April 2026

OHID and HSID users (EDA and Rebuild flows)

A transaction monitoring (TMX) velocity check was introduced before sending international one-time passwords (OTPs) via SMS or voice.

• OTP requests were evaluated for abnormal request patterns before processing
• Requests exceeding acceptable thresholds were blocked and surfaced with an error message
• OTPs were sent only after passing the velocity check
• The feature was initially deployed in monitoring mode

Earlier, OTP requests were sent without validating request velocity, which increased exposure to SMS pumping attacks and unnecessary carrier costs. This enhancement introduced early validation to detect abnormal request patterns, reducing fraud risk, preventing excessive spend, and protecting system stability from high-volume traffic spikes.

HSID users (EDA login experience)

The login process was enhanced to handle user data synchronization failures more effectively.

• The system used available cached user data when synchronization issues occurred
• Users were allowed to continue login without repeated retries in recoverable scenarios

Earlier, synchronization issues could interrupt login and require repeated attempts or manual intervention. This update improved login success rates by allowing users to proceed when valid data was available, resulting in fewer disruptions.

HSID users (EDA registration experience)

Arabic language support was added to the registration experience.

This enhancement addressed the C&S requirement to support Arabic in the EDA registration experience.

OHID Tier 1 and Tier 2 support agents

Enhancements were delivered in the Aikyam Identity Console (AIC) to improve usability and efficiency.

• Audit log ingestion was made near real time
• Audit tables were improved with better refresh behavior and default column reset
• Pagination support was expanded up to 100 records per view
• User search enabled multi-select filtering for application IDs
• Search results could be exported (up to 500 records)
• Phone number updates aligned with tenant-configured country codes
• Application deletion capability was introduced

Earlier, administrators faced delays in audit visibility and limitations in managing user data. These improvements reduced investigation time, simplified workflows, and improved efficiency in user management operations.

HSID users (iOS and Android applications)

Accessibility issues were fixed in login and registration flows for mobile applications.

These updates improved usability and ensured compliance with accessibility standards.

HSID users using Fast-track registration (FTR)

Error messaging and page titles were updated when users attempted to register with an already registered email address.

• Users were clearly prompted to enter a different email address

Earlier, unclear error messages caused confusion and increased drop-offs during registration. This update provided clearer guidance, helping users complete registration more successfully.

HSID users (EDA experience) and administrators

Improvements were made to ensure consistent country code handling in the Aikyam Identity Console (AIC)

• Country codes in user profile and search now use tenant-configured values
• Removed reliance on static country code lists

These issues previously caused inconsistent behavior across admin tools and user flows. The fixes improved reliability, ensured consistent data handling, and reduced confusion for both users and administrators.

HSID administrators

Default contact details were updated during HSID application setup.

• Removed prefilled OHID phone number and email
• Made email optional for HSID applications
• Maintained existing requirements for other tenants

Earlier, default contact values could lead to incorrect or unnecessary data during application setup. This update improved flexibility and reduced configuration errors.

This primarily affected users:

• Began FTR using an invitation link and attempted to register an existing account.
• Selected “Forgot Password” and transitioned to the account recovery flow.

A defect caused incorrect verification behavior when users switched from Fast‑track registration (FTR) to account recovery.

• The system continued using the FTR verification process instead of the account recovery process.
• Incorrect verification requests were triggered during account recovery.
• Required account recovery states were not properly updated.
• This behavior led to potential failures or confusion during the recovery experience.

Earlier, incorrect flow handling caused registration logic to continue during account recovery, leading to inconsistent behavior and user confusion. This fix ensured that the correct verification process was applied, enabling users to recover their accounts successfully without interruption.

OHID applications

Phone-based Identity Confirmation (PBIC) was enabled as an account recovery option.

• Available in both the user interface and Aikyam Identity Console (AIC)
• Supported for US phone numbers only

Earlier, account recovery relied on more complex verification methods. This enhancement simplified the process by enabling faster phone-based verification while maintaining required security controls.

OHID, GovID, Tier 1 and Tier 2 support agents

Support users were migrated from legacy admin tools to the Aikyam Identity Console (AIC).

• Users were automatically redirected to Aikyam Identity Console (AIC)

Earlier, multiple admin tools created inconsistencies in user management. This migration established a single, standardized interface, improving usability and operational efficiency.