NADRA Verisys: What It Is, Who Can Use It and What the OTP Means (2026 Guide)

NADRA

Last Updated: October 2026

Verisys is NADRA’s web portal for checking a CNIC, NICOP or POC number with the cardholder’s consent, which the cardholder gives as a one-time password (OTP). NADRA provides it to institutions through its Nishan Pakistan portal. The FAQ there names government and regulated entities and lists a charge of Rs 35 for the private regulated sector and Rs 25 for government and law enforcement agencies. NADRA’s pages describe no Verisys service for individuals, so on what NADRA publishes a person cannot order a check on someone else. If you receive an OTP for a NADRA verification, it is your consent, and you should give it only to an institution you asked to verify you.

This guide uses NADRA’s Verification Services page, its media release of 10 February 2026, the public pages and sample agreement of the Nishan Pakistan portal, the Regulations NADRA notified on 28 July 2026, the NADRA Ordinance, and 2023 reports of NADRA’s consent service. We did not sign in to any NADRA portal or request a verification.

What Verisys is

NADRA’s Verification Services page says NADRA extends identity verification to the public and private sector under Section 7 of the NADRA Ordinance, 2000. It describes Verisys as a web portal for consent-based verification: the cardholder gives an OTP, and the client can instantly verify a CNIC, NICOP or POC number. NADRA’s home page adds that Verisys works through web and API access. Its release of 10 February 2026 calls Verisys a demographic and identity verification service and says digitally onboarded entities, among them banks, microfinance banks, electronic money institutions, non-banking financial institutions and telecommunication companies, can use it alongside multi-biometric verification APIs, a Proof-of-Life API and single sign-on.

Service	What NADRA says	What goes in	What comes back
Verisys	A web portal for citizen consent (OTP) based verification of CNIC, NICOP and POC numbers.	The CNIC number, the date of issuance and the citizen’s consent as an OTP.	A pictorial display of CNIC-borne information.
Biometric Verification (BIOSYS) and MBVS	Matches fingerprints and a photograph with the CNIC, with instant results. The MBVS API adds facial recognition to fingerprint verification.	The CNIC number, plus fingerprint and photograph.	A verification status, Yes or No, or approved data fields.
Batch verification (API based)	Bulk biometric verification for organisations with large backlogs.	Not listed.	Not listed.
Verification through e-Sahulat	Biometric verification extended through the franchise network, so citizens can verify identity across Pakistan.	Not listed.	Not listed.

NADRA’s page lists SMS among its verification services but gives no short code. Our biometric verification guide covers the fingerprint check applicants meet at a NADRA centre, which is a different thing from a Verisys check.

Who can use Verisys

The Nishan Pakistan FAQ says all government and regulated entities that hold a licence from their regulator are eligible to apply for verification services. It describes two roles. A service provider can only be a government entity. A subscriber is a government or regulated entity acquiring verification services for KYC and verification purposes. The Regulations of 28 July 2026 are broader on paper. They define a requesting entity as any government, semi-government or private entity that applies for access, and split it into regulated entities, which a sectoral regulator licenses or supervises, and non-regulated entities, whose compliance period is set in the services agreement. Both texts speak of entities. Neither describes an individual applicant.

• Sign-in. An entity creates its account on Nishan Pakistan through single sign-on with a registered PakID account.
• Documents. The FAQ lists the NTN or FTN certificate, incorporation certificate, company profile, Form-29, Form-9 or Form-II, Form-A, the licence issued by the regulator, a confidentiality undertaking, a vendor undertaking, a cloud hosting SLA, a network diagram, a cyber security evaluation report, a VAPT report and the memorandum and articles of association.
• Vetting. NADRA’s Nishan governance page says its Projects division reviews the legal basis and use case and defines the service, data fields and pricing, its Legal division drafts the service agreement, and its Information Security division audits the entity’s infrastructure.
• Time. Scanned copies are accepted to start approval, and the agreement and affidavits must also be sent in original. NADRA says onboarding takes 20 working days at its end and that the agreement cannot be amended afterwards.

