Cyprus’s national electronic identity (e-ID) project is facing mounting scrutiny after the Auditor General told Parliament that the procurement process gave JCC Payment Systems Ltd. a significant competitive edge, raising questions of transparency, governance, and potential conflicts of interest.

>>Audit Office Exposes Flaws in €3.85m Direct Award for Cyprus e-ID Project<<

Briefing the House Audit Committee, Auditor General Andreas Papaconstantinou explained that the first contract—worth €3.85 million for 30,000 e-IDs—was awarded directly to JCC. The broader framework covers the initial 100,000 cards, with the project expected to reach €40–€50 million as it expands nationwide.

Although EU-licensed providers exist, Cyprus’s legal requirements—including the need for local offices and infrastructure—narrowed the field. Combined with delays since 2021, this created a “technical restriction” that left JCC as the sole eligible bidder when the tender was launched in October 2024.

Papaconstantinou argued that the Deputy Ministry could have used a voluntary prior transparency procedure to allow objections before signing the contract. He also highlighted a risk of “special relationship,” as Deputy Minister of Research, Innovation and Digital Policy Nikodimos Damianou previously served as JCC’s executive director.

While stressing that all actions were lawful, the Auditor General said additional safeguards should have been applied to avoid perceptions of bias. He also questioned the role of the Cabinet, noting that the Council of Ministers should not decide on a specific contractor, as this could pressure the Ministry’s Tenders Board.

Deputy Minister Damianou rejected any suggestion of wrongdoing, outlining the project’s timeline:

• 2017–2019: policy planning with Estonian advisers

• 2018: e-signature legislation adopted

• 2019: JCC licensed as a Qualified Trust Service Provider

• 2020: government decision for an open licensing framework

• 2021: law enabling e-IDs passed

He emphasized that the framework was open for four to five years, allowing other companies to enter the market. Many EU countries, he added, operate e-ID systems with a single provider.

The government decided to subsidize the first 30,000 cards, making them free to citizens. According to Damianou, this required Cabinet approval for the subsidy, while the Tenders Board handled the award itself.

So far, only 7,000–7,600 e-IDs have been issued—well below the 30,000 target. MPs pressed whether JCC would still receive the full €3.85 million. The Auditor General suggested the contract could be extended instead.

By law, the maximum citizen fee is €50 for a three-year validity (two certificates), lower than the €100–€150 charged in some EU states. Damianou said negotiations brought the internal benchmark down to €38–€39 per card.

Opposition MPs expressed deep concerns over transparency and conflicts of interest:

• AKEL’s Christos Christofides questioned Cabinet’s involvement and suggested possible criminal liability.

• DISY’s Savia Orphanidou warned that explicitly naming JCC in Cabinet decisions could compromise the procedure.

• DIPA’s Alekos Tryfonides called for Attorney General and MOKAS review.

• VOLT’s Alexandra Attalidou and AKEL’s Irini Charalambidou urged looser local-presence rules and a voluntary transparency notice to attract more EU providers.

Audit Committee chair Zacharias Koulias demanded full documentation and warned that subscription-style fees might deter citizens, undermining value for money.

The Deputy Ministry countered that providers had ample time to establish a presence in Cyprus and that local infrastructure is crucial for national security and data sovereignty. Officials are considering a three-year contract extension while ramping up public information campaigns to boost uptake.

For now, JCC’s lead in the first 100,000 cards leaves it well-positioned for future phases—an advantage the Auditor General believes could have been avoided with earlier, more transparent procurement choices.