cnbcindonesia.com via Reddit

Indonesia mandates AI face-scan for new SIM cards

surveillance regulation facial-recognition biometrics surveillance telecom-regulation

Key insights

  • Starting July 1, 2026, Indonesia requires AI facial recognition for every new SIM card registration under Regulation No. 7 of 2026.
  • Each Indonesian identity is capped at three registered SIM numbers, blocking the bulk-acquisition tactic used by fraud operations.
  • At 270 million people, this ranks among the largest government AI biometric mandates applied at the telecom infrastructure layer globally.

Why this matters

Indonesia's mandate is the first proof-of-concept for embedding AI biometric identity directly into telecom infrastructure at national scale, and every large government watching will benchmark their own plans against this deployment. The architecture linking a national ID register to real-time biometric data at retail points of sale is replicable infrastructure that can be adopted across Southeast Asia, Africa, and Latin America within 18 to 36 months. For founders and practitioners building identity, fraud-prevention, or KYC systems, this deployment will generate the first large-scale ground-truth dataset on whether biometric-gated SIM registration actually reduces telecom fraud.

Summary

Indonesia is rolling out mandatory facial recognition for every new SIM card purchase starting July 1, 2026, in one of the world's largest AI biometric deployments at the telecom layer. Under Regulation No. 7 of 2026, citizens must link their National Identity Number to a face scan at point of sale. Foreign nationals present passports. Each identity is capped at three numbers. Essentially: (Indonesia's Ministry of Communication, national telcos) are deploying a biometric checkpoint across 270 million people. - The prior NIK-only system was exploited via borrowed or stolen IDs to acquire SIM cards for fraud at scale. - The July 1 mandate covers all carriers and all retail points of sale simultaneously, with no phased rollout announced. At this scale, Indonesia's deployment becomes a live template for AI-powered telecom identity infrastructure that other governments can benchmark and adopt directly.

Potential risks and opportunities

Risks

  • Indonesian telcos (Telkomsel, Indosat Ooredoo Hutchison, XL Axiata) face significant capex pressure to deploy biometric hardware at every point of sale before the July 1 deadline, with limited time to test at national scale.
  • A breach of the unified NIK-biometric database would expose the facial geometry of hundreds of millions of Indonesians, and unlike passwords, biometrics cannot be reissued or changed.
  • Populations unable to meet the NIK or passport requirement, including undocumented residents and some rural communities, risk effective exclusion from mobile connectivity, creating legal and humanitarian exposure for the Indonesian government.

Opportunities

  • Biometric identity hardware and software vendors (NEC, Thales, IDEX Biometrics, Aware Inc.) are positioned to win significant contracts as Indonesian telcos rush to meet the July 1 mandate.
  • Fraud prevention and KYC platform providers (Jumio, Onfido, Sumsub) can use Indonesia's national-scale deployment as a reference case to accelerate sales in comparable telecom markets across Southeast Asia and Africa.
  • Indonesian domestic systems integrators with existing government relationships, particularly those already embedded in the NIK infrastructure, gain leverage as preferred implementation partners for the biometric rollout.

What we don't know yet

  • Which AI facial recognition vendor or vendors supply the biometric system, as no supplier is identified in Regulation No. 7 or in public reporting as of May 2026.
  • Whether the three-SIM cap applies retroactively to existing registered numbers or only to new registrations after July 1, 2026.
  • How the Ministry of Communication plans to handle SIM registration in rural and remote areas where deploying biometric hardware at every retail point by July 1 may not be feasible.