Overview
ISO 24366:2021 - Financial services - Natural person identifier (NPI) defines a machine-readable, unambiguous natural person identifier and the associated reference data for uniquely identifying a natural person in financial transactions without exposing personal identifying information. The standard is intended to support global interoperability, persistence, extensibility and privacy protection across cross‑border financial services and regulatory use cases.
Key topics and technical requirements
- NPI format: 15 characters total - 13 upper‑case alphanumeric characters (A–Z, 0–9) followed by 2 numeric check digits (format: 13!c2!n).
- Check digit algorithm: Uses ISO/IEC 7064 (MOD 97‑10 simplified) procedure:
- Convert letters in the 13‑character string to digit pairs (A=10 … Z=35).
- Append two zeros, perform a Euclidean division by 97, subtract remainder from 98 to get the check digit pair.
- Valid check pairs range from 02 to 98; a correctly formed NPI converted to numbers should yield remainder 1 when divided by 97.
- NPI data record: Defines required and optional reference attributes (see Table 1), such as:
- Legal name (surname, given name, middle names), alternative names and name types
- Date of birth (ISO 8601 representation), country of birth (ISO 3166‑1)
- Citizenship/nationality (ISO 3166‑1), physical addresses, phone numbers, emails
- Jurisdictional IDs (type, value, jurisdiction), gender, optional biometrics
- Record status flags, validation flags and validation sources
- Design principles: No embedded intelligence in the code, global uniqueness, persistence, extensibility and interoperability with existing financial reference data.
Practical applications
- Privacy-preserving identity reference in KYC, AML and beneficial ownership reporting where regulators or firms need to link persons without sharing raw personal data.
- Cross‑border transaction processing and reconciliation where national identifiers are insufficient or incompatible.
- Enabling straight‑through processing, cross‑jurisdiction systemic risk monitoring and reduced operational friction between banks, payment processors and regulators.
- Identity management for employees and customers while minimizing exposure of personal information.
Who should use this standard
- Banks, payment service providers, fintechs and custodial institutions
- National and international regulators and supervisory bodies
- Identity providers, trust frameworks and AML/KYC tooling vendors
- Standards implementers and architecture teams building global reference data systems
Related standards
Keywords: ISO 24366, NPI, natural person identifier, financial services, machine‑readable identifier, check digits, MOD 97‑10, privacy, KYC, AML, ISO 3166, LEI.