14 Aug

Introduction

Nigeria’s financial sector is entering a more technology-driven and supervisory phase of anti-money laundering (AML), counter-financing of terrorism (CFT), and counter-proliferation financing (CPF) compliance.

The Central Bank of Nigeria (CBN) issued the Baseline Standards for Automated AML/CFT/CPF Solutions for Financial Institutions in Nigeria on 10 March 2026. The Standards apply to banks, mobile money operators, international money transfer operators, payment service providers and other financial institutions regulated by the CBN. They establish minimum functional, governance, technology, reporting and control requirements for automated financial crime monitoring.

The 12-Month Timeline: What Changed?

The CBN’s 2025 exposure draft initially proposed a 12-month implementation period. However, the final Standards issued in March 2026 provide 18 months for Deposit Money Banks and 24 months for Other Financial Institutions, calculated from 10 March 2026. Institutions were also required to submit implementation roadmaps within three months of issuance.

The extension should not be interpreted as a reason to delay implementation. The CBN expressly states that implementation begins from the date of issuance and that institutions remain responsible for complying with existing AML/CFT/CPF obligations.

What Has the CBN Changed?

The Standards move AML compliance beyond having policies and manual controls. Regulated institutions are expected to operate automated AML/CFT/CPF solutions that are proportionate to their size, business model, transaction volumes and risk profile.

Key requirements include:

Customer Due Diligence and KYC/KYB: Systems should support customer identification, verification, risk profiling, enhanced due diligence and continuous monitoring.

Transaction Monitoring: Institutions must have systems capable of identifying unusual and potentially suspicious activity using risk-based scenarios, customer behaviour and transactional information.

Sanctions and PEP Screening: Institutions must screen customers, beneficial owners, related parties and transactions against relevant sanctions, watchlists and PEP databases.

Reporting and Case Management: AML systems should support the investigation, documentation and reporting of suspicious activity and maintain appropriate audit trails.

Risk Assessment: Institutions are expected to conduct and document ML/TF/PF risk assessments and ensure that their AML systems reflect those risks.

Data Protection and Security: AML systems must incorporate appropriate security controls and comply with applicable Nigerian data protection and data sovereignty requirements.

Third-Party and Vendor Management: Institutions using external AML technology providers must maintain appropriate vendor management, change management, incident handling and exit arrangements.

The CBN’s Expectations Go Beyond Buying an AML Solution

One of the most important developments is that compliance is being assessed at the institutional level. Simply purchasing an AML platform or relying on a vendor’s claim of regulatory compliance will not be sufficient.

The institution must be able to demonstrate that its solution is properly configured, integrated with relevant KYC/KYB and transaction systems, supported by appropriate governance, regularly tested and capable of producing effective outcomes.

The Standards also contemplate the use of AI, machine learning and advanced analytics, but these technologies remain subject to governance, validation, explainability and human oversight.

What Should Financial Institutions and Fintechs Be Doing Now?

Businesses within the CBN’s regulatory perimeter should treat implementation as a structured compliance project.

First, conduct a gap assessment. Compare your existing AML/CFT/CPF framework, policies, technology and controls against the Baseline Standards.

Second, review your risk assessment. Your AML technology and monitoring rules should reflect your actual customers, products, transaction patterns, delivery channels and geographic exposure.

Third, review KYC/KYB and beneficial ownership controls. Customer information must be accurate, current and sufficiently connected to transaction monitoring and risk classification.

Fourth, assess your AML technology. Determine whether your existing solution can support transaction monitoring, sanctions and PEP screening, case management, regulatory reporting, audit trails and appropriate integration.

Fifth, strengthen governance. Board and senior management oversight, clear compliance ownership, documented responsibilities, internal audit and regular training should form part of the implementation programme.

Finally, document everything. Institutions should be able to demonstrate not only that controls exist, but that they operate effectively.

What This Means for Fintechs

For fintechs, particularly payment service providers and other technology-driven financial institutions, the direction is clear: AML compliance is becoming a technology, governance and business-wide responsibility, not simply a compliance department function.

The CBN’s wider supervisory approach already covers Payment Service Providers and other regulated institutions using a risk-based model.

Fintechs should therefore consider AML readiness alongside product development, system architecture, data governance, vendor selection and regulatory compliance from the outset.

Conclusion

The current AML/CFT/CPF regulatory wave is not simply about meeting a future deadline. It represents a shift towards demonstrating that financial institutions have effective, technology-enabled and risk-based systems for preventing and detecting financial crime.

The practical question for regulated businesses is therefore not “When is the deadline?” but “If the CBN reviewed our AML framework today, could we demonstrate that it actually works?”

Businesses that begin their gap assessment, governance review and technology implementation early will be better positioned to meet the Standards and respond to increasing regulatory scrutiny.

This update is for general information and does not constitute legal advice. Businesses should assess the Standards against their specific regulatory status, business model and risk profile.