Who authorizes Nigeria’s SIM outage fallback?

Summary

Operators must test the NIMC verification API every 10 minutes and report failures to the NCC each week.
After a week below the 99% availability target, a limited-access activation route can allow calls and SMS while keeping mobile data off.
One appendix says the NCC triggers the route by email; another gives authority to an unnamed “relevant governance body.”

A Nigerian subscriber can be held at the edge of a mobile network by an identity check. The country’s August 2026 SIM-registration rules offer a narrow way through when the National Identity Management Commission’s verification service is down. The exception is precise about clocks and fuzzy about the hand that opens it.

The rules set expected NIN-verification availability at 99%. Communications service providers must probe the NIMC API at 10-minute intervals, record the result and failure reason, then send weekly service-level statistics to the Nigerian Communications Commission (NCC). If availability stays below the agreed threshold for a week and the condition produces a priority-one outage, Appendix 3 says the NCC assesses the data and emails providers to trigger a Limited Access activation workaround for SIM activations only. The NCC’s August 2026 rules set out the sequence in Appendices 3 and 4.

Then Appendix 4 changes the description. Its note says providers are authorized to trigger the same workaround by the “relevant governance body.” The rule names no members, chair, delegation or decision record for that body. It never says whether this is the NCC under another label or a separate authority.

That gap matters to the subscriber who has to wait for the identity service. Before Limited Access, the rules allow only SMS or a provider message needed to confirm NIN verification. After the workaround is authorized, the subscriber may receive calls and SMS and call emergency numbers or the provider’s call centre. Mobile data remains unavailable. The route lasts 14 days or until the verification service returns and stays at its expected level for a week, subject to Commission authorization.

The NCC therefore has a strong hand in the process, even if the wording leaves the formal trigger unclear. The rules call subscriber registration the Commission’s “sole duty.” NIMC verifies identity against the NIN. Providers collect and update subscriber records, operate the probes, and supply evidence about API performance. Once Limited Access begins, providers also send the affected subscriber’s NIN and mobile number to the NCC for monitoring. Elsewhere, the rules direct subscriber demographics and verified biometrics to an NCC central database on an interim basis pending a new data dictionary.

The customer-facing control is thinner. The rules require a dedicated customer-care line for complaints arising from self-KYC use in SIM–NIN linkage, but the cited clause sets no response deadline. A failed API has a sampling interval, a reporting schedule and a return-to-service test. A subscriber disputing a mismatch gets a phone line, without a clock in this document.

The published rules provide a 99% target but no observed NIMC API uptime series; a public weekly record would show whether this fallback is exceptional or routine. The authority question is more immediate. A provider can prove that the threshold was crossed. It still needs one unambiguous answer about who can authorize service on the restricted lane.

The NCC should reconcile the two appendices in one public procedure: name the decision-maker, define the evidence it receives, state when its email takes effect, and tell subscribers what service they will have while the identity check is unavailable. The rule already measures the outage. It should make the decision just as visible.