Saint Lucia's Digital ID Sandbox Needs an AI Test Before It Opens

Saint Lucia announced plans on 15 September 2026 for a regulatory sandbox, supported by the UN Economic Commission for Latin America and the Caribbean (ECLAC), with an initial focus on digital identity and payments. Digital identity systems often lean on face matching, and face matching can fail unevenly across groups of people. We found no public Caribbean accuracy test for any such tool. A bank, credit union, telecom or fintech that expects a seat in the sandbox can start by checking its own onboarding process and asking vendors for relevant accuracy evidence.

What the sandbox would test

The government announced the plans on 15 September 2026. On 22 September, Biometric Update reported that the Government of Saint Lucia, through its DigiGov programme and with ECLAC's support, is preparing a regulatory sandbox. It will test digital ID management and payments first, with regulators, financial institutions, telecom companies and fintech firms taking part. A concept document is being finalised, and funding for governance and operations comes after that. The stated aim is to find regulatory gaps and develop safeguards while the testing runs.

The sandbox builds on the National Authentication Framework (NAF), which the government launched in February 2026. A sponsored VP Digital article in The Voice describes it as a common way to verify identity for government services online and offline. It sits behind DigiGov, whose About page sets a target of online access to 154 public services across eight ministries by 2021. We could not confirm the current number. Biometric Update says a third phase of NAF is intended to allow private-sector organisations such as banks, insurers and utilities to use the infrastructure for know-your-customer checks, subject to consent and legal frameworks.

Nothing in this reporting says the sandbox will test face matching. The question is worth asking before a product enters the sandbox. The Panama experiment discussed below shows how a photograph requirement can interrupt an application, even without an automated face-matching decision. Testing should examine both kinds of failure.

What does the evidence say about face matching and error?

NIST’s 2019 study tested 189 algorithms from 99 developers on 18.27 million photographs of 8.49 million people in US government databases. In one-to-one matching, false-match rates for Asian and African American faces were often 10 to 100 times those for Caucasian faces, depending on the algorithm. A false match accepts two different people as the same person. The pattern was not universal; Asian-developed algorithms did not show the same large Asian–Caucasian difference. Development location alone does not establish accuracy. The study did not report a Caribbean error rate and does not validate current products. Buyers need current false-match and false-rejection results for the system, threshold and population they intend to use.

The second finding concerns application design. An IDB working paper published in August 2021 reports on a 2020 identity-card renewal experiment in Panama, analysing 3,459 participants. Table A4 records the last application step reached by 343 platform users: 60.3% stopped at the photograph step. That is a result for this particular application, not a general biometric rejection rate. The photo rules were demanding and specifically prohibited using a phone's front-facing camera. This was not a requirement to take a selfie. The study supports testing the whole application process, including whether people can supply an acceptable photograph.

The third finding is about the rulebook. The Cullen International benchmark dated 30 September 2026 covers 13 Caribbean countries, Saint Lucia among them. It found that no country has an AI-specific regulatory framework and that current approaches rely on non-binding strategies and readiness assessments. We read the public summary, not the full benchmark.

The last numbers set the scale. World Bank data gives Saint Lucia a population of 180,149 in 2025, GDP of $2.66 billion and GDP per capita of about US$14,746.

The same World Bank page puts internet use at 68% of people in 2024. Nearly a third of residents were offline, so any identity system that assumes a smartphone camera and a stable connection will leave people out.

The method: Agent Colonialism

Adrian Dunkley's Agent Colonialism describes AI deployed into communities without their input into the design, without compensation for their data, and without their interests represented in how the system decides. The community carries the errors and none of the commercial value.

Apply it to a face-matching product bought for a digital ID scheme. If the vendor has not tested it locally or involved Saint Lucians in its design, buyers have an evidence gap to close. A wrongful rejection can send a customer back to a branch. A false match can expose an account to fraud. The contract should identify who investigates and remedies each kind of failure.

The method comes with a practical question. A test we suggest, adapted from the method rather than taken from Adrian's own writing: ask the vendor for the model and version, matching threshold, false-match and false-rejection rates, and the sample and conditions used to measure them. Training-data provenance can provide context, but cannot establish local accuracy on its own. Without relevant test results, record an evidence gap in the risk register.

What this means for Saint Lucia

Saint Lucia has the pieces of a working identity layer. NAF is live, DigiGov has a stated target of 154 services, and the sandbox gives regulators a controlled place to learn. With a population of 180,149, Saint Lucia needs evidence relevant to its residents. A sandbox could provide a setting for that testing, alongside work by individual institutions.

Picture a fisher at Castries Harbour who wants a mobile payment account and is asked for a selfie that must meet a technical specification. This is an illustration, not a real person. Panama's experiment shows how a demanding photograph step can interrupt an application. We found no comparable public figure for Saint Lucia; participants could measure it in the sandbox.

On the legal side, the Data Protection Act 2011 provides for a Data Protection Commissioner, but the Attorney General's Chambers page lists as in force only, from 31 January 2023, Part I, sections 32 to 43 of Part III, Part VI and paragraphs (a) to (g) of Schedule 2 (S.I. 4/2023). Part II, which covers the Commissioner's appointment and powers, is not in that list, and we could not confirm that a Commissioner has been appointed. The distinction between a policy process and enforceable rules also appears in our note on Suriname's readiness assessment.

Regional help, and a disclosure

Disclosure: this article is published by CAIRMC, which Adrian Dunkley chairs, and he is also President of the Caribbean AI Association, so the organisations named here are close to the publisher. StarApple AI was founded by Dunkley.

