Learners should only receive a digital identity at enrolment—when institutional responsibility, governance, and security obligations formally begin, rather than earlier in the application process, to avoid operational debt, data risks, and lifecycle complexity.