In many markets, USSD-based mobile banking solutions are adopted as a means to advance financial inclusion, enabling access to basic banking services without the need for internet connectivity or smartphones.While these solutions are undeniably simple and cost-effective, their alignment with recognised information security management standards requires careful and objective evaluation, particularly within regulated financial environments. The USSD Authentication Model The typical USSD authentication model relies on two primary elements: a mobile number registered with the telecom operator. a numeric PIN entered by the user. From an ISO/IEC 27001:2022 risk management perspective, this model presents inherent structural limitations that must be explicitly acknowledged and assessed. Key Security Risks in a USSD Context Confidentiality of authentication information: PINs are entered in plain text and may be observed, conflicting with the principle of protecting sensitive information. Reliance on SIM possession: SIM swap and SIM cloning attacks undermine identity assurance and access control mechanisms. Lack of asset binding: the absence of device-level trust weakens logical access controls. Single-factor dependency: compromise of a single factor can result in full account compromise, increasing residual risk. Absence of end-to-end encryption: exposure of data within third-party telecom infrastructures challenges confidentiality and integrity requirements. Transaction Authorisation and Control Effectiveness In SIM swap scenarios, transaction confirmation mechanisms that rely on the same communication channel, such as SMS, USSD-based OTPs or voice calls, do not constitute independent controls.From an ISO/IEC 27001:2022 standpoint, this creates control dependencies that significantly reduce overall effectiveness.For users limited to feature phones, physical hardware tokens remain the only truly independent second factor capable of mitigating this risk. However, they introduce additional operational cost, distribution challenges and lifecycle management complexity, often conflicting with financial inclusion objectives.Experience from large-scale deployments, including M-Pesa, confirms that SIM swap fraud is a material and recurring risk, with measurable financial, operational and consumer protection implications. The NEARSOFT Digital Banking Platform Approach As smartphone adoption increases, including in emerging markets, more robust, auditable and proportionate security control frameworks become feasible.The NEARSOFT Digital Banking Platform is developed and operated by NEARSOFT, an organisation certified under ISO/IEC 27001:2022, supported by a formally implemented and externally audited Information Security Management System (ISMS).Within this framework, the platform is designed with: Device binding as a trusted asset: logical access is restricted to registered and validated devices, strengthening access control and mitigating SIM-based attacks. Layered and risk-based authentication: multiple authentication factors are orchestrated according to transaction risk. Independent authorisation for sensitive operations: critical transactions require controls that are not dependent on SIM ownership. End-to-end encryption: ensuring confidentiality and integrity from the client device through to the banking core. A Risk-Based Path to Sustainable Inclusion Financial inclusion remains a strategic priority. However, under ISO/IEC 27001:2022, inclusion mechanisms must be supported by documented risk assessment, appropriate control selection and continuous improvement.As connectivity improves and smartphone penetration continues to grow, regulators and financial institutions have a clear opportunity to progressively transition from SIM-centric models to device-trusted, cryptographically protected digital channels, without excluding underserved populations.The NEARSOFT Digital Banking Platform demonstrates that: "Financial Inclusion, Information Security and Regulatory Compliance are not mutually exclusive. They are mutually reinforcing."