TurtleBird is an AI safety toolkit created through Maestro AI Labs and offered to Caribbean governments at no cost. Its description says it tests whether a model can be pushed into producing non-consensual imagery, impersonation content or other harmful output before a system goes live. It is not described as a tool for measuring face-matching accuracy, so it does not answer the question in this article. It could, however, be part of a pre-launch review of any generative tool a sandbox participant adds. CAIRMC also offers AI risk certification programmes, and adriandunkley.net lists the published methods used here.

The upside

Done well, digital ID lowers the cost of opening an account, paying a licence fee or proving who you are. Barbados, as Biometric Update notes, got faster uptake by tying ID to high-value services, which suggests a plan for Saint Lucia: start with the services people already queue for. A carefully bounded sandbox would let the responsible authorities review failures before wider deployment and give local firms a forum to question vendors.

The risks

The first risk is wrongful acceptance. A false face match can expose an account to fraud; responsibility for any loss depends on the facts and applicable law. Review the full authentication process against applicable standards and the service's risks, and do not rely on a face match alone for sensitive actions.

The second risk is exclusion. A demanding photograph step can exclude people whose devices, connections or surroundings do not meet its requirements. Panama's study illustrates the problem, but does not identify which Saint Lucian groups would be most affected. Nearly one in three Saint Lucians was offline in 2024. The guardrail is a staffed, non-biometric route for every service, available from day one.

The third risk is that biometric data outlives the pilot. A face template cannot be changed like a password. Before enrolment, the operator should document a retention and deletion schedule that meets the applicable law. Ask the Attorney General's Chambers or DigiGov which authority oversees the pilot; an informal agreement is not a substitute for legal requirements. Section 43, among the provisions brought into force in January 2023, addresses the duty to destroy personal data. A fourth risk is that participants treat the sandbox as an approval stamp. Ask who is accountable when a tested product later fails in the market.

Do this week

1. List every point in your onboarding where software decides who gets in: face match, liveness check, document reader, fraud score. Count them and record the number as your baseline by 14 October 2026. Record the supplier and accountable staff member for each step; one supplier may provide several tools.
2. Ask each vendor for the model and version, threshold, false-match and false-rejection rates, and test sample conditions. Ask how the results apply to your customers and how updates are assessed. Log answers by 21 October 2026, set a follow-up date, and record missing evidence without treating training-data origin as proof of accuracy.
3. Test your own funnel. Use a restricted, lawfully accessed sample of 50 recent onboarding attempts to count failures or abandonment at the selfie step by 21 October 2026. Report aggregate counts, without copying identity documents or face images into the review. This small operational sample can identify problems; it cannot establish population-level biometric accuracy. Investigate each recurring barrier and provide a staffed alternative while it is being addressed; a low overall failure rate can still hide an access problem for a small group.
4. Write to the Attorney General's Chambers ((758) 468-3200, attorneygeneral@gosl.gov.lc) or the DigiGov programme office, asking whether a Data Protection Commissioner has been appointed, which in-force sections apply to sandbox testing and how long test data may be kept. Record the reply and the date by 21 October 2026.

Frequently asked questions

Is Saint Lucia's sandbox testing face recognition?

The reporting we read does not say so. Biometric Update names digital ID management and payments as the first focus, with a concept document still being finalised. Face matching is common in digital ID onboarding, so the scope is worth asking about directly. We would not claim the sandbox includes it until the concept document is public.

What is the National Authentication Framework?

It is the Government of Saint Lucia's identity management system, launched in February 2026, that lets a person use one verified account across government services on the DigiGov portal. The government's launch notice does not say whether it uses biometrics, and Biometric Update reports that a third phase is meant for private-sector use.

How many services does DigiGov offer today?

DigiGov's About page set a target of 154 services across eight ministries by 2021, and we could not confirm the current number. The page says payments run through Mastercard, Visa and SurePay, and that the platform is led by the Division of Public Sector Modernization in the Department of Public Service.

How large was the NIST face recognition study?

The 2019 study examined 189 algorithms from 99 developers on 18.27 million photographs. It did not report Caribbean error rates and does not validate a current product for Saint Lucia.

Does Saint Lucia have an AI law?

Cullen International's 30 September 2026 benchmark of 13 Caribbean countries found no AI-specific regulatory framework in any of them, Saint Lucia included. Existing privacy, identity and financial-sector rules may also apply. The Data Protection Act 2011 is partly in force: Part I, sections 32 to 43 of Part III, Part VI and part of Schedule 2 since 31 January 2023. Part II, on the Commissioner, is not in that list. Confirm the position with the Attorney General's Chambers.

Will banks and other private firms be able to use the National Authentication Framework?

Biometric Update says the third phase of NAF is intended to let private-sector organisations such as banks, insurers and utilities use the infrastructure for know-your-customer checks, subject to consent and legal frameworks. Separately, the government's notice of 27 February 2026 said people who registered before the first week of March could win weekly prizes, including tablets and mobile phones.

The loose end

The weakest part of this article is its central link. Nothing public says the sandbox will test face matching, and we are arguing from the Panama example and from how digital ID systems are usually built. If the concept document leaves biometrics out, most of the risk section narrows to data retention and exclusion. The Panama evidence comes from a 2020 identity-card renewal experiment, not a test of present-day face recognition. We could not confirm whether a Data Protection Commissioner is in post. The firms most likely to disagree are those whose vendors already hold Caribbean accuracy figures, and if they do, we would like to see them published.