Government & Public Services Compliance in Armenia

Armenia is in the middle of a document reset. The Law on Identification Documents replaced the separate passport and identity card laws on 30 October 2026, and issuance of the new biometric passports and identity cards began on 1 November 2026 through service centres run by a private partner, HayPass. Documents issued under the old laws stay valid until they expire, so two generations will circulate for years.

The Migration and Citizenship Service of the Ministry of Internal Affairs decides on identity documents. The Yes em platform belongs to the Information Systems Agency of Armenia (ISAA), EKENG is the certification authority, and a new autonomous Information Systems Regulatory Commission organises the national identification layer and sets security requirements for state databases.

The biggest constraint for anyone building digital public services is enrolment: every credential that unlocks Yes em starts with an in-person step.

1. Who regulates this sector

The Law on Identification Documents lets the state delegate parts of the application process to a private partner selected under public-private partnership rules (art. 13 and 14). The partner is HayPass CJSC; Government Decision 604-A of 15 May 2025 approved a change in the shareholding of its consortium, selected under the programme approved by Decision 2346-A of 28 December 2023.

2. Licensing and authorisation

Certification authorities

Certification centres may be accredited by the body the Government authorises (Law on Electronic Document and Electronic Digital Signature, art. 15). Government Decision 1015-N of 24 July 2025 set the procedure and named the Ministry of High-Tech Industry (now the Ministry of High-Tech Industry and Artificial Intelligence) as the accrediting body. Mobile signature operators must keep their systems in Armenia (Decision 572-N, annex 2, pt. 10).

Connecting to state databases

A resident legal entity or investment fund may connect to state and local government databases only after the operator (EKENG) approves an application and signs a contract, and only if it meets minimum security requirements (Decision 1849-N, pt. 13). The application lists each database, data type, purpose and use; the operator approves it within two weeks where technically possible, unless it doubts that lawfulness or proportionality will be respected (pt. 15 and 16).

Private partner for documents

The private partner may receive applications, collect data from state databases, check documents and send notices, but may not collect, store or use any other personal data, and may use what it collects only to issue identity documents (Law on Identification Documents, art. 14).

3. Identity framework (AML rules do not apply)

Ministries, agencies and local governments are not reporting entities under the Law on Combating Money Laundering and Terrorism Financing (art. 3(1)(4)), so they carry no customer due diligence obligation. Two state bodies are listed, but only for suspicious transaction reporting, the confidentiality of reports and record-keeping: the state register of legal entities and the body keeping the unified real estate cadastre. Senior public officials, including heads of local government and board members of state-owned organisations, are politically exposed persons under the same law (art. 3(1)(25)).

Identity in the public sector is instead governed by:

• Law on Identification Documents (HO-210-N, adopted 11 May 2026) [In force since 30 Oct 2026], with Government Decisions 1581-N and 1583-N of 29 October 2026 on document design and the issuance procedure.
• Law on Electronic Document and Electronic Digital Signature (2004, last amended 4 December 2025) and Government Decision 572-N of 25 May 2017 on signatures in public services (technical requirements restated 24 July 2025).
• Law on Public Information and Law on Cybersecurity (both in force since 4 January 2026).
• Law on Protection of Personal Data (2015, as amended).
• Draft Law on Electronic Identification and Trust Services[Proposed, comments close 17 Nov 2026].

4. Identity verification and onboarding

The documents

An identity card is mandatory from 16 and voluntary from 6, and a passport is issued from 16 only to identity card holders (Law on Identification Documents, art. 3(2)). Cards are valid for five years; passports for three, five or ten years by age (art. 3(3) and (4)). The card carries biometric data and the public services number, in Armenian and English, using State Population Register data (art. 3(6), (7) and (9)). The state duty is AMD 5,950, 5.95 times the AMD 1,000 base duty (Law on State Duty, art. 8 and 14).

Chip and biometrics

Biometric data are the photograph, signature and fingerprints (art. 2); fingerprints are taken from 6 and signatures from 16 (art. 11(3)). Every document type listed in art. 11(1) has an electronic data store holding the biometric data (art. 11(6)). Under Decision 1581-N, the card's dimensions follow the ICAO Doc 9303 (8th edition) TD1 specification, and its chip has contact (ISO/IEC 7816) and contactless (ISO/IEC 14443) interfaces with applications for electronic identification and electronic digital signatures (annex 2, pt. 2 to 4). Only cards issued before 15 February 2023 and new cards issued from 1 November 2026 have a usable chip; holders of chipless cards use Mobile ID, issued at mobile operators' service centres (National Services Gateway).

