| Feature | Estonia · X-tee | Mongolia · X-Road MN | Mongolia · KhUR |
|---|---|---|---|
| Launched | 2001-12-17 | 2026-07-22 (instance MN) | 2017 pilot, officially 2018-01 |
| Technology | X-Road (NIIS, MIT) | X-Road 7.8.2 (NIIS, MIT) | Open-source-based ESB, built in-house |
| Architecture | Distributed, peer-to-peer | Distributed, peer-to-peer | Centralized hub |
| Operator | RIA | Gerege Systems (technical); the management server is owned by the Ministry of Digital Development | National Data Center |
| Instance / identifier | EE/GOV/… | MN/GOV|COM/… | — |
| Member classes | GOV · COM · NGO | GOV · COM | — |
| Members | ~1,000 directly connected (1,083 in logs) | 3 (NDC, Ministry, Gerege) | ~517 organizations unverified |
| Traffic | ~13 million requests a day | Test traffic; no providers registered yet | 2.67 billion transactions (cumulative, 2024) unverified |
| Connectivity | mTLS over the internet | mTLS over the internet | VPN or government network, static IP allowlist |
| Message signatures | Yes, with the organization's key | Yes, eID Mongolia organization CA | No requirement found |
| Timestamps | Yes, RFC 3161 | Yes, tsa.timeserver.mn | No requirement found |
| Key exchange | PKI, OCSP | PKI, OCSP (RFC 6960) | PGP, data center access certificate |
| Legal basis | Government Regulation No. 105 (2016) | None yet — needs a government resolution | Order A/61 (2016), technical rules A/64 (2022) |
| Fees | The layer is free | Undecided | Paid (Government Resolution No. 259, 2022) |
| Data control | Stays with the owner | Stays with the owner | Passes through the center |
KhUR figures come from a 2024 ministry / E-Mongolia Academy presentation slide — which system they describe has not been officially confirmed. Sources give different numbers, anywhere from 462 to 659 organizations. In 2026, preparations began to move KhUR to a "distributed architecture" under the Smart Government II project.
The core argument
A study from Mato Grosso, Brazil, puts it plainly: earlier integration-bus attempts failed because they required centralizing data, and data owners refused to give up control. X-Road delivered the same result while keeping owners autonomous.
That is Mongolia's situation. Organizations not sharing data is a governance problem, not a technical one — and X-Road solves it through architecture.
Peer countries
~7 million people, post-Soviet. €500k in total (USAID + Estonian Foreign Ministry), 260 specialists trained. 2018: 363 thousand → 2024: 3.5 billion transactions, 185 organizations. Stalled in 2016–2018 and moved only after the prime minister made it mandatory. The hardest organizations were not the outdated ones but those locked into proprietary contracts.
Launched 2020-06-15. Deployed in-house from open source. 87 members (32 public, 55 private), 269 services, 117 million transactions (2026-05). Proof that a local team can do it.
Went live 2025-07-28. Nortal, UNDP funding. 10 ministries, 12 services, 75 specialists trained, hosted in-country.
Samleikin (eID) · Heldin (X-Road) · Vangin (portal). In Mongolia: DAN · KhUR/X-Road · e-Mongolia. All governance terminology was created in the native language.
~3 years from partner to full member. The blockers were not technical but legal: roles and responsibilities. Rule: member servers may not lag the center by more than 2 versions.
Many organizations on one Security Server. For Mongolia, with 1,392 government organizations, the key model for connecting small ones. 573 systems were audited before connecting.
Risks
Recurring causes across the 13 rollouts studied.
Amapá (Brazil) halted; Querétaro (Mexico) stalled at 50%. Mongolia's digital ministry has been renamed twice.
Colombia, Brazil and El Salvador had to change their CAs. For MN, this part is done.
Quintana Roo started because of COVID and shut down when the crisis ended.
Members bear the cost while the state gets the benefit (OECD OPSI). Needs central funding or a multi-tenant model.
Roadmap
Based on the Turkmenistan model. Cost benchmark: €250k–500k, including PKI. The X-Road software itself is free.
CA gaps (OCSP, TSA, organization profile) closed. KhUR audit and legal analysis remain.
Central Server + 2 Security Servers, production CA. Publishing two real services and Mongolian terminology remain.
Government resolution, naming the operator (ministry owns, NDC runs), international funding.
Start with 10 organizations and 10–12 services. No big-bang migration. Train specialists.