What it costs

The Nishan Pakistan FAQ lists these service charges. They are what institutions pay, and the FAQ lists no charge for the citizen who gives consent.

Service	Charge (Rs)
Verisys	35 for the private regulated sector, 25 for government and law enforcement agencies
Branch banking	45
BIOSYS for digital onboarding	45
Branchless banking	10 for a mobile wallet account, and 6, 4 and 2 for over-the-counter transactions
BIOSYS for walk-in customers or for an ATM	10
BIOSYS, generic	10 for a standard yes or no answer, and 2 for each additional field
BIOSYS, standard	10
ID verification, bulk or batch	10

The FAQ gives no unit for the figures. NADRA’s sample agreement leaves the rate blank, bills monthly for the hits an institution has used, and keeps a 90 day log of each “successful transaction”, which it defines to count whatever the record status and whatever the accuracy of the input. The sample also asks for a refundable security deposit set at NADRA’s discretion and says charges can be revised by mutual consent.

What the OTP means for you

NADRA’s Nishan governance page says no data is shared without explicit, informed citizen consent. The mechanism was announced in March 2023 as “Ijazat Aap Ki”. Geo reported that from 2 March 2023 all verification transactions would need a six digit passcode sent to the citizen’s registered mobile number, that the passcode would be treated as the citizen’s consent to the verification, and that NADRA collects mobile numbers when an ID card is registered. NADRA also launched an SMS service for citizens to enrol their mobile numbers, and the Digital Rights Foundation reported the code as 8009. NADRA told the Foundation that the service needs no pre-registration, that it sends the code to the citizen’s recently reported number at the time of verification, and that more than 250 entities were moved onto it in the first phase.

NADRA’s current website does not mention “Ijazat Aap Ki” or the enrolment code, so confirm with NADRA on 1777 before you send your CNIC number to any short code. Our helpline guide lists every channel.

The Regulations of 28 July 2026 say their purposes include ensuring that the data subject’s consent, where applicable, is obtained before access is started. Their Schedule VIII sets out Assurance and Trust Levels from ATL-0 to ATL-4. Consent is “embedded” at ATL-0, “mandatory” from ATL-1 to ATL-3 and “explicit” at ATL-4, and every level is marked “Yes” for the availability of data access or verification history to the data subject. We could not tell from the pages we read which level Verisys falls under, or where a citizen would see that history.

NADRA’s sample Verisys agreement binds the institution. The client states that, wherever required, it has and will obtain the necessary written consents of the cardholders, may use the output only for the purpose named in the agreement, and, under the information security annex for API-based services, must not retain, store or archive the data it receives and must delete it once the purpose is met. It is a blank template, and a signed agreement may differ.

Can an individual or a small business get a Verisys check?

Not on anything NADRA publishes. Section 7(1)(i) of the Ordinance provides for access to the National Data Warehouse for “government, semi-government and private institutions”, in the manner and for the fee set by regulations. Section 28 punishes publishing or passing on information known to have been disclosed in breach of the Ordinance, and an employee’s unauthorised disclosure, with up to five years in prison, a fine of up to one million rupees, or both. Section 29 provides rigorous imprisonment of up to fourteen years and a fine of not less than one million rupees for breaching the data security regulations. NADRA’s Nishan governance page adds that misuse can bring contract termination and blacklisting, penalties under Section 30(1)(f) of the Ordinance, and prosecution under the Prevention of Electronic Crimes Act, 2016.

NADRA’s Domain Authenticity Policy says its official website is accessible only through its www address on the nadra.gov.pk domain, that every subdomain of nadra.gov.pk is NADRA’s, and that a site outside that domain is not an official NADRA website. A page that sells Verisys reports from any other address is not NADRA’s. The policy lists nine subdomains and does not list nishan.nadra.gov.pk, although NADRA’s own site links to it, so check the address ends in nadra.gov.pk rather than whether it is on the list.

