficient digital transformation at scale. It involves The utility of this approach became evident during the developing essential digital capabilities or DPIs—such as digital COVID-19 pandemic and subsequent wave of momentum identity verification, payments, and trusted data sharing—that around digitalization. During the pandemic, countries with are required for many digital services and transactions across existing DPIs were able to provide emergency assistance the public and private sector. By providing these systems faster and reach three times more beneficiaries, compared to as interoperable and modular building blocks that can be countries without (World Bank 2022b). In Thailand, for example, easily integrated into a variety of software applications and the ability to link a digital ID to a bank or e-wallet account processes, DPI enables governments and firms to rapidly enabled informal workers to complete an online application deploy new or improved services, rather than reinventing the for an emergency cash transfer quickly and conveniently, wheel for each new application (Desai et al. 2023). The ability and then receive payment directly in their account (World of interoperable DPI services to work together as a “digital Bank 2024a). The pandemic accelerated recognition of DPI’s stack” facilitates a variety of use cases—for example, across value proposition for scaling digital transformation faster and sectors such as financial services, healthcare, agriculture, and more efficiently. This prompted international collaboration social protection—and allows for streamlined, on-demand, and consensus on DPI standards, notably through the G20 and paperless transactions, reducing costs and spurring agreement on guiding principles for DPI (World Bank 2024a). innovation and new markets (World Bank 2022a, CDPI 2024). This momentum has been supported by global organizations DPI can support broader digital transformation strategies, like the World Bank Group (WBG), United Nations (UN), including those focused on building digital public services Organization for Economic Cooperation and Development and digitalization across sectors. It also offers a central role (OECD), Digital Public Goods Alliance (DPGA), Gates Foundation, for the private sector as DPI providers and users, creating Center for Digital Public Infrastructure (CDPI), Digital Impact new opportunities for crowding private investment into the Alliance (DIAL), Co-Develop, and GovStack, among others, digital service ecosystem. Finally, a DPI approach embeds that have prioritized DPI as a crucial enabler of digitalization for sustainable development. 4 Energy Broadband PKI Data Centers AI & Public oversight, accountability, Technology Enablers & Devices & Cloud Big Data and feedback loops Foundations and boosters … for DPI deployment, use, Digital skills ICT industry innovation & literacy & jobs Figure 1. Key benefits and challenges of DPI DPI ENABLES … POTENTIAL BENEFITS Identity & e-signature Interoperable, efficient improve facilitate enable & scalable digital DPI Data sharing individual access, government private business products, services, convenience & services competition & transactions, and trust empowerment & efficiency innovation across sectors Payments CHALLENGES & RISKS TO MITIGATE lock-in, legacy lack of capacity, exclusion for those misuse or systems poor resources, or with low digital mismanagement quality and not institutional access, skills, literacy of personal data fit-for-porpuse inertia Source: Original figure for this paper. However, challenges and risks remain in deploying and utilizing registration systems that can be leveraged as DPI. Moreover, DPI effectively. As summarized in Figure 1, these include the World Bank recently launched Project FASTT (Frictionless legacy digital platforms (such as digital identity, payments, Affordable Safe Timely Transactions) to work on the nexus of data sharing) that lack the interoperability, modularity, security digital payments and financial inclusion, produce knowledge, or inclusivity to play the role of DPI; incomplete or inaccurate and provide technical and financing assistance for implementing foundational identification (ID) and civil registration systems to fast payment systems (FPS). From a use case perspective, the provide trusted identity data; low institutional and technical Digitalizing Government-to-Person Payments (G2Px) Initiative capacity or resources; poor underlying digital data quality focuses on leveraging DPI to help modernize the delivery and accuracy; inadequate data governance, protection, and of government benefits to improve convenience, financial other safeguards that are critical to fostering trust; exclusion inclusion, and women’s economic empowerment (WEE).1 or discrimination in access to digital systems; and deficits in internet and device access and affordability to ensure As this approach has gained momentum, the WBG has further everyone can take advantage of digital opportunities (World prioritized DPI and safeguards as key elements of digital Bank & IADB 2024). Addressing these issues is crucial to fully transformation. For example, safe and inclusive DPI is one of realizing the potential of a DPI approach to enhance public three priority investment areas under the Accelerating Digital service delivery, stimulate innovation, build digital trust, and Global Challenge Program (GCP), which provides targeted close the divide in digital adoption. support to boost digital inclusion and service delivery over the next five years. Similarly, DPI and safeguards are part of The WBG supports countries to overcome these challenges the digital policy commitment under IDA21, which will support and achieve safe, inclusive, and transformational digitalization low-income countries to invest in digital infrastructure. A new through DPI linked to high-impact services. Through its Global DPI Program will provide a one-WBG approach to public Identification for Development (ID4D) Initiative, the WBG is and private sector investments that support and safeguard providing technical assistance and/or financing for nearly 70 DPI as a key ingredient to delivering digital services at scale. countries to develop safe and inclusive digital ID and civil 1 For more information on ID4D, G2Px, and Project FASTT, see http://id4d.worldbank.org, https://www.worldbank.org/en/programs/g2px, and https:// fastpayments.worldbank.org/, respectively. DIGITAL PUBLIC INFRASTRUCTURE AND DEVELOPMENT: A WORLD BANK GROUP APPROACH 5 DIGITAL TRANSFORMATION WHITE PAPER, VOLUME 1 2. PURPOSE & SCOPE In terms of scope, this paper focuses on high-level considerations for building and using DPI. While it discusses systems like digital identity, payments, and data sharing that can be built This paper provides a common framework and primer on DPI as DPIs, it does not provide in-depth technical details on how for policymakers, practitioners, WBG staff, and the broader to implement each of these systems or any specific DPI use development community. It builds on existing work, including case. For identity, payments systems and related use cases, the World Bank’s Digital Progress and Trends Report (World there is already a deep body of technical guidance from ID4D, bank 2024a), World Development Reports on digital and Project FASTT, and G2Px, which can be found online.2 Newer data (World Bank 2016 & 2021a), and other related efforts. topics, including data sharing, e-signatures, and DPI use Specifically, this paper outlines: cases beyond G2P payments are treated more lightly in the paper but will be the subject of future work under the WBG • DPI Concepts and Theory of Change: This includes a Global DPI Program. Finally, DPI does not exist in isolation working definition of DPI and its core characteristics, and is closely linked to other digital technologies and various including the role of the private sector, how DPI differs government and private sector systems and applications. This from past approaches to digitalization, and the relationship broader ecosystem is summarized in Section 2; however, an between core DPI systems, sector-specific systems, other in-depth treatment of these complementary topics is outside digital technologies, and broader ecosystem enablers the scope of this paper. and safeguards. The paper also articulates the potential benefits of DPI across a range of public and private sector services, and risks and challenges for implementation 3. ORGANIZATION and adoption. • Considerations for Implementation: Drawing on the This paper is organized as follows: Section 2 outlines the WBG experiences of a diverse set of countries across regions, working definition of DPI and the broader DPI ecosystem, income levels, and DPI approaches, the paper identifies including core DPI systems, sector-specific digital systems, common trends for building, scaling, and using DPIs that technology enablers, and DPI governance, enablers, and are safe and inclusive. This includes identifying what safeguards. It also provides a deep dive into why and how DPI we know (and do not yet know) around different DPI can be a key enabler of digital transformation across sectors, design choices and models, implementation strategies, along with specific risks and challenges to DPI implementation, procurement, issues around use case integration and including those related to inclusion, data protection, institutional sequencing of DPI, and more. inertia, legacy systems and procurement challenges, and more. Section 3 draws on the country case studies included in Volume • Principles and Practical Lessons: Finally, it summarizes 2 of this series to outline key trends in DPI implementation, key lessons from countries’ experiences with DPI to date, including core design choices and models, implementation highlighting critical success factors and risk mitigation questions, and use case integration. Section 4 outlines strategies for policymakers, practitioners, and develop- important lessons learned to date for successfully building ment partners. A separate volume provides examples of and using DPI. Finally, Section 5 highlights key areas where DPI from countries around the globe. additional work is needed that will be the focus of the WBG’s new Global DPI Program. 2 See, for example, the ID4D Practitioner’s Guide (http://id4d.worldbank.org/guide), Project FASTT’s Flagship Report (https://fastpayments.worldbank. org/ ), and G2Px Modern G2P Architecture (https://www.worldbank.org/en/programs/g2px). 6 II UNDERSTANDING DPI What is DPI, and why does it matter for development? Figure 2. DPI: Between hard infrastructure and This section builds a working definition of DPI and its core service applications characteristics and explains why it represents a new approach to digitalization that prioritizes common infrastructure, inclusion, ENABLERS & SAFEGUARDS and trust. It also provides a framework for thinking about DPI in relation to the broader digital ecosystem, clarifying Beneficiaries People Business Government how it relates to hard infrastructure, other new technologies, broader digital government services, and sector-specific digital systems while outlining governance requirements and Digital Services Across Sectors Use Cases other enablers and safeguards. Finally, it provides a concise theory of change for DPI, identifying how and when it can have positive impacts across sectors, as well as associated Examples: challenges and risks. DPI Digital ID & Payments Data Sharing e-Signature 1. DEFINING DPI Hard Broadband, Devices, infrastructure Data Centers, Cloud DPI is a relatively new approach to digitalization that focuses not only on what to build, but on how to build it for scale, impact, and safety. Specifically, it represents shared digital Source: Adapted from World Bank (2024). resources that are designed for the public benefit and can be Foundational, digital building blocks for the public benefit. reused across sectors to avoid reinventing the wheel for each This overall vision for DPI is generally shared across prominent new digital service. At its simplest, DPI can be understood global actors, though there are important variations in each as an intermediate software layer in the digital ecosystem organization’s interpretation essential functions: used in many DPI of oftypes and areas of emphasis transactions that sits atop physical infrastructure (including internet society-scale: across sectors and populations (see Box 1). CDPI, for example, considers DPI as an approach Scope connectivity, devices, servers, data centers, and cloud) and public & private: built, operated, and/or used by technology to harnessing digital government andfor social change that must firms below the layer of platforms and applications that leverage adhere to a discrete set of technical architecture principles DPI building blocks to deliver specific services. These may around interoperability, minimalism, innovation, inclusion, include integrated portals for accessing digital public services, decentralization, security, and privacy (CDPI 2024). 3 The e-commerce platforms, telemedicine services or electronic Core DPI earlier G20 framework (G20 2023a) includes many of the same health records systems, and more (see Figure 2). … characteristics and further emphasizes the need for clear Identity & E-sign Payments Data Sharing governance and community components of DPI in addition to technology.4 The G20 and the Global Partnership for Financial 3 Foundational, digital building blocks for the public .benefit. The CDPI architecture principles include interoperability driven by open specifications; minimalist, reusable building blocks; diverse, inclusive, innovation by the public and private ecosystem via open and multimodal access; federated and decentralized with a preference for letting data stay where it is collected; and security and privacy by design (CDPI 2024a). 4 G20 Digital Economy Working Group (DEWG) framework from August 2023 interoperable: includes the followingwith other DPIs suggested and systems principles across for DPI: sectors inclusivity; (and interoperability; modularity and extensibility; scalability; security and privacy; collaboration; governance for public ideally, benefit, across trust, andborders) transparency; grievance Scope open: uses open standards, specifications, and/or APIs modular & minimalist: provides a discrete function and avoids over-centralization of data DIGITAL PUBLIC INFRASTRUCTURE WORLD AND DEVELOPMENT: A can requires … BANK leverage … GROUP APPROACH 7 DIGITAL TRANSFORMATION WHITE PAPER, VOLUME 1 ow-To … Box 1. Example DPI definitions G20 Digital Economy Working Group (DEWG): “set of shared digital systems that should be secure and interoperable, and can be built on open standards and specifications to deliver and provide equitable access to public and / or private services at societal scale and are governed by applicable legal frameworks and enabling rules to drive development, inclusion, innovation, trust, and competition and respect human rights and fundamental freedoms” (G20 2023a). G20 Global Partnership for Financial Inclusion (GPFI): “interoperable, open, and inclusive systems supported by technology to provide essential, society-wide, public and private services” (Ardic Alper et al., 2023). GovStack and Digital Public Goods Alliance (DPGA): “solutions and systems that enable the effective provision of essential society-wide functions and services in the public and private sectors. This includes but is not limited to digital forms of ID and verification, civil registration, payment (digital transactions and money transfers), data exchange, and information systems (including sector-specific, i.e., health or education). A country’s digital public infrastructure may include implementations of multiple proprietary and/or open-source solutions (including digital public goods)” (GovStack Community of Practice 2022). OECD: “common, foundational digital systems that enable the delivery of services in the digital age. Elements of DPI can be developed by the public or private sector, or co-developed to benefit the delivery and access to services across both sectors, and eventually across borders. DPI needs to be standards-based and re-usable” (OECD 2024). Center for Digital Public Infrastructure (CDPI): “an approach to solving socio-economic problems at scale, by combining minimalist technology interventions, public-private governance, and vibrant market innovation” (CDPI website). Note: Adapted from World Bank & IADB (2024). Inclusion (GPFI) consider DPIs to be interoperable, open, Building on the above work, this paper develops a common and inclusive systems supported by technology that facilitate definition of DPI across the WBG that attempts to further essential services for society, and that encompass protocols, distill these concepts into a simple and practical framework. frameworks, and governance structures utilized by market To be useful, this definition should resonate with policymakers players to serve customers (Ardic Alper et al. 2023).5 Nearly and practitioners across diverse country contexts and allow all definitions recognize digital identity, digital payments, for flexibility as this new concept evolves over time. This and data sharing as examples of systems that can be built requires avoiding a definition that is too specific or rigid as “core” DPIs, while allowing for flexibility in the emergence to be useful, or too general such that the term essentially of additional essential building blocks, and in each country’s becomes meaningless (Porteous 2023). The definition below approach to establishing its own DPI. attempts to strike this balance by articulating a short definition that embodies and organizes the primary characteristics or principles of DPI. redress; sustainability; human rights; intellectual property protection; and sustainable development (G20 2023a). 5 This document was prepared by the World Bank as an implementing partner of the GPFI, with inputs from the GPIF members and other GPFI implementing partners. 8 World Bank Group Definition • For the Public Benefit: DPI is a developmental approach that requires embedding principles around inclusion World 3. Figure Bank Definition Defining of DPI at Digital the World Public Infrastructure Bank Group and user centricity (for example, user choice, control, and accessibility); privacy-by-design; and strong gover- Foundational, digital building blocks for the public benefit. nance including public oversight and accountability, to achieve the promise of safe and trusted digitalization that essential functions interoperable inclusive & user-centric leaves no one behind. While DPIs also require external Norms Scope Specs society-scale open privacy-by-design public & private modular & minimalist strong governance safeguards, these norms should be embedded into the technical design of DPIs by default. more efficient & public and private improved protecting & When built for the public benefit, these foundational, digital Goals rapid roll-out of sector innovation digital trust enhancing digital services & competition and adoption people’s rights building blocks can achieve multiple goals. By providing and data essential digital tools that can be reused and integrated into a variety of digital applications, the soft infrastructure of DPI Source: Original figure for this publication. can underpin the rapid development and deployment of trusted digital services and catalyze innovation across the Digital public infrastructure (DPI) refers to systems that serve economy. DPI’s public benefit orientation—which emphasizes as foundational, digital building blocks for public benefit user centricity, inclusivity, privacy –by design, and transparent - (Figure 3). Digital Systems Systems built asE-gov & Services DPI apps, portals, can comprise service centers, Registries, MIS, and software for: a variety of governance—and Non-Tech helps to avoid common digital pitfalls by Enablers Public & private sector data, Health Social Financial Agri Tax and Safeguards digital and appsplatforms, software, systems, built on or APIs, and services, along with protecting CivicTech protection sector users’ Covering rights DPIs, and their use, data, and the and boosting digital trust, combined with DPI for broader digital ecosystem their related legal and service delivery regulatory frameworks, standards, adoption, and competition. … policies, and processes. The term “DPI” can refer to this overall DPI-specific laws, regulations, institutions, & governance approach or to the DPI set of specific systems Identity & built as DPIs within Importantly, many countries already have well-functioning frameworks Payments Data Sharing Foundational a country. building blocks Unpacking this definitionE-Signatures highlights the essential digital systems that provide many benefits but do not fully for the public benefit to … Data governance & data characteristics or principles of DPI(s): support digitalization across meet this ideal-type definition of DPI. This is particularly the protection sectors case for countries that were early adopters of digital solutions Cybersecurity • Foundational: DPIs provide essential digital functions and platforms, as certain practices—such as interoperability, Energy Broadband PKI Data Centers AI & Public oversight, accountability, resources or Technology at society scale—that Enablers is, not limited & Devices & Cloudto Big a Datathe use of open loops privacy-enhancing technologies, standards, and feedback Foundations and boosters … particular sectoruse, for DPI deployment, or population—enabling widespread and user control—have Digital skills ICT industry rapidly over the past 5-10 developed innovation & literacy & jobs adoption by government, firms, and individuals. Crucially, years. In such cases, moving toward a DPI approach may DPIs can be provided by the public and/or private sector. involve some gradual reforms to already operational and While each country takes a different approach to iden- valuable systems, rather than building new systems from tifying and defining these essential functions, common scratch. The goal of this definition is not to imply that only examples of foundationalDPI systems ENABLES include—but … are not those POTENTIAL systems BENEFITS that meet all DPI criteria are “good.” Rather, it necessarily limited to—those that provide digital identity is to highlight important DPI principles and provide direction and e-signatures, Identity & digital payments, and data sharing. for how current systems can evolve to fully realize the potential e-signature Interoperable, efficient • Building Blocks: A building & scalableblock digitaldesign enables DPIs to of society-scale improve facilitate digitalization, enable platforms, and services. DPI Data sharing individual access, government private business products, services, be adopted and reused across institutions, applications, transactions, and trust convenience & services competition & empowerment Finally, & DPI is distinct from—but efficiency complements—broader digital innovation sectors, and borders. requires them to be open and This sectors across Payments public services or sector-specific digital data or infrastructure, interoperable, including the use of open standards and such as government e-serviceportals, e-gov applications; digital open specifications. In addition, a modular and minimalist registries for social protection, business, credit, agriculture; design allows DPIs to provide a discrete set of functions CHALLENGES & RISKS TO MITIGATE health-sector interoperability and data exchange standards; that can be integrated into diverse services with minimal lock-in, legacy lack of capacity, exclusion for those misuse or information systems for digital tax or human resources, and so disruption, while avoiding unnecessary centralized data with low digital systems poor resources, or mismanagement on. quality DPIs and not do not replace such systems, institutional but rather help enable storage processing. orskills, access, literacy of personal data fit-for-porpuse inertia and scale other digital services and platforms more quickly, reliably, and efficiently. The following section unpacks these characteristics in more detail. DIGITAL PUBLIC INFRASTRUCTURE AND DEVELOPMENT: A WORLD BANK GROUP APPROACH 9 DIGITAL TRANSFORMATION WHITE PAPER, VOLUME 1 Hard Broadband, Devices, infrastructure Data Centers, Cloud Foundational Figure 4. Foundational characteristics of DPI Foundational, digital building blocks for the public benefit. The “foundational” nature of DPI relates to its scope, answering the question: What kinds of systems could be a DPI? essential functions: used in many types of transactions To provide soft infrastructure that is relevant for the public society-scale: across sectors and populations Scope at large, core DPIs must be relevant to many types of public & private: built, operated, and/or used by government and firms transactions, population groups, and sectors. For example, the GPFI distinguishes between other financial infrastructure (such as credit reporting systems and automated clearing houses) and DPIs based on their “cross-sectoral nature and use Core DPI … across a wide range of economic and social interactions” (Alper et al. 2023, p. 2). As noted in Figure 4, examples of systems Identity & E-sign Payments Data Sharing that commonly meet these foundational criteria include those that facilitate identity verification and authentication, digital Source: Original figure for this publication. payments, and data sharing. However, a recent paper on DPI Foundational, digital building blocks for the public .benefit. specific sector cannot be built with “DPI thinking.”6 Even if in Latin America and the Caribbean notes that the nature of a system designed for a narrower purpose does not meet what is considered essential and available at society scale the foundational scope interoperable: criteria with of and other DPIs DPI, it could systems still across follow sectors can be a matter of degrees, and the scope of DPI requires (and ideally, across borders)below—such as the DPI specifications and norms discussed flexibility to adapt to context (World Bank & IADB 2024). Each Scope open: uses open standards, specifications, and/or APIs interoperability, modularity, user-centricity, and privacy-by- country may arrive at its own definition of what core functions modular & minimalist: provides a discrete function and avoids design—to enable public benefit and innovation. over-centralization of data In Kenya, for are foundational for its digital ecosystem. example, an agriculture-specific data platform has focused on Furthermore, this sector-agnostic characteristic of DPI interoperability requires … and user centricity, with the goal of building can leverage … does not mean that digital systems or resources within a a resource that can be used by different players across the How-To sector (see Box 2). … open open open open composable standards specs APIs source architecture Box 2. Kenya’s Big Data Platform for agriculture In Kenya, the Big Data Platform at the Kenya Agricultural and Livestock Research Organization (KALRO), supported by the World Bank, was designed with “infrastructure thinking” that embraced many DPI characteristics at the sector level. Rather than focusing on technology solutions, it involved a holistic approach to understanding and improving systems and emphasizing the interoperability and interconnectedness of components within the big data ecosystem (Makini et al 2020). The fundamental design principles included a farmer service-oriented perspective, sustainability (future- ready technology), adaptability, and collaboration with the one-farmer platform ag-tech startups. Applying these principles not only has benefits for the agriculture sector but enables future integration with Kenya’s DPI to enhance potential impact. The Kenyan Big Data Platform now hosts 6.5 million farmers and a geo-tagged digital registry of farms. It has enabled millions of users access diverse digital services, and has fostered several innovations, including location-crop-growth- stage specific digital climate advisory services, crop-livestock-pasture selector, and digitized Good Agricultural Practices (GAP) advisory services. The Big Data Platform is the backbone for delivering essential digital public agricultural services, unlocking groundbreaking innovation for farmers, agribusinesses, investors, and policymakers in the Kenyan agricultural ecosystem, and demonstrating impact and scale in digital service delivery in the sector. 6 See CDPI. “DPI Thinking” Retrieved on 8 August 2024 from https://docs.cdpi.dev/the-dpi-wiki/dpi-overview. 10 Core DPI … Identity & E-sign Payments Data Sharing In addition to being society-wide in use, the provision of Figure 5. DPI as digital building blocks DPI also spans the public and private sector. While the Foundational, digital building blocks for the public .benefit. “public” in DPI denotes public benefit (described in more detail below), this does not mean that it must be government- provided. The success of DPI also depends on private sector interoperable: with other DPIs and systems across sectors participation. This includes driving adoption and use through (and ideally, across borders) Scope open: uses open standards, specifications, and/or APIs DPI-enabled services, as key innovators in DPI components modular & minimalist: provides a discrete function and avoids and technology, and as developers, participants in public- over-centralization of data private partnerships (PPP), and DPI providers (World Bank 2024a). Careful attention should be paid to opportunities requires … can leverage … for crowding in private sector investment in DPI deployment How-To and use and avoiding a regulatory environment that hampers … competition and innovation. open open open open composable standards specs APIs source architecture For example, fast payment systems (FPS) typically function as DPIs, providing simplified access and inherent interoperability Source: Original figure for this publication. for digital payments across the economy. The ownership models of FPS can vary, including public, private, and public- innovations in one country can more quickly be replicated private partnerships. For instance, the Banco Central do Brasil, in others, avoiding the need to repeatedly reinvent the same Brazil’s central bank, crafted a vision for increasing digital building block (see for example, the spread of Estonia’s payment adoption and implemented this vision by developing X-Road solution for data sharing across dozens of countries). Pix. In India, the Unified Payments Interface (UPI) is managed Furthermore, the ability of DPI systems to interoperate with by the National Payments Corporation of India, a non-profit each other (that is, to work together as a software stack) company which is an initiative of the Reserve Bank of India creates new possibilities for innovation and seamless service (RBI) and the banking association, owned by several banks, delivery (World Bank 2022a). This approach is leveraged in payment service operators, payment banks and small finance countries such as Singapore, India, and Moldova. banks. In Jordan, the Cliq and JoMoPay FPS are owned and operated by JoPACC, an entity co-owned by the Jordanian Although there are many technical specifications and central bank and private banks. design strategies that can help create building blocks for digitalization, one essential ingredient is openness. This Digital Building Blocks requires open standards, specifications, and application programming interfaces (APIs). One example is Singapore’s The characterization of DPI as “digital building blocks” relates National Digital Identity (NDI) Stack, which publishes its API to its core specifications, answering the question: what are specifications, allowing developers to quickly build and test the functional design requirements for a DPI? new applications in a sandbox (World Bank 2022a). GovStack8 provides open, standard-based building blocks that can be To play the role of DPI, foundational systems should be built utilized across a wide range of use cases, such as identity, as interoperable building blocks (see Figure 5). Interoperability registration, messaging, and workflow. Cambodia developed is essential to ensure adoption and reuse across the economy; its Verify.gov.kh document verification platform using the DPIs cannot be fully leveraged unless they can speak to various OpenAttestation open-source software and specifications systems and integrate easily with a diverse set of applications developed by Singapore’s GovTech Agency. In turn, Cambodia across sectors and potentially across borders. At a minimum, is now making its customization of OpenAttestation available this requires the use of open standards, specifications, and/or to countries such as Lao PDR and Timor Leste. Newer software APIs, along with clear governance frameworks. To the extent design philosophies such as composable architecture, which that DPI is open source or built as a digital public good7 (DPG, emphasizes modularity, flexibility, and scalability, and an see Section 3 for the differences between these concepts), API-first approach, are also aligned with core DPI goals. This 7 According to the UN and the Digital Public Goods Alliance (DPGA), DPGs are “are open-source software, open standards, open data, open AI systems, and open content collections that adhere to privacy and other applicable best practices, do no harm, and are of high relevance for attainment of the United Nations 2030 Sustainable Development Goals (SDGs)” (GovStack 2022). 8 See https://www.govstack.global/. DIGITAL PUBLIC INFRASTRUCTURE AND DEVELOPMENT: A WORLD BANK GROUP APPROACH 11 DIGITAL TRANSFORMATION WHITE PAPER, VOLUME 1 is consistent with the overall “building blocks” approach Beyond its functional design requirements, the “public” in advocated by initiatives such as GovStack.9 DPI is commonly understood to denote public purpose and benefit. To have positive impacts for societies—including the Finally, building DPIs to be modular and minimalist helps attainment of the sustainable development goals (SDGs)—the ensure their relevance across applications and their ability next wave of digitalization must be rooted in equity, trust, to adapt and scale over time with minimal disruption (G20 and value (World Bank 2021a) and intentionally designed 2023a). Rather than end-to-end solutions, DPIs are akin to small to serve the needs of people and societies. DPIs can help molecules that can be combined and recombined in different advance these goals to the extent that they embed core ways to create different compounds or services. This is one principles required to serve people well, including the most reason DPIs are often distinct from traditional government vulnerable in society. This includes strong public oversight service applications, such as e-government service apps or and accountability; inherent user centricity that emphasizes portals . However, DPI and these systems work together hand in convenience and value; putting people in control of their data; hand. For example, Estonia’s X-Tee system enables the secure ensuring that DPI is universally accessible and addresses the data exchange across different existing platforms, while the needs of those most likely to be excluded from the digital e-Estonia platform utilizes this foundation to offer a variety economy; and embedding technical, legal, and operational of government services to citizens and businesses. Moldova controls to ensure that DPI enhances human rights and protects has made significant strides in digitalizing its government-to- people’s privacy by design (World Bank & IADB 2024, G20 business services through the use of shared digital systems, 2023a, Eaves et al. 2024). While external safeguards (discussed including the M-Connect data exchange platform, and M-Pass in more detail below) are important, DPI systems should be and M-Sign for digital identity and e-signatures. Ukraine’s designed to be inclusive and privacy-protecting by default.10 Diia app and ecosystem provide multiple DPIs along with a single access point for nearly 120 public services. There are myriad tools and strategies available to implement a public benefit orientation in a DPI’s technical design and For the Public Benefit supporting ecosystem. For example, there is a growing trend toward decentralization in digital identity credentials The characterization of DPI as “for the public benefit” relates and data sharing—including through verifiable credentials to the principles it is intended to embody, answering the and wallets—to increase user control and reduce the risks question: What are the normative design requirements for DPI? associated with centralized data storage. Korea, for example, is piloting a new mobile ID (K-DID) using a decentralized, privacy- Figure 6. DPI for the public benefit Foundational, digital building blocks for the public benefit. inclusive & user-centric: designed for accessibility, low-resource groups, user choice & control Scope privacy-by-design: embeds privacy- and rights-enhancing measures by default strong governance: institutions, oversight, & accountability How-To … laws & independent human-centric non-digital public & CSO impact grievance data & regulations oversight design options engagement assessments redress research - Conventional Source: Original figure Approach for this publication. DPI Approach 9 See, for example, the Service GovStack approach Service Serviceto building Service blocks here: https://govstack.gitbook.io/specification/building-blocks/about-building-blocks Service Service Service Service . 