Supervised institutions
CBN AML/CFT obligations for licensed institutions
The Central Bank of Nigeria supervises the AML/CFT programmes of the institutions it licenses. What follows is the shape of that programme — the elements a supervisor expects to find and the evidence each one produces — written without citations or timelines, because those change and this page cannot be relied on to be current.
Who sets the expectation
Central Bank of Nigeria (CBN)
Licensing and prudential authority for banks and other financial institutions in Nigeria, and their AML/CFT supervisor for the obligations attaching to the licence.
Who this applies to
- Commercial and merchant banks
- Full programme expectations, with group-wide application where the institution has subsidiaries or branches.
- Microfinance banks and other deposit-taking institutions
- The same programme elements, applied proportionately to the size, complexity and risk profile of the institution.
- Payment service providers and switches
- High-volume, largely machine-mediated intake, where the design question is how human adjudication keeps pace with automated detection.
- Bureaux de change and other cash-intensive licensees
- Cash-facing due diligence and threshold-based reporting, where transaction records and customer identification are the whole evidence base.
What it requires
The obligation, stated qualitatively
Each duty below is described in substance — what it requires and what evidence it produces. Thresholds, deadlines, section numbers and penalty provisions are deliberately absent, and where a duty turns on one, the parameter you must read from the operative instrument is named beside it.
A board-approved AML/CFT programme
A written policy and programme approved at board level, proportionate to the institution's assessed risk, and reviewed on a defined cycle. Approval is the point: an unapproved policy is a draft, whatever it contains.
Evidence: The policy, the board minute approving it, the version history, and evidence that the programme in operation is the one that was approved.
Read from the operative instrument: The required review cycle and any prescribed content.
A designated compliance officer with authority and independence
A named officer of appropriate seniority, with direct access to senior management and the board, responsible for the programme and for reporting decisions.
Evidence: The appointment record, the reporting line, and evidence that the officer can escalate without going through the business they are reviewing.
Read from the operative instrument: Any prescribed seniority, notification or approval requirement for the appointment.
An enterprise-wide risk assessment
The institution assesses the money laundering and terrorist financing risk inherent in its customers, products, channels and geographies, assesses how effectively its controls mitigate it, and derives the rest of the programme from the result.
Evidence: The assessment itself, the data behind it, and a visible line from its findings to customer risk bands, due diligence tiers and monitoring coverage.
Read from the operative instrument: The required refresh cycle, and any prescribed methodology or content.
Customer due diligence, proportionate to risk
Identify and verify the customer, identify beneficial owners and take reasonable measures to verify them, understand the purpose and intended nature of the relationship, and keep the information current through the life of the relationship.
Evidence: Complete customer files with the verification evidence attached, an ownership record that traces to natural persons, and a refresh history.
Read from the operative instrument: Acceptable identification documents and data sources, the ownership percentage at which the beneficial ownership test bites, and the circumstances requiring re-verification.
Enhanced measures where risk is higher
Additional measures for higher-risk relationships: more information, establishing source of funds and source of wealth, senior approval to establish or continue the relationship, and closer ongoing monitoring. Politically exposed persons are the clearest case, but not the only one.
Evidence: The evidence obtained, the senior approval record, and a demonstrable difference in the monitoring applied.
Read from the operative instrument: The categories mandating enhanced measures, and the treatment of domestic as against foreign politically exposed persons.
Sanctions screening and freezing
Screen customers and counterparties against applicable designations, act on a confirmed match without delay, and be able to demonstrate the screening was performed against the list in force at the time.
Evidence: Screening runs recorded with the list version and publication date, the adjudication of each hit, and the action taken on a confirmed match.
Read from the operative instrument: The applicable designation regimes, the required response time, and the reporting route for a freeze.
Ongoing transaction monitoring
Scrutinise transactions during the relationship against what is known about the customer, using detection appropriate to the institution's risk profile, with internal escalation to the compliance officer.
