What Is the UMID? Card Data and Verification for KYC
The UMID is a Philippine government ID that consolidates membership across SSS, GSIS, PhilHealth, and Pag-IBIG into one card, carrying a Common Reference Number and biometric data on a contactless smartchip.
Two things changed recently that KYC teams need in their acceptance policy. New issuance has stopped: GSIS ended it in May 2024 and SSS discontinued generic UMID cards under Circular No. 2025-008, launching the MySSS Card in its place.
Existing UMID cards remain valid, so they will keep arriving at onboarding for years.
What Is the UMID (Unified Multi-Purpose ID)?
The UMID was created to solve a specific problem: four government agencies, four separate membership cards, four sets of records for the same person.
Its legal basis is Executive Order No. 420, which directed government agencies and government-owned corporations issuing ID cards to adopt a unified multi-purpose system, with stated goals of reducing costs, improving convenience, and enhancing the reliability of government-issued IDs. The Supreme Court upheld EO 420 in Kilusang Mayo Uno v. Director-General of NEDA, decided 19 April 2006.
Issuance was split by membership. SSS issued cards to private sector workers, GSIS to public sector workers, and PhilHealth to individuals covered by neither. Rollout began in 2010, with distribution reaching scale from 2011.
New issuance has ended
This is the part most KYC documentation has not caught up with.
GSIS announced in April 2024 that it would stop issuing UMID cards on 31 May 2024, moving to its GSIS Digital ID system. SSS launched the MySSS Card on 1 October 2025, and per the SSS, it is the new official functional ID equipped with an EMV chip that replaces the old UMID card. SSS Circular No. 2025-008 discontinued issuance of new generic UMID cards and UMID Pay Cards.
The SSS is equally clear about what did not change: all previously issued SSS cards remain valid. Members with a lost or damaged card now apply for a MySSS Card rather than a UMID replacement.
For an onboarding flow, the practical consequence is that UMID volume will decline slowly rather than stop, since existing cards do not expire on a schedule and holders have no reason to replace a working card.
What Data the UMID Card Carries
The front carries the holder’s name, date of birth, address, sex, signature, photograph, and the Common Reference Number. The reverse carries a magnetic stripe with encoded personal data, a barcode, serial numbers, and the expiration date.
The Common Reference Number (CRN) is the identifier that made the whole scheme work. It is a unique number assigned to each holder that links their SSS, GSIS, PhilHealth, and Pag-IBIG records. It is not the same as an SSS number, and treating the two as interchangeable in a customer record creates reconciliation problems later.
The contactless smartchip stores membership information and biometric data including fingerprints, facial image, and signature. Physical security features on later iterations include guilloche patterns, laser-engraved personal details, and microprinting.
One quirk worth knowing if you run multilingual document processing: all text fields on the UMID appear in English only, without Filipino translations, reflecting how the four issuing agencies standardised their internal records.
How the CRN was issued, and why it matters
According to the SSS, applicants’ fingerprints were compared against others in the database through a centralised biometric data matching process, using the Central Verification System of the Philippine Statistics Authority. Applications returning a fingerprint match were investigated. Only applications passing the uniqueness check were assigned a CRN and sent for card printing.
That is one-to-many biometric deduplication, running in Philippine government infrastructure years before PhilSys applied the same principle at national scale. The CRN was gated on uniqueness, exactly as the PSN is now.
UMID vs PhilID vs Driver’s Licence
| UMID | PhilID | Driver’s Licence | |
|---|---|---|---|
| Issuer | SSS, GSIS, PhilHealth | PSA | LTO |
| Still issued? | No, discontinued | Yes | Yes |
| Machine-readable layer | Smartchip, magnetic stripe, barcode | QR code | None standardised |
| Public verification service | None confirmed | PhilSys Check | None confirmed |
| Carries address | Yes | Yes | Yes |
| Mandatory acceptance | No | Yes, under RA 11055 | No |
The bottom row is the one to build policy around. Only the PhilID carries statutory mandatory acceptance. The SSS itself notes that the MySSS Card is not mandated for acceptance by other government agencies or private institutions, and that PhilSys now serves as the primary official identification.
Why UMID Verification Is Harder: No MRZ, No QR
Philippine documents split into two verification families, and the UMID sits awkwardly between them.
Passports carry an MRZ with check digits that validate internally, so a parser can detect an inconsistency without contacting anyone. The PhilID and ePhilID carry a QR code that authenticates externally against PhilSys Check.
The UMID has neither. Its smartchip and magnetic stripe are designed for agency terminals, not for a business scanning a document during onboarding, and no public read path exists for either. What arrives in a KYC flow is a photograph of a card, and everything must be established from that image.