10 For example, the UN Office of the Secretary-General’s Envoy on Technology (UNOSET) and UNDP have led the development of a DPI safeguards framework that outlines core risks and principles (UNOSET & UNDP 2024). For details, see https://www.dpi-safeguards.org/. Enablers & Safeguards Data Sharing Data Sharing Data Sharing unavailable Data Sharing Digital Digital unavailable Digital Digital Payments Payments Payments Payments 12 Digital ID Digital ID Digital ID Digital ID and e-signatures & e-sign unavailable & e-sign & e-sign Box 3. What DPI is not: Five common myths Myth 1. All digital ID, digital payments, and data sharing platforms are DPI. Identity, payments, and data sharing systems all provide critical functions for digitalization. However, many existing systems today do not meet DPI’s full scope (for example, they may be limited to a specific sector), functional characteristics (for example, they may not be interoperable and reusable by third parties, and not use open standards or specifications) or norms (for example, they may not incorporate privacy-by-design, user centricity, or other features). Myth 2. DPI replaces the need for sector-specific digital data or infrastructure. DPI is a complement to sector digitalization, not a replacement. Core sector digital systems and standards—such as digital registries for social protection, business, credit, agriculture; health-sector interoperability and data exchange protocols; a digital tax or human resource management information systems (HRMIS); a government e-service app—are essential investments to be managed in the respective sector. DPIs can help enable and scale sector-owned digital services that rely on these systems more quickly, cheaply, and reliably. Myth 3. All DPIs require centralization. In some cases, a specific DPI system is operated by a single provider (such as a digital agency that issues an official digital ID credential). However, each DPI often involves different entities, such as a national ID agency, a digital agency, a certificate authority, the central bank, and payment service providers, among others. While data sharing platforms enable data exchange between entities, this does not necessarily involve data aggregation (an exception could be public forms of open data). Indeed, for identity and personal data, there is a significant trend toward federation and decentralization (for example, verifiable credentials and wallets for identity and personal credentials), keeping data where it is collected or in the hands of individual users. Payment systems are by definition centralized. Although new approaches based on distributed ledger technologies could allow for some degree of decentralization, they are not relevant at this point in the context of discussion on DPI. Myth 4. Building DPI means you must use it for everything. The advantage of DPI is its ability to reuse the same building blocks—such as a fast payments system—for various services such as a health insurance payment, a social welfare benefit, or a person-to-person transfer. However, this does not mean that because a DPI exists, it should be integrated into all services, or that all features of a particular DPI are appropriate in all use cases. For example, high-assurance digital identity services—that is, those that use strong authentication methods such as digital certificates, biometric recognition, and secure devices—may be appropriate for some transactions (such as opening a high-value investment account) but not for others (such as enrolling your child in school online). The goal of a DPI approach is to provide building blocks for innovation and consumer choice, with multiple solutions that can address a variety of service provider and user needs and preferences. Myth 5. DPI is the end goal or cure-all. DPI is not a silver bullet. It is one piece of a comprehensive strategy for digital transformation, a means to the ends of scaling up impactful digital services and creating new markets that generate benefits for people, governments, and firms. Focusing too narrowly on DPI is likely to be ineffective. Therefore, while the purpose of this paper is to provide a primer on DPI, broader dialogue at the country, regional, and global levels should adopt an outcomes-based approach to digital transformation that considers DPI as part of a broader set of tools and strategies to achieve digitalization goals more quickly and efficiently. DIGITAL PUBLIC INFRASTRUCTURE AND DEVELOPMENT: A WORLD BANK GROUP APPROACH 13 DIGITAL TRANSFORMATION WHITE PAPER, VOLUME 1 enhancing architecture, as is the European Union’s electronic The DPI Difference Identification, Authentication and Trust Services or eIDAS 2.0 scheme, the EU Digital Wallet. Beyond the technology itself, Even though many systems now being built as DPIs—such as the process of designing and deploying DPIs should follow digital identity, payments, or data sharing—have existed for a multi-stakeholder approach, including consultations with decades, some aspects of the DPI approach to digitalization the public and civil society organizations (CSOs),11 privacy for development are new. This includes: (1) a focus on and human-rights impact assessments, regular feedback creating shared building blocks, rather than digitalizing in mechanisms and grievance redress, and ensuring there are silos, (2) the whole-of-society approach required to build non-digital options available for those who need it. Examples and innovatively use DPIs, including the private sector, and of CSO consultations in Jordan, South Africa, and Jamaica (3) embedded functional and normative principles such as are described in more detail in Section 3. Such approaches openness, interoperability, inclusion, transparency, strong are essential for building trust in the DPI ecosystem, which is governance, and data protection and privacy. needed for adoption and impact, and to ensure that DPI and its use effectively protects people and their data and helps From Silos to Building Blocks to close the digital divide. Under a fragmented approach to digitalization, each sector With regard to digital identity, many modern digital ID works to build its own end-to-end digital services. As shown systems have sought to minimize data collection and provide in Figure 7, this begins with digitalizing sector data into digital individuals with greater control over their information, in registries and databases, developing management information line with data protection principles. In Nigeria, for example, systems (MIS), and then building the core functionality needed the National Identity Management Commission (NIMC) is to deliver services online, such as developing in-house payment reducing the number of data fields collected for the national systems, functional IDs,12 and single-sector data sharing ID from over 80 to 10 (Desai & Clark 2021). Countries are also platforms. In some cases, these services might attempt to making strides in user agency and convenience through their leverage or integrate with digital systems in other sectors DPI. In Indonesia, the new digital ID application incorporates (for example, a social protection MIS cross-checking a health privacy-by-design features, such as selective disclosure of system to verify disability status), though often this is done personal data, allowing individuals to control which specific through one-off connections and bilateral agreements. information is shared, thereby enhancing privacy and security while interacting with government and private sector While silo-ization may be logical from a service provider services. In Singapore, the national digital identity platform perspective, it means that each actor or sector is repeatedly SingPass has been piloting new user-centric functions such reinventing the wheel for certain core functionalities, such as as “digital delegation,” which allows citizens to securely and confirming that a beneficiary or customer is unique, requesting conveniently manage government interactions on behalf of or making a digital payment, or verifying information about others, addressing the needs of families who previously faced a person. In contrast, a DPI approach focuses on building a challenges in assisting elderly or overseas relatives. shared set of software or platforms that can be reused across sectors and plugged in—if needed—to their digital services. Finally, in addition to characterizing what DPI is, it is also This saves time, cost, and human resources for sectors and important to understand what DPI is not. Box 3 highlights allows them to focus on core competencies (such as developing five common misperceptions about DPI. electronic health records or implementing health-specific data and interoperability standards). In addition to these efficiency gains, DPI-specialized providers will typically be able to provide these services with higher levels of quality, security, and sustainability than entities without similar expertise. Building across silos is particularly important in an increasingly globalized world, as the digital economy flows across borders. 11 See Eichholtzer and Desai (2022). 12 Functional ID systems are created for a specific, limited purpose, such as social security number, tax IDs, or driver’s licenses. While they may be recognized for other purposes, this often has limitations, and most countries have therefore implemented foundational ID systems (such as a national ID) as general-purpose proof of legal identity (see World Bank 2019). 14 How-To … laws & independent human-centric non-digital public & CSO impact grievance data & regulations oversight design options engagement assessments redress research - Figure 7. DPI versus a conventional approach to digitalization Conventional Approach DPI Approach Service Service Service Service Service Service Service Service Enablers & Safeguards Data Sharing Data Sharing Data Sharing unavailable Data Sharing Digital Digital unavailable Digital Digital Payments Payments Payments Payments Digital ID Digital ID Digital ID Digital ID and e-signatures & e-sign unavailable & e-sign & e-sign Sector Data, Sector Data, Sector Data, Sector Data, Sector Data, Sector Data, Sector Data, Sector Data, Systems, & Systems, & Systems, & Systems, & Systems, & Systems, & Systems, & Systems, & Standards Standards Standards Standards Standards Standards Standards Standards Source: Adapted from World Bank (2024). A building blocks approach also enables multiple DPIs to be across the country—“has been a product of a multi-stakeholder used together, with multiplier effects. For example, India’s process with representatives from government, academia, DPI is a layered stack of multiple, interoperable digital building the private sector, and civil society organizations.” They note blocks created with the goal of enabling remote, paperless, that through the National Council for the Information Society, and cashless service delivery across the country. It exists a diverse Digital group ID can of stakeholders authenticate continuously a person’s identity monitors (are you who the in the form of APIs—including for ID (Aadhaar), payments you claim to be?) and/or implementation of theverify basic identity Agenda, leading information (e.g., of to high degrees name, age) for in-person and/or online transactions. (Unified Payments Interface or UPI), brokered data sharing public trust. Similarly in Singapore, the government created (Data Empowerment and Protection Architecture or DEPA), Examples of use: and Digital Government Group (SNDGG) as a a Smart Nation Identity & E-Signatures personal document storage and sharing (Digi-Locker), and Securely log-in • government to an online coordinating government body service to improve intragovernmental • Verify your identity when opening a bank account Core publicly available to developers, enabling e-signatures—made data sharing through a focus on developing and enforcing • Check if a person has already enrolled in a social program them to improve Digital Payments DPI upon and repurpose these APIs. Together, shared digital infrastructure, common standards (such as for these APIs enable seamless service delivery, for example, by data security), E-signatures transactions by of and interoperability authenticate digital (Desai et applications providing enabling remote workers to apply for social benefits, which are Data Sharing al. 2022). versions of signatures that are legally equivalent to handwritten paid directly into their bank account, or electronically sign an signatures. application for a loan all on their phone (World Bank 2024a). Focusof Examples on Outcomes use: and Principles • Apply for a loan or transfer property titles online Whole-of-Society Approach ConsentDPI • Finally, for your telehealth recognizes provider that to view your digitalization electronic is about much medical record more than technology. It represents a modern approach to • Sign a service agreement with a remote contractor As the 2024 World Bank Digital Trends and Progress Report digitalization that bakes in core principles around interoperability, notes, “the paradigm shift” toward DPI can only be realized minimization, inclusion, data protection, and more. This includes with a whole-of-society approach (World Bank 2024a). ensuring that DPI is technically designed and deployed in Breaking down silos and thinking about horizontal building alignment with good practices and accompanied by sound blocks requires continuous coordination across government legal frameworks, regulations, and institutions for accountable entities, including digital agencies, line ministries, and governance and oversight, data protection, and cybersecurity regulators; participation and collaboration of the private (G20 2023a). Furthermore, DPI advocates an outcomes-based sector; and regular engagement with CSOs, the public, and orientation focused on inclusive adoption of digital services, other stakeholders. In Uruguay, for example, Desai et al. private and public sector innovation, and the productive use (2022) describe how each iteration of the Uruguay Digital of digitalization to achieve development goals. Agenda—which includes a vision for data sharing and other DPI DIGITAL PUBLIC INFRASTRUCTURE AND DEVELOPMENT: A WORLD BANK GROUP APPROACH 15 DIGITAL TRANSFORMATION WHITE PAPER, VOLUME 1 2. DPI ECOSYSTEM public sector, the private sector, or a public-private partnership. More specifically, the private sector can be instrumental in the entire life cycle of the DPIs, from initial design and DPI does not exist in isolation; rather it is part of a broader development to deployment, scaling and ongoing operation. ecosystem of technologies, systems, laws and regulations, Private investment is essential to the growth and success of capabilities, institutions, and frameworks required for DPI. For example, equity investments may be crucial for the the end-to-end deployment, adoption, and protection of development of innovative firms to support the development digital services. Figure 8 provides a broad overview of this and uptake of high-impact use cases. In economies with limited ecosystem, including (1) core DPI systems (including digital private investment and an underdeveloped digital economy, identity and e-signatures, payments, and data sharing), (2) adoption of DPI may not be as fast. non-technology enablers and safeguards, (3) technology enablers (such as energy, broadband, devices, data centers, Core DPI Systems cloud, AI, and big data), and (4) other digital systems and services across sectors (such as e-government service portals DPI is a flexible concept, and therefore we should expect the World Bank Definition of Digital Public Infrastructure and applications, social registries, credit systems, and public emergence of new DPIs over time to enable digitalization at financial management systems). society scale. The World Bank Group will continue to document Foundational, digital building blocks for the public benefit. and provide guidance on new DPIs as they evolve; however, To succeed, economy-scale digitalization efforts must this paper focuses primarily on those systems—including digital invest in each of these ecosystem components. As with the identity and e-signatures, digital payments, and data sharing— of DPIfunctions essential definition interoperable may evolve over itself, this categorization inclusive & user-centric that are well-accepted as providing “core” DPI functionality. Norms Scope Specs society-scale open privacy-by-design time with technology innovations and evolving standards and public & private modular & minimalist strong governance learning around DPI. However, it provides a useful starting Digital Identity & Electronic Signatures point to disentangle some of the common questions around where the “bounds” of DPI start and end, and to identify Identity and electronic signatures (e-signatures) are key ingre- more efficient & public and private improved protecting & complementary of of investment areas fully leverage needed to digital dients in establishing online digital trust. While digital identity Goals rapid roll-out sector innovation trust enhancing and safeguard DPI. digital services & competition and adoption people’s answers rights the question “with whom am I interacting?” e-signa- and data tures answer the questions “is this document or transaction The private sector plays a key role in the DPI ecosystem. While (legally) valid?” and “did this person authorize this transaction?” Figure 8 does not specify the roles of the public and private Many transactions and interactions with government—whether sectors, DPI can be owned, operated and managed by the in-person or online—require one or both types of questions to Figure 8. Locating DPI within the digital ecosystem Digital Systems & Services E-gov apps, portals, Registries, MIS, and software for: - Non-Tech Enablers service centers, Public & private sector data, Health Social Financial Agri Tax and Safeguards CivicTech protection sector systems, and apps built on or Covering DPIs, their use, and the combined with DPI for broader digital ecosystem service delivery … DPI-specific laws, regulations, institutions, & governance DPI Identity & Payments Data Sharing frameworks Foundational building blocks E-Signatures for the public benefit to … Data governance & data support digitalization across protection sectors Cybersecurity Energy Broadband PKI Data Centers AI & Public oversight, accountability, Technology Enablers & Devices & Cloud Big Data and feedback loops Foundations and boosters … for DPI deployment, use, Digital skills ICT industry innovation & literacy & jobs Source: Original figure for this publication. DPI ENABLES … POTENTIAL BENEFITS Identity & 16 e-signature Interoperable, efficient improve facilitate enable & scalable digital DPI Data sharing individual access, government private business products, services, convenience & services competition & Standards Standards Standards Standards Standards Standards Standards Standards Figure 9. Role of digital identity and electronic signatures Digital ID can authenticate a person’s identity (are you who you claim to be?) and/or verify basic identity information (e.g., name, age) for in-person and/or online transactions. Examples of use: Identity & E-Signatures • Securely log-in to an online government service • Verify your identity when opening a bank account Core • Check if a person has already enrolled in a social program Digital Payments DPI E-signatures authenticate transactions by providing digital Data Sharing versions of signatures that are legally equivalent to handwritten signatures. Examples of use: • Apply for a loan or transfer property titles online • Consent for your telehealth provider to view your electronic medical record • Sign a service agreement with a remote contractor Source: Original figure for this publication. be answered. In some cases, such as securely logging in to an customer,” and the ability (when required) to link a person’s online account, digital ID alone may be sufficient. For other online accounts to a person’s legally recognized and unique types of transactions—especially those involving a contract, identity (for example, to enroll in government benefits or vote agreement, or user consent—a legally valid signature may also online). Digital identity services can be facilitated through a be required after verifying the parties’ identity. Digital ID and wide variety of credential and authenticator technologies, e-signatures thus complement each other in ensuring trust in including cards with chips or QR codes; PINs, passwords and online interactions. While it is possible to implement digital one-time-passwords (OTPs); digital certificates; biometrics; ID without e-signature functionality, there is a growing trend and mobile applications and wallets, to name a few. These to implementing the two together, to take advantage of their technologies—along with the degree of “identity proofing” complementary nature and similarity . For this reason, these when a person obtains a digital ID14 —provide different levels are considered together in this paper. of assurance or confidence in the identity a person presents. Digital identity services enable secure and remote identity The core functions of a digital identity DPI can be provided authentication and verification. These functions—confirming by a variety of ID systems. Most countries have some type that the person13 presenting an ID is the same person to whom of foundational ID system15 —such as a national ID, population it was issued (authentication) or verifying specific identity register, civil register, or similar—to provide government- attributes or uniqueness (verification)—play a central role in recognized (also called “legal” or “official”) forms of ID and many transactions online, as well as digitally enabled face-to- documentation of vital events (birth, death, marriage, divorce) face services (World Bank 2022a). This includes online services for individuals. As these systems have increasingly digitalized, that requires a secure login to prevent fraud and protect many offer forms of legal ID, such digital national IDs or birth personal data, the ability of service providers to “know their certificates, that can be digitally verified or authenticated for 13 Although this paper focuses on digital identity for individuals, DPI can also play an important role by providing trusted, and verifiable digital identity for other interacting parties, such as businesses, other legal entities, and devices. However, these are typically provided by separate systems (such as a business register), rather than a foundational (digital) ID system. 14 Digital IDs that provide higher levels of assurance often require in-person registration (or virtual, assisted registration) to “bind” the person to the digital ID—that is, to ensure that they are a real person and the person they claim to be. Linking this ID with a person’s legal identity, for example, as evidenced through a birth certificate or national ID, also typically increases the level of assurance and is often required for digital identities used for government services. Ensuring the quality and inclusivity of national ID and civil registration systems is therefore of paramount importance to the trustworthiness of digital identity systems and the transactions they underpin. 15 According to data in Casher et al. (2024) 175 out of 198 countries with data have a foundational ID system, typically called a “national ID system” or similar. DIGITAL PUBLIC INFRASTRUCTURE AND DEVELOPMENT: A WORLD BANK GROUP APPROACH 17 DIGITAL TRANSFORMATION WHITE PAPER, VOLUME 1 in-person or online services.16 As described in more detail traditional ID and civil registration systems play in establishing in Section 3, the past decade has seen a rise in parallel legal identity to underpin rights and services.20 In Indonesia, digital ID systems that provide official online identity services for example, the national ID card (e-KTP) serves as the basis either through a single provider (such as a digital agency), or for legal and digital identity, with new digital ID applications through multiple public and private sector entities operated (including the IKD and INA Pas) built on top. In Uruguay, the ID in a federation or decentralized architecture. As the demand Uruguay digital platform launched by AGESIC in 2019 has been for digital identity grows, new markets for private sector a steppingstone for digitalization, enabling citizens to securely digital identity providers have emerged to add value on top access over 190 digital services and complete more than 1,500 of government-provided official ID. For the purposes of this online procedures, including essential services like healthcare paper, any of these systems can constitute a DPI if they meet records, tax filings, and social security benefits (Public Digital the DPI criteria discussed above.17 2023). In India, the Aadhaar Enabled Payment System (AePS), is a bank-led model enabling interoperable financial transactions E-signatures—which help ensure the security, authenticity, at agents through biometric authentication. AePS supports and integrity of digital transactions—are essential for basic banking services such as cash deposits, withdrawals, digitalization. Analogous to written signatures in the physical fund transfers, and balance inquiries, by using Aadhaar as world, e-signatures help establish confidence in the origin the identity verification and authentication mechanism. In of digital data and documents and ensure that transactions the Maldives, the eFaas platform provides a secure digital carried out electronically are legally valid.18 This is important identity for accessing 128 digital service portals, spanning for enabling remote signing of contracts or agreements, sectors such as public health, housing, local government, including documenting consent. E-signatures provide four core and finance. Building on this foundation, the government now functions that facilitate online trust: (1) identifying the signer, aims to integrate eFaas with a secure data-sharing platform (2) attributing the signature to the signer, (3) recording intent to enhance consent-based data sharing, reduce redundancy, to sign, and (4) assuring the integrity of the signed data and and address data silos. protecting against tampering (Tullis et al. 2024). Implementing these functions requires a combination of dedicated legal In some cases, e-signature capabilities are standalone frameworks, processes, and digital technologies. Some type systems, not implemented through an ID system. Mexico’s of e-signatures, such as clicking an “I accept” box, provide low FIEL/e.firma (Advanced Electronic Signature) system, managed levels of assurance or security, while those based on digital by the Mexican tax authority (SAT), has over 13 million users signatures19 technology using public key infrastructure (PKI) and has enabled the streamlining of administrative processes, can provide the highest level of assurance, as shown in Box 4. improved tax compliance, and has enhanced the security and legal recognition of digital transactions across various sectors In many countries, digital identity has been a cornerstone or (Mifiel 2024). In Indonesia, e-signatures and a range of other “first block” of a DPI stack. This relates to digital identity’s role trust services 21 are provided through licensed certificate in helping to secure or enable digital payments and facilitate authorities (PSrEs), which include both public entities and the safe exchange of personal data, and to the role that private companies. 16 For more details on the digital readiness of foundational ID systems globally, see Metz et al. (2024). 17 The forms of digital ID described in the paper include those linked to a person’s official or legal identity, whether or not they are provided by the same entity that issues the foundational ID. Not included are those such as using Facebook, Amazon, or Google accounts to log-in to other websites or services on the internet via federation protocols. 18 Whether or not a particular technical implementation of an e-signature is legally valid depends on the relevant trust framework in the jurisdiction. Under the European Union’s eIDAS, for example, only “qualified electronic signatures” (QES) that involve strong identity proofing and PKI are presumed legally valid. However, the role of an e-signature framework is to provide clarity and levels of assurance for various technical implementations (Tullis et al. 2024). 19 Note that the terms “electronic signatures” and “digital signatures” are not synonymous; the latter refers to one potential underlying technical implementation of e-signatures that uses digital certificates issued by certificate authorities (CAs) under a PKI. Digital signatures also have many broader uses such as secure internet communications. In addition to Figure 10, see Tullis et al. (2024 & 2025) for more on e-signatures and PKI. 20 For example, SDG 16.9 called on countries to provide “legal identity for all, including birth registration, by 2030.” As countries have moved to digitalized their national ID and civil registration systems, providing these digital forms of identity can bolster the right to an ID in both the physical and digital worlds. 21 Electronic signatures are one of multiple “trust services” that provide confidence in digital transactions and could be built as DPIs given their central role in authenticating digital transactions. The UN Commission on International Trade Law (UNCITRAL) defines trust services as “an electronic service that provides assurance of certain qualities of a data message and includes the methods for creating and managing electronic signatures, electronic seals, electronic time stamps, website authentication, electronic archiving and electronic registered delivery services” (UNCITRAL 2023). 18 Box 4. Digital identity, e-signatures, and digital signatures Digital identity, e-signatures, and digital signatures can be related but are not synonymous. This paper uses the following definitions: • Digital identity: A set of electronically captured and stored attributes or credentials that uniquely identify a person and enable authentication of the individual and/or verification of identity attributes. • E-signature: Analogous to written signatures, e-signatures help establish confidence in the origin of digital data and documents and ensure that transactions carried out electronically are valid. They are a legal concept that can be implemented through various technologies, from the very basic (signing your name on a touchpad) to the more advanced (for example, using digital signatures). • Digital signature: A technical operation using public key cryptography, wherein a user’s private key is used to digitally sign data, and their public key is used to verify the signature. Digital signatures are implemented using digital certificates provided by certificate authorities (CA) as part of a public key infrastructure (PKI). For more on PKI, see “Technology Enablers” later in this section. To illustrate these complexities, here are some examples of how these functions overlap: • IDs are often digitally signed by the issuing agency (using their digital certificate) to improve the integrity and security of the credentials. • IDs are often used as proof of identity to link users to their e-signatures or digital signature certificates (for example, see Table 2). • Digital signatures can be used to implement high-assurance digital ID authentication or e-signatures and some digital IDs include digital certificates to implement these signatures. Source: Adapted from Tullis et al. (2024 & 2025). Increasingly, however, e-signatures are built into the integrated alongside a high-trust digital ID credential in one functionality of a digital ID. For example, Argentina’s national easily usable package that will be rolled out across the 27 EU ID smartphone application, called Mi Argentina, includes member states by 2026 (Tullis et al. 2024). a digital certificate to generate legally valid electronic signatures. Under Sweden’s BankID scheme, various banks Some high-risk or high-value transactions require a digital issue credentials that include a PKI-based certificate for digital ID or e-signature that can provide a very high level of identity authentication. During authentication, this certificate assurance or trust. This includes, for example, the use of creates an authentication token, which authorizes transactions PKI-based digital signatures that use strong cryptography under the eIDAS’s “substantial” level of assurance. When an and other processes .22 Ideally, digital identity and e-signature e-signature is required, the authentication token triggers ecosystems will provide multiple types of ID that enable the generation of a one-time digital signing certificate along user choice and various levels of assurance to facilitate a with a signature at the “advanced” level of assurance (DIGG risk-based approach to identity verification across high- and 2020). In addition, under the European Union’s planned low-risk transactions. Providing only high-assurance digital digital wallet (eIDAS 2.0), a high-trust electronic signature is ID and e-signatures—for example, requiring biometric- and/ 22 PKI is further discussed in “Technology Enablers,” later in this section; however, it could also be considered as a separate DPI. For more on the distinction between digital identity, e-signatures, and digital signatures, see Box 4. DIGITAL PUBLIC INFRASTRUCTURE AND DEVELOPMENT: A WORLD BANK GROUP APPROACH 19 DIGITAL TRANSFORMATION WHITE PAPER, VOLUME 1 or PKI-based authentication for all interactions—can increase Digital Payments complexity and/or costs, and potentially exclude some users to the extent that they require owning or using more advanced Digital payments enable more secure, convenient, interoperable, devices or technologies. Similarly, providing only low levels and cashless transactions. They allow individuals, businesses, of assurance is insufficient to move high-value or high-risk and governments to transfer money easily and securely. This transactions fully online, such as voting, purchasing property, includes e-commerce and merchant payments, government- or issuing and signing contracts. to-person (G2P) payments such as social assistance benefits; person-or-business-to-government (P2G or B2G) payments Countries can follow multiple models to build effective such as taxes; and person-to-person (P2P) payments among digital ID systems that serve as DPIs; however, notable gaps individuals. In addition to replacing the need to pay with remain. According to World Bank estimates, there are still physical cash or checks, digital payments enable users to some 850 million people without any proof of their identity— receive payments remotely (for example, on their mobile paper based or digital—mostly concentrated in lower-income phone via a bank or mobile money account), giving them countries (Clark et al. 2022). Furthermore, an estimated 1.25 choice about if, when, and where they want to cash out, save, billion people do not have a digitally verifiably identity record or use the money digitally. or credential, while an estimated 3.3 billion people live in countries without a government-recognized digital identity for Technological innovation and changing priorities have led online transactions (Metz et al. 2024). And while a significant to a paradigm shift toward fast payment systems (FPSs). share of the population living in upper-middle and high- Traditional payment infrastructures in most jurisdictions consist income countries do have a digital ID of some kind, many of of a real-time gross settlement (RTGS) system for large-value these systems are not built with DPI functionality or norms and time-critical payments, an automated clearing house in place. As such, they may not be interoperable or usable (ACH) for low-value payments, card payment processing by diverse service providers, may not be widely accessible systems, e-money service providers (including interoperable to the population, or may offer inadequate protections for infrastructure), and mechanisms for cross-border payments. personal data. However, the transition to an FPS allows for instant funds transfer and immediate fund availability to beneficiaries on a Similarly, there is room to make significant gains in e-signature 24/7/365 basis. As an FPS evolves, it enables a diverse set of capabilities globally. As of 2024, only 96 economies had payment service providers (banks and non-banks) and supports fully operational e-signatures, of which 69 were high-income a variety of payment instruments, use cases (domestic and or upper middle-income countries. Some 35 additional cross-border), transaction channels, and overlay services. 