Evidence: Detection coverage mapped to the typologies the risk assessment identifies, alert and disposition records, and the tuning history behind the parameters in force.
Read from the operative instrument: Any prescribed monitoring expectations for specific products or channels.
Record keeping and retrievability
Retain customer due diligence and transaction records, and be able to produce them to a competent authority in a usable form.
Evidence: A retention schedule by category, and a demonstrated retrieval within a reasonable time for a past period.
Read from the operative instrument: The retention period and its start point.
Training and awareness
Staff receive training appropriate to their role, and the institution can show who was trained, on what, and when.
Evidence: Training records by individual and role, with content versions and completion dates.
Read from the operative instrument: Any prescribed minimum frequency or content.
Independent testing
The programme is reviewed periodically by a function that does not run it, covering design, operating effectiveness and the quality of the decisions it produced.
Evidence: The review scope, the findings, and the tracked remediation.
Read from the operative instrument: The required frequency and any prescribed scope.
Returns and notifications to the supervisor
Periodic returns and event-driven notifications, produced from governed data rather than assembled by hand each cycle.
Evidence: The submitted returns, the data lineage behind them, and the approval that released each one.
Read from the operative instrument: Which returns apply to this licence category, their cadence, their format and their due dates.
How the platform supports it
Capability, and the control it traces to
Each row below describes behaviour the product documentation records, and carries the identifier of the control-register row it traces to, so a claim can be checked rather than taken on trust.
- Governed CDD formsDue diligence forms and their storage bindings are schema-validated and versioned, proposed by one role and activated by another, so the questions asked of a customer are a governed artefact with a version history.Control C-06
- Lifecycle and EDD decisions separated from data captureThe person capturing information is not the person deciding the customer's status, and a self-approval is refused rather than discouraged.Control C-07
- Beneficial ownership that traces to natural personsOwnership declarations are cycle-safe and historical, so a structure can be traced through intermediate entities and the position as at a past date can be reproduced.Control C-08
- Explainable monitoringMonitoring decisions retain the rule, the version and the evaluation evidence that produced them, and an alert can be replayed deterministically against the rule version that raised it.Control C-09
- Screening with retained provenanceWatchlist data is versioned and published under approval, and a hit retains the source, the list version and the match evidence it was adjudicated against — including entries later removed upstream.Control C-11, C-12
- Supervisory returns from governed dataInstitution returns are produced through the same governed mapping and approval path as reports to the financial intelligence unit, rather than as a spreadsheet built each cycle.Control C-14
- Board and executive reporting that fails closedExecutive analytics are aggregate and suppression-aware, and an unavailable data stream is reported as unavailable rather than rendered as zero.Control C-15
What we do not claim
On a compliance product the absence of a claim is information a buyer needs as much as the presence of one.
- We do not claim CBN approval, licensing or endorsement of this software. No Nigerian authority has reviewed or certified it.
- Installing software does not make an institution compliant. The programme, the risk assessment, the thresholds and the decisions remain the institution's, and the supervisor examines those.
- We do not state which CBN regulation, circular or guideline is currently in force, or what it says. That determination belongs to the institution and its advisers.
Verify before you rely on this page
This page states obligations qualitatively and carries no figures. Before acting on anything here, confirm the following against the instrument currently in force for your licence category — and record the date you checked it.
- Which CBN instrument or instruments are currently operative for each licence category, and their current versions.
- The prescribed review cycles for the policy, the risk assessment, training and independent testing.
- The beneficial ownership threshold and any prescribed verification measures.
- The categories mandating enhanced due diligence, and the treatment of domestic politically exposed persons.
- The applicable sanctions regimes, response times and freeze reporting route.
- Which periodic returns apply to each licence category, with their cadence, format and due dates.
- The record retention period and its start point.
- Whether any of the above differs by licence category, and where it does.
Talk to a specialist
Map your programme to evidence you can produce on request
Every element above produces evidence. We can walk you through where each one lives in the platform and what a supervisor would see.