Which means UMID verification falls back to what the printed surface can prove: whether the data is internally consistent, whether the physical security features are present and correct, and whether the person presenting it matches the portrait.
How Businesses Verify a UMID in Practice
OCR the printed fields
Name, date of birth, sex, address, and CRN. Field positions are consistent within a card generation, but the 2021 iteration moved the photograph to the opposite side compared with the 2010 version, so a template built against one generation will misread the other. Both circulate.
Validate the CRN format
Format checking catches fabricated numbers and transcription errors. It does not confirm the number belongs to this person, which is a different claim.
Run document forensics
Check for the guilloche patterns, laser engraving, and microprinting, and for the digital editing artifacts that betray a manipulated image.
Match the holder to the portrait
Biometric liveness comparing a live selfie against the card photograph is the single strongest control available for this document, precisely because the document offers no external verification path of its own.
Cross-check against a second source
Where the customer also presents a PhilID, PhilSys Check provides an authoritative anchor that the UMID cannot supply on its own.
SSS and GSIS Record Checks
A caution before you design around this. No public endpoint allowing a business to verify a UMID or a CRN against SSS or GSIS records could be confirmed, and no vendor claim to the contrary should be accepted without documentation.
Members can view their own records through the My.SSS portal, and the MySSS Card programme itself uses PhilSys eVerify for identity verification during application. Neither of those is a third-party verification service.
Treat any site offering UMID verification with the same caution warranted for clearance verification sites: check whether the domain belongs to the issuing agency before entering a customer’s details into it.
UMID in BSP-Compliant KYC Onboarding
The UMID appears on essentially every Philippine institution’s list of valid IDs, and it is widely treated as a primary document because it is government-issued, photo-bearing, and biometrically enrolled.
Its practical value in customer due diligence goes slightly beyond identity. It carries an address, which supports address verification, and it evidences formal employment or membership status, which can inform risk profiling.
Acceptance policy now needs to handle three states rather than one:
- Legacy UMID. Still valid, still circulating widely, no longer issued.
- MySSS Card. The SSS successor, EMV chip, but with no mandatory acceptance status attached, so accepting it is your policy decision.
- PhilID and ePhilID. The only formats carrying statutory mandatory acceptance under RA 11055.
An institution whose published ID list still says “UMID” and nothing else will meet customers holding a MySSS Card who reasonably expect it to work. Under BSP Memorandum 2024-006, that published list is visible to anyone, which makes the gap easy to notice from outside.
Frequently Asked Questions About the UMID
What does UMID stand for?
- Unified Multi-Purpose ID. It consolidates membership identification across the Social Security System, Government Service Insurance System, PhilHealth, and Pag-IBIG Fund into a single card, established under Executive Order No. 420.
Is the UMID still being issued?
- No. GSIS stopped issuing UMID cards on 31 May 2024 in favour of its Digital ID system, and SSS Circular No. 2025-008 discontinued issuance of new generic UMID cards and UMID Pay Cards following the launch of the MySSS Card on 1 October 2025.
Are existing UMID cards still valid?
- Yes. The SSS states that all previously issued SSS cards remain valid. Members with a lost or damaged card now apply for a MySSS Card rather than a UMID replacement, but a working UMID does not need replacing.
What is the Common Reference Number on a UMID?
- The CRN is the unique identifier linking a holder’s SSS, GSIS, PhilHealth, and Pag-IBIG records. It is not the same as an SSS number. It was assigned only after the applicant’s fingerprints passed a uniqueness check against the database.
Can businesses verify a UMID online?
- No public endpoint for third-party UMID verification against SSS or GSIS records could be confirmed. Verification in practice relies on OCR of the printed fields, document forensics against the physical security features, and biometric matching between the cardholder and the card portrait.
Must businesses accept the MySSS Card?
- No. The SSS states that other government agencies and private institutions are not mandated to accept the MySSS Card, and that acceptance depends on their own policies, since the National ID under PhilSys now serves as the primary official identification. Only the PhilID and ePhilID carry mandatory acceptance under RA 11055.
A Card With No Verification Service Needs a Verified Person
The UMID is a well-built document by 2010 standards, with real biometric enrolment behind it and a CRN that was gated on fingerprint uniqueness. What it does not have is any way for a business to ask the issuing agency whether the card in front of them is real.
That gap does not close by inspecting the card harder. It closes by verifying the person, because a genuine UMID presented by someone other than its holder passes every document check you can run on the image.
Verihubs eKYC API covers the UMID alongside 15+ Philippine government ID types, with per-document OCR that handles both card generations, forgery detection, and biometric liveness matching the holder against the card portrait, plus PhilSys authentication where a customer presents the national ID as well.
Talk to the Verihubs team about handling legacy and current Philippine ID formats in one flow.
