Baobyte AML Suite
Book a demo

Bureaux de change

The control happens at the counter, in ninety seconds

A cash-intensive operator cannot apply its controls after the fact against an account relationship, because there usually is not one. Identification, screening and the decision all have to happen while the customer is standing there — and still be evidenced well enough to defend at an inspection two years later.

  • CBN-licensed operators
  • Cash-intensive
  • Walk-in and occasional customers
  • Multi-branch aggregation

Obligations

What a licensed operator has to demonstrate

Deliberately without figures. Reporting levels and return cycles are exactly the sort of detail that changes, and a vendor page is the wrong place for a regulated operator to source one.

CBNA licensed operator with a documented programme
A bureau de change operates under a CBN authorisation and carries the compliance obligations that come with it: a written AML/CFT policy, a designated compliance and reporting officer, a risk assessment reflecting a cash-intensive business, staff training, record keeping and independent testing. The scale is small; the list of headings is not shorter.
AML legislationIdentification of occasional and one-off customers
A customer who transacts once and is never seen again is still a customer. Identification and verification obligations attach to occasional transactions above the applicable level and to any transaction where suspicion arises, regardless of value — which makes the counter, not a back office, the place the obligation is discharged.
NFIUThreshold and suspicious transaction reporting
Cash and currency transactions at or above the applicable reporting level are reportable, and suspicion triggers a report independently of value. Confirm the current figures and cycle for your category with your compliance counsel before configuring anything against them.
AML legislationLinked transactions cannot be treated as separate ones
Splitting a single amount across several transactions, days, tellers or branches to stay under a reporting level is a recognised typology, and the obligation is to recognise the aggregate rather than the parts. This is the control most dependent on customer identification actually being captured consistently.
SanctionsScreening at the counter
Designated-party obligations apply to walk-in customers exactly as they do to account holders. That means screening has to be fast enough to run before the transaction and evidenced well enough to defend afterwards, including for the overwhelming majority of hits that are cleared.
CBNPeriodic returns and inspection readiness
Licensed operators render periodic returns and are subject to inspection. The practical requirement is that the transaction record, the customer record and the decision record can be produced together, for a named date range, without reconstructing them from ticket books.
NDPAIdentity documents collected at a counter are personal data
Photographs and photocopies of identity documents taken at a counter attract