Issuance

The application starts on the unified electronic platform, and the person attends a HayPass service centre to give biometrics. The document should be ready on the 14th working day. At handover, the partner runs a biometric check against the stored data, and a new cardholder sets two PINs for digital identification and electronic signing (Decision 1583-N, annex 1, pt. 31 to 34 and 37).

Digital credentials

Decision 572-N recognises three signature types: identity card, mobile (USIM or eSIM) and smart-device signatures with keys in a remote hardware security module (annex 2, pt. 3). Yes em returns the public services number as the unique identifier; the National Services Gateway lists the identity card and Mobile ID as the current login methods. Foreign residents must first be identified in person at the Migration and Citizenship Service before an operator can issue Mobile ID (annex 2, pt. 13).

5. Digital channels: what's different

Bottom line: Armenian public services can be used fully online once a person holds a credential, but no credential can be obtained remotely: identity documents, Mobile ID and app-based signatures all start with an in-person check.

Online pre-registration, physical attendance

Applications go through the unified electronic platform, linked to the State Population Register (Law on Identification Documents, art. 2(1)(21) and 10(1)). Applicants may pre-register with Yes em or without it; without it, their details are matched against the register and mismatches are corrected at the Migration Service before booking. A person aged 16 or over must apply in person (art. 10(3)).

Credentials and standards

Decision 572-N allows the mobile signature on a USIM or an eSIM, issued at the offices of operators contracted to the signature operator (annex 2, pt. 3 and 12). In practice, the National Services Gateway describes eSIM Mobile ID as available at operators' service centres, while EKENG's FAQ still says Mobile ID does not work on eSIM phones, so availability should be confirmed with the operator. The number must be registered in the user's name. The app-based signature requires identification with an identity document at a certification authority point (pt. 22 and 23), and remote signing must apply ETSI TS 119 431-1 and -2, ETSI TS 119 432, ETSI TS 119 312 and TS 419 241-1 and -2 (pt. 28).

Legal effect online

An electronic document protected by an electronic digital signature has the same legal significance as one signed by hand, provided the signature is authenticated and there is no sufficient evidence of alteration (Law on Electronic Document and Electronic Digital Signature, art. 4). Electronic signatures are used to obtain state and local government services electronically, on systems that meet Government security and interoperability requirements (art. 11.1).

Pending: draft Law on Electronic Identification and Trust Services [Proposed, comments close 17 Nov 2026]

The Ministry of High-Tech Industry and Artificial Intelligence published the draft for comment from 2 to 17 November 2026, with a companion law repealing the Law on Electronic Document and Electronic Digital Signature. As drafted, from 1 January 2027 (art. 75) it would:

• set two assurance levels for eID schemes, low and high, with technical minimums set by the Information Systems Regulatory Commission (art. 12);
• create one free, voluntary Armenian Digital Identity Wallet at high assurance, holding identification data, attribute attestations and qualified signatures, which any body that must identify users online would have to accept (art. 5; state bodies within two years, art. 76(5));
• give qualified electronic signatures handwritten-equivalent force (art. 28) and regulate seals, timestamps, registered delivery, attribute attestation, archiving and ledgers;
• treat biometric identification as high-assurance only when it uses the identity card chip or the state biometric database, and require that route for biometric identification in public, health and financial services (art. 18).

Qualified providers would verify identity through high-assurance eID, a qualified certificate or in person; no video method is listed (art. 27(2)). Foreign eID and trust services would be recognised only under treaties (art. 1 and 71). Accredited providers would become qualified and existing certificates would stay governed by the law in force when issued (art. 76). Mobile ID is not mentioned by name.

6. Data protection and biometrics

Biometric personal data may be processed only with the data subject's consent, unless a law provides otherwise and its aim can only be achieved by processing those data (Law on Protection of Personal Data, art. 13). The Law on Identification Documents is such a law for state documents. A private operator that captures selfies or fingerprints for its own service needs consent unless another law provides otherwise, and must notify the Personal Data Protection Agency before it starts processing biometric data (art. 23(3)). Consent must be given in writing or electronically with an electronic digital signature, or orally through reliable actions that clearly show it (art. 9(7)); a tick-box alone may not meet this test. The Government's biometric processing rules for identity documents (art. 11(5)) were still a draft as of 13 November 2026.