23 economies with e-signature regulations have yet to develop technological infrastructure, reflecting that one of the core FPSs provides critical advantages, including offering imme- challenges to implementing trust services is the cost and diate access to funds and lower fees, reducing switching complexity of developing sustainable business models for PKI costs, promoting interoperability, and encouraging the use as one of the core technologies underpinning high-assurance of transaction accounts. This shift enhances platform compe- e-signatures (World Bank 2024a). At the time, progress had tition and enables new providers to offer diverse services, been made, including increasing moves toward cross-border thus increasing competition and dynamic efficiency within interoperability of e-signatures to build the digital economy. the payments ecosystem. Additionally, an FPS plays a crucial For example, the European Union’s eIDAS regulation provides role in the digitization of government payments, enabling for cross-border interoperability across the EU, allowing for real-time revenue collection and efficient disbursement of e-signatures created in one member state to be verified and time-sensitive payments. This infrastructure supports urgent legally recognized in any other. Interoperability is assured transactions during emergencies, ensuring timely delivery of irrespective of whether the trust service was provided by a financial aid to vulnerable populations. The types of payment public- or private-sector entity (EU 2014 & 2024). instruments supported by FPSs include credit transfers, direct debits, and e-money. Direct debits are available in 23 When comparing modern models for digital payments, it is important to clearly articulate how FPS differ from newer models, such as those promoted by Open Finance. A Payment Initiation Service Provider (PISP), as encountered in Open Finance frameworks, is not an infrastructure but a service model that allows third-party providers to initiate payments on behalf of customers directly from their transaction accounts, possibly leveraging an FPS for this purpose. While an FPS focuses on the underlying technology and network to facilitate instant transactions, a PISP leverages such infrastructure to enhance user convenience and broaden access to financial services. 20 - Figure 10. Role of digital payments Digital payments transfer money between people, government, Identity & E-Signatures and businesses digitally— including through bank and mobile money accounts. Core Examples of use: Digital Payments DPI • Send remittance instantly to a relative’s account • Receive an emergency cash transfer digitally • Pay tuition fees online Data Sharing • Scan a QR code to pay a merchant Source: Original figure for this publication. China, Hong Kong SAR, India, Nigeria, and Singapore, with Data Sharing - development underway in Australia and Malaysia. E-money is supported in Chile, Hong Kong, India, Malaysia, Mexico, Digital systems for sharing data can help optimize the flow Nigeria, Thailand, and the United States. Credit transfers Data and sharing reuse of systems data in facilitate the digitaltrusted sharing, particularly economy, exchange, oracross Identity & E-Signatures transfer of data, including personal and non-personal data, are universally supported across all jurisdictions that have sectors. This includes protecting data that should not be between individuals, governments, and/or firms. implemented an FPS. shared, while simultaneously removing constraints that result Core Examples of use: Digital Payments in suboptimal data flows. For example, while much global A growing numberDPI of countries have implemented an FPS • attention Share your educational has necessarily credentials been paid withtoan employer personal protecting • Verify income information for a social assistance beneficiary as a core component of their DPI. Over the years, many data from exposure and misuse, it is equally important to with the revenue authority countries have enhanced their DPI ecosystems through the • enable Data Sharing Aggregate easy sharing climate of data data that could for research and provide policymakingpublic benefit implementation of FPSs. These systems unify a diverse range and enable better service delivery and digital innovation. of providers and use cases, fostering interoperability and Data sharing DPIs can enable entity-to-entity data sharing competition, reducing costs, and spurring financial inclusion architecture (for example, a finance ministry agency sharing and innovation. Approximately 70 emerging market and data with the tax authority), open data for public use (for developing economy (EMDE) jurisdictions have launched example, open data portals and data lakes), and personal these systems, with several more expected to go live in the data sharing and management (for example, decentralized Integrated Digital Social Financial Trade & near future. 24 Notable successes include Thailand , where Protection Health Agriculture Tax Public Services management of personal data Inclusion and documents). other As with Invest PromptPay reached close to 20 billion transactions in 2023, DPIs, data sharing software and platforms can be provided • E-service • Electronic • Digital • Online • Precision • Digital tax • G2B services Brazil, with 112 transactions per portal capita annually, and India, benefits medical by the public or private sector; account e-extension in particular, platforms new•markets National single where 81 percent of all digital payments • Government records are processed (EMRs) through registration opening market &data • E-workflowmanagement window for Applications • Telemedi- for decentralized personal and credential mobile app • Digital G2P • Remittances services for taxpayer automated an FPS. However, fewer than 20 25 EMDE countries • Single sign on have fully payments cine-enabled applications finance are like wallets • MSME • dMRV likely to grow substantially queries in the customs leveraged the complete range of functionalities that services FPSs offer, coming years. such as merchant payments. Cross-border interoperability • Gov interop. • Health MIS • Social • Core • Subsidy MIS • Integrated tax forLeveraging payments has become a priority for many•jurisdictions. framework HL7, FHIR, The appropriate protection data sharing banking • Crop system yield depends admin on the purpose ForDPI for: with the goal of adhering example, to EU standards • Enterprise DICON and MIS and type of data being shared. systems MIS Systems that enable systems individuals, (ITAS) • Identity architecture • ICD, LOINC, • Case mgmt. • Credit • Soil health • Local tax integrating into verification & the Single InformationEuro Payments • Data Area (SEPA), SNOMED CT the businesses, MIS and systemsgovernments MIS to seamlessly invoicing and securely Systems & Western Balkans attributes have adopted Standards common standards legislation and • share Payment or MIS exchange data •across Input (and within) system sectors are key • Electronic tracking payments infrastructure, modernizing the regional payment for many types of transactions, as well as for research and signatures system to enable cost-efficient cross-border payments. • Instant broader policy making. There are multiple technical solutions • Register of • Shared health • Social register • eKYC/eCDD • Farmer reg. • Tax register • Registers of payments registries & client for data sharing (dynamic, registerdepending on the type • Agribusiness andof tax data and other regulations • Cross-sector • Service registries integrated) • Alias MSME reg. and identifica-API gateways data sharing factors, including enterprise service busses, catalogues • Reference reg. • Unemploy- directories • Geo-refer- tion number procedures • And more … • Business reg for products, ment & labor • Fraud register enced plots (TIN) Registries • Land reg providers, registries • Transaction terms reg. • Public health 24 Recent research from the Bank for International Settlements indicates that as fast payment volumes increased, the demand for small denomination datasets banknotes decreased. This rise in fast payments also coincided with an increase in card payments, demonstrating that fast payments are a key driver in the digitalization of payment ecosystems. See Alberto Di Iorio et al. (2024). 25 See Bank of Thailand (2024), Alberto Di Iorio et al. (2024), and Reserve Bank of India (2024), respectively. DIGITAL PUBLIC INFRASTRUCTURE AND DEVELOPMENT: A WORLD BANK GROUP APPROACH 21 DIGITAL TRANSFORMATION WHITE PAPER, VOLUME 1 and exchanges, warehouses for open data, and verifiable X-tee platform—which enables data sharing for 1,700 services—is credentials. These are discussed in more detail in Section 3. embedded in a robust data governance framework, along with technical controls such as a citizen portal to enable people to One key parameter for data sharing architecture is whether see how their data is used (World Bank 2022a). Furthermore, the goal is to promote wide data reuse or to protect data from countries and regions are increasingly looking to implement abuse. Data at risk of oversharing requires systems that enforce cross-border data sharing to improve access to services, trade, strict access controls and, in the case of personal data, gives and migration through multi-country frameworks such as the control and transparency to people (“data subjects”) over how European Union’s eIDAS and EU Digital Identity Framework their data is used. For example, India’s Data Empowerment (EUDIF). For instance, the Europass Digital Credentials for and Protection Architecture (DEPA) creates a framework for Learning project offers a trusted way to share verifiable diplomas third party “data fiduciaries” to facilitate consent-based data and certificates, allowing easy verifiability by employers in sharing on behalf of an individual, and with the legal obligation any of the 27 EU member countries. to act in their best interest. In contrast, systems designed to increase the reach of data, such as those aimed at increasing Non-Technology Enablers and Safeguards transparency and efficiency through open data, should be designed with accessibility, usability, and discoverability in DPI is much more than technology. This section outlines some mind. In the Maldives, where climate change poses significant of the key “non-tech” components of the digital ecosystem— risks, the government plans to develop a secure data-sharing sometimes referred to as “analog complements” (World platform integrated with existing DPIs to enable consent-based Bank, 2016)—including legal frameworks, regulations, and data sharing, remote service delivery, and improved sharing governance requirements for DPI systems themselves, along of non-personally identifiable data for climate adaptation. with additional measures to ensure that DPI is safe, inclusive, and helps close rather than widen the digital divide. Data sharing DPIs facilitate data sharing across sectors and should integrate into sectoral data systems. In addition to - Laws and Regulations society-wide DPIs that enable data sharing and personal data management across sectors, some sectors will have their Each DPI requires appropriate enabling laws and regulations own specific data sharing protocols and platforms (such as Digital payments specific to the transfer system. money between people, This includes government, legal and regulatory for health data, which Identity is highly sensitive) that can be built & E-Signatures and businesses digitally— including through bank and mobile frameworks money accounts. required to establish and operate each DPI to interoperate with DPIs for cross-sector data exchange. with clear roles and responsibilities. Typically, this involves Core data sharing DPIs do not replace sector- As noted earlier, Examples of use: separate laws, regulations, or decrees related to each core Digital Payments DPI specific data and interoperability standards—such as the Fast• Send remittance instantly to a relative’s account DPI system, such as a national or digital ID law, laws on data Healthcare Interoperability Resources (FHIR) standard in the • Receive an emergency cash transfer digitally • sharing access, andfees Pay tuition laws on e-signatures, and laws governing online health sector—but should be Sharingto interface with them. designed Data Scan a payment • digital ecosystems. QR code to In addition, it includes legal pay a merchant instruments required to enable the use of DPI for digital As with other DPIs, trusted data sharing systems go beyond services and transactions and ensure legal equivalence technology and are closely linked to laws, policies, and with paper transactions, such as broad e-transactions and frameworks for data governance. In Estonia, for example, the - Figure 11. Role of data sharing Data sharing systems facilitate trusted sharing, exchange, or Identity & E-Signatures transfer of data, including personal and non-personal data, between individuals, governments, and/or firms. Core Examples of use: Digital Payments DPI • Share your educational credentials with an employer • Verify income information for a social assistance beneficiary with the revenue authority Data Sharing • Aggregate climate data for research and policymaking Source: Original figure for this publication. Integrated Digital Social Financial Trade & Health Agriculture Tax Public Services Protection Inclusion Invest 22 • Electronic • E-service • Digital • Online • Precision • Digital tax • G2B services portal medical benefits account e-extension platforms • National single • Government records (EMRs) registration opening & market • E-workflow window for e-commerce laws and sector-specific laws (for example, as bias can occur when the data or models used for analysis relevant for health, social protection, agriculture, and other mirror or exacerbate existing biases, potentially resulting in sectors). Even if data sharing and e-signature capabilities unfair or discriminatory outcomes, such as denying credit to exist, they will not reach their full potential if paper copies marginalized groups. Preventing algorithmic bias requires and handwritten signatures are still required by law. the use of diverse and representative datasets, regular audits to detect biased patterns, and explainability techniques to Beyond those specific to DPI systems, broader legal and understand how algorithms make decisions. regulatory frameworks for data governance, and data protection are critical. Robust data governance practices, Governance and Institutions supported by tools that oversee the use and reuse of data throughout its lifecycle, are crucial for maximizing the value of Beyond laws and regulations, each DPI system also requires DPI. Effective data governance must address both personal broader governance frameworks, including policies and and non-personal data, recognizing their distinct characteristics standards at the national and sector level (World Bank & and governance requirements. This is an important basis IADB 2024). Most countries are unlikely to have a single for all DPIs—including digital identity, payments, and data framework on “DPI governance,” as DPIs are typically provided sharing—that engage in data processing. by different entities—including the private sector—and governed separately. With digital identity systems, for example, these Personal data requires stringent safeguards to ensure privacy are often implemented by national ID, civil registration, or and protection, which are fundamental for maintaining digital transformation agencies, with specific governance public trust in a DPI that processes this type of data. This arrangements and institutions. Digital identity and e-signatures includes the adoption of legal and regulatory frameworks often also include “trust frameworks” that outline roles and for data protection alongside the integration of privacy- responsibilities for ID and e-signature providers and users, enhancing technologies within the technical design of DPIs. requirements and specifications for specific levels of assurance Core data protection principles include lawfulness, fairness, (or trust) provided, and more.26 For payments, governance and transparency in data processing; purpose limitations to frameworks encompass the structure, processes, and policies ensure data is collected for specific, legitimate purposes; through which Financial Market Infrastructures’ (FMI) decisions minimization of data to collect only what is necessary; accuracy are made and decisions are managed, regardless of whether of data; storage limitations; integrity and confidentiality; and FMIs are publicly or privately operated entities. accountability. These principles are outlined in frameworks and instruments like the European Union’s General Data Broader data governance also requires policies, standards, Protection Regulation (“EU GDPR”), the Council of Europe’s and guidelines to govern how data is processed, shared, Convention for the Protection of Individuals with Regard to and reused across the economy, including for DPIs. Data the Processing of Personal Data (“Convention 108+”), the governance frameworks clarify the roles and responsibilities OECD Guidelines Governing the Protection of Privacy and of various stakeholders, define mechanisms required for Transborder Flows of Personal Data 2013, and others. monitoring and enforcing compliance, and establish consistent definitions, formats, and protocols for effective exchange of Non-personal data, including aggregated, anonymized, or data. Importantly, this broader framework will need to consider machine-generated data, also plays a pivotal role in driving sector-specific data governance mechanisms especially as they innovation and informing decision-making processes through relate to DPI use cases, ensuring alignment while accounting data sharing DPIs in particular. For non-personal data, the for the unique needs of individual sectors. This interplay helps emphasis must be placed on ensuring data quality, accuracy, maintain coherence across domains while enabling sectoral and accessibility, as these factors are critical for realizing the full and DPI-specific policies to adapt to distinct regulatory, potential of data-driven insights and innovations. However, the operational, and technological requirements. governance of non-personal data should be carefully calibrated to avoid unnecessary restrictions that could stifle innovation, Across and within DPIs, multi-stakeholder involvement in which is central to the evolving role of DPI in various sectors. governance is critical. The success of DPIs requires buy-in In addition, algorithmic bias must be prevented. Algorithmic across various sectors, institutions, and the broader public. 26 For detail on trust frameworks for federated ID ecosystems, see World Bank (2022b), for details on trust frameworks for e-signatures, see Tullis et al. (2024). DIGITAL PUBLIC INFRASTRUCTURE AND DEVELOPMENT: A WORLD BANK GROUP APPROACH 23 DIGITAL TRANSFORMATION WHITE PAPER, VOLUME 1 Involving a range of groups in the design and governance will development with broader strategies, such as national financial improve accountability and contribute to the success of DPIs inclusion or government digitization initiatives, can optimize by ensuring that they meet the needs and concerns of diverse resource allocation and enhance institutional readiness. users (World Bank & IADB 2024). At a minimum, these groups should include government and private entities involved in Cybersecurity, Resilience and Operational Reliability building DPIs, service providers from across sectors who will use DPIs, regulators, and CSOs and community groups Operational risks, including cyber threats, are amplified in (such as in Australia, Jordan, and South Africa, as discussed complex, interlinked systems like DPI. Operational risks in DPI in Section 3). Strong engagement in DPIs by CSOs helps arise from their heavy reliance on technological and operational strengthen their overall design andensure effective oversight components, making them vulnerable to disruptions, fraud, and accountability of these systems in the long run. cybersecurity threats, and risks from connected third parties. Operational failures, such as IT disruptions, cyberattacks, Additionally, institutional capacity is necessary for the or errors in processes, can severely impact the DPIs ability effective implementation and operation of DPIs. This to provide essential services. Such disruptions may lead to involves clear lines of accountability and responsibility and significant economic losses, and reputational damage. For allocating resources and training to ensure that frameworks example, in the financial sector, in extreme cases, operational are effectively operationalized, allowing countries to reap failures may lead to systemic risk by undermining confidence the benefits of DPI across the economy. For instance, Korea in the financial system. employs a three-tiered data governance structure. At the top, the Presidential Special Committee on Data Policy sets For this reason, policy guidance and robust frameworks for national directions and coordinates data-related projects mitigating operational risks and for cyber resilience in the between institutions. The Ministry of the Interior and Safety financial sector already exist, with implications for broader (MOIS) oversees public data initiatives, while the Ministry of DPI. For example, the GPFI provides a policy framework to Science and ICT (MSIT) oversees data produced and held by ensure the secure and resilient development and governance the private sector. Supporting both ministries, the National of DPI (Alber et al. 2023). More broadly, the Principles for Information Society Agency (NIA) focusses on ensuring Financial Market Infrastructures (PFMIs) also provide a robust alignment between their efforts, exemplifying an integrated framework to mitigate operational risks across Financial Market approach to data governance (Khoury et al. 2024). Infrastructures (FMIs) including Fast Payments Systems (FPS) (CPMI and IOSCO 2012). The recommendations across these Institutional capacity is particularly crucial for ensuring frameworks advocate for the development of DPIs incorporating high availability and efficient responses to users’ demands. privacy-enhancing technologies, robust security measures, Adequate resources, expertise, and organizational arrangements resilience against attacks or system failures, and sound within implementing and operating entities are critical for risk management to build trust. They emphasize continuity managing the complexities of DPI development, including planning to ensure uninterrupted operations and encourage stakeholder coordination, technical design, and governance adaptive, risk-based regulatory, supervisory and oversight frameworks. High availability is a core requirement for DPIs; frameworks tailored to the evolving risks posed by DPIs and new for instance, FPSs re expected to operate 24 hours a day, 365 entrants. Additionally, they highlight the need for transparent days a year to provide uninterrupted access and reliability. governance stakeholder representation to safeguard public Without sufficient institutional capacity, the risks of delays, interest. Equally important is the development of features inefficiencies, and misalignment with broader public policy within DPIs to enhance customer protection, reduce risks, objectives are significantly heightened. Strengthening internal and foster trust. By leveraging these frameworks, countries capacity of operators and leveraging private sector expertise can assess their financial infrastructure risks and work toward ensure that DPI initiatives are not only implemented effectively minimizing them. but also supported throughout their lifecycle to deliver long- term economic and social benefits. Moreover, aligning DPI 24 The rapid adoption of Fast Payment Systems (FPS) introduces point of failure and requires technological and operational heightened cyber risks, such as ransomware and DDoS continuity strategies and established protocols that allow for attacks, posing systemic threats to financial stability. 27 timely communication and resolution of service interruptions. Effective risk management is needed to ensure seamless operations even under cyber threats, reducing disruptions that Digital Inclusion, Literacy, and Skills could compromise the overall functioning of the economy. To address these risks, tailored guidance and leading practices “Inclusion first” is a core principle of DPI. As with data have been developed for FPS ecosystem par ticipants, protection, this requires a multi-pronged approach, including including payment system infrastructure operators, payment the technical design of a DPI (such as complying with design service providers, and end users.28 This guidance emphasizes principles around universal accessibility) and legal and comprehensive cybersecurity programs across people, regulatory frameworks to ensure non-discrimination in DPI processes, and technology layers, leveraging internationally access and use. For example, as services increasingly move recognized frameworks and standards. A risk-based approach online, it is important to ensure that people with challenges is recommended to prioritize resources for critical threats, using digital technology are not left behind due to difficulties with tailored risk management frameworks. Continuous accessing these services or prior exclusion from systems (such monitoring, regular testing of cybersecurity controls, and as IDs) that may be prerequisites for access. While DPIs can proactive measures like encryption, secure access channels, facilitate better access to services for many people, digital and identity management can contribute to operational delivery should not be the only option for people to receive resilience. Collaboration through information sharing and basic services or exercise their rights. Paper-based or assisted cybersecurity awareness programs is also essential for robust options, along with clear exception handling mechanisms defense against evolving cyber risks. when digital technologies fail, are essential. For example, Cambodia’s Verify.gov.kh document verification platform Ensuring the protection of both personal and non-personal includes the ability for users to print documents that can be data in practice also requires strong cybersecurity measures. digitally verified using QR codes. This includes cybersecurity strategies and legislation, institutions and capacity building for cybersecurity incident response, and Proactive measures are needed to ensure that the potential public awareness and training to improve cybersecurity skills benefits of DPIs reach everyone. The digital divide is a market within government, businesses, and the general public. For failure; closing it requires systematically identifying and example, both Singapore’s “Digital Readiness Blueprint” initiative addressing barriers to digital adoption and use. This includes and Uruguay’s central coordinating body for digitalization (the dedicated efforts or campaigns to reduce existing gaps in Agencia de Gobierno Electrónico y Sociedad de la Información, connectivity (such as broadband and devices) and DPI access or AGESIC) have sought to prioritize cybersecurity capacity (such as lack of foundational IDs or financial accounts needed building and related digital skills (Desai et al. 2022) as a to get the most out of digital identity and digital payments) key component of their strategies, which contributes to the and promote uptake of DPI-enabled services among groups reliability of their DPI. most likely to be excluded. In Mozambique’s conflict-affected Cabo Delgado province, “one-stop-shop” mobile registration Continuity strategies to avoid disruption in the provision brigades, offering civil registration and national ID registration of DPI services is also crucial. The goal of DPI is to provide services, were set up to (re)register and provide official building blocks for the delivery of digital services across identity documents to internally displaced persons. These sectors—the reliability of these systems is therefore paramount mobile brigades use simplified registration procedures and to building trust, avoiding service disruptions, and managing charge no fees to enable same-day registration and credential reputational risk. This requires backup systems and disaster issuance for the most vulnerable, and enabled more than recovery sites, but also a deep analysis of potential failure 75,000 people to obtain official identity documents and use scenarios, their probability, and impact. This is particularly these to access services, education, and job opportunities important in cases where a specific DPI represents a single (World Bank 2023). 27 The World Bank’s Project FASTT addresses the growing cyber risks associated with the adoption of FPS by providing tailored guidance and leading practices to safeguard the FPS ecosystem. For guidance on cybersecurity please see (World Bank 2025). 28 More broadly, financial sector standard-setters have underscored the critical role of FMIs in ensuring financial stability and economic growth by maintaining robust cyber resilience. See CPMI and IOSCO (2016) which supplement the PFMI and offer detailed recommendations on addressing escalating cyber threats. DIGITAL PUBLIC INFRASTRUCTURE AND DEVELOPMENT: A WORLD BANK GROUP APPROACH 25 DIGITAL TRANSFORMATION WHITE PAPER, VOLUME 1 Such efforts also require—and can be opportunities to physical infrastructure for digital connectivity and individual provide—basic digital literacy training and education. Even access to devices. In rural and low-income regions that remain if people have access to DPI and DPI-enabled services (for underserved by high-speed internet, or where access to example, through an application on their mobile phone), they smartphones (or even feature phones) is low, the opportunities may need additional training and education to understand, for end-to-end digital service delivery will remain lower. As part trust, and use these services. In Ukraine, the Diia. Education of their efforts to expand internet access, many countries are online platform offers free digital literacy courses, including investing not only in hard infrastructure, but also in “hybrid” a national digital literacy test (Digigram) aligned with the service points where people can physically come to access European framework of digital competencies. The initiative online services. For example, Bangladesh has built over 9,000 extends beyond online resources, supporting over 6,000 offline “Digital Centers” run by young entrepreneurs that provide hubs to reach citizens across the country, bridging gaps in last-mile connectivity and access to over 300 government digital skills and access (Ingram & Vora 2024). In Bangladesh, services to help “bridge the gap” between physical and digital the BRAC Shakti program29 was established in 2020 to boost services (Chowdhury 2024). confidence among women in using digital financial services. It employed a gamified approach to surround women with Public Key Infrastructure (PKI) the peer support they need to explore, learn, and build comfort using new digital tools. Women are introduced to PKI—a combination of cryptographic technologies with the program through their peers and are then onboarded to complementar y polic y, organizational, and process a small group where they learn about savings using mobile elements—is an essential ingredient for online trust.30 Under money and navigating other household dynamics around a PKI, Certificate Authorities (CAs) issue digital certificates finances. Every two weeks, women go with the group to cash to users (e.g., people, firms, government entities) that allow in their money at a mobile agent. As they deposit money, they them to digitally sign documents and encrypt or authenticate earn rewards such as cash-back bonuses, among others. This information. At a basic level, these digital signatures and gamified, peer-based learning approach was instrumental in certificates enable secure web browsing by helping to reducing women’s reliance on other household members, thus establish secure communication channels (such as via the building their trust and confidence when making or receiving transport layer security or TLS protocol). PKI is also required payments digitally. for implementing high-trust digital ID and e-signatures, as discussed earlier in this section, and for securing digital payments and data sharing. Although the term “PKI” implies Technology Enablers a single, unified infrastructure, there are often multiple PKIs DPI does not exist in a vacuum. The ability to deploy and operational in a given jurisdiction, including those provided use DPI relies on strong technology foundations, including by the public and private sector. connectivity, devices, PKI, data hosting, and cloud computing, and can also leverage advances in data-driven innovation, In the financial sector, for example, PKI supports the end-to-end such as artificial intelligence (AI). DPI can also contribute to the encryption of payments data and the use of tokens to replace development of new technologies including AI by improving account details for enhanced security. PKI also supports data sharing and creating new markets for DPI-related robust authentication and transaction signing from financial AI applications. transaction participants and operators at a system level. For example, FPS operators require participants to authenticate Connectivity and Devices using digital certificates, such as x.509. Furthermore, each participant is required to digitally sign payment messages using Broadband connectivity and access to devices are crucial the certificate issued by a trusted authority (in some cases foundations for DPI and any digitally enabled service. While the operator of the FPS). Data sharing applications similarly some DPI applications can be used without the internet—for rely on PKI for secure transmission of data and authentication example, scanning a QR code printed on an ID as a low-assurance between data senders and recipients. For more on PKI, read form of identity verification—they still overwhelmingly rely on Tullis et al. (2025). 