Planning
Reporting cycles and the compliance calendar
A compliance calendar is only useful if every date on it is right. This one therefore lists the reporting cycles by name and by what triggers them, and leaves every date, deadline and threshold to be filled in from the operative instrument — because a vendor page is the wrong place to learn when a filing is due.
Who sets the expectation
Multiple
Different cycles run to different recipients — the financial intelligence unit, the licensing supervisor, the DNFBP supervisor, the data protection regulator, and the institution's own board.
Who this applies to
- Compliance functions planning a year
- The cycles below are the recurring commitments a programme carries. The dates attach to your licence category and your supervisor, not to this list.
- Internal audit
- A calendar with owners and evidence locations is the fastest way to test whether a programme's periodic obligations are actually being met.
What it requires
The obligation, stated qualitatively
Each duty below is described in substance — what it requires and what evidence it produces. Thresholds, deadlines, section numbers and penalty provisions are deliberately absent, and where a duty turns on one, the parameter you must read from the operative instrument is named beside it.
Build the calendar from primary sources, once
Take each cycle below, find the operative instrument that sets its cadence and deadline, record the citation and the date you checked it, and give it an owner. The exercise takes a day and it is the difference between a calendar and a list of intentions.
Evidence: A calendar entry per cycle carrying the citation, the date verified, and the owner.
Re-verify on a defined cycle
Deadlines and thresholds change. A calendar with no re-verification date is accurate on the day it is written and unaudited thereafter.
Evidence: A review log showing each entry re-checked against its source.
Reporting cycles
The commitments a programme carries, by name and by trigger
Every cell that would normally hold a date holds an instruction instead. Take each row to the operative instrument for your licence category, record the citation and the date you checked it, and give it an owner — that is the exercise this table is designed to start, not to replace.
Placeholder — every cadence, deadline and threshold in this table requires compliance-counsel verification against the operative instrument. Replace with sourced, approved content before this page is made public.
| Cycle | Cadence | What triggers it | Confirm before you diarise it |
|---|---|---|---|
| Report of suspicionNigerian Financial Intelligence Unit | Event-driven | Knowledge, suspicion or reasonable grounds to suspect that funds are the proceeds of crime or relate to terrorist financing. | The time limit that runs from the trigger, the precise event that starts it, and the accepted submission format and channel. |
| Cash and threshold-based transaction reportingNigerian Financial Intelligence Unit | Threshold-driven | A transaction, or a set of related transactions, meeting the prescribed objective criterion — regardless of whether anything about it is suspicious. | The threshold value and currency, the aggregation rule for related transactions, the instruments and channels in scope, and the submission cycle. |
| DNFBP reportingSCUML and, where applicable, the financial intelligence unit | Event-driven | A designated activity or relationship of a registered designated business, in the circumstances the supervisor specifies. | Which report types apply to which designated category, the format, the recipient, and whether any periodic return, renewal or re-confirmation duty exists. |
| Supervisory returnsThe licensing supervisor | Periodic, set by the authority | The reporting period closing, for each return applicable to the licence category. | Which returns apply to this licence category, their cadence, their format and their due dates. |
| Designation list ingestion and re-screeningInternal — screening operations | Event-driven | Publication of a new or amended designation list by an applicable authority. | Which designation regimes apply, the required response time on a confirmed match, and the freeze reporting route. |
| Periodic customer reviewInternal — compliance operations | Periodic, set by the institution | The review date falling due for a customer, set by the risk band the customer currently sits in. | Any minimum review frequency the regime prescribes for higher-risk categories, and the institution's own approved cycle per band. |
| Enterprise-wide risk assessment refreshBoard, and available to the supervisor | Periodic, set by the institution | The approved refresh cycle falling due, or a material change in business, product set, geography or the external risk environment. | Any prescribed refresh cycle or required content. |
| Compliance reporting to the boardBoard or delegated committee | Periodic, set by the institution | The reporting cycle set in the institution's own AML/CFT programme. | The cycle and content the board charter and the programme require, and any supervisory expectation about frequency. |
| Independent testing of the programmeBoard or audit committee | Periodic, set by the institution | The audit plan cycle falling due, or a triggering event such as a material finding. | Any prescribed frequency or scope, and the required reporting line for findings. |
| Staff training and awarenessInternal — with records available to the supervisor | Periodic, set by the institution | The training cycle set in the programme, plus onboarding of new staff and role changes. | Any prescribed minimum frequency or content, and the record-keeping expectation. |
| Registration and renewal dutiesThe relevant supervisor or regulator | Periodic, set by the authority | A registration, licence or notification falling due for renewal or re-confirmation. | Whether a renewal or re-confirmation duty exists for each registration the institution holds — with the financial intelligence unit, with SCUML, and with the data protection regulator — and on what cycle. |
| Data protection filings and reviewsNigeria Data Protection Commission | Periodic, set by the authority | A filing or audit duty falling due for organisations meeting the criteria the regime sets. | Whether this institution meets those criteria, which duties follow, and their cadence and deadlines. |
Where the evidence for each cycle comes from
- Report of suspicion
- Case file, linked alerts and rule evaluations, narrative, maker-checker approval, and submission evidence recorded against the payload digest.