What a citizen can do is verify their own identity. NADRA lists biometric verification among the things its PakID app does, and its Verification Services page says biometric verification is extended through e-Sahulat franchises, which our e-Sahulat guide describes. Our guides to checking CNIC status and to SIMs registered on your CNIC cover two checks people often have in mind.

Older guides describe a different service

ProPakistani’s and Zameen’s guides tell individuals to create an account at id.nadra.gov.pk/e-id, choose Verisys Services, deposit Rs 300 by card and accept a declaration, or to send a CNIC number by SMS to 7000 for Rs 10. NADRA’s current pages say nothing like that. The Verisys charges in its Nishan FAQ are Rs 35 and Rs 25 and apply to institutions, and the only place its website mentions 7000 is the Projects page, for verifying holders of Proof of Registration cards, which is not a CNIC service.

The old portal is partly still there. As we checked on 6 October 2026, the public addresses we tried on id.nadra.gov.pk, including its tracking address, redirect to NADRA’s homepage, while id.nadra.gov.pk/e-id/ loads a landing page with Register and Login buttons that still invites online applications. NADRA’s main website does not link to it. We did not sign in, so we cannot say whether a Verisys option remains behind the login. Treat the Rs 300 and the 7000 code as unconfirmed.

Where NADRA’s pages differ

• Who is eligible. The Nishan FAQ names government and regulated entities with a regulator’s licence. The Regulations also define non-regulated private entities.
• Consent. The governance page says no data is shared without explicit, informed consent. The Regulations say consent is obtained where applicable.
• The earlier data sharing rules. The Nishan About page and the Regulations call them the NADRA (Data Sharing) Regulations, 2024. NADRA’s release of 10 February 2026 calls them the 2025 Regulations. The 2026 Regulations say they replace the 2024 ones.
• When Nishan Pakistan started. NADRA’s homepage says it was launched in 2025, and its release announcing it is dated 10 February 2026.

What we could not confirm

• Anything for individuals behind the id.nadra.gov.pk login. We did not sign in or create an account.
• The fields a Verisys check shows. NADRA calls the output a pictorial display of CNIC-borne information and does not list the fields.
• Whether the 2023 enrolment code still works. It is not on NADRA’s current website.
• Most of the Regulations. They are a scanned Gazette notification of 59 pages, S.R.O. 1172(I)/2026. We read pages 1 to 12 and 57 to 59, not the pages between.
• Signed agreements. We read NADRA’s blank sample, not any institution’s agreement.

Common mistakes

• Sharing an OTP with someone who calls or messages you. It is your consent to a verification.
• Paying a website or an agent for a Verisys report. NADRA publishes no Verisys service for individuals and no Verisys certificate.
• Following older instructions. The Rs 300 deposit and the 7000 SMS are not in NADRA’s current pages for CNICs.
• Confusing Verisys with biometric verification. Verisys works from the CNIC number and an OTP. Biometric verification matches fingerprints, a photograph or a face.
• Trusting an address because it looks like NADRA’s. Only subdomains of nadra.gov.pk are official.

Sources: the service descriptions and the e-Sahulat extension from NADRA’s Verification Services page, its home page and its release of 10 February 2026; the eligibility, roles, documents, inputs and outputs, charges and onboarding terms from the Nishan Pakistan FAQ, the consent and misuse statements from its governance page and its About page, and the sample Verisys master agreement from its Resources page; the definitions, purposes and Schedule VIII from the NADRA (Requisite Access to National Data Warehouse) Regulations, 2026; Sections 7, 28 and 29 from the National Database and Registration Authority Ordinance, 2000; the web addresses from NADRA’s Domain Authenticity Policy; the 2023 consent service from Geo and the Digital Rights Foundation; and the older instructions from ProPakistani and Zameen. All read between 3 and 6 October 2026. NADRA can change these without notice.

Frequently Asked Questions

Quick answers to common questions about this topic.