29 For more, see https://www.ideo.org/project/brac-shakti. 30 For this reason, PKI could also be classified as a DPI, as it provides essential, society-wide functionality, and can be built with DPI specifications and principles. For the purposes of this paper, however, it is classified as an underlying technology. 26 Data Centers and Cloud A DPI approach can also be used to strengthen the development of new technologies. Korea, for example, has Modern data hosting and computing solutions are required to built a public infrastructure for data sharing and processing support DPI growth and expansion in a scalable and secure with the goal of supporting AI innovation (Khoury et al. manner. Implementing DPI systems and platforms requires 2024). Another example is in the European Union, where access to highly secure, reliable, and accessible data hosting projects like the European Open Science Cloud and various environments to ensure trust in and availability of DPI. These AI research initiatives including the AI4EU platform34 —which hosting environments, whether on premises or accessed leverages DPI for data sharing and digital identity—connects through the cloud, must conform to high security standards AI researchers, developers, and users across Europe providing while ensuring that DPI-based services meet performance a virtual platform for collaboration. and accessible requirements. Broader Digital Systems and Services To enable real-time processing, storage, and exchange of large volumes of data, operators of DPI platforms increasingly DPI does not deliver services in a vacuum—it works with leverage the cloud in DPI deployment. DPI operators may and for a host of digital systems across sectors. Although make DPI services available to users over the cloud, deploy DPIs such as digital identity and digital payments represent the DPI platforms themselves in cloud environments, or a standalone digital services themselves, the power of DPI is combination of both. While some DPI operators use private its ability to integrate into a variety of sector applications. For cloud solutions or host DPI platforms in their own data this to succeed, sectors must have a variety of digital systems, centers, others leverage public cloud services to help promote including digitized databases and registers, interoperable scalability, reduce costs, improve performance, ensure security, information systems, and sector-specific data standards and and give the flexibility to meet the evolving data storage and digital-ready laws and regulations. A relentless problem- processing needs of DPI ecosystems.31 These approaches can driven, user-centric focus, rather than an over-emphasis on reduce some risks of vendor lock-in for DPI operations, as technology, is required for effective DPI adoption. Strategic well as enable innovation through cloud-based DPI services.32 investment in the tools, practices, and institutional conditions required to provide good services is essential for scalability. Data-Driven Innovation Examples of these systems across different sectors are presented in Figure 12. New technologies have the potential to boost DPI development and applications, including advances in artificial intelligence (AI), DPI can help strengthen myriad sector-specific applications, machine learning (ML), quantum computing, edge computing, information systems, and registries to improve digital and more. For example, AI and ML were pivotal in augmenting services and transactions. For example, rolling out digital DPI during India’s massive COVID-19 vaccination drive. The registration and direct deposit for a social assistance program CoWIN platform, built using an open-source platform DIVOC may use a dynamic social register with data on potential (Digital Infrastructure for Verifiable Open Credentialing),33 used beneficiaries, management information systems (MIS) to AI algorithms to optimize vaccine distribution, appointment determine eligibility, and applications for online registration. scheduling, and real-time monitoring (Kumar & Veer 2021). A digital identity DPI can help improve the integrity of the AI helped predict demand patterns and ensure equitable social register (by ensuring that each person registers only one vaccine allocation across different regions. Edge computing time), accurately map unique beneficiaries to their accounts, also has the potential to extend DPI-based digital services. In and facilitate online registration (verifying the identity of a Brazil, for example, processing data locally at edge devices new applicant). A data sharing DPI can help verify eligibility enabled healthcare providers to offer real-time diagnostics by cross-checking applicants’ income levels against the tax and telemedicine even in regions with limited connectivity, system, while a digital payment DPI facilitates instant payments thus extending services to underserved populations (Silva to beneficiary accounts. et al. 2022). 31 For example, over-reliance on public sector investment in cloud infrastructure or regulatory uncertainty can deter private investments in cloud needed to boost the digital economy and ICT industry. For more on cloud, see Gelvanovska-Garcia et al. (2024). 32 See Varma et al (2024). 33 For more, see https://divoc.digit.org/. 34 For more, see https://www.ai4europe.eu/about-ai4eu. DIGITAL PUBLIC INFRASTRUCTURE AND DEVELOPMENT: A WORLD BANK GROUP APPROACH 27 DIGITAL TRANSFORMATION WHITE PAPER, VOLUME 1 Core Examples of use: Digital Payments DPI • Share your educational credentials with an employer • Verify income information for a social assistance beneficiary with the revenue authority Data Sharing • Aggregate climate data for research and policymaking Figure 12. Example digital systems by sector Integrated Digital Social Financial Trade & Health Agriculture Tax Public Services Protection Inclusion Invest • E-service • Electronic • Digital • Online • Precision • Digital tax • G2B services portal medical benefits account e-extension platforms • National single • Government records (EMRs) registration opening & market • E-workflow window for Applications mobile app • Telemedi- • Digital G2P • Remittances services for taxpayer automated • Single sign on cine-enabled payments • MSME finance • dMRV queries customs services • Gov interop. • Health MIS • Social • Core • Subsidy MIS • Integrated tax Leveraging framework • HL7, FHIR, protection banking • Crop yield admin DPI for: • Enterprise DICON MIS systems MIS systems (ITAS) • Identity architecture • ICD, LOINC, • Case mgmt. • Credit • Soil health • Local tax Information verification & • Data SNOMED CT MIS systems MIS invoicing Systems & attributes Standards standards • Payment MIS • Input system • Electronic tracking signatures • Instant • Registers of • Register of • Shared health • Social register • eKYC/eCDD • Farmer reg. • Tax register payments registries & client (dynamic, register • Agribusiness and tax regulations • Cross-sector • Service registries integrated) • Alias MSME reg. identifica- and data sharing catalogues • Reference reg. • Unemploy- directories • Geo-refer- tion number procedures • And more … • Business reg for products, ment & labor • Fraud register enced plots (TIN) Registries • Land reg providers, registries • Transaction terms reg. • Public health datasets Source: Original figure for this publication. Integrated digital public service (DPS) layers and access points and conflicting digitalization initiatives across ministries. The are often closely linked to DPI. DPS can include whole-of- core difference is that while DPI can be built, owned, and government enterprise architecture, interoperability frameworks, operated by the public and/or private sector, DPS systems single-sign on (SSO) e-service portals, and government mobile are generally publicly owned and operated and typically apps designed to provide integrated delivery of digital only facilitate access to government services. Furthermore, government-to-person (G2P) and government-to-business DPS technologies are often bundled with broader change (G2B) services. Countries such as Ukraine, Brazil and Jordan management and institutionalization of digital government have integrated DPI directly into this “one-stop-shop” approach reforms designed to enable a “whole-of-government” approach to digital government. In Jordan, for example, the Sanad to digitalization (versus the DPI focus on “whole-of-economy” application and e-services platform includes digital ID and or society). e-signatures functionalities that enable citizens to access over 2,000 services, including applying for government benefits, accessing personal records, digitally signing documents, and 3. DPI AND DEVELOPMENT making bill payments. A DPI approach to digitalization has many possible benefits, Like DPI, DPS service layers and applications are sector- but also some obstacles. This section provides a concise agnostic, and provide soft infrastructure and shared tools to theory of change for DPI and where we might expect it to have architect a seamless, user-centric service delivery experience important impacts for development, followed by a summary across all government agencies and providers. They also of potential challenges and risks. improve government efficiency by minimizing duplicative 28 Digital Payments DPI • Send remittance instantly to a relative’s account • Receive an emergency cash transfer digitally • Pay tuition fees online Data Sharing • Scan a QR code to pay a merchant Figure 13. Potential impact: DPI versus a siloed approach Direct Mechanisms Through Which DPI Outcomes for People, Improves Over a Siloed Approach Governments, and Firms - Provides high quality shared assets More responsive, efficient services that reduce cost & time to roll-out new services DPI Improved service quality Focuses on inclusion, accountability, data privacy & user-control User convenience & empowerment Increased trust Provides shared, open assets for private sector innovation and competition Competition and new markets Source: Original figure for this publication. Direct Mechanisms Through Which DPI Outcomes for People, Benefits of DPI ID systems, data-sharing Improves Over a Paper-Based Approach Governments, and Firms platforms, and payment systems enhance accessibility, empowering new entrants and improving DPI has the potential to positively impact multiple development consumer choice through better services and personalized outcomes through both direct and indirect pathways. Ability Figure to verify identity offerings. In Brazil, the introduction of Pix, a real-time payment remotely 13 highlights three direct mechanisms for impact based on system, has increased Improved efficiency competition by enabling small banks Identity & Higher levels of assurance and how the DPI approach of providing “foundational e-sign security online and digital to offer comparable services to larger institutions, attracting in person DPI building blocks for the public benefit” is expected to improve more deposits and narrowing End-to-end, legally valid digital qualityrate gap while the deposit Improved service outcomes, compared to following a traditional “siloed” enhancing depositor benefits (Sarkisyan 2024). However, while transactions approach to digitalization: open standards and equitable access are User convenience critical for market & empowerment Payments instant, Ability to make and receiveinclusivity, robust regulatory oversight is essential to ensure cashless 1. The availability of high-quality shared payments digital building fairness, prevent market dominance, and safeguard against Increased trust blocks can significantly improve efficiency Greater userand reduce control over data risks like data breaches and cybersecurity threats. costs of government and private sector service providers, Data Increased data flows, including accelerating the development of new sharing services. across borders The case of digitalizing G2P payments Competition andillustrates these benefits. new markets 2. By providing systems that focus on inclusion, public As summarized in the World Bank Digital Progress and Trends accountability, data privacy and protection, and user report (World Bank 2024a), for example, digitalizing G2P control, DPI’s public benefits orientation can improve payments has contributed to 865 million people worldwide consumer experiences and empowerment, the quality opening their first financial institution account to receive of services and data, and online trust and security. money from the government (Demirgüç-Kunt et al. 2022), and provided benefits such as reduced waiting times for 3. Providing open, shared building blocks can enable payments (India), greater control of financial resources by significant private sector innovation and competition, women (Pakistan, Niger, India), and reduced time required potentially further improving service quality and effi- to complete services (Singapore, Estonia). Digitalizing G2P ciency, and helping to develop new services, developer payments has increased competition among payment service communities, and digital markets. providers (Zambia) and lowered the cost of onboarding clients For example, DPIs can transform competition across markets (India, Singapore) (World Bank 2024a). For governments, it has by lowering entry barriers, enabling smaller players to also reduced the cost of payments delivery (Zambia), reduced challenge established firms, and fostering innovation. By leakages (India), and enabled the rapid scaling of emergency democratizing access to data, automating processes, and benefits (globally during the COVID-19 response) (World Bank promoting interoperability, DPIs reduce transaction costs 2024a). To the extent that DPI enables faster, more efficient, and address information asymmetries, creating a more and more secure scaling of digital services like G2P payments, dynamic and inclusive marketplace. Innovations like digital its potential indirect impacts on development are sizable. DIGITAL PUBLIC INFRASTRUCTURE AND DEVELOPMENT: A WORLD BANK GROUP APPROACH 29 DIGITAL TRANSFORMATION WHITE PAPER, VOLUME 1 Increased trust Provides shared, open assets for private sector innovation and competition Competition and new markets Figure 14. Potential impact: Core DPIs versus paper-based systems Direct Mechanisms Through Which DPI Outcomes for People, Improves Over a Paper-Based Approach Governments, and Firms Ability to verify identity remotely Improved efficiency Identity & Higher levels of assurance and e-sign security online and in person DPI End-to-end, legally valid digital Improved service quality transactions User convenience & empowerment Payments Ability to make and receive instant, cashless payments Increased trust Greater user control over data Data Increased data flows, including sharing across borders Competition and new markets Source: Original figure for this publication. In addition to the overall benefits of a DPI approach, specific Challenges and Risks DPI systems provide direct benefits compared with non-digital systems. These mechanisms of impact are detailed in Figure While DPI holds potential for transforming service delivery 14, and articulate the ways that specific DPIs can improve and fostering economic growth, its implementation still faces efficiency, service quality, user convenience and empowerment, significant challenges. One key obstacle is existing gaps in digital trust, and market innovation. There are numerous availability and access to DPI systems and their precursors examples of these impacts around the globe. In Singapore, both across and within countries. As noted above, for example, eKYC—facilitated by the Singpass consented data-sharing an estimated 850 million people lack official identification— service—reduced the time to complete digital transactions around half of whom are children whose births have not been by 80 percent (OECD 2022). In Estonia, the government, registered—and 3.3 billion lack digital identities that can be citizens, and residents save 820 years of working time every used for online services (Metz et al. 2022). Similarly, some year thanks to the X-Tee data-sharing platform (Vainsalu 2017). 1.4 billion adults lack accounts to safely store money and In India, the Aadhaar ID system has reduced the onboarding make daily transactions via digital payments (Demirgüç-Kunt cost for firms from approximately US$23 to less than US$0.15 2022). Furthermore, the quality and accessibility of data are (World Bank 2018). crucial for effective DPI, yet many countries are struggling with data silos, poor data management practices, and To the extent that DPI accelerates digitalization, it can limited digitalization of government services. Procurement improve downstream outcomes for people, governments, practices, technology choices, thoughtful policy and regulatory and businesses. As noted above, DPI enables governments frameworks, and government capacity play a crucial role in DPI and businesses to develop faster and better services that success. Unsustainable technology choices, vendor lock-in, would not have existed otherwise. For example, enabling and inadequate government capacity to design, implement, governments to quickly roll out a social assistance program and maintain DPI systems can hinder progress. following a crisis, empowering individuals to open accounts or use their transaction history to access credit, or allowing The implementation and adoption of DPI can encounter patients to swiftly access telehealth services with full access political and change management challenges to the extent to their health history. These faster and better services are that it disrupts existing power structures, governance models, improving healthcare, climate resilience and financial inclusion, and vested interests. Shifting from traditional siloed models among other positive outcomes, partially enabled by DPI. of digitalization to a DPI approach requires overcoming institutional inertia, as established processes, norms, and bureaucratic practices may resist change. Governments may face 30 difficulties in phasing out legacy systems, which have become services, its success hinges on ensuring equitable access to DPI deeply embedded in workflows and are often supported by systems, digital literacy, and affordable internet connectivity long-term contracts with service providers. This inertia can be and devices. The collection, storage, and sharing of personal compounded by a lack of political will, especially if reforms data for DPI systems—including digital identity, personal data threaten entrenched interests or alter the distribution of power sharing, and payments information—also raises potential concerns across government agencies and with private stakeholders. about privacy violations, data theft, misuse, and surveillance. Managing these dynamics requires strong leadership, multi- While the goal of a DPI approach is to mitigate many of these stakeholder engagement, and transparent policymaking to risks by embedding a public benefit orientation that prioritizes ensure that DPI initiatives serve the public interest. The transition inclusivity, data protection, user control, and oversight into the also requires significant investments in change management, design of DPIs, broader safeguards are needed (UNOSET & as public officials and end-users must shift to new ways of UNDP 2024). This includes adopting robust legal and policy working and interacting with digital systems. Developing clear frameworks for data protection and privacy, cybersecurity, roadmaps, incentivizing adoption, and providing continuous and non-discrimination, building strong oversight bodies and capacity-building are critical to overcoming these barriers. public engagement, outreach to marginalized and vulnerable Digital citizen engagement approaches can also help address groups, and more. Critically, these safeguards should not only resistance to change from end-users. be limited to DPIs themselves, but to how they are used and integrated across sectors. The persistence of temporary or stopgap solutions could also hinder DPI development in the longer term. In some Finally, low levels of online trust and digital skills present cases—such as during COVID response and vaccination significant barriers to DPI adoption. Reluctance to trust campaigns— governments need immediate solutions to deliver digital services can impede widespread use. New users of a specific service and cannot wait for DPI or interoperability digital technologies often have lower digital skills and thus frameworks to be developed. While one-off digital systems can can be at greater risk of predatory practices. Addressing meet an urgent short-term need, they can create challenges these challenges requires building trust through transparent down the line, such as a proliferation of data silos, inconsistent governance, robust security measures, capacity building and standards, and duplication of efforts. Overreliance on quick effective communication. For example, public engagement fixes can undermine the long-term sustainability of digital strategies can constitute a proactive approach to risk mitigation. systems and the ability to adopt a DPI approach in the future, By engaging users early and often, providers can identify locking governments into costly systems that are difficult to potential issues before they become widespread problems, upgrade or integrate. To avoid these pitfalls, governments can such as conducting public consultations on data sharing adopt a strategic approach to DPI development, emphasizing policies to address privacy concerns and build trust in DPI interoperability, scalability, and alignment with broader national systems from the outset. Similarly, not all countries and service goals, and building DPI systems in parallel with urgent sector providers interested in adopting DPI have the necessary projects. This requires building institutional capacity not internal skills or capacity for development or oversight that only for immediate implementation but also for continuous ensures robust security measures. Investing in digital skills improvement and system upgrades as technologies evolve. development programs for both individuals and government officials is essential to ensure a digitally literate population Digital inclusion and data privacy and protection are critical capable of navigating and benefiting from DPI initiatives. concerns for any digital system, particularly those that deal Evidence assessing the risks and potential mitigating solution with personal or sensitive data. While DPI can help bridge the to DPI-enabled services is nascent and should be expanded. digital divide by improving the availability and accessibility of DIGITAL PUBLIC INFRASTRUCTURE AND DEVELOPMENT: A WORLD BANK GROUP APPROACH 31 DIGITAL TRANSFORMATION WHITE PAPER, VOLUME 1 Box 5. DPI in the context of fragility, conflict, and violence Digital Public Infrastructure (DPI) holds transformational potential for countries affected by fragility, conflict, and violence (FCV) but also presents unique and more pronounced obstacles. While many of the challenges and opportunities outlined in this report also apply to FCV-affected countries, the journey to develop and adopt DPI in an FCV setting will be markedly different and will require attention to systemic challenges. FCV countries face fundamental challenges require adaptive and innovative solutions: • Risks related to the misuse or mismanagement of personal data can be heightened due to weak institutional or legal capacity, potential compromises to critical infrastructure (such as data centers) that can result in data loss or exposure, and potential incentives for surveillance or persecution leveraging data. Ensuring robust data protection and privacy is critical to prevent such misuse. • Mistrust in government and lack of legitimacy can lead to low public demand for digital public services. People may prefer informal access to services, undermining the adoption of DPI. Political dynamics in FCV countries often include economic and institutional capture and systemic corruption, which can obstruct or distort DPI development and use. Capacity constraints are another major challenge. Conflict and disaster-related destruc- tion can severely impact institutional and infrastructure capacities. The loss of human resources, fragmented international assistance, and lack of fundamental enablers further exacerbate these constraints. In post-crisis contexts, there is often an urgent need for sector-specific quick wins. Balancing these immediate needs with a holistic DPI approach can be challenging but is essential for sustainable development. Despite these challenges, the transformational potential of DPI in FCV contexts is significant: • Experience has shown that digital technologies can facilitate the rapid resumption of services following conflict or disaster-related disruptions. In Haiti, for example, mobile money has been instrumental in delivering social assistance payments in the Grande Anse area where distribution of cash would be otherwise challenging. • While the initial investment in applying a more holistic DPI approach in these contexts is more time and resource intensive than parallel sectoral system development, upfront investments in DPI (and its associated enablers and prerequisites) could generate an important multiplier effect and better returns on investment over the medium term. In Mozambique, a combined birth registration and ID registration exercise for internally displaced persons across the conflict-ridden province of Cabo Delgado improved access to services and assistance. • DPI can serve as a critical enabler for restarting economic activity and jobs—and importantly—breaking monop- olistic and predatory wartime and post-disaster economic drivers. In Ukraine, for example, the Diia app and ecosystem which leverage DPI were critical to provide a single access point for nearly 120 public services, facil- itating seamless service delivery for Ukrainians regardless of their location. Digitalization of services including DPI can also improve recovery trajectories by providing more efficient pathways for institutional and service capacity that do not require the traditional “brick and mortar” approaches to reconstruction and re-establish- ment of services. • Last but not least, the principles of inclusion, user-centricity, and participation that underpin the DPI approach can yield a powerful peacebuilding impact in a post-crisis context, serving as a vector for more equitable governance and service delivery and the rebuilding of the social contract between individuals and the state. Implementing DPI in FCV contexts is undoubtedly more challenging than in higher and middle-income countries with established capacities and systems. However, by combining a practical, context-sensitive approach with enhanced safeguards, the potential for DPI in countries experiencing or emerging from crises should not be overlooked. 32 III BUILDING, SCALING, AND USING DPI How can countries build DPI effectively and efficiently? • Greenfield vs. add-on: One key variation in overall Although DPI involves technology, it goes far beyond the architecture is whether DPIs are built on top of existing procurement of a digital solution. For policymakers, this begins infrastructure or from scratch. In countries with strong with adopting a holistic vision for DPI and choosing between legacy systems, adding new functionality may be an various models for the overall architecture of each DPI system option for quickly scaling up DPI. In other cases, legacy and how they will work together, as well as the role of the public systems may be weak or nonexistent, and it is necessary and private sector. With this vision in mind, there are important or preferable to do a larger greenfield implementation. implementation considerations, including assessing readiness Indonesia, for example, already has a strong national ID for DPI in terms of prerequisites, considering various technology and civil registration system, and is currently building out options, undertaking sometimes complex procurements for its DPIs by adding digital identity verification services government-led DPIs, the willingness of the private sector to and a mobile-based digital ID. invest in the DPI ecosystem, and conducting pilots and user • Champion and first mover: In some cases, DPI development testing. These design and implementation choices should has been driven or championed by central government be strongly rooted in use cases across priority sectors, each agencies, such as Ministries of Digital Transformation of which bring their own requirements and considerations. (e.g., Singapore’s Smart Nation and Digital Government Group or SNDGG) or Prime Minister’s Offices (e.g., Ethi- 1. DESIGN opia’s digital national ID). In others, they have been led by agencies, ministries, or the private sector responsible for implementing a specific DPI (such as central banks This section provides a brief overview of DPI architecture and for payments DPI). In Ukraine, DPI efforts are led by the core design choices and models for DPIs, and potential roles Ministry of Digital Transformation, supported by Chief for the public and private sector depending on the type of DPI. Digital Transformation Officers and Deputy Ministers in each ministry to drive the digitalization process, as well Overall DPI Architecture as the National Bank of Ukraine. • Point of entry: Relatedly, countries have also differed in There is no single model for the overall architecture of the lens through which they approached DPI. India, for a country’s DPI other than the requirement that various example, started by building a core DPI stack (beginning DPIs should be interoperable with each other. Although a with digital ID, then payments and data sharing). Estonia variety of design choices and models have surfaced within began with digitalizing sectoral databases and registers to individual DPIs, it remains premature to pinpoint established enable data sharing through X-Road/X-Tee. Korea started best practices or standard archetypes for an overarching DPI integrating databases and government services in the ecosystem. Successful implementation depends on selecting early 2000s, focusing extensively on interoperability and the approach that delivers the most impact, tailored to the data-driven innovation. In Australia, the New Payments local context, legacy systems, and institutional dynamics. Platform (NPP) is a cornerstone of the DPI ecosystem, enabling real-time transactions through open design In broad strokes, however, countries have followed different and public-private collaboration. pathways toward DPI development and adoption (Eaves 2023). Based on the country examples analyzed in Volume 2 of this report, this includes variation based on: DIGITAL PUBLIC INFRASTRUCTURE AND DEVELOPMENT: A WORLD BANK GROUP APPROACH 33 DIGITAL TRANSFORMATION WHITE PAPER, VOLUME 1 • Public regulation vs. building: A final difference in Digital Identity & Electronic Signatures approach is the envisioned role of the public sector. In many cases, public authorities have led not only the The model for digital identity and e-signature DPIs varies definition of DPI strategies and frameworks but have widely from country to country, and there is no one-size-fits-all been heavily involved in building and operating DPI, approach. Countries must make a variety of important choices— particularly for digital ID and data sharing. In other many of which are outlined in the ID4D Practitioner’s Guide cases, such as many of the European Union’s DPIs, the (World Bank 2019)36—including the ownership and governance public sector focus has been largely on regulation and of ID systems, the types of authentication mechanisms and developing and maintaining common trust frameworks. credentials used, the type and amount of data collected, the levels of assurance and related technologies for e-signatures, As countries progress in constructing their respective DPI and more. “stacks,” the World Bank Group will continue to document these evolving models and disseminate key innovations and Within the DPI framework, however, a fundamental decision lessons for implementation.35 relates to the type and number of identity providers (IDPs). For example, digital identity services can be provided by the same Models and Design Choices for Various Types entity—typically a national ID or civil registration department of DPI or agency—that issues the country’s foundational ID. In some cases, this is a centralized system with this entity providing Beyond the architecture and development of a country’s overall the only government-recognized digital ID. In others, official DPI, each type of DPI—including digital identity, payments, forms of digital identity are provided by other entities, such and data sharing—has a variety of potential design choices as Ministries of Digital Transformation, or private partners and models. While these choices can be complex, this section (see Table 1). There may also be multiple IDPs operating in distills some of the primary options for designers across core a federated or decentralized architecture (see below). These DPI systems. models are not mutually exclusive, and each offers unique Table 1. Pros and cons of combining foundational and digital ID Foundational ID and digital identity provided Pros Cons by … Same entity (commonly a • Reduces identity management complexity • Potential monopoly and single point of national ID or civil registration failure for identity • Reduces potential redundancies (e.g., in authority) identity proofing process) • Concentration of identity and digital transaction data can create potential • May streamline user experience and boost for surveillance inclusion (e.g., only enrolling once) • Traditional ID agencies may not have high digital capacity or incentives for innovation Different entities (such as a • Other entities may have higher • Added complexity to identity ecosystem digital ID provided by digital capacity to provide and innovate digital with multiple stakeholders to coordinate agency and/or other or identity services and oversee multiple public and private • Reduces monopoly in identity ecosystem • May take longer to develop than adding entities) digital functionalities when reforming • Multiple ID providers can create existing ID systems competition and innovation, potentially boosting user choice and inclusion 35 Helpful DPI architecture resources from other organizations include CDPI’s wiki (https://docs.cdpi.dev/) and GovStack materials on broader digital government stacks, including DPI (https://govstack.gitbook.io/). 36 See, for example, a list of key design choices here: https://id4d.worldbank.org/guide/3-key-decisions-0. 