- Cash and threshold-based transaction reporting
- Canonical transaction records with explicit currency handling, deterministic aggregation, and a reconciliation between qualifying transactions and reports produced.
- DNFBP reporting
- DNFBP classification and governed evidence lists, with the report kind present in the catalogue and filing refused until the authoritative mapping is supplied.
- Supervisory returns
- Institution returns produced through the same governed mapping and approval path as reports to the financial intelligence unit.
- Designation list ingestion and re-screening
- Versioned watchlist import under publish approval, with removed entries retained in history and the list version recorded against every screening run.
- Periodic customer review
- Next-review dates written by each risk assessment, with the assessment recording the event that triggered it and the factors that drove it.
- Enterprise-wide risk assessment refresh
- Governed aggregate analytics over the current customer book, with small-cell suppression and explicit unavailable states rather than zeros.
- Compliance reporting to the board
- Scheduled board packs built only from suppression-aware aggregates, with immutable occurrences, deterministic artefact hashes and an audited delivery record.
- Independent testing of the programme
- Append-only audit chain, retained rule versions and reproducible decisions, so a reviewer can sample decisions rather than only controls.
- Staff training and awareness
- Outside the platform. Training records are the institution's; what the platform contributes is the per-user permission and action history a reviewer compares them against.
- Registration and renewal duties
- Outside the platform. Listed because it is the cycle most often absent from an institution's calendar.
- Data protection filings and reviews
- Sensitive-access audit records, retention schedule and legal hold register, and the sub-processor register.
How the platform supports it
Capability, and the control it traces to
Each row below describes behaviour the product documentation records, and carries the identifier of the control-register row it traces to, so a claim can be checked rather than taken on trust.
- Scheduled reporting and distributionRecurring internal reporting runs on tenant-scoped schedules with explicit wall-clock recurrence, unique immutable occurrences, and an audited record of each delivery — so a periodic commitment produces evidence that it was met.Control C-15
- Filing register and deadline compositionFiling volume, trend and deadline composition are available as governed aggregates, which is what lets a compliance officer see the shape of a period rather than reconstructing it from a queue.Control C-15
- Approval before releaseAnything leaving the institution passes a maker-checker gate, so a deadline never becomes a reason for an unreviewed submission.Control C-03
What we do not claim
On a compliance product the absence of a claim is information a buyer needs as much as the presence of one.
- No date on this page is a legal deadline. The cadence column describes what kind of cycle each obligation is; it does not state when your filing is due.
- The list of cycles is not exhaustive and is not tailored to any licence category. Your supervisor's requirements govern.
Verify before you rely on this page
This page states obligations qualitatively and carries no figures. Before acting on anything here, confirm the following against the instrument currently in force for your licence category — and record the date you checked it.
- Every cadence in the table below, against the operative instrument for your own licence category — the table states the shape of each cycle, never its due date.
- The threshold, currency and aggregation rules for threshold-based reporting, and its submission cycle.
- The deadline for a report of suspicion and the event from which it runs.
- Which supervisory returns apply to each licence category, with cadence, format and due dates.
- Whether SCUML imposes a periodic return, a renewal or a re-confirmation duty, and on what cycle.
- Any prescribed minimum frequency for training, independent testing and risk assessment refresh.
- Data protection filing or registration renewal duties, if any apply to this institution.
Related reading
Talk to a specialist
Turn the calendar into evidence rather than reminders
Scheduled runs, immutable occurrences and an audited delivery record mean a periodic obligation leaves proof behind it.