NIC verification, and what it really proves.
The National Identity Card number is the identifier every Sri Lankan KYC flow starts from. It is also the one most often oversold. This is what a check on it establishes, and what it leaves for other signals to carry.
The number
What an NIC encodes.
Two formats are in circulation. The older one is ten characters — nine digits and a trailing letter. The newer one, issued since 2016, is twelve digits. Both encode the holder's year of birth, a day-of-year value and a serial.
The day-of-year field carries the sex of the holder: values above 500 indicate female, with 500 subtracted to recover the actual day. That is why a well-formed NIC yields a date of birth and a gender without asking for either — and why a number that fails those internal rules is not merely unrecognised but impossible.
The check
What we return.
A structured outcome — pass, fail, or send to a human — together with the date of birth and gender derived from the number, and the reason when it fails. The same request shape and the same outcome shape as every other module, so you are not special-casing this one in your code.
In the sandbox the last four digits choose the result: 0000 verifies, 1111 is not found, 2222 times out and 3333 is malformed. Those are deterministic on every machine, so the failure paths are testable before you hold a live key.
The limit
What it cannot establish.
Sri Lanka has no national NIC registry exposed as an API. No provider can confirm from the number alone that it was issued, that it is current, or that the person quoting it is its holder. A vendor claiming otherwise is describing a structural check in more confident language.
Treat the NIC as the key a customer claims, then prove the claim: a mobile OTP shows they hold the SIM, a bank account link inherits the KYC that bank already performed, and a certified liveness check with a 1:1 match ties a live face to the identity photo. Each returns its own result, so your threshold is yours to set.
Next step
Try it against your own numbers.
A sandbox key comes with the account, before any review, and sandbox usage is never metered.