34 • Data marketplaces updating 31 Batch Pull Pooling Direct Intermediary Decentralized Diffusion Data are collected, processed, Real-time, record-level data exchanges Data Combining multiple One entity shares A third party facilitates A user manages Data is their at intervals and shared sent to multiple where the initiation of a transaction rather continuo data sources for data directly with or manages data sharing verified data, sharing users or subscribers Type than in real-time “pulls” data from another source e reuse by third parties another on a user’s behalf directly with third parties simultaneously Trigger benefits and challenges. Examples: Similar choices are Examples: available when Examples: Examples: One alternative has been Examples: a federated model of digital identity. Examples: Examples: Exampl • Pooling: A national meteorological • Direct: A hospital’s patient registration • Dire developing PKI to underpin • Data warehouses, • Systemse-signatures, integration as described • Trusted data more • In model, thisservice Verifiable multiple credentials • public Message and/or queues private-sector IDPs operate system checks a health insurance syste lakes, lakehouses • Interoperability intermediaries/ • Personal data consolidates vaults daily • Broadcasting database to verify coverage for a patient. data Tullis fully •inOpen dataet al. (2025). portals platforms or services fiduciaries under an explicit temperature or wallets federation and rainfall data fromtrust framework and typically • Intermediary: A person applies for a loan, • Inter • Data brokers • Periodic syncing/ multiple weather stations into a • Data marketplaces updating implementcentral a data hub lake foror exchange climate to facilitate and their datacommunication fiduciary pulls relevant and data from their financial service providers data Centralized architecture has been most common for traditional between research. IDPs and RPs (World Bank 2022b). Examples to share with prospective include lenders. to sh • Direct: The transportation authority foundational ID systems, such as national IDs, including federated digital bulk-uploads all ID newly systems issued in Belgium • Decentralized: A person shares their , Estonia , Italy , and • Dece 31 driver’s licenses into a secure verified professional license with a new verifi those that provide Batch digital identity services. In Pull a centralized more. These central models database Push each month the advantage have employer,ofwhich reducing the pulls data on risk the license emp into their employee record system into model, a are Data single entity, collected, often the government, processed, acts as Real-time, record-level datathe IDP associated exchanges Data iswith a single “pushed” out frompoint of in failure, limiting some risk of a source, and shared at intervals rather where the initiation of a transaction continuous streams or in response to specific and manages and maintains the digital than in real-time ID system (see Figure surveillance, “pulls” data from another source and events, providing rather consumer choice in their IDP and than transactions This entity is responsible for data 15).Examples: storage, management, potential credential formats and form factors. They are also Trigger Examples: Examples: and • verification. Examples Pooling: A national include• meteorological India ’s Aadhaar Direct: system A hospital’s patient and well adapted registration • Direct: A hospital’s patient registration for establishing interoperability in digital identity service consolidates daily system checks a health insurance system checks a health insurance - Peru’s Nationaland temperature rainfall (DNI), ID Card amongdatabase data from many others. Centralized to verify coverage and e-signatures for a patient. across database to verify Relying coverage borders Parties for a (RPs) or organizations, where patient. • Intermediary: A person applies for a loan, • Intermediary: A person applies for a loan, systems can be more efficient in and multiple weather stations into a terms of administration their data fiduciary pulls relevant multiple jurisdictions and need their data fiduciary pullsto collaborate (for relevant example, the in(IDP) central data lake for climate Identity Provider User and coordination, research. particularly in an dataenvironment from their financial with servicefew providers data from their financial European Union ’s Health eIDAS service providers framework). However, they e.g., also add foundational • Direct: The transportation authority to share with prospective lenders. insurance to share with prospective lenders. ID system high-capacity bulk-uploads IDPs; all newlycan be easier•to issued ensure compliance Decentralized: A person shares with their complexity to the ecosystem • Decentralized: A person shares that requires strong coordination their verified professional license with a new verified professional license with a new and regulatory legal driver’s licenses into aframeworks secure compared to multiple IDPs; and oversight; employer, which pulls data on the license employer, create challenges which pulls for ensuring the uniqueness data on the license central database each month and may also be easier to integrate with other government of digital into their employee record system intoidentities their employee Social across record IDPs; system. and require a high-capacity security systems and services. ecosystem of public and/or private-sector identity providers Credential (such as banks, e.g., foundational IDtelecom operators, dedicated companies). Figure 15. Single IDP in a centralized model MNO Relying Parties (RPs) Figure 16. Federated model Identity Provider (IDP) Relying Identity User Health Identity Exchange/Hub/Broker Providers e.g., foundational Parties (RPs) insurance ID system (IDPs) User Social security mapping Credential e.g., foundational ID Credential(s) MNO Identity Relying (e.g., national ID mobile ID, Provider Party bank ID) Source: Adapted from World Bank 2022b. Relying Identity Identity Exchange/Hub/Broker Providers Parties (RPs) (IDPs) Source: Adapted from World Bank 2022b. User However, as transactions have moved online—including as part of a country’s core DPI—there has been a shift toward A third emerging model for digital identity is for users to decreasing centralization and decoupling mapping“in person” and control credentials that can be verified by service providers “online” ID. In part, this is due to some of the key limitations in a decentralized way. In a decentralized model, various and Credential(s) risks of centralized systems, which can create a single point (e.g., national ID Identity Relying public and/or private sector entities issue digitally verifiable of failure for mobile ID, online authentication Providerif they are out Party of service. credentials (VCs) that are stored locally by the user, typically in bank ID) To the degree that data storage itself is centralized, this may a digital wallet on a smartphone or smartcard. These entities also increase the risks and cost of data breaches, and potential can include foundational or digital ID providers, issuing VCs for surveillance. With notable exceptions, many foundational as an official form of digital identity (e.g., a digital national ID ID systems have provided a limited range of credential and or birth certificate). As this model is relatively new, national- technology options, potentially limiting consumer choice and scale implementations37 of VCs and wallets for digital identity inclusion (World Bank 2022b). are still limited, but relevant examples include the issuance of mobile driver’s licenses in a handful of U.S. states, the 37 Smaller scale implementations of decentralized ID have been more common. For example, the Kiva Protocol initiative in Sierra Leone that gives unbanked people digital identities and secure control over their credit information through a decentralized approach. For more on Kiva Protocol, see: https://assets.ctfassets.net/j0p9a6ql0rn7/3jnqTBAv3MYA0ByuYC8eYr/211c7bd152a397899481b0b3ef99ab6b/Kiva_Protocol_-_Technical_White_Paper_-_ June_2021.pdf. DIGITAL PUBLIC INFRASTRUCTURE AND DEVELOPMENT: A WORLD BANK GROUP APPROACH 35 DIGITAL TRANSFORMATION WHITE PAPER, VOLUME 1 Credential(s) (e.g., national ID mobile ID, bank ID) planned European Digital Identity Wallet, and Bhutan ’s of assurance. As mentioned in Section 2, e-signatures can National Digital Identity (NDI) wallet.38 These decentralized be implemented as separate systems or coupled with digital models have a number of benefits, including Send providing users identity. The latter is most common for high-trust e-signatures, Credential User Presentation Relying more direct control over with Issuers their Acquires, identity data and when it Party given the strong role that identity assurance plays in e-signature Issues credentials Stores, Presents Requests, Verifies is shared, and reducing the potential for undue surveillance. levels of assurance. For example, countries such as Argentina, In practice, however, they also Register present some challenges, Estonia, Georgia, Germany, Singapore and Spain all have Identifiers and including operating in low-connectivity Use Schemas environments and digital ID credentials linked to, or containing, a signing Verify Identifiers those with lower Verify Identifiers and Use levels of smartphone penetration. and Use certificate based on PKI to implement strong e-signatures Verifiable Data Registry Schemas Maintain Identifiers Schemas (Tullis et al. 2024). Figure 17. Decentralized approach and Schemas Crucially, however the overall trust framework for e-signatures should enable a risk-based approach by establishing clear requirements for multiple levels of assurance. For example, in the EU, eIDAS provides a three-tier assurance framework,39 that User specifies requirements to meet each tier, including the processes Acquires, Stores, Presents and technologies related to the identity of the signer and the Issues Presents registration process; the data used for signing; the integrity of the signed document; the accreditation and supervision of Reads schema the digital certificate issuer; and the device used for signing Writes schema Verifiable Data and revocation Registry and revocation status Relying (Tullis et al. 2024).40 For low-risk transactions, e-signatures Credential status Maintains issuer Issuers registry, schema Party (RP) can be implemented using multiple basic technologies, Requests and Issues credentials registry, revocation verifies without additional requirements, as described in Table 2. registry proofs However, while multiple implementations are possible for Trusts medium- and high-assurance signatures, achieving medium and advanced signatures under eIDAS requires additional Source: Adapted from World Bank 2022b. processes and technologies. Both public and private sector entities can provide e-signature As noted above, these models are not mutually exclusive, solutions and underlying trust services. Many of the e-signature and many countries have adopted a layered approach to implementations described in Table 2 can be provided by digital identity. For example, in countries such as Belgium, the private sector. This requires legal and trust frameworks to Norway, Denmark, Uruguay, and Thailand, government ID ensure the interoperability of e-signatures across providers. authorities issue a centralized identity in the form of a digitally Similarly, in most countries the underlying PKI technology to enabled national ID card (World Bank 2022b). This credential provide high-assurance e-signatures is implemented through is then used as a basis for enrolling in other digital IDs issued a partnership of multiple actors, often including the private through federations of IDPs, or for verifying someone’s identity sector.41 Where the private sector is involved, it is also common before issuing a verifiable credential. to establish a standards-based approach to governing digital For e-signatures, some of the same model options apply, ID and trust services and providing for interoperability between though model choices are linked more closely with levels them, both within countries and across borders. 38 For more on mobile driver’s licenses and the EU wallet, see https://www.aamva.org/topics/mobile-driver-license and https://ec.europa.eu/digital-building- blocks/sites/display/EUDIGITALIDENTITYWALLET/EU+Digital+Identity+Wallet+Home, respectively. For more on Bhutan’s NDI, see: https://www.bhutanndi. com/ and https://trustoverip.org/wp-content/uploads/Case-Study-Bhutan-NDI-National-Digital-Identity-ToIP-Digital-Trust-Ecosystems-V1.0-2024-05-21. ext_.pdf. 39 In eIDAS terms, the levels are simple electronic signature (SES), advanced electronic signature (AES), and qualified electronic signature (QES), corresponding to low, medium, and high levels of assurance, respectively. 40 A multi-tiered trust framework is not unique to the EU, and has also been pursued by Brazil, Singapore, and other countries. However, it is not the only approach to implementing electronic signatures. Another is a technology-neutral approach taken, for example, by the UNCITRAL Model Law on e-commerce. Australia has also focused on the legal dimensions of e-signatures, allowing the market to determine appropriate technologies to achieve various security levels (Tullis et al. 2024). 41 For more on PKI architecture, see Tullis et al. 2025. 36 Table 2. eIDAS levels of assurance for electronic signatures Level of Risk / Implementation examples Process & technology requirements Assurance Low • Typing a name at the end of an email or document None. • Clicking on an “I accept” button on a website • Using a scanned image of a handwritten signature • Using a finger or stylus to hand write a signature on screen • Digital authentication (for example, a biometric or a one-time password) Medium • Plug-ins to PDF reader applications that allow • Identity of the signer: Electronic signature uniquely digital certificate-based electronic signing linked to a signatory identity, e.g., through ID document verification. • Cloud-based signature solutions offering a secure remote signing service • Registration process: Requires some assurance of the identity of the signatory (e.g., ID verification), but no • A mobile app using secure elements in requirement for in-person. smartphones to generate signatures • Data used for signing: Must be under the sole control • A hardware token, such as a smart card containing of the signer (e.g., Digital authentication using a a digital certificate on a chip. biometric or other factor required for each signing transaction). • Integrity of signed document: Cannot be modified after signing. • Supervision of digital certificate issuer: Ex-post. High The above, plus: • Registration process: Rigorous in-person or equivalent onboarding with a high-trust ID. • Data used for signing: Must also conform to rigorous standards for digital certificates • Accreditation of digital certificate issuer: The signature solution vendor is accredited as a qualified trust service provider (QTSP) by the competent Supervisory Body before issuing the digital certificates used in its products. • Device used for signing: High-security, certified signature-creation device required (can be physical or in the cloud). • Supervision of digital certificate issuer: Ex-ante. Source: Adapted from Tullis et al. (2024). DIGITAL PUBLIC INFRASTRUCTURE AND DEVELOPMENT: A WORLD BANK GROUP APPROACH 37 DIGITAL TRANSFORMATION WHITE PAPER, VOLUME 1 Payments42 catalyst, and regulatory. In their operational role, they may provide settlement services or directly manage certain payment The Fast Payment System (FPS) ecosystem and design systems. Acting as catalysts, central banks work closely with choices banks and non-bank payment service providers to enhance payment infrastructure and drive the development of new The FPS ecosystem is a complex network that includes services. In their regulatory role, they monitor and evaluate various key stakeholders working together to facilitate retail payment systems, even in cases where explicit legal seamless transactions. At the core is the central bank, which authority is lacking, using regulation and active engagement often oversees and regulates the system to ensure safety, with market participants to guide system improvements. efficiency and reliability. In some cases, other regulatory bodies may also be involved. The operator is responsible Public authorities have a crucial role in the development and for the day-to-day management and technical operation oversight of FPSs in many jurisdictions. They are often involved of the payment system. Ownership can vary, with some from the initial stages of planning, providing strategic guidance systems owned by the central bank, consortia of banks, or and integrating an FPS into broader national initiatives, as seen private entities. Participants in the ecosystem include banks in countries like Thailand and Brazil. Even when the private and non-bank payment service providers (PSPs) that directly sector leads these efforts, public sector influence remains interact with the payment system. Third-party providers, significant, with central banks acting as key drivers for the such as technology vendors and financial intermediaries, design and implementation of these infrastructures. Central offer essential services that enhance functionality and user banks also oversee an FPS to ensure safety and efficiency, experience. End users, comprising individuals, merchants, requiring operators to manage various risks and comply with and government agencies, are the final beneficiaries, using regulations. Operational roles differ by country; some central the system for transactions like merchant payments, person- banks, like in Mexico, fully own and operate the FPS, while to-person transfers, and bill payments. in others, responsibilities are shared with private entities. Across all models, public authorities work to align the FPS Designing and implementing an FPS involves making several with objectives of stability, efficiency, and financial inclusion. critical choices that span various aspects and that affect each participant of the ecosystem. Each choice will contribute to the When public authorities operate an FPS, it is essential to overall success and efficiency of the system. These decisions implement safeguards to ensure the private sector is not include, determining the objective, the stakeholders involved, crowded out. Public authorities can achieve this by adopting access to the system and accordingly the participation model a minimalistic design that allows the private sector to develop for both banks and non-bank payment service providers (PSPs), additional services on top of the FPS, such as merchant selecting the appropriate clearing and settlement models, payments. Additionally, key overlay services, such as end-user and identifying the most effective payment instruments, use access channels, can be developed by the private sector. cases and access channels. Furthermore, the integration of Furthermore, public authorities can enable interoperability overlay services, such as aliases, can significantly enhance between different private sector solutions to enhance economies user experience and adoption rates. Technical aspects and of scale and network effects, thereby increasing the benefits specifications, such as the type of messaging standards, are of DPIs for both market participants and users. also critical to the effectiveness of an FPS. Participation Public authorities’ role The success of FPS depends on the participation of both banks Public authorities, especially central banks, play a crucial role and non-bank PSPs, with regulatory incentives often needed in maintaining the safety, efficiency, and competitiveness of initially to encourage their involvement. FPSs can have either retail payment systems, including payment DPIs like FPSs. direct or a combination of direct and indirect participants. Their responsibilities involve ensuring that payment systems Direct participants, typically banks, have a direct link to the are accessible and effective while also protecting consumers payment system infrastructure and a settlement account at and fostering a competitive landscape. To achieve these the central bank. The non-banks could be direct or indirect objectives, central banks take on various roles: operational, participants based on the technical capabilities and access to central bank account. Indirect participants, such as other 42 This section is adapted from the World Bank’s FASTT Flagship report (World Bank 2021b). 38 Figure 18. Types of clearing models in FPS i ii iii Distributed Hub RTGS Clearing Approach Approach Approach Bank A Bank B Bank A Bank B Bank A Clearing Bank B Clearing RTGS Settlement RTGS Settlement Mirror A/Cs Third Party Central Bank Central Bank Real Time 24x7x365 RTGS Settlement Central Bank Source: World Bank 2021b. financial institutions or PSPs, use the infrastructure through a obligations are settled on a net basis at the end of a predefined sponsor bank’s settlement Relyingaccount (even though they may have Identity cycle, either once or multiple times a day. This model is more Identity Exchange/Hub/Broker Providers Parties (RPs) direct technical connectivity to the FPS). Jurisdictions adopt efficient as it reduces liquidity needs, but it carries inherent (IDPs) User models for non-bank PSPs: indirect participants various access risks such as credit risk from net debit positions, which must sign commercial agreements with direct participant banks be managed with measures like debit caps, guarantee funds, (e.g., PromptPay in Thailand, Pix in Brazil); direct participants prefunding, and collateral arrangements, etc. In contrast, maintain their own settlement accounts at the central bank the real-time settlement model involves continuous, order- (e.g., RPP in Malaysia, SPEI in Mexico); and some non-bank by-order settlement of funds. A fast payment transaction is PSPs connect directly to the infrastructure but settle through completed only if the originating participant has sufficient Credential(s) a commercial bank (e.g., UPI in India). balances in its settlement account with the central bank (e.g., national ID or other settlement agent, eliminating credit risk between mobile ID, Clearing and Settlement bank ID) participants and providing immediate finality of all payments. There are three main clearing models for FPSs. The hub Key technological options and specifications approach, used in India, Singapore, and the UK, involves a clearinghouse managing real-time clearing, with its participants Technological options and specifications for FPSs include bound by the rules of participation, and downstream settlement the choice of messaging formats and integration methods with the central bank. The RTGS-based approach, adopted Send to streamline electronic data exchange and enhance by Mexico and the USA, uses the RTGS Credential Usersystem for Relying efficiency. Messaging formats are standards for clearing transaction Presentation Issuers returning failed payments and settlement, Acquires,to the originator. electronic Party data exchange between institutions in a payment Issues credentials Stores, Presents Requests, Verifies The distributed clearing model, followed by Australia, allows system, covering categories such as orders, invoices, customs participating banks to validate and clear payments in real time documents, remittance advances, and payments. Uniform Register Identifiers and on a 24/7 basis, with the payer bank initiating settlement with messaging standards are essential for standardizing payment Use Schemas the central bank. flows, Verify especially with the rise in cross-border transactions Identifiers Verify Identifiers and Use Verifiable Data Registry and and multiple Use payment systems. These standards facilitate the The choice of a settlement model Schemas Maintainsignificantly Identifiers impacts Schemas identification of senders and receivers, specify key attributes safety and efficiency in fast payments. There are primarily of a payment transaction (such as currency, amount, and value and Schemas two main settlement models: deferred net settlement (DNS) date), and include additional information necessary for the and real-time settlement. In the DNS model, inter-participant User DIGITAL PUBLIC INFRASTRUCTURE AND DEVELOPMENT: A WORLD BANK GROUP APPROACH 39 Acquires, DIGITAL TRANSFORMATION WHITE PAPER, VOLUME 1 Stores, Presents onward transmission and processing of transactions. The mechanisms to ensure it is adequately shared and accessible. main messaging standards for domestic payment transfers Factors such as the type of entities involved public institutions, include ISO 8583, SWIFT MT Standards, and ISO 20022, with private companies, individuals), the legal and regulatory some operators developing their own proprietary standards. frameworks governing the data, and the intended application Australia, the EU, Poland, Singapore, and Thailand have of the data (such asanalytics, transactions, public services) adopted ISO 20022. Bahrain, Chile, China and Hong Kong all influence the appropriate data-sharing method. As such, SAR China adopted ISO 8583. India uses proprietary standards most countries are developing multiple data sharing systems. (ML-UPI), with plans to migrate to XML and ISO 20022. Mexico and Nigeria use proprietary standards (Binary and XML, Selecting the right method for a particular use case requires respectively). careful consideration of the specific risks, whether they pertain to data integrity, privacy, availability, or regulatory A key technological choice for FPSs involves how participants compliance. The risk of over-sharing sensitive data often calls and the infrastructure integrate and interact. APIs facilitate for strong privacy controls, user consent mechanisms, and seamless integration between financial institutions and service strict access management. Conversely, the risk of not sharing providers, enabling real-time transactions and enhancing user critical public-interest data can result in missed opportunities experience. Other integration methods, such as file-based batch for societal benefits and necessitates strategies to enhance processing and direct database access, involve more complex availability, discoverability, and interoperability. The balance and limited real-time interactions. APIs boost interoperability between these concerns is often in tension, meaning that systems by providing easy access to fast payment arrangements and designed for data sharing must be tailored to the specific various banking functions, including account details and requirements of each use case. A one-size-fits-all approach lending. They also enable interactions between stakeholders, is ineffective, and trusted data-sharing frameworks must be such as third-party application providers and consumers, adaptable to meet the diverse needs of different scenarios. supporting payment initiation, e-commerce transactions, and other applications. Fast payment operators typically define There are several methods by which data can be shared, each the API framework, outlining essential attributes for system suited to different use cases and requirements. This section integration. Australia’s NPP API framework aligns with ISO discusses a few of the most common for DPIs, summarized in 20022 and encourages the use of its capabilities, though it Figure 19. This includes various types of methods, including is not mandatory. India uses standardized APIs exclusively for data pooling, direct sharing, intermediated data sharing, UPI payments, supporting extensive third-party integration decentralized credentials and documents, and data diffusion. and customer account aggregation. Mexico offers limited These approaches can involve multiple “triggers” for data APIs through Banco de México for value-added services like sharing, related to the impetus, direction and frequency of transaction status checks and retrieval, with plans to expand data sharing, including batch data transfers at specific intervals, access to third-party open APIs. Under the United Kingdom’s transaction-based “pulls,” and event-based or continuous Open Banking framework, developed by the Open Banking “pushes” of data from source to recipient. These various Implementation Entity (OBIE), the Financial Conduct Authority methods, along with related requirements, enablers, and (FCA) grants licenses for various services such as payment architectures for data sharing are discussed in more depth initiation and account information, covering both technical and in Tullis (forthcoming). non-technical aspects, including customer experience guide- lines, dispute management, and API security specifications. Direct data sharing methods are among the most common ways digital data is shared, particularly among government entities. Direct data sharing can be implemented via direct Data Sharing integrations between two systems (such as a civil register The appropriate model for a specific data sharing system and an ID system), as well as interoperability platforms and varies significantly by use case, including the nature of the services (such as Estonia’s X-Tee/X-Road and Singapore’s data involved and the purposes for which it will be used—and APEX). Data sharing between these systems can be processed multiple systems are likely required. Not all data is created in batches (for example, nightly syncs) or in real time via pull- equal, and the methods chosen to share it must reflect its requests triggered by specific transactions (such as hospital sensitivity and intended usage. For instance, personal or system pulling data from an insurance provider’s system on sensitive data necessitates strong privacy protections to prevent a patient’s coverage), or pushes triggered by specific events oversharing, while open or public-interest data may require (such as a hospital system notifying a civil register system at 40 Figure 19. Data sharing models Pooling Direct Intermediary Decentralized Diffusion Combining multiple One entity shares A third party facilitates A user manages their Data is sent to multiple data sources for data directly with or manages data sharing verified data, sharing users or subscribers Type reuse by third parties another on a user’s behalf directly with third parties simultaneously Examples: Examples: Examples: Examples: Examples: • Data warehouses, • Systems integration • Trusted data • Verifiable credentials • Message queues lakes, lakehouses • Interoperability intermediaries/ • Personal data vaults • Broadcasting • Open data portals platforms or services fiduciaries or wallets • Data brokers • Periodic syncing/ • Data marketplaces updating 31 Batch Pull Push Data are collected, processed, Real-time, record-level data exchanges Data is “pushed” out from a source, in and shared at intervals rather where the initiation of a transaction continuous streams or in response to specific than in real-time “pulls” data from another source events, rather than transactions Trigger Examples: Examples: Examples: • Pooling: A national meteorological • Direct: A hospital’s patient registration • Direct: A hospital’s patient registration service consolidates daily system checks a health insurance system checks a health insurance - temperature and rainfall data from database to verify coverage for a patient. database to verify coverage for a patient. multiple weather stations into a • Intermediary: A person applies for a loan, • Intermediary: A person applies for a loan, central data lake for climate and their data fiduciary pulls relevant and their data fiduciary pulls relevant research. data from their financial service providers data from their financial service providers • Direct: The transportation authority to share with prospective lenders. to share with prospective lenders. bulk-uploads all newly issued • Decentralized: A person shares their • Decentralized: A person shares their driver’s licenses into a secure verified professional license with a new verified professional license with a new central database each month employer, which pulls data on the license employer, which pulls data on the license into their employee record system into their employee record system. Source: Adapted from Tullis (forthcoming). the event of a new birth). In general, bilateral integration is pooling is powerful for enabling insights from diverse datasets, not feasible as the number of digital systems involved grows; it poses challenges related to standardization, data quality, interoperability platforms and Relying (RPs) Partiescan services help centralize the and privacy—especially when sensitive information is involved. governance of data sharing while federating or decentralizing Data must Identity Provider (IDP)be carefully processed and sometimes anonymized User Health This is because in typical data sharing and management. before e.g., foundational aggregation to protect individuals’ privacy while still insurance ID system interoperability platforms, data flows directly from the source enabling meaningful analysis. to the recipient, without requiring data to be processed by a central intermediary. Intermediated methods involve third-party platforms or Social entities that facilitate data exchange on behalf of individual security Pooling is another important data-sharing method that data subjects. Although intermediated methods also involve involves Credential centralizing data from multiple sources for analysis third parties like the pooling method, they differ in two e.g., foundational ID or dissemination by a third MNO party. This includes data ways. First, pooling methods tend to operate through batch warehouses (typically structured data, processed for analysis), sharing, while intermediated methods typically pull data data lakes (often unstructured data or a mix, stored in its at the individual- or record-level for a specific transaction. original format), and data lakehouses (a mix of processed Second, the role of the third-party intermediaries—sometimes Identity Relying structured data and unprocessed Identity Exchange/Hub/Broker unstructured data). It also called data Providersfiduciaries—is to act on behalf of the data subject, Parties (RPs) (IDPs) includes open data portals with data published for public ensuring that their data is shared in a controlled manner and User consumption, data marketplaces where data providers can in their interests. These methods can help ensure that data list datasets for purchase or access. The pooling approach is sharing adheres to regulatory requirements and that trust is particularly useful for policy planning, large-scale analytics, maintained between parties. Examples of this method include and open data initiatives where data from various mapping entities regulated schemes such as India’s Data Empowerment and are combined to provide a comprehensive overview. While Credential(s) (e.g., national ID Identity Relying mobile ID, Provider Party bank ID) DIGITAL PUBLIC INFRASTRUCTURE AND DEVELOPMENT: A WORLD BANK GROUP APPROACH 41 DIGITAL TRANSFORMATION WHITE PAPER, VOLUME 1 Protection Architecture (DEPA) or the European Union’s Data private sector. Thus, while government services providers Governance Act. and other public authorities are often the first users of DPIs (such as via e-service portals), the sustainability of DPIs is Decentralized methods place individuals at the center of typically achieved when companies have integrated DPIs data sharing, giving them greater control over how their into their business processes (for example, using a digital ID personal data is accessed and used. Common in the analog for onboarding new customers or a fast payment system to world—where individuals often present ID cards and paper collect fees from customers). documentation to obtain a service—decentralized data sharing is only beginning to take hold in the digital world. However, the private sector has a broader role to play in This model is exemplified by digital verifiable credentials developing and deploying DPI, bringing resources, expertise, (VCs), personal data vaults, and other consent-based data and innovation to the table. While the public sector plays sharing systems. In this approach, the individual has a direct an essential role in DPIs—as potential DPI providers, but also role in managing their data, deciding who can access it and through strategies, regulations, standards, and oversight—it for what purposes. This method empowers individuals without is equally important to harness private sector innovation and relying on intermediaries or central authorities. The recent avoid crowding out markets in DPI development. Beyond their revision to the European Union’s eIDAS regulation (discussed role as vendors that provide the technology and infrastructure above in the context of decentralized identity) exemplifies this for DPI development. Furthermore, private companies approach by allowing individuals to store and control their can contribute to innovation and development of DPIs by digital IDs and other credentials securely in a digital wallet. building upon foundational rails and regulations provided by This model is gaining momentum globally, as evidenced by governments. They can create new applications and services the adoption of similar frameworks elsewhere, such as in the that leverage DPI, leading to a thriving ecosystem. African Union. As the DPI landscape evolves, it is likely that the models Finally, diffusion methods involve the constant or near- for private sector involvement will continue to adapt. For constant exchange of data, often through streaming platforms example, innovations in data sharing DPIs and the need to or event-driven broadcasting. These methods are ideal for develop new ways to meaningfully provide people with control applications that require real-time data processing, such as over their data—without overwhelming users with “consent Internet of Things (IoT) networks, smart city infrastructures, popups”—are leading to new models of data “fiduciaries” or disaster early warning systems, or public utilities management. intermediaries (described above). This creates a potential Continuous methods ensure that data flows smoothly and area of growth for the market, and there are already multiple consistently between systems, allowing for instantaneous private-sector and non-profit-led organizations operating in updates and dynamic responses to changing conditions. Event- this space (Desai et al. 2022).43 driven models, such as message queues and brokers, allow for scalable and reliable data sharing by decoupling the sender The right balance for public and private involvement in DPIs and receiver systems, ensuring data is shared asynchronously also depends on the specific DPI and country context. The and processed as needed without immediate demands on opportunities for private sector involvement will vary significantly either party’s systems. These methods are critical in scenarios for each country, for different DPIs, and likely over time. For where timely data processing and responsiveness are key, example, public authorities are likely to continue playing a such as traffic monitoring, customs and border procedures, strong role when it comes to issuing legally recognized forms or emergency response systems (Tullis, forthcoming). of digital identity, although there are still ample opportunities for public-private partnerships and a broader market for private-sector provided digital identity. Jurisdictions like the Role of the Private Sector EU and India that already have highly developed IT sectors Successful DPIs typically have high levels of use by the have focused on regulation and crowding in private sector private sector. For most people, touchpoints with government participation for personal data sharing DPIs, but this may not service providers are much more infrequent than with the be immediately feasible in contexts with fewer market players. 