Since 4 January 2026, the Information Systems Regulatory Commission (the "autonomous body" under the Law on Public Information, art. 3(1)(2)) sets the requirements for biometric data carriers and storage outside information systems, and supervises the security of processing by cybersecurity service providers and state database managers (art. 19(6) and (8), as amended by HO-447-N).

7. Sector-specific obligations

Loss of force and invalidity

A document loses force automatically on expiry, issue of a new version, loss of the underlying status, the holder's death, or failure to collect it within 12 months of notice (art. 12(1)). It is declared void when reported lost or stolen (art. 12(2)), and invalid when forged or obtained unlawfully (art. 12(3)).

Cybersecurity

State and local government bodies are service providers under the Law on Cybersecurity (art. 1(3) and 3). They must notify the autonomous body of a significant cyber incident immediately and no later than 24 hours after becoming aware of it (art. 11).

8. Risk indicators and red flags

Identity abuse indicators drawn from Armenian law and official guidance

• Superseded document: an old-format document presented after a new one was issued to the same person (art. 16(5)).
• Reported lost or stolen: a document declared void after a loss or theft report (art. 12(2)).
• Forged or unlawfully obtained: grounds for invalidity under art. 12(3).
• Document held by a third party: taking another person's passport or identity card, or accepting it as a pledge, is an offence (Code of Administrative Offences, art. 199).
• Number in another name: Mobile ID linked to a phone number not registered to the user, which the National Services Gateway says is not allowed.
• Code set off-premises: a Mobile ID PIN created outside the operator's office, which EKENG warns against.

9. Enforcement and penalties

The Migration and Citizenship Service declares documents void or invalid (Law on Identification Documents, art. 12), and an accredited certification centre terminates a signature certificate when the identity card is declared invalid or a court finds the certificate forged (Law on Electronic Document and Electronic Digital Signature, art. 16).

Fines under the Code of Administrative Offences are set as multiples of a AMD 1,000 calculation base (Law on Minimum Monthly Wage, art. 3):

Remedying a data protection breach within the Agency's deadline releases the offender from liability (art. 189.17(8)); the Agency can also order processing stopped (Law on Protection of Personal Data, art. 24(3)). Cybersecurity breaches carry administrative or criminal liability (Law on Cybersecurity, art. 24).

10. Recent changes and what to watch

• 2 November 2026[Proposed, comments close 17 Nov 2026]: draft Law on Electronic Identification and Trust Services published, with a planned start date of 1 January 2027 and repeal of the current e-signature law.
• 1 November 2026[In force]: new biometric passports and identity cards issued at HayPass centres; service abroad expected within two to four months.
• 30 October 2026[In force]: Law on Identification Documents replaced the 2011 passport and identity card laws, with Decisions 1581-N and 1583-N on design and issuance.
• 5 October 2026[Temporarily suspended]: passport services at embassies and consulates, including by video link, paused while the new system is introduced.
• 25 March 2026[Completed]: chair of the Information Systems Regulatory Commission elected.
• 4 January 2026[In force]: Laws on Public Information and on Cybersecurity; biometric storage rules and security supervision of state databases moved to the Commission.
• 24 July 2025[In force]: technical requirements under Decision 572-N restated, recognising eSIM Mobile ID and smart-device signatures; Decision 1015-N named the Ministry of High-Tech Industry (now the Ministry of High-Tech Industry and Artificial Intelligence) as accreditation body.
• Pending[Proposed, draft Government decision]: rules on processing biometric data for identity documents (art. 11(5)), published for consultation on e-draft.am by the Ministry of Internal Affairs.
• Watch: updated Yes em guidance for logging in with the new cards (National Services Gateway guidance on card login still refers to cards issued before 15 February 2023), whether an app-based credential is offered to the public, and new technical requirements from the Commission for state databases.

11. What this means for identity verification

• Two card generations. Accept old-law cards (valid ten years) and new cards (five years), and treat an older document as void once a newer one exists (art. 16(5)).
• NFC chip reading. New cards and passports carry a contactless chip with biometric data, enabling chip reading and face matching. Old-law cards issued from 15 February 2023 have no usable chip; their holders use Mobile ID.
• Use Yes em where accepted. It returns the public services number as a stable identifier.
• Biometrics. Notify the Agency before processing biometric data and capture consent in a form art. 9(7) accepts.
• Register checks need a contract. State register checks require an approved EKENG connection.
• Plan for the draft eID law. As drafted, biometric identification in public, health and financial services would have to use the card chip or state biometric database, and services requiring online identification would have to accept the wallet.
• Foreign users. Their credentials depend on residence status and a public services number.