43 This includes, for example, Inrupt, Digi.me, and the Data Transfer Project. 42 Table 3. Potential role of private sector in DPI Type of Vendor Provider or Operator User (Relying Party) DPI Digital ID software and applications Provide and/or operate digital Use digital ID services Identity vendor and integrator, biometric authentication and credential systems, provided by government systems, enrollment devices and apps, and/or services; serve as digital and/or a private company. hardware. identity providers (IPs) within a trust framework; provide/operate digital wallet infrastructure; participate in standards development. e-signatures Suppliers of e-signature software, Provide and/or operate e-signature Rely on e-signatures public key infrastructure (for higher services and/or related trust services provided by government levels of assurance), cryptographic including the underlying technical and/or a private company tools, security services, secure implementation of digital signatures and by integrating their devices, and other software and digital certificates. creation and verification hardware underlying the provision into business processes of e-signatures. and service-delivery workflows. Digital Software vendor, integrator, and Operate payment networks, monitor real- Use different types of Payments operator; payment instruments time transactions, ensure interoperability payment services including and access points and channels, and manage clearing and settlement. person-to-person and such as points-of-sale; provision of merchant payments, bulk Payment services provider for end users; switching, clearing and settlement payments and international merchant acquiring and specialized services; provision of value-add remittances. merchant services such as aggregation and overlay services, such as fraud and facilitation services. detection tools. Data Provide data exchange platforms, Provide and/or operate data sharing Use shared data to Sharing software, and associated systems platforms or data streaming services; act generate insights, improve integration services; provide data as data intermediaries or brokers; provide/ decision making and offer processing and transformation operate digital wallet infrastructure; predictive services. tools; provide security solutions participate in standards development. such as encryption and access- control mechanisms; conduct audits and conformity assessments. Building Trust To begin, designing a new DPI requires a comprehensive assessment of existing legal and regulatory frameworks For DPI to fulfill its promise of increasing online trust, it is and governance mechanisms to ensure compliance and to essential to ensure the trustworthiness of DPI systems. This safeguard the rights of stakeholders. These frameworks—as can involve a variety of steps, including those described below, discussed in Section 2—are essential to establish the legal such as conducting and publishing comprehensive legal and boundaries within which DPIs operate, providing requirements regulatory reviews; privacy and rights impact assessments; on data privacy, digital transactions, cybersecurity, and using widely recognized standards for technology, policy, intellectual property rights. Assessing regulatory frameworks and regulations; prioritizing underserved groups; strategic involves examining national and international requirements, communication and consultation with stakeholders; effective understanding their applicability to digital platforms, and grievance redress mechanisms; and more. These steps should identifying gaps that need to be addressed to facilitate the be integrated into the design phase of DPIs and continued development of DPI without compromising security or privacy. throughout implementation. DIGITAL PUBLIC INFRASTRUCTURE AND DEVELOPMENT: A WORLD BANK GROUP APPROACH 43 DIGITAL TRANSFORMATION WHITE PAPER, VOLUME 1 The adoption of recognized standards can make the where stakeholders collaborate to design, develop, and implementation of DPI more efficient and transparent, refine DPIs, can foster a sense of ownership and increases building trust. Using widely accepted policies, standards, the likelihood of successful implementation and adoption. and frameworks can help signal the legitimacy of the project Regular consultations can also help in identifying potential and simplify development, integration, and operation and challenges early in the process, addressing opposition, promote interoperability between different systems and enabling proactive solutions.46 For instance, Ukraine’s Diia platforms, reducing the need for costly and time-consuming platform, which supports digital ID verification, e-signatures, customizations. This consistency can also streamline procurement, and document storage, was developed through collaboration lower implementation risks, and facilitate collaboration among between government, technologists, and civic innovators. various stakeholders.44 In contrast, adopting custom policy and regulatory solutions often leads to increased complexity, To encourage adoption and participation in DPIs by the higher costs, and potential compatibility issues, slowing public at large, effective communications and skill building deployment and making maintenance and operation more are essential. DPI as an abstract concept and unknown to the challenging and costly. Standards also enhance scalability public at large. Therefore, developing clear understanding and adaptability, allowing DPIs to evolve with technological and communications around potential benefits of specific advancements and changing user needs. DPIs—such as cost reductions for online service delivery, lower administrative fees for online company registration, improved Prioritizing inclusivity and accessibility is essential for building access to essential services, or enhanced user experiences trust in DPI. Inclusivity ensures catering to all segments of the through proactive approaches to service delivery—is important population, including potentially marginalized and vulnerable to build understanding and trust. Providing transparent groups, such as women and girls; low literacy groups; remote communication that emphasizes how to use DPIs safely and and rural dwellers; the elderly; persons with disabilities; which security and privacy safeguards are in place can also help refugees and migrants; internally displaced persons; stateless encourage trust and adoption. Additionally, offering positive groups; ethnic, linguistic and religious minorities; and sexual incentives, as well as meaningful sanctions for non-compliance, orientation and gender identity (SOGI) minorities, among others. are important for boosting adoption of policies and good This includes designing platforms and building blocks that practices (such as data privacy and security standards) among adhere to open standards and specifications around universal government and private sector users. accessibility, ensuring that in-person access points (such as digital ID registration) are accessible to all, user-testing groups Grievance redress mechanisms (GRM) are crucial for ensuring and others who are more likely to be affected by the digital accountability. Key elements of a good GRM system include divide, and engaging in dedicated outreach, education, and easy accessibility through multiple channels (web, mobile), consultations with marginalized and vulnerable people and efficient handling of grievance cases with automated routing, advocacy groups.45 and proactive communication. The GRM should also prioritize data protection, transparency, and inclusivity. For example, Engaging a diverse set of stakeholders in the design process the Digital Malawi project’s GRM is founded on principles is key to success. Multi-stakeholder consultations should of accessibility, predictability, confidentiality, fairness, and involve a wide range of participants, including government transparency, designed to include marginalized and vulnerable entities, private sector, academia, and CSOs working on populations. 47 Effective GRMs address user concerns and technology, privacy, rights, and development. Co-creation, provide valuable insights for continuous improvements. 44 OECD (2020), “The OECD Digital Government Policy Framework: Six dimensions of a Digital Government”, OECD Public Governance Policy Papers, No. 2, OECD Publishing, Paris, https://doi.org/10.1787/f64fed2a-en. 45 See, for example, ID4D notes on inclusion for persons with disabilities (World Bank 2020) and SOGI groups (Lebbos et al. 2021). 46 See, for example, the ID4D Guide on CSO Consultation (Eichholtzer 2022). 47 For more information on the Digital Malawi GRM, see https://digmap.pppc.mw/home/grievance-redress-mechanism/. 44 2. IMPLEMENTATION • Connectivity Infrastructure: Robust and widespread internet connectivity is essential, as it forms the backbone of any digital infrastructure. This includes both the physical This section provides an overview of key topics related to DPI broadband and wireless networks, as well as policies implementation, including potential prerequisites that should that make internet and digital device access affordable precede or accompany DPI rollout, adoption of open-standards, and equitable. considerations for using open source, DPI procurement, and • Digital Access and Literacy: The population needs access conducting pilots and user testing. to digital devices and the internet. Equally important is digital literacy, ensuring that people have the skills and DPI Prerequisites confidence to use digital services safely and effectively. As a country or jurisdiction develops its DPIs, several critical • Financial Resources: Adequate funding must be secured elements are needed to ensure successful design, deployment for both the initial development and the ongoing oper- and adoption. While some of these might be developed in ation of the DPI, whether provided by the public or parallel with DPI, it is essential to have these elements in private sector. place once the infrastructure is deployed to ensure the safe, • Private Digital Ecosystem: A vibrant private digital inclusive, sustainable, and empowering outcomes that are ecosystem—including businesses, startups, and entre- pursued. These prerequisites include: preneurs—is crucial to help innovate and create value by leveraging the DPI. • Political Commitment: There must be a strong and sustained commitment from leaders and policymakers. How to develop and sequence these requirements is beyond This commitment should manifest in the form of clear the immediate scope of this paper but will be expanded in visions, strategies, and the political will to drive DPI future work. In addition, there are many quality resources initiatives forward. that provide in-depth guidance on specific topics, including • Stakeholder Engagement: It is important to engage connectivity, legal and regulatory frameworks, and stakeholder with a wide range of stakeholders, including various engagement.48 ministries, departments, agencies, and other public authorities, private sector, civil society, academia, and Open Standards end users to leverage their expertise and ensure that the DPI meets the diverse needs of the society and has Open standards are a critical enabler for building successful widespread support. and sustainable DPI. They promote interoperability, reduce vendor lock-in, and reduce barriers to leveraging DPIs as building • Institutional and Technical Capacity: Public institutions blocks, making them more accessible. Open standards can must have the capacity to effectively govern DPI initiatives, reduce the risk of certain types of vendor lock-in by enabling and DPI implementers—whether in the public or private countries to switch providers more easily if needed and to easily sector—must have the technical capacity to effectively adapt the technology to changing needs. Open standards are implement and manage them. This includes having and also essential for enabling cross-border use of DPIs, such as retaining skilled personnel and effective processes in mutual recognition of digital IDs, interoperable fast payment place for the development, operation, or oversight of DPIs. systems and secure data sharing. They can lower the costs • Legal and Regulatory Framework: A comprehensive legal and risks associated with international transactions. Examples framework should be established before or in parallel of open standards for digital identity can be found in Mittal to DPI development to address issues related to data (2022); Box 6 provides examples in fast payment systems. protection, privacy, cybersecurity, and digital transactions. 48 For example, visit the World Bank’s Digital Transformation website (https://www.worldbank.org/en/topic/digital) for resources on broadband infrastructure, and the ID4D website for the ID4D Practitioner’s Guide, ID Enabling Environment Assessment (IDEA), and additional publications on CSO and stakeholder engagement. DIGITAL PUBLIC INFRASTRUCTURE AND DEVELOPMENT: A WORLD BANK GROUP APPROACH 45 DIGITAL TRANSFORMATION WHITE PAPER, VOLUME 1 Box 6. Open standards in fast payment systems Messaging standards define the syntax, structure, and semantics of messages exchanged between parties. In FPS, these standards are essential for ensuring a common understanding of transmitted data across linguistic, regional, or system boundaries. Implementing a messaging standard guarantees that the exchanged data is correctly interpreted and machine-readable, leading to cost reductions and increased efficiency. Furthermore, messaging standards define the fields and data elements that compose a message, which can be utilized for various use cases. Globally, three main types of messaging standards are used in FPS: ISO 8583, ISO 20022, and proprietary. The International Organization for Standardization (ISO) has defined various standards for facilitating financial transaction messages, evolving with payment dynamics and technological advancements: • ISO 8583, designed for high-volume, low-latency payment instructions, is widely used for card payments (ATMs and point-of-sale terminals) and supports pull payments, particularly for auto-debit mechanisms. However, its unstructured format limits information exchange and customization. • ISO 20022 offers greater flexibility with structured, data-rich exchanges and allows the standardization of messaging components, emerging as the global benchmark for real-time payments. • Proprietary messages can be XML-based, like ISO 20022 messages, or non-XML-based, such as ISO 8583 or SWIFT MT messages. These messages offer high levels of customization and can leverage the experience and resources of a payment system implementer, leading to the development of common platforms and reduced user training requirements. A comparative analysis of messaging standards using both quantitative and qualitative methods highlights their different strengths and weaknesses. ISO 8583, with its unstructured fields and smaller size, is ideal for environments with limited infrastructure but lacks updates and fields necessary for advanced operations and reconciliation. ISO 20022, the global standard for electronic messaging between financial institutions, supports both structured and unstructured data, offers greater data-carrying capacity, and undergoes regular updates, making it suitable for robust network environments and enhancing interoperability. For this reason, many operators using ISO 8583 aim to migrate to ISO 20022, necessitating clear business requirements, market practices, and a migration roadmap to share information between financial institutions effectively. Proprietary payment messages are unique formats defined by a country, region, or monetary authority to facilitate payments. These formats are typically localized and require widespread adoption throughout the payment ecosystem to be effective. Due to customization for specific regional needs and local languages, they often lack standardization for cross-border payments. However, this can achieve interoperability with middleware, making them ideal for niche requirements where flexibility is prioritized. Source: Adapted from World Bank (2021b) and World Bank (2022d). Technology Choices and wallets, that can affect how these systems are used. In general, technology should be selected through careful Beyond standards, there are several high-level technology consideration of country context, inclusive of the available choices in DPI development. For example, countries can choose capacity, resources, and appropriateness for priority use between proprietary or open-source software solutions as cases. By carefully considering these technology choices—and the basis for building specific DPIs, with important tradeoffs prioritizing outcomes and architecture over specific solutions— that should be assessed for each country context. There are policymakers can build robust and resilient DPI that not only also high-level architectural choices related to emerging meets current needs but also adapts to future challenges. technologies, such as implementing verifiable credentials 46 Open-Source Software wallet and credential is its true owner) and can offer additional features to protect data (such as the ability to selectively DPIs can be built using customized open-source software disclose certain attributes only). (OSS), though OSS is not required. While open standards include publicly available guidelines or specifications to By putting the user in control of credential management and ensure interoperability and compatibility between different use, VCs offer a new architecture for how people manage systems and products (often developed through consensus their personal information digitally. Through a decentralized by standard-setting bodies), OSS makes the actual software use, people can directly attest to their identity or data through code open and freely available for any organization to use presentation to a service provider, without the involvement and customize. Although OSS adoption still requires procuring of the credential issuer (for example, a national ID agency, system integrators, in addition to hardware, devices, and ministry of health, or university), reducing the potential other IT services, it can potentially lower the up-front cost of risk of profiling that comes with centralized systems for DPI software and shorten the road to piloting and testing. authentication or data exchange. For this reason, the past OSS can also facilitate reuse of technology across borders. five years have seen multiple prominent developments in the For example, Estonia has made the underlying technology VC/wallet space, including maturing standards—such as W3C for its X-Tee data exchange platform available as an OSS and OpenID standards ISO/IEC standards for mobile driver’s (X-Road), which has been used or has inspired countries like license (mDL) and online credential registration and KERI for Ukraine, Cambodia, Finland, Mauritius, Kyrgyz Republic, legal entity identification—large-scale rollouts in multiple US and Namibia. This demonstrates how OSS can be used to jurisdictions for mobile driver’s licenses and the European share knowledge and best practices, fostering innovation Digital Identity Wallet. Countries like Bhutan and Korea are and adoption of DPI globally. implementing VCs and wallets as their main form of digital ID, while Thailand is piloting VCs for people to manage and Experience has shown that implementers need strong share their education transcripts. capacity to manage the development of DPI using OSS. Whether integrated in-house or with support from a systems Still, this technology is not appropriate for all types of integrator, the use of OSS that may be unfamiliar to the digital identity or data sharing applications or contexts. For development team can bring additional risks and learning example, some data sharing applications such as aggregating curves. A key lesson from past DPI implementations using or warehousing open data or sharing of non-personal data OSS shows the importance of having detailed and accessible between entities require different technologies. In addition, documentation and a viable market ecosystem, including of the most advanced VC/wallet standards rely on smartphone systems integrators and providers of peripheral devices and technology which is still not accessible to billions of people. For software that work with the software solution. Sufficient Internal this reason, countries such as Cambodia’s Verify.Gov.Kh service capacity to manage OSS deployments is also important. In uses a hybrid approach that includes paper-based versions every case, it will be important for the country to assess the of VCs with 2D barcodes that users can print themselves. pros and cons of adopting OSS for DPI, including total costs, time to deploy, and potential lock-in risks as part of a detailed Procurement market analysis. Procurement is a critical challenge for DPIs and other digital Verifiable Credentials and Wallets services built by public authorities and can present significant challenges. One major concern is vendor lock-in, where countries Verifiable credentials (VCs) and digital wallets are a specific become overly reliant on specific vendors. This can lead to architecture for digital identity and sharing personal data and high costs, limited interoperability, and difficulty adapting to documents. As described above, VCs enable digital issuance evolving needs. To address this, countries should prioritize and verification of specific attributes such as a person’s identity building local technical and operational capacity, adopting or credentials such as educational certificates, business open standards, and consider investing in modular designs permits, employment information, vaccine certificates, and that enable swapping out underperforming components or more. Digital wallets—akin to physical wallets—offer a user- vendors without having to rebuild the entire system. friendly and secure means for individuals to store, manage, and present their credentials. Compared with physical wallets, Another challenge for government-led DPI is the capacity to however, they provide higher levels of security (for example, manage procurement and contracts effectively, especially using selfie authentication to ensure that the person using the given the fast-evolving nature of relevant technologies. This DIGITAL PUBLIC INFRASTRUCTURE AND DEVELOPMENT: A WORLD BANK GROUP APPROACH 47 DIGITAL TRANSFORMATION WHITE PAPER, VOLUME 1 can result in lengthy timelines, suboptimal contract negotiations, tions from this testing—such as the need to retain offline/ and a lack of oversight. To overcome this, governments in-person onboarding processes, develop the application to should invest in training and development for procurement make use of operating system-native talk back, and simplify professionals, streamline processes, and consider using data- navigation—are being adopted and rolled out in late 2024. driven approaches to identify and evaluate potential vendors. By addressing these procurement-related issues, countries Incorporating ongoing feedback mechanisms as systems can ensure that DPI projects are implemented efficiently, and are deployed can also ensure continuous improvement. sustainably. Efforts to certify solutions according to specific For example, robust monitoring and evaluation systems, and standards or specifications can improve the information periodic client satisfaction surveys can provide important available and help countries avoid some pitfalls.49 insights to course-correct and address urgent issues. This approach not only enhances public engagement but also There are several good practice examples related to public ensures that digital services remain aligned with the evolving procurement in the digital space. For example, governments needs of users. in Australia, Singapore, and the UK have developed dedicated online marketplaces for the procurement of not just commercial off the shelf software (COTS), but also subscriptions and 3. SERVICE USE CASES services that have been pre-negotiated and can be purchased based on framework agreements, such as cloud computing Realizing the potential of DPI requires leveraging it for resources and software development. Still, more work is meaningful use cases across the public and private sectors. A needed in the DPI procurement space to reduce costs, shorten use-case or outcomes-driven approach ensures that DPI is not procurement timelines, address capacity and lock-in issues, simply another piece of infrastructure, but a practical building and spur market innovation. While funding from donors and block designed to deliver impact across various sectors. A focus development partners can help with start-up costs, ensuring on use cases can help reinforce the user-centricity needed longer term sustainability is essential for the adoption and to drive uptake and ensure that the infrastructure supports impact of DPIs. services that can improve people’s lives. Specific use cases are also effective in mobilizing stakeholders—for example, Pilots and User Testing partnering with financial service providers to design a use case for digital ID and data sharing can generate enthusiasm Pilots and user testing are integral to a human-centered around the DPI project and spur later adoption. design approach and can greatly enhance the success of DPI implementation. These preliminary steps allow for the The trade-off between sector-specific development and a practical evaluation of the system in a controlled, real-world DPI approach is a strategic decision that requires careful environment, providing valuable insights into user experience consideration of timing, coordination, and resource and system performance. By incorporating diverse user allocation. From a use case perspective such as delivering feedback during these stages, governments can ensure that social assistance payments digitally, it is tempting to focus on the DPI not only meets technical specifications but also aligns sector-specific quick wins, which provide immediate results. with the actual needs and expectations of people and service However, this can lead to a patchwork of solutions that may providers. This iterative process creates a feedback loop for be duplicative, expensive, with limited impact. The challenge continuous improvement, fostering the development of a often lies in the readiness of DPI to meet immediate sectoral system that is not only functional but also user-friendly and needs, which can drive the momentum towards developing responsive to the public’s needs. standalone infrastructures. In Indonesia, for example, the Directorate General of Popu- Sequencing the implementation of different DPIs and lation and Civil Registration (Dukcapil) developed a mock priority services is therefore critical and dependent on digital ID application and tested it with women, low-literacy country context. Retrofitting existing systems, especially groups, and persons with disabilities across the country. already digitalized services, to leverage DPI can be costly and This design process was done to help ensure the future user challenging due to status quo bias. Existing country efforts to interface and features would be accessible and user friendly digitalize services should be considered when defining the for vulnerable populations. The findings and recommenda- initial priority use cases for DPI. For most use cases, multiple 49 For example, GovStack is launching “GovMarket” to identify providers with products that are compliant with GovStack specifications. 48 DPIs will play an important role, underlining the importance payments made by the government to individuals, including of interoperability between DPIs and across sectoral digital social assistance, pensions, public wages, and various subsidies. infrastructure. Coordination to develop and leverage DPI is By providing shared and interoperable building blocks for time-intensive and at times politically challenging, but it lays digital transactions, DPI enables multiple government agencies the groundwork for long-term efficiencies and a platform for to leverage the same infrastructure. This creates efficiency continuous innovation. gains and helps government agencies avoid reinventing the digital wheel for each new payment stream or program. This section outlines some prominent DPI use cases, including for government-to-person transfers, financial inclusion, health, DPI can help digitalize G2P payments in an efficient, inclusive, and agriculture. While these examples are illustrative, they and adaptive way. When COVID-19 left billions of people in are not exhaustive. need of assistance, countries with elements of DPI in place were better able to reach the poorest in a faster, more targeted, Government-to-Person (G2P) Payments and transparent manner. G2Px research on the role of digital during COVID-19 showed that among 85 countries, those that DPI is increasingly recognized as a driver transforming the were able to use digital databases and trusted data sharing delivery of G2P payments. G2P payments encompass all reached, on average three times more beneficiaries than Box 7. DPI for social protection in Zambia The Social Cash Transfer (SCT) is the Republic of Zambia’s primary social protection initiative aimed at stabilizing the consumption of the poor. It involves small, frequent unconditional cash transfers, requiring payment points to be within 7 km of communities due to the difficulties beneficiaries face in traveling long distances. Prior to 2022, the program’s management information system (MIS) was unstable, and all cash transfer payments were made manually in physical cash by civil servant Pay Point Managers (PPMs), most often teachers. This created challenges for accountability, payment reconciliation, and beneficiary authentication, increasing risks of error, fraud, and corruption. The WBG supported the government of Zambia to overhaul this process by leveraging a payments gateway DPI and investing in a social protection MIS. For “urban areas” with network connectivity and payment service providers (PSPs) the government engaged multiple PSPs to reach a national scale, allowing beneficiaries the flexibility to select a PSPs of their choice, based on their knowledge of proximity of PSP locations. These payments are processed in real-time from the new CORE-MIS system and passed to the payment gateway. This facilitates a “double-entry” payments approach, where funds only leave the ministry’s account if the balancing credit is successfully credited to each beneficiary account at the PSP. This means that in case of failed transactions there is no movement of funds and no need for the government to request refunds from the PSPs. For “rural areas” without network connectivity and PSPs, an Android mobile App was developed to record evidence of payments delivered in offline areas. Beneficiaries present their National Registration Card to ensure a match with the approved payroll downloaded from the MIS to the App. The digitalization of payments has improved their timeliness and reduces duplicates and potential errors, fraud, and corruption. Leveraging the payments gateway DPI allows the government to maximize the integration effort with PSPs and reuse these for multiple other social protection programs. The MIS system and payment strategies have been adapted to support delivery to more than 2 million households, including almost 1 million as part of the ongoing emergency drought response. Evaluations show that when given the choice, beneficiaries tend to select the PSP with the closest, most convenient access point, reporting that this reduces travel expenses and frees up time to spend with family or on income-generating activities. Choice also gives the SCT program the flexibility to replace a PSP easily when one provider drops out or does not comply with the service standards. Allowing beneficiaries the choice of PSPs is therefore not only a more customer-centric approach but can also avoid reinforcing monopolies and protect program officers from being lobbied by PSPs. Source: Adapted from World Bank (2021b) and World Bank (2022d). DIGITAL PUBLIC INFRASTRUCTURE AND DEVELOPMENT: A WORLD BANK GROUP APPROACH 49 DIGITAL TRANSFORMATION WHITE PAPER, VOLUME 1 those that could not rely on these DPIs and had to collect • A trusted and inclusive ID system can support digital G2P information from scratch (Marin & Palacios 2022). payments, ensuring that beneficiaries have the necessary documentation to open financial accounts or can open an A modern G2P architecture50 that utilizes DPI, particularly account remotely. In addition, a digital ID that provides digital ID systems, payment clearing and settlement systems, services to sectoral systems (such as social registries and trusted data sharing frameworks, creates efficiencies and and social protection MIS) can assist in identifying and benefits for recipients and governments. Key processes in enrolling potential beneficiaries into social assistance G2P payment delivery that benefit from DPI include account programs more easily. opening for payment recipients, registration with G2P programs, • Aligned with a modern G2P architecture, DPIs can allow payment instructions, and fund transfers to financial institutions countries to offer beneficiaries a choice of payment service or treasuries, and the subsequent reconciliation and cash-out providers, which can increase convenience, promote of digital transactions. An architecture leveraging DPI provides financial inclusion, and contribute to market development. a unified digital platform for various G2P payment channels, This requires an interoperable retail payment switch with resulting in fiscal savings for governments and fostering a broad participation from banks and non-bank payment payment ecosystem that enhances financial access and the service providers, along with a database or platform development of relevant financial products and services, that supports the matching of beneficiary identifies and ultimately leading to increased convenience, inclusion, and account numbers, known as an account directory. This empowerment for beneficiaries. allows beneficiaries to select and update their preferred account for receiving government payments without the • Payment Systems that include both large volume and need to coordinate with multiple programs or agencies. retail payment clearing and settlement systems, with wide participation from payment service providers and the Financial Inclusion availability of a government payment gateway or interface, are essential for the digital delivery of G2P payments. DPIs democratize financial access by enabling digital processes These payment systems can be used to direct payments that reduce costs and extend the reach of financial services. into individual accounts, enabling governments to give DPIs democratize access by allowing financial institutions to payment recipients the choice of account and provider in leverage shared infrastructure, enabling broader reach and which to receive their payments, thus unlocking further reducing operational expenses. The ability to verify identities convenience and inclusion benefits. and process applications digitally ensures that even remote Figure 20. Role of DPI in financial inclusion Improved Productivity gains for the More investments by reliability of public and private sector the government for 1 Reduced frictions information further productivity gains and inefficiencies Increased efficiencies via enabling digital Digital and end-to-end Lower cost for the government financial literacy processes Increased speed Increased efficiencies for financial service providers Catalyze demand Citizen Financial Inclusion DPIs for DFS by individuals Empowerment and MSMEs New business models • Access and use to deliver DFS transaction accounts/ payments ü Participation in the 2 DFS Market digital economy Structure • Access and use More competition other DFS such as ü Productivity gains among DFS providers savings, credit and for individuals and insurance MSMEs Denotes the path to productivity gains via route 1 Denotes potential additional productivity gains via route 1 Source: Ardic Alper et al (2023) 50 See World Bank (2022c). 50 Box 8. Impact of PIX and digital G2P payments on financial inclusion Since its launch in November 2020, the PIX fast payment system has significantly advanced financial inclusion in Brazil. The number of active users in the financial system more than doubled from June 2018 to December 2023, largely due to its contribution to the digitalization of financial services. The implementation of PIX, along with the distribution of emergency aid during the COVID-19 pandemic, played a crucial role in expanding access to financial services. Active clients of financial services increased from 77.2 million to 152 million, raising the proportion of adults with active accounts from 46.8 percent to 87.7 percent. The adoption of PIX has also benefited micro businesses, with the number of active business clients growing from 3.4 million to 11.6 million during the same period. PIX has facilitated the expansion of financial service usage, particularly in digital credit and payment services. This led to a 3,000 percent increase in digital credit users. The cooperative banking sector also experienced substantial growth, especially in active credit users. Source: Banco Central do Brasil (2023) or economically marginalized communities can benefit from loans more easily. Additionally, data exchange infrastructures financial services. help financial providers use alternative data—like transaction records and utility payments—to assess creditworthiness, Efficiencies and increased competition driven by DPIs making formal financing options available to more businesses. play a crucial role in advancing financial inclusion. DPIs This expanded access to credit supports entrepreneurship further productivity and financial inclusion through reduced and stimulates economic development. inefficiencies and enhanced digital processes. By improving information reliability, lowering costs, and increasing speed, Advancing financial inclusion through DPIs requires a set DPIs empower citizens and transform the digital financial of key enablers and catalyzers to maximize their value and services market, driving efficiencies for governments and support this objective. To achieve financial inclusion outcomes, service providers, fostering new business models, and several enablers and catalyzers are essential. DPIs add value by enhancing competition. This, in turn, spurs demand for financial offering affordable identification, efficient payment solutions, services among individuals and MSMEs, improving access and secure data exchange, which collectively lower barriers and to payments, savings, credit, and insurance. Together, these make financial services more accessible. Strong governance effects promote financial inclusion and productivity, enabling and coordinated efforts are necessary to underpin DPI broader participation in the digital economy (Figure 20). development, ensuring sustainability and a whole-of-society approach. Additionally, robust and widespread support services DPIs can improve the usage of financial services by making and infrastructure are critical for effective implementation, transactions more efficient, secure, and accessible. Payments along with sound regulatory frameworks that provide clear, DPIs, for example, allow for seamless and real-time transactions, enforceable guidelines. Catalyzers such as widespread digital which reduce the reliance on cash and make financial management and financial literacy and inclusive financial service access more convenient for individuals and businesses alike. This points further promote financial inclusion. efficiency encourages more frequent use of digital financial services and also builds trust in the formal financial system. Health In crisis situations, such as the COVID-19 pandemic, digital payments have proven invaluable, enabling governments to For health systems, DPI can serve as a catalyst to achieve swiftly distribute financial aid, ensuring that even the most the World Bank’s goal of providing quality, affordable health vulnerable populations receive timely support. services to 1.5 billion people by 2030. DPI that is effectively integrated into the health sector can play a critical role in For MSMEs, digital payments provide critical tools that advancing Universal Health Coverage (UHC) by lowering promote the effective use of financial services and support barriers to access healthcare services, enhancing efficiency, business growth. Digital payment platforms built as DPI enable and improving health outcomes. Using elements of core DPI MSMEs to track revenues, build credit histories, and access stacks makes digital systems in the health sector robust so DIGITAL PUBLIC INFRASTRUCTURE AND DEVELOPMENT: A WORLD BANK GROUP APPROACH 51 DIGITAL TRANSFORMATION WHITE PAPER, VOLUME 1 Box 9. Role of DPI in Indonesia’s SatuSehat Indonesia’s SetuSehat program exemplifies a comprehensive approach to leveraging digital public infrastructure (DPI) for healthcare improvement. The program, launched in 2022, aims to create a robust, interoperable, and secure digital health ecosystem by integrating data from various technology-based apps and health facilities. At its core, SetuSehat relies on a standardized national health data system, which leverages a Master Patient Index validated by the Population and Civil Registration Agency (Dukcapil) to ensure accurate and secure digital identification. This digital ID system serves as the foundation for electronic medical records (EMRs) and facilitates seamless data sharing across the healthcare system. Furthermore, SetuSehat integrates with the National Health Insurance scheme (JKN), administered by Badan Penyelenggara Jaminan Sosial-Kesehatan (BPJS-K). This integration enables secure and efficient electronic payments for healthcare services, streamlining the insurance claims process and reducing administrative burdens. The platform also facilitates data sharing between various stakeholders, including insurance companies, biotechnology laboratories, pharmacies, health-tech startups, and government agencies. This interoperability is achieved through open APIs based on microservices, allowing for secure and standardized data exchange across the ecosystem. SetuSehat’s success hinges on the establishment of a robust trust framework. The program prioritizes data protection and security, adhering to the Personal Data Protection Law passed in 2022. This legislation ensures data ownership rights, regulates data collection and usage, and imposes sanctions for data breaches. The program leverages a regulatory sandbox to test new digital health tools and associated legislation in a controlled environment, fostering innovation while mitigating risks. By utilizing digital ID systems, secure payments, data sharing platforms, and a strong trust framework, SetuSehat demonstrates the transformative potential of DPI in improving healthcare delivery and achieving universal health coverage in Indonesia. they can fundamentally transform healthcare delivery, disease responses to health emergencies. Countries must also invest surveillance, and public health interventions. In the context of in building the human capacity to maintain and evolve these global health, data sharing can enable interoperable health systems, as health technologies and standards continuously information systems, digital identity frameworks can improve advance. The COVID-19 pandemic demonstrated how countries reliability of patient records, and digital payment interfaces with an established digital health infrastructure were better can improve access to care and allow for more equitable positioned to implement contact tracing, vaccine distribution, healthcare financing. For healthcare financing and access, and telemedicine services, highlighting the critical need for fast payment systems create opportunities for integrated such systems to be developed as public goods rather than payment infrastructure within health systems that can streamline proprietary solutions. insurance claims, government health scheme payments, and out-of-pocket expenses. Trust-based digital authentication Agriculture systems can also combat counterfeit medicines by enabling verification at every step of the supply chain. The agriculture sector is a prime use-case for DPI, with the potential for large-scale transformational impact. Globally, Utilizing DPI in the health sector requires careful consideration approximately 1 billion people (ILO 2024, via World Bank of privacy protections, human capacity, and interoperability DataBank) and two-thirds of the world’s poorest are engaged challenges. Health data demands exceptional privacy in or depend on agriculture for their livelihoods (UN 2023). DPI protections and security measures while simultaneously enables a technology and data-driven approach to agriculture needing to be accessible across different healthcare providers based on interoperable systems, dynamic digital infrastructure (both public and private) and jurisdictions, and in some cases (particularly digital ID, e-payments and e-signature systems), support cross-border data exchange, enabling early warning data-sharing mechanisms, and a robust trust ecosystem. By systems for disease outbreaks and coordinated international leveraging foundational components, DPI can foster efficient 52 and transparent transactions in the agriculture sector that digitalization efforts, such as farmer and farm IDs, to empower farmers, governments, and agribusinesses alike enhance adaptation and mitigation efforts through by facilitating timely access to information, financial services, government benefits and tools like real-time weather and Digital Public Goods (DPGs). Overall, DPI offers a scalable advisories and region-specific climate-smart inputs. solution to address key challenges such as: • Efficient Markets: Digital payment systems and data sharing capabilities can support online marketplaces that • Access to Services: Improved digital IDs and digital can reduce transaction costs and expand market access. payments can enhance access to critical services such as input subsidies, agricultural credit, crop insurance, • Inclusivity: DPI in agriculture can promote inclusivity, and real-time advisory services—key tools for mitigating especially for smallholder farmers who often lack access risks and improving productivity and income. to essential financial and information services. DPI can bring marginalized rural populations into formal economic • Data-Driven Timely Decision-Making: Interoperable systems, enabling them to access credit, make digital systems and data-sharing capabilities allow policymakers payments, and secure insurance and other services. and agribusinesses to make informed decisions based on additional data such as on crop patterns, land use, • Agribusiness models: As food security becomes more and environmental data. pressing, there is a need to enhance agribusiness models. DPI can be leveraged to improve the efficiency, • Climate Resilience: The agriculture sector is particularly transparency and resilience of food systems, enabling vulnerable to climate change (Mbow et al. 2019). Here, monitoring of production, storage and distribution. For DPI can be leveraged for both adaptation and mitigation example, farm and farmer IDs, based on official digital measures. For example, DPI can support sector-specific Box 10. India’s AgriStack India’s AgriStack exemplifies how DPI can revolutionize agriculture at scale. India’s AgriStack, an initiative by the Government of India is built on the country’s foundational DPI. It serves as an example of how sector-specific solutions can be built upon existing core DPI. Specifically, AgriStack’s leveraging of Aadhaar (the national digital ID system) for farmer identification demonstrates exactly how foundational DPI can enable digital transformation across sectors without reinventing core infrastructure. The AgriStack aims to create a unified digital ecosystem for the agricultural sector by integrating multiple data streams, including farmer identities, land records, and crop information. At its core is a digital farmer’s registry, which provides each farmer with a unique digital ID, built on the Aadhaar system, enabling them to access government schemes and benefits more easily. Further, agriculture benefits (such as farm subsidies, crop insurance, credit, etc.) in India are often received directly into Aadhaar-linked bank accounts of eligible farmers and require Aadhaar numbers to receive benefits to reduce administration, targeting and fraud related costs. India’s AgriStack has built other databases which leverage the farmer and in-turn Aadhaar registry such as the geo-referenced village database and the crop sown registry. These databases link each farmer’s identity with their land records and crop details, allowing for a comprehensive view of agricultural activities across the country. Through the AgriStack, the government can better monitor crop patterns, allocate resources, and deliver targeted services such as crop insurance and subsidies. It also enables digital crop surveys each season, providing critical data to enhance productivity, manage risk, and support policy planning. By leveraging mobile-based platforms (WEF 2023), AgriStack makes it easier to conduct on-the-ground data collection, making the system more responsive and adaptable. This initiative has potential not only to support individual farmers but also to create a foundation for a robust agri-tech ecosystem (Beriya 2022) in India. AgriStack is a pioneering example of how DPI can be leveraged to enable efficient, data-driven, and inclusive agricultural policies that benefit farmers and stakeholders alike. For more information see https://agristack.gov.in/ DIGITAL PUBLIC INFRASTRUCTURE AND DEVELOPMENT: A WORLD BANK GROUP APPROACH 53 DIGITAL TRANSFORMATION WHITE PAPER, VOLUME 1 IDs, can be linked to platforms that track crop health to AgriStack (Box 10) also demonstrate the importance of DPI help farmers make more informed decisions. Similarly, systems such as system interoperability, standardized data- IoT-based sensors in warehouses and distribution networks sharing protocols, and governance frameworks that protect can be linked to other datasets based on data sharing farmer privacy while enabling efficient data utilization. standards or through data sharing platforms to ensure monitoring of the storage and transportation of food. Long-term coordinated financial commitments are required, and investments should prioritize interoperability and To scale and leverage DPI for agriculture globally, significant connectedness to ensure equitable access. Capacity building and coordinated investments are needed. These investments is also essential to empower local experts and farmers with include in foundational DPI, overall digital ecosystem (such as the knowledge and tools to effectively leverage DPI-enabled connectivity, digital skills, advanced data processing capabilities, services. Investments should support training programs, digital and cloud computing) and agriculture-specific digital systems literacy campaigns that would be beneficial across sectors as (such as digitalization of agriculture services, farm and farmer well as, with the agriculture-sector, farmer-centric platforms, registries, agriculture platforms) are necessary. Lessons from including registries, payment systems, and advisory tools, to initiatives like Kenya’s Big Data Platform (Box 2) and India’s ensure user-friendly and inclusive access. 54 IV KEY LESSONS As Section 3 demonstrated, there is no single blueprint for comprehensive approach to legal and regulatory reforms designing and implementing DPI. The type of DPI system, is often necessary to address the broad spectrum of country context, and use cases matter. However, it is still possible safety and inclusion within DPIs. However, by prioritizing to identify some high-level good practices and principles legal reforms essential to core DPIs (such as digital ID, around DPI and its use. This section synthesizes some of these e-signatures, digital payments, and data-sharing) and lessons, highlighting five success factors to help harness the then expanding to more sector-specific regulations, potential of DPI while mitigating key challenges and risks and countries can help lay the foundations for a safe and providing concrete examples that can be incorporated into inclusive digital infrastructure that can gradually be policy and project design. expanded and refined as the surrounding ecosystem matures. In Jordan, the prioritization of strategic reforms These lessons build on existing guidance on broader digitalization was key to advancing DPI, a strategic commitment for efforts and on implementing specific systems as DPI. For the country since 2021. Notable reforms such as the example, the Principles for Digital Development 51 provide a recognition of electronic transactions and e-signatures, high-level set of guideposts for rolling out any digital system or a revised law on access to information, the adoption of strategy that resonate strongly with the DPI approach, including a law against cybercrime, and the new data protection the importance of sharing and reuse, designing with people law. While additional reforms are still needed to address and for inclusion, creating open and transparent practices, all aspects comprehensively, these foundational changes and mitigating potential harms. For digital identity systems have enabled Jordan to make substantial progress in in particular, the Principles on Identification for Sustainable deploying DPI safely and inclusively. Development52 establish 10 principles for inclusive and trusted • Security- and rights-enhancing: DPIs must be built with ID systems, focusing on universal access, design principles robust data protection and security measures in their around interoperability, security, and privacy-by-design, and DNA. Data breaches and misuse can erode public trust comprehensive governance and oversight. and undermine the very benefits DPI aims to deliver. In addition to a strong legal and regulatory framework, 1. SAFETY AND INCLUSION FIRST countries should prioritize privacy-enhancing technologies and continuous investment in cybersecurity. Data privacy and human rights impact assessments throughout the DPI The success of DPI hinges on its ability to deliver safe and development process are crucial. This involves conducting inclusive digital services that benefit all members of society. thorough assessments to identify potential risks and This requires a fundamental shift in how the world approaches implementing mitigation measures to address them. In digitalization, moving beyond technology to creating a trusted Australia, for example, the Commission Report on Data and accessible ecosystem. Some key success factors include: Availability and Use that preceded the Consumer Data Right framework (a data sharing DPI), included multiple • Legal and regulatory reforms: Laws and regulations rounds of consultation and privacy impact assessments are critical for ensuring that DPIs are safe and inclusive, (Desai et al. 2022). providing a trusted environment for digital services. A 51 See https://digitalprinciples.org/. 52 See http://idprinciples.org. DIGITAL PUBLIC INFRASTRUCTURE AND DEVELOPMENT: A WORLD BANK GROUP APPROACH 55 DIGITAL TRANSFORMATION WHITE PAPER, VOLUME 1 • Accessible design: DPIs, as well as any service and product These assessments should be informed by a country’s built leveraging DPI, should be universally accessible, unique constraints and a clear vision of the intended users accommodating diverse needs and ensuring no one is and their needs. In 2023, for example, the World Bank left behind. This includes incorporating universal acces- partnered with the government of Lebanon to conduct a sibility features to cater to individuals with disabilities, use case analysis, identifying where and how integrating simplifying user interfaces for those with limited digital digital identity within a broader digital transformation literacy, and offering alternative non-digital options for program could enhance the delivery of public services those who prefer them. Proactive outreach and testing in the country (World Bank 2024b). with marginalized groups are essential to identify and • Stakeholder consultations are vital in this process. address potential barriers to adoption, as done in Indo- Engaging with the diverse array of users—from individ- nesia (see Section 3). uals and businesses to government entities—ensures • CSO engagement: Engaging with civil society organi- that DPI meets real-world demands and is user-centric. zations (CSOs) throughout the process is vital to ensure This collaborative approach helps to identify the most diverse perspectives are considered and to build trust pressing issues and fosters a sense of ownership and in the DPI ecosystem. For example, Jordan ’s open alignment among all parties involved. In 2020, South government data initiative, which involved extensive Africa launched a series of community consultations as public consultations with CSOs, has fostered a more part of an effort to reform its national identity system transparent and accountable data sharing environment to be more inclusive. Consultations revealed that the (see section 3). gender-coded identification number in the national ID system excluded nonbinary and transgender individuals, prompting regulatory changes (DHA 2020). In Jamaica, 2. FOCUS ON OUTCOMES, a CSO coalition successfully reviewed the new ID legis- NOT TECHNOLOGY lation, achieving consensus on various provisions and actively participating in the legislative process, with their contributions publicly acknowledged by the government.53 Avoid thinking of DPI as a new technology that will save the • An outcomes-based strategy also requires data and day; instead, focus on outcomes and use cases, and work backwards to arrive at priority investments, architecture, and research. To maximize the potential of DPI and keep the technology choices. It is essential to prioritize the outcomes focus on outcomes, rigorous evidence-building is needed and practical applications over the allure of new technology. to test and document impact. Measuring impact cannot The goal is not to find a technological panacea but to identify be an afterthought; rather, strategies for assessing and and invest in solutions that address specific needs and deliver calibrating effectiveness should be built into the design tangible benefits. This outcome-driven approach requires a and rollout of DPIs. This entails developing clear, actionable careful analysis of the desired impact, and a strategic selection metrics and research designs (including robust impact of technology based on those goals. evaluations) to evaluate not only the tangible benefits—such as efficiency gains or service reach—but also the quality • Use case assessments are a critical starting point. By of citizen experiences, including their satisfaction, trust, thoroughly understanding existing challenges in service and sense of inclusion. The World Bank is supporting this delivery and digital transactions, stakeholders can identify type of work through the launch of DPI-specific research use cases where DPI is likely to have a large impact (and labs, including in Ethiopia, Philippines, and India.54 where it is not the most pressing issue). This understanding • Feedback loops and participatory evaluations are also should guide the design and implementation of DPIs, essential to ensure that DPIs evolve in response to user ensuring that technology choices are fit for purposes—such needs and maintain public confidence. For example, as improving the efficiency of social protection programs, tracking adoption rates alongside qualitative measures enhancing financial inclusion, or streamlining e-services. of citizen satisfaction can illuminate the reasons behind 53 For more information about the CSO coalition in Jamaica, see: https://nidsfocus.com/. 54 DPI research labs are a collaboration between the World Bank’s ID4D, G2Px, and Development Impact Evaluation (DIME) programs, country governments and DPI providers and users, and multiple academic research partners and donors. The goal is to outline priority research topics around specific DPI implementations and mobilize a research and partnership community to support and execute these studies. For more, see ID4D and G2Px’s most recent Annual Report (World Bank 2024c). 56 success or stagnation. By grounding DPI initiatives in robust platforms and public consultations, can offer valuable evidence and meaningful engagement, stakeholders can insights on ensuring DPIs effectively meet user needs. build infrastructures that are both technically sound and • Prototyping and Testing: Developing prototypes of the deeply aligned with the needs of the people they serve. DPI user interfaces or DPI-enabled services and testing The varied uptake of DPIs, illustrates that widespread them with real users to gather feedback. This iterative adoption requires clear value propositions, widespread process helps refine the solutions to better meet user availability, and trusted processes. For example, Austra- needs. In a series of blog posts, Singapore’s National lia’s Consumer Data Right (CDR) 55 —an opt-in data sharing Digital Identity program detailed how they revised their service—outlines key use cases for data sharing, benefits ID system to better meet individual needs, including for individuals, and its overall vision for the customer conducting “real life” testing to identify unexpected journey (Desai et al. 2022). challenges users faced while using their mobile app.57 • Service Blueprinting: Mapping out the service interactions 3. USERS AT THE CENTER across different touchpoints and channels to ensure a seamless user experience. This helps in identifying any Countries should create DPIs—and DPI-enabled services—that gaps or areas for improvement in service delivery. are tailored to the needs, behaviors, and experiences of users. • Accessibility and Inclusivity: Assessing that the DPI is By integrating “service design” and human-centric design accessible to all users, including those with disabilities, (HCD) principles into the development of DPI, governments and designing for inclusivity to cater to the diverse needs and organizations can create more effective, efficient, and of the population. For example, Indonesia has engaged in user-friendly services that are more likely to be adopted and significant user testing with women, persons with disabil- valued by the public. Implementing these approaches can ities, and low literacy groups for its new digital ID app. involve the following: • Iterative Design: Continuously improving the service • User Research: Conducting in-depth research to understand based on user feedback and changing needs. This agile the needs, pain points, and behaviors of the end-users. approach allows for adjustments to be made as new This can include interviews, surveys, field studies, and insights are gained. usability testing. User journey mapping can be a partic- Ideally, the above approaches can be designed and managed ularly useful tool to visualize the steps users take when by staff dedicated to user experience. For example, the UK interacting with a DPI service. This includes identifying Government Digital Service employed various techniques pain points, frustrations, and areas for improvement. For like assigning a dedicated researcher to each project team, example, ID4D has worked with governments in Ethiopia, using an experimental design approach, and regularly Nigeria, Rwanda, Indonesia, Philippines, Timor Leste, observing end users interacting with their products to make and others on qualitative research studies to inform the their services more aligned with people’s needs.58 The Italian design of digital ID systems.56 Digital Agency developed a comprehensive manual for the • Co-Creation: Involving stakeholders, including end-users, in Public Administration’s websites and digital services, offering the design process to ensure that the solutions developed operational guidance on topics such as digital administration are aligned with their needs and expectations. Workshops design, project management, service design, user experience, and collaborative design sessions can be effective in this accessibility, and interface design.59 stage. Incorporating digital citizen engagement through participatory design mechanisms such as crowdsourcing 55 For more, see https://www.cdr.gov.au/. 56 Reports from many of these studies are available on the ID4D website at https://id4d.worldbank.org/research. ID4D’s Qualitative Research Toolkit (Bailur & Esquivel Korsiak 2019) also provides additional guidance on conducting this type of study, and is available at https://id4d.worldbank.org/ qualitative-research. 57 For more information about how the Singaporean GovTech agency is performing user research to improve their ID system and processes, see their series of blogs at https://medium.com/ndi-sg/making-digital-services-more-accessible-for-all-part-1-a150ef027ea4 58 For more information about the way GDS team applied user research to their activities, see Gov.UK Blog at https://gds.blog.gov.uk/2013/08/30/ how-we-do-user-research-in-agile-teams/. 59 For more information, see the “Manuale operativo di design” (Operational Design Manual) at https://docs.italia.it/italia/designers-italia/manuale- operativo-design-docs/it/versione-corrente/index.html. DIGITAL PUBLIC INFRASTRUCTURE AND DEVELOPMENT: A WORLD BANK GROUP APPROACH 57 DIGITAL TRANSFORMATION WHITE PAPER, VOLUME 1 4. INVEST IN PEOPLE 5. IT TAKES A VILLAGE TO BUILD GOOD DPI Investing in human capital is a cornerstone of successful DPI deployments. This investment transcends mere technology A whole-of-society—and cross-border—approach is important acquisition; it is about empowering individual stakeholders— for building and sustaining DPI and other ecosystem civil servants, businesses, and individual users—to navigate components. Each country will have a unique set of key and leverage DPI and DPI-enabled services effectively. This stakeholders and respective roles they can play. While this investment is the bedrock upon which the success of DPI broad ecosystem can create complexities for coordination, initiatives is built, ensuring they are inclusive, sustainable, and it also creates opportunities for multiple agencies to make resilient in the face of rapid technological change. progress on building or using DPI simultaneously. Importantly, this requires building strong institutions and champions for For the government, training and capacity building for public DPI not only in the central government and digital ministries servants to be able to develop, regulate, supervise or leverage or agencies, but across other sectors and ministries, and DPI is paramount. Incentives are also crucial for attracting and with the private sector. International collaboration is essential retaining the qualified personnel necessary to operate and for encouraging interoperability and open and common innovate within the DPI ecosystem. For example, Singapore’s standards to enable digitalization of cross-border services approach to revamping compensation packages for data talent and transactions.  and creating specialist career pathways attracts and retains high-caliber professionals, while Mauritius’ National Open Data Example roles and opportunities across stakeholders include: Policy, which mandates the creation of Open Data teams within each ministry, illustrates the importance of structured capacity Public Sector: building at various government levels (Desai et al. 2022). In Colombia, the government published a profile for chief data • Lead the development of a national, cross-sector DPI officers that helps define core competencies required in this strategy in cooperation with the private sector, ensuring role across public sector agencies, laying the groundwork for alignment with broader digital transformation goals. advanced skills building (World Bank & IADB 2024). • Establish policies to ensure the long-term sustainability of DPI initiatives, such as through securing public resources Digital literacy for the population at large is another critical to fund government-built DPI and crowding in private investment. A digitally literate population can better leverage sector investment. the opportunities DPI unlocks while minimizing exclusion risks, ensuring that the benefits of digital services are widely • Develop a legal and regulatory framework that supports accessible. Initiatives like Estonia’s “Tiger Leap,” which invested DPI development and adoption, including data sharing, massively in connectivity and digital skills, and Singapore’s privacy, and cybersecurity policies, as well as sector- and Digital Readiness Blueprint, which had the goal of ensuring DPI-specific relevant regulations. that all Singaporeans have access to technology to improve • Foster collaboration across public and private sectors their lives, have been instrumental in fostering a digitally savvy to ensure seamless integration, interoperability, and citizenry (Desai et al. 2022). Uruguay has similarly promoted service delivery. “digital citizenship,” including the development of a set of basic digital skills to enable access, retrieval, understanding, • Establish and promote technical standards for data evaluation (Desai et al. 2022). sharing, verifiable credentials, and digital services to ensure consistency across sectors. • Create enabling environments for innovation, such as regu- latory sandboxes, to test and iterate on digital solutions. • Safeguard consumer rights, promote awareness, and ensure access to grievance mechanisms within the DPI ecosystem. • Build DPIs (as needed, or as defined by national strategy), potentially in collaboration with the private sector. 58 Private Sector and Start-ups: International and Regional Bodies: • Build DPIs, potentially in collaboration with or as regu- • Facilitate cross-border collaboration and standard-setting lated by government. for DPI, including adopting frameworks for interopera- bility and recognition of digital identity, e-signatures, • Integrate DPIs into existing digital services. and transactions, as well as cross-border payments and • Innovate on top of DPI platforms to create value- data sharing. added services. • Share best practices and provide platforms for knowl- • Promote trust in DPI by providing audit, conformity edge exchange. assessment, cybersecurity, and other services. • Support capacity-building in developing countries for • Partner with the public sector to drive technology adoption DPI implementation. and digital literacy. • Help build and support open standards and digital public • Contribute to the development of open standards and goods for DPI. interoperable solutions. • Develop new DPI technologies, services, and solutions. Standards Development Organizations: Civil Society and Non-Governmental Organizations: • Develop and maintain technical standards for compo- nents of DPI. • Advocate for inclusive and equitable DPI that serves all • Promote interoperability across digital systems by creating segments of society, with a focus on at-risk or margin- standardized frameworks that facilitate cross-platform alized groups. and cross-border integration. • Participate in policy discussions and provide feedback • Engage with stakeholders to ensure that standards remain on DPI initiatives to ensure that design responds to user relevant given technological advances. needs and minimizes exclusion and other risks. • Participate in established DPI governance bodies, such Accreditation Bodies: as public oversight committees. • Accredit auditors that assess the technical and operational • Engage in community monitoring and capacity building compliance of DPI systems. to improve implementation and accountability for DPI and its use. • Promote accreditation of actors that ensure trust in DPI such as certification bodies and testing laboratories. • Help to build and support open standards and digital public goods for DPI. • Facilitate cross-border recognition of accredited services and certifications. • Support digital literacy and awareness campaigns to empower citizens. By embracing a whole-of-society approach and public-private partnerships, stakeholders can overcome inertia and legacy Academics and Researchers: constraints. This shift in mindset requires high-level political champions and a well-coordinated strategy to ensure buy-in • Partner with DPI ecosystem members to conduct novel and mobilization among all stakeholders. Center-led initiatives research and data collection to improve and measure are likely to be insufficient, and complementary sector-led DPI impact. digitalization efforts can help boost momentum and uptake • Propose evidence-based policy recommendations for of DPI. Robust and resourced institutions are essential for DPI providers based on new research. enforcing rules and offering effective redress. Iterative policy • Develop and test new DPI technologies, services, environments and agile institutions will enable continuous and solutions. learning and improvement, adapting to the fast-paced evolution of technology and data governance. DIGITAL PUBLIC INFRASTRUCTURE AND DEVELOPMENT: A WORLD BANK GROUP APPROACH 59 DIGITAL TRANSFORMATION WHITE PAPER, VOLUME 1 A well-designed DPI may have the ability to unlock shared and ensuring greater transparency through standardized cross-border growth. For example, the adoption of Estonia’s messaging, modern technology, and a common rulebook. X-Road by several countries facilitates cross-border data exchange However, this progress comes with multiple challenges. To and economic linkages. Cross-border collaboration for DPIs address these, stakeholders in multi-jurisdictional contexts is also essential. For example, FPS interlinking enhances the should establish clear legal, ownership, and operational end-user experience in cross-border payments by providing structures while leveraging international standards. 24/7 availability, improving transaction speed, reducing costs, Box 11. The role of different public sector stakeholders in a country’s DPI journey The relevant government stakeholders and the specific roles each might plan in DPI will vary across countries. Below is a sample list of potential roles different public stakeholders could have. Digital Government Authority or Similar: • Lead or champion DPI, ensuring alignment with national digital strategies. • Foster innovation for digital services and data sharing across sectors. • Coordinate with other government entities and the private sector to ensure interoperability and seamless service delivery. • Publish an optional standard for verifiable credentials to encourage ministries, departments, and various levels of government to issue their certificates and documentation digitally. • Encourage line ministries and departments to provide open APIs for their online services to enhance user expe- rience and service delivery. • Lead or champion efforts to revise or create laws to enable e-signatures and digital transactions, as well as the implementation of trust frameworks and standards for digital identity and e-signatures. • Potentially lead the development of online digital ID and data sharing systems (can also be done by ID agency and/or private sector, based on context). Ministry of Finance: • Secure funding for DPI initiatives and ensure financial sustainability of government-built DPIs. • Work with other ministries to align budgeting with digital transformation goals. • Implement financial policies that incentivize digital adoption, innovation, and private capital mobilization for DPIs. • Integrate DPIs into public financial management systems as appropriate. Central Bank and Financial Regulators: • Foster an enabling digital financial ecosystem. • Support or lead the development of fast payments systems. • Develop an eKYC/CDD policy to facilitate DPI adoption. • Develop a regulatory framework for Open Finance, including technical specifications for financial data sharing across sectors. • Develop and enforce financial sector specific regulatory and supervisory frameworks for financial sector cyber- security, data protection, consumer protection, and other safeguards. 60 Digital Regulators and Accreditation Bodies: • Review and reform legacy legal frameworks to eliminate barriers to DPI adoption. • Create regulatory sandboxes to allow for testing and iteration of digital solutions. • Lead or champion efforts to revise or create laws to enable e-signatures and digital transactions, as well as the implementation of trust frameworks and standards for digital identity and e-signatures. • Develop certification and qualification schemes for digital ID and trust service providers. Consumer Protection Authorities: • Enforce compliance with national consumer protection laws and regulations across the DPI ecosystem. • Promote consumer rights, educate, and raise awareness of the various stakeholders involved in DPI. • Facilitate complaint mechanisms and dispute resolution arising from the use of DPI-enabled services. • Advocate for consumer interests in policy development related to DPI. Data Protection Authorities: • Enforce DPI compliance with data protection laws and regulations. • Develop and publish guidelines to strengthen the normative framework for data protection. • Oversee data practices within the DPI ecosystem, investigate and address violations. • Promote awareness of public and private sector organizations involved in DPI about data protection best practices and inform data subjects about their rights and mechanisms to enforce them. • Oversee and resolve complaints lodged by data subjects including breaches and other violations of their individual rights. • Coordinate with relevant national and cross-border agencies to ensure a holistic approach to safeguarding data within the DPI ecosystem. Cybersecurity Authorities: • Set national or regional cybersecurity policies that protect and ensure trust in DPI. • Offer guidance and certification schemes to ensure that DPIs meet cybersecurity standards and can withstand emerging threats. • Coordinate response to cybersecurity incidents that impact DPI, ensuring quick recovery and continuity of services. ID and Civil Registration Authorities: • Implement foundational ID and civil registration systems as trusted sources of legal identity and vital records (e.g., birth, marriage, divorce, death). • Ensure universal access to ID and civil registration coverage among the population. • Add capabilities to existing ID and civil registration systems to operate as DPIs (e.g., opening up systems to allow third parties to verify data and credentials) • Potentially lead the development of online digital ID systems (can also be done by digital agency or private sector based on context). DIGITAL PUBLIC INFRASTRUCTURE AND DEVELOPMENT: A WORLD BANK GROUP APPROACH 61 DIGITAL TRANSFORMATION WHITE PAPER, VOLUME 1 Line Ministries: • Integrate DPI into sector-specific strategies and service delivery models. • Build new sector digital infrastructure following a DPI approach (modular, interoperable, etc.) so that it can easily integrate with existing or future DPI). • Collaborate with DPI providers to ensure sectoral needs are met. • Review laws and regulations for digital readiness and data sharing. • Engage in capacity building to leverage DPI for improved service outcomes. • Develop core registers using common data formats and interoperability standards. 62 V FORWARD LOOK This paper outlines a framework for understanding and core DPI systems, as well as the broader policy, technology, supporting the development of DPI as a driver of inclusive and capacity needed to build safe and inclusive DPIs and transformative development. Despite this potential, across a variety of contexts, including for low-income the successful implementation of DPIs requires a concerted and fragile, conflict-affected, and vulnerable countries. effort across government, the private sector, civil society, and • Building DPI champions and capacity: Providing knowl- the global community. Each country’s DPI and digitalization edge, training, and peer-exchange resources and support journey will be unique; however, there are some common to help build in-country capacity related to DPI, including considerations and lessons. This paper has provided insights fostering multi-stakeholder alignment and collaboration into these emerging good practices and also uncovered across the public and private sector and with civil society. areas where further research and guidance will be needed. • Strategies for sequencing and change management: The WBG’s Global DPI Program is a new cross-sectoral and Exploring optimal approaches to the timing and inte- multi-donor initiative to support countries in building safe, gration of DPI components relative to sector-specific inclusive, and transformational DPI. The program will build systems and services, including whether DPIs should be on the successes of the existing ID4D and G2Px Initiatives, established first or if sectoral use cases can be developed and other efforts including Project FASTT, expanding in scope concurrently and later integrated, and how to effectively to cover data sharing and additional use cases. It will bring manage change by overcoming institutional inertia and together teams across the WBG—including those working on vested interests. agriculture, digital transformation, financial inclusion, gender, governance, health, legal, private sector investment, research Implementing Safe and Inclusive DPI and data, social inclusion, and social protection—to harness multisector expertise and financing to support DPI and its use. • DPI legal and regulatory reforms: Supporting legal and regulatory reforms to ensure that DPI systems are The DPI Program will focus on developing policy-relevant implemented in a safe, inclusive, and sustainable manner. data and guidance, supporting country and regional clients, This could involve providing DPI-specific guidance on and engaging in global advocacy around practical strategy data privacy and protection, cybersecurity, and public questions. It will also support the design and implementation engagement to minimize risks to data privacy and exclusion. of next-generation DPI in line with good practices, including • Data sharing and governance frameworks and models:  diagnostics and assessments, technical assistance, capacity Developing guidance and frameworks for data sharing, building, and peer exchange. Priority areas for the WBG to including definitions, types, models, and operationaliza- bridge some of the knowledge gaps outlined in this paper tion, including those that are appropriate for different under the Global DPI Program will include: use cases (open data, public intent data, personal data, and more), and different contexts (for example, low Strengthening DPI Strategy connectivity or low-trust environments). • DPI diagnostics and maturity models: Developing diag- • Decentralized solutions for digital identity and data nostics and maturity models to assess the status quo of sharing in developing countries: Developing guidance DPI ecosystems across countries and identify areas for and support for the development of decentralized solu- investment. This could involve developing tools to assess tions for digital identity and data sharing, particularly in DIGITAL PUBLIC INFRASTRUCTURE AND DEVELOPMENT: A WORLD BANK GROUP APPROACH 63 DIGITAL TRANSFORMATION WHITE PAPER, VOLUME 1 developing countries. This includes a focus on wallet/ DPI systems in relation to sector-specific systems and VC implementations, including architectures that work services, required regulatory reforms by sector, ques- in online and offline environments and cases where tions on interoperability and data standards, and more. smartphone penetration is low. • Core government registries as foundations of DPI:  • DPI procurement, architecture, and financing: Devel- Exploring whether and how existing core government oping guidance on procurement processes, systems registries (such as for birth, death, marriage, land, business) architecture, and financing options for DPI, with a focus might be leveraged as foundational elements of data on understanding how different strategies (including the sharing and other DPI. This will involve examining how to use of DPGs) impact overall costs, capacity requirements, improve data quality, interoperability, and accessibility of time-to-deploy, sustainability, and potential for lock-in. these registries to support broader digital service delivery. This will involve exploring existing procurement and • Data collection and research on DPI:  Building the architecture models, identifying market and financing evidence through advanced data collection and research, gaps, and building capacity to manage procurement with a focus on measuring DPI gaps and progress, iden- and contracts effectively. tifying successful strategies for implementation, and • New forms of DPI: As countries advance in their digi- estimating the impact of DPI for people, governments, talization agendas and the concept of DPI matures, and businesses. additional types of core DPI may emerge. For example, some have argued for an additional category of DPI By combining financial resources with a strong knowledge focused on enhancing the discoverability of services and agenda and partnerships, the WBG and other development providers (such as through open protocols and APIs) to partners can help countries accelerate their digitalization improve public service delivery and enhance peer-to-peer through a DPI approach. While this paper has spelled out transactions, such as the Beckn Protocol (CDPI 2024b). some core lessons and success factors, each country will The World Bank will follow these developments and chart a unique digitalization journey based on their starting incorporate additional guidance on new DPIs as needed. point, available resources, and desired objectives. This will require dedicated champions in the public and private sector Adopting DPI for High-Impact Services to build, operate, and govern DPI systems , and to invest in broader digitalization across government and the economy. • Sec tor roadmap for use c ase integration and Through the Global DPI program, the WBG will continue to sequencing: Developing guidance on how to integrate support countries holistically on these journeys, including DPI into specific sectors (such as financial services, through thought leadership, research, global convening, social protection, health, agriculture, and public financial technical assistance, and financial support to build safe and management), including sequencing and retrofitting inclusive DPI under the Digital GCP and IDA21. 64 REFERENCES Alberto Di Iorio, Anneke Kosse, and Robert Szemere. 2024. “CPMI Brief No 3: Tap, click and pay: how digital payments seize the day”. February 2024. Bank for International Settlements’ Committee on Payments and Market Infrastructures (CPMI). Available at https://www.bis.org/statistics/payment_stats/commentary2402.pdf. Ardic Alper, O.P., Galicia Rabadan, G.A., Marin, G., Natarajan, H., Piveteau, T.Y., Ramteke, N.C., and Sarkar, A. 2023. “G20 Policy Recommendations for Advancing Financial Inclusion and Productivity Gains through Digital Public Infrastructure.” Washington, D.C.: World Bank Group. http://documents.worldbank.org/curated/ en/099092023121016458/P178703046f82d07c0bbc60b5e474ea7841. Bailur, S. and Esquivel Korsiak, V. 2019. Understanding People’s Experiences with Identification: A Guide for Qualitative End-User Research on ID. Washington, DC: World Bank Group.  http://documents.worldbank.org/curated/ en/795541561701481546/Understanding-People-s-Experiences-with-Identification-A-Guide-for-Qualitative-End- User-Research-on-ID Banco Central do Brasil. 2023. “Relatório de Economia Bancária” https://www.bcb.gov.br/content/publicacoes/ relatorioeconomiabancaria/reb2023p.pdf Bank of Thailand. 2024. “PS_PT_018 Use of PromptPay 1/.” Accessed on 19 August 2024 at https://app.bot.or.th/BTWS_ STAT/statistics/BOTWEBSTAT.aspx?reportID=921&language=ENG. Beriya, A. 2022. “India Digital Ecosystem of Agriculture and Agristack: An Initial Assessment.” ICT India Working Paper #68. https://csd.columbia.edu/sites/default/files/content/docs/ICT%20India/Papers/ICT_India_Working_Paper_68. pdf Casher, C., Metz, A., and Clark, J. 2024. “ID4D Global Dataset 2021: Volume 3 - Trends in Identification for Development.” Washington, DC: World Bank. https://documents.worldbank.org/en/publication/documents- reports/documentdetail/099031924132035631/p17634114229a80dc18ea11c4c279817517?_gl=1*123id7t*_gcl_ au*MTczNDYzMzQ0NS4xNzIyMDAyMzc5. Centre for DPI. 2024a. “Is my system a DPI?” DPI Wiki. Retrieved from https://docs.cdpi.dev/. Centre for DPI. 2024b. “Discovery & Fulfilment.” DPI Wiki. Retrieved from https://docs.cdpi.dev/. Centre for DPI. 2024c. “Identifiers & Registries.” DPI Wiki. Retrieved from https://docs.cdpi.dev/. Centre for DPI. 2024c. “eConsent.” DPI Wiki. Retrieved from https://docs.cdpi.dev/. Chowdhury, A. 2024. “Bangladesh’s “phygital public infrastructure” bridges DPI theory and practice.” GovInsider Asia, 5 October 2024. https://govinsider.asia/intl-en/article/bangladeshs-phygital-public-infrastructure-bridges-dpi-theory- and-practice. DIGITAL PUBLIC INFRASTRUCTURE AND DEVELOPMENT: A WORLD BANK GROUP APPROACH 65 DIGITAL TRANSFORMATION WHITE PAPER, VOLUME 1 Clark, J., Metz, A., and Casher, C. 2022. ID4D Global Dataset 2021: Volume 1 - Global ID Coverage Estimates. Washington, D.C.: World Bank Group. http://documents.worldbank.org/curated/en/099705012232226786/ P176341132c1ef0b21adf11abad304425ef. Committee for Payments and Market Infrastructures (CPMI) and International Organization of Securities Commissions (IOSCO), 2012. Principles for Market Infrastructures (PFMIs), Basel: Bank for International Settlements and Madrid: International Organization of Securities Commissions. CPMI and IOSCO, 2016. Guidance on cyber resilience for financial market infrastructures. Basel: Bank for International Settlements and Madrid: International Organization of Securities Commissions. Demirgüç-Kunt, A., Klapper, L., Singer, D., and Ansar, S. 2022. “The Global Findex Database 2021: Financial Inclusion, Digital Payments, and Resilience in the Age of COVID-19.” Washington, DC: World Bank. doi:10.1596/978-1-4648- 1897-4. Department of Home Affairs (DHA). 2020. Draft official identity Management policy, public consultation version. Republic of South Africa. https://www.gov.za/sites/default/files/gcis_document/202101/44048gon1425.pdf. Desai, V., and Clark, J. 2021. “10 principles for good ID: A 2021 refresh.” World Bank Voices Blog. https://blogs. worldbank.org/en/voices/10-principles-good-id-2021-refresh Desai, V., Marskell, J., Marin, G., and Varghese, M. 2023. “How Digital Public Infrastructure Supports Empowerment, Inclusion, and Resilience.” Digital Development (blog), March 15, 2023. https://blogs.worldbank.org/digital- development/how-digital-public-infrastructure-supports-empowerment-inclusion-and-resilience. Desai, V. T., Dolan, J. J., McGowan, K., Vora, P., Barzelay, A. M., Das, P. L., Satola, D., & Srinivasan, S. 2022. Unraveling Data's Gordian Knot: Enablers and Safeguards for Trusted Data Sharing in the New Economy. Washington, D.C.: World Bank Group. Retrieved from http://documents.worldbank.org/curated/en/863831612427670947/Unraveling- Data-s-Gordian-Knot-Enablers-and-Safeguards-for-Trusted-Data-Sharing-in-the-New-Economy. DIGG (Sweden Agency for Digital Government). 2020. “Swedish eID: Notification form for electronic identity scheme under Article 9(5) of Regulation (EU) No 910/2014.” Kingdom of Sweden. Available at https://ec.europa.eu/digital- building-blocks/sites/display/EIDCOMMUNITY/Sweden. Dobhal, A., & Pathak, D. 2023. "India's Farmers Are on the Cusp of an Agritech Revolution: AgriStack." World Economic Forum, November 14, 2023. Retrieved form: https://www.weforum.org/stories/2023/11/indias-farmers-are-on-the- cusp-of-a-technological-revolution-agristack/. Eaves, D. 2023. “Unpacking Digital Public Infrastructure and its Importance.” Presentation at the Global DPI Workshop, 12 September 2023, Washington, DC. https://thedocs.worldbank.org/en/ doc/98949920afb52c54cd4fc4dd15a02dbd-0050112023/original/1-1-TBS-Sept-11-DPI-presentation-edition.pdf. Eaves, D., Mazzucato, M. and Vasconcellos, B. 2024. “Digital public infrastructure and public value: What is ‘public’ about DPI?” UCL Institute for Innovation and Public Purpose, Working Paper Series (IIPP WP 2024-05). https://www.ucl. ac.uk/bartlett/public-purpose/ wp2024-05. Eichholtzer, M. 2022. “Guidance Note on Engaging Civil Society Organizations (CSOs) for Successful ID Systems” World Bank Group. https://documents1.worldbank.org/curated/en/099825009302229686/pdf/originalNames.pdf European Union. 2014. Regulation (EU) No 910/2014 of the European Parliament and of the Council of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv:OJ.L_.2014.257.01.0073.01.ENG. 66 European Union. 2024. Regulation (EU) 2024/1183 of the European Parliament and of the Council of 11 April 2024 amending Regulation (EU) No 910/2014 as regards establishing the European Digital Identity Framework. https:// eur-lex.europa.eu/eli/reg/2024/1183/oj/eng. G20. 2023a. “Digital Economy Ministers Meeting: Outcome Document & Chair’s Summary.” Bengaluru, Karnataka, 19 August, 2023. https://g7g20-documents.org/database/document/2023-g20-india-sherpa-track-digital- economy-ministers-ministers-language-g20-digital-economy-ministers-meeting-outcome-document-and-chai- r-summary#section-3. G20. 2023b. “G20 New Delhi Leaders’ Declaration.” New Delhi, India, 9-10 September 2023. https://www.mea.gov.in/ Images/CPV/G20-New-Delhi-Leaders-Declaration.pdf. Gelvanovska-Garcia, N., Mačiulė, V., and Rossotto, CM. 2024. Advancing Cloud and Data Infrastructure Markets: Strategic Directions for Low- and Middle-Income Countries. Sustainable Infrastructure Series. Washington, DC: World Bank. http://hdl.handle.net/10986/41587 GKV-Spitzenverband. Undated. “Statutory health insurance.” Accessed on 22 August 2024 at https://www. gkv-spitzenverband.de/english/statutory_health_insurance/statutory_health_insurance.jsp. GovStack Community of Practice. 2022. “GovStack Definitions: Understanding the Relationship between Digital Public Infrastructure, Building Blocks & Digital Public Goods.” May 2022. https://digitalpublicgoods.net/DPI-DPG-BB- Definitions.pdf. GovStack. 2024. “Digital Registries.” Building Blocks Specifications 1.0 Publication. Retrieved from https://govstack. gitbook.io/bb-digital-registries. Ingram, G and Vora, P. 2024. Ukraine: Digital Resilience in a Time of War. Working Paper #185. Brooking Institute. https:// www.brookings.edu/wp-content/uploads/2024/01/Digital-resilience-in-a-time-of-war-Final.pdf. Khoury, Z., Ko, Y.S., Eom, S.K., Park, K.C., Park, J.E., Cho, B., Lee, J., and Lesnichaya, Y. 2024. “Enabling Data-Driven Innovation: Learning from Korea’s Data Policies and Practices for Harnessing AI.” WBG Korea Office Innovation and Technology Notes. Washington, D.C.: World Bank Group. http://documents.worldbank.org/curated/ en/099516201122472656/IDU15a864e96181d3149fe1993916838604fcb49. Kumar R, Veer K. 2021. “How artificial intelligence and internet of things can aid in the distribution of COVID-19 vaccines.” Diabetes Metab Syndr. 2021 May-Jun;15(3):1049-1050. doi: 10.1016/j.dsx.2021.04.021. Lebbos, T.J., Esquivel-Korsiak, V, Clark, J. 2021. “ID Systems and SOGI Inclusive Design.” Washington, DC: World Bank. https://documents.worldbank.org/en/publication/documents-reports/documentdetail/803981634587620467/ id-systems-and-sogi-inclusive-design?_gl=1*1yen2x7*_gcl_au*MTczNDYzMzQ0NS4xNzIyMDAyMzc5. Makini F.M., Mose L.O., Kamau G., Mulinge W., Salasya B., Akuku B., and Makelo M. 2020. “The Status of ICT Infrastructure, Innovative Environment and ICT4AG Services in Agriculture, Food and Nutrition in Kenya” FARA Research Report. Vol 5(11)PP 75. Marin, G. and Palacios, R. 2022. “The Role of Digital in the COVID-19 Social Assistance Response. Washington, D.C.: World Bank Group.” http://documents.worldbank.org/curated/en/099830009302217091/ P1731660f8c52f062092ac00d53c648bac7. DIGITAL PUBLIC INFRASTRUCTURE AND DEVELOPMENT: A WORLD BANK GROUP APPROACH 67 DIGITAL TRANSFORMATION WHITE PAPER, VOLUME 1 Mbow, C., C. Rosenzweig, L.G. Barioni, T.G. Benton, M. Herrero, M. Krishnapillai, E. Liwenga, P. Pradhan, M.G. Rivera- Ferre, T. Sapkota, F.N. Tubiello, Y. Xu. 2019. “Food Security,” In: Climate Change and Land: an IPCC special report on climate change, desertification, land degradation, sustainable land management, food security, and greenhouse gas fluxes in terrestrial ecosystems [P.R. Shukla, J. Skea, E. Calvo Buendia, V. Masson-Delmotte, H.-O. Pörtner, D.C. Roberts, P. Zhai, R. Slade, S. Connors, R. van Diemen, M. Ferrat, E. Haughey, S. Luz, S. Neogi, M. Pathak, J. Petzold, J. Portugal Pereira, P. Vyas, E. Huntley, K. Kissick, M. Belkacemi, J. Malley, (eds.)]. https://doi. org/10.1017/9781009157988.007. Metz, A., Casher, C., and Clark, J. 2024. “ID4D Global Dataset 2021 : Volume 2 - Digital Identification Progress & Gaps.” Washington, DC: World Bank. https://documents.worldbank.org/en/publication/documents-reports/ documentdetail/099020824141510923/p176341192f2c50e11bc5619be95c4fb2ed?_gl=1*bwlikn*_gcl_ au*MTczNDYzMzQ0NS4xNzIyMDAyMzc5. Mifiel. 2024. “Infografía – ¿Quién tiene FIEL (Firma Electrónica Avanzada)?” Accessed on 19 August 2024 at https://blog. mifiel.com/quien-tiene-fiel/. Mittal, A. 2022. “Catalog of Technical Standards for Digital Identification Systems.” Washington, DC: World Bank Group. http://documents.worldbank.org/curated/en/707151536126464867/Catalog-of-Technical-Standards-for-Digital- Identification-Systems/. OECD. 2024. “Developing scalable and secure digital public infrastructure”, in Government at a Glance: Latin America and the Caribbean 2024. Paris: OECD Publishing. https://www.oecd-ilibrary.org/governance/government-at-a-glance- latin-america-and-the-caribbean-2024_4abdba16-en. Porteous, D. 2023. “Is DPI a useful category or a shiny new distraction?” Working Paper. https://www.integralsolutionists. com/is-dpi-a-useful-category-or-a-shiny-new-distraction. Public Digital. 2023. “Show the Thing 5: Uruguay (AGESIC) - Digital ID and digital signature.” Accessed on 19 August 2024 at https://public.digital/pd-insights/blog/2023/11/show-the-thing-5-uruguay-agesic-id-uruguay-y-firma-gub-uy. Reserve Bank of India. 2024. “Payment System Indicators.” Accessed on 19 August 2024 at https://www.rbi.org.in/Scripts/ PSIUserView.aspx?Id=22. Sarkisyan, S. 2024. “Instant Payment Systems and Competition for Deposits”, in Jacobs Levy Equity Management Center for Quantitative Financial Research Paper, Available at SSRN: https://ssrn.com/abstract=4176990 or http://dx.doi. org/10.2139/ssrn.4176990 Silva, M.C., Bianchi, A.G.C., Oliveira, R.A.R. and Ribeiro, S.P. 2022. "Designing a Multiple-User Wearable Edge AI system towards Human Activity Recognition," 2022 XII Brazilian Symposium on Computing Systems Engineering (SBESC), Fortaleza/CE, Brazil, 2022, pp. 1-8, doi: 10.1109/SBESC56799.2022.9964915. Tullis, C., Constantine, N., Cooper, A. 2024. “Electronic Signatures: Enabling Trusted Digital Transformation.” Digital Public Infrastructure Policy Note Series. Washington, DC: World Bank. https://hdl.handle.net/10986/42186. Tullis, C and Black, D. 2025. “Public Key Infrastructure: Implementing High-Trust Electronic Signatures.” Digital Public Infrastructure Policy Note Series. Washington, DC: World Bank. http://hdl.handle.net/10986/42663. Tullis, C. Forthcoming. “Trusted Data Sharing: Governing Data Reuse and Value Creation.” Washington, DC: World Bank. 68 United Nations (UN). 2023. “Extreme Poverty in Developing Countries Inextricably Linked to Global Food Insecurity Crisis, Senior Officials Tell Second Committee.” Seventy-eighth Session, 16th & 17th Meetings (AM & PM), GA/EF/3590, 11 October 2023. UN Press Release. https://press.un.org/en/2023/gaef3590.doc.htm#:~:text=Agriculture%2C%20 being%20the%20most%20important,families%20in%20the%20agriculture%20sector%E2%80%9D. UN Office of the Secretary-General’s Envoy on Technology (UNOSET) and UNDP. 2024. “The Universal Digital Public Infrastructure Safeguards Framework.” https://dpi-safeguards-framework.org/frameworkpdf. UNCITRAL. 2023. “UNCITRAL Model Law on the Use and Cross-border Recognition of Identity Management and Trust Services.” Vienna, Austria: United Nations. https://www.un-ilibrary.org/content/books/9789210028530. Varma, P., Matthan, R., Chaudhuri, R., and Madhukar, C.V. 2024. “The Future of Digital Public Infrastructure: A Thesis for Rapid Global Adoption.” Carnegie India. https://carnegie-production-assets.s3.amazonaws.com/static/files/The_ Future_of_Digital_Public_Infrastructure-_A_Thesis_for_Rapid_Global_Adoption-1.pdf. World Bank. 2016. “World Development Report 2016: Digital Dividends.” Washington, DC: World Bank. https://www. worldbank.org/en/publication/wdr2016. World Bank. 2018. “Private Sector Economic Impacts from Identification Systems.” Washington, D.C. : World Bank Group. http://documents.worldbank.org/curated/en/219201522848336907/Private-Sector-Economic-Impacts-from- Identification-Systems. World Bank. 2019. “ID4D Practitioner’s Guide.” Washington, DC: World Bank. https://id4d.worldbank.org/guide. World Bank. 2020. “Creating Disability Inclusive ID Systems.” Washington, DC: World Bank. https://documents.worldbank. org/en/publication/documents-reports/documentdetail/967741605683569399/creating-disability-inclusive-id- system?_gl=1*1yen2x7*_gcl_au*MTczNDYzMzQ0NS4xNzIyMDAyMzc5 World Bank. 2021a. “World Development Report 2021: Data for Better Lives.” Washington, DC: World Bank. https://www. worldbank.org/en/publication/wdr2021 World Bank. 2021b. “Considerations and Lessons for the Development and Implementation of Fast Payment Systems: Main Report.” Washington DC: World Bank. https://fastpayments.worldbank.org/sites/default/files/2021-11/ Fast%20Payment%20Flagship_Final_Nov%201.pdf. World Bank. 2022a. “A Digital Stack for Transforming Service Delivery ID-Payments and Data Sharing.” Washington, D.C.: World Bank Group. http://documents.worldbank.org/curated/en/099755004072288910/P1715920edb5990d60b83 e037f756213782. World Bank. 2022b. “Federated Ecosystems for Digital ID: Current Approaches and Lessons.” Washington, DC: World Bank. https://documents1.worldbank.org/curated/en/099745012232218303/pdf/P17159208cf1d501a0af6f001e4852 997fc.pdf. World Bank. 2022c. “Next Generation G2P Payments : Building Blocks of a Modern G2P Architecture.” Washington, DC: World Bank. https://documents.worldbank.org/en/publication/documents-reports/ documentdetail/099600110202238143/p173166068e4220430a0ff03279b01c83db. World Bank. 2022d. “Focus Note: Messaging Standards in Fast Payments” in the World Bank Fast Payments Toolkit. Finance, Competitiveness, and Innovation, Payment Systems Development Group. Washington, DC: World Bank. https://fastpayments.worldbank.org/sites/default/files/2022-03/Messaging%20Standards_Final.pdf. DIGITAL PUBLIC INFRASTRUCTURE AND DEVELOPMENT: A WORLD BANK GROUP APPROACH 69 DIGITAL TRANSFORMATION WHITE PAPER, VOLUME 1 World Bank. 2023. “Feature Story: Restoring Hope in Conflict-torn Northern Mozambique: Identification Documents and Livelihoods.” World Bank. https://www.worldbank.org/en/news/feature/2023/08/09/restoring-hope-in-conflict-torn- afe-northern-mozambique-identification-documents-and-livelihoods. World Bank. 2024a. Digital Progress and Trends Report 2023. Washington, DC: World Bank. World Bank. 2024b. “Lebanon Digital ID Use Cases.” Washington, DC: World Bank. https://documents1.worldbank.org/ curated/en/099041124084041172/pdf/P1809801acb17a05c1b7f815a1a68051fa9.pdf World Bank. 2024c. “Putting People at the Center of Digital Public Infrastructure (DPI): Annual Report 2023. Washington, DC: World Bank Group. http://documents.worldbank.org/curated/en/099647503042425828/ IDU1a9d1a6be130dc148e6193181cf9d26959fb9 World Bank. 2025. “Project FASTT – Cyber risk in Fast Payment Systems”. Washington, DC: World Bank Group. World Bank and Inter-American Development Bank (IADB). 2024. “Unlocking the Potential of Digital Public Infrastructure (DPI) in Latin America and the Caribbean (LAC): A Region-Specific Perspective.” A World Bank-IADB Technical Note. 70 DIGITAL PUBLIC INFRASTRUCTURE AND DEVELOPMENT: A WORLD BANK GROUP APPROACH 71 DIGITAL TRANSFORMATION WHITE PAPER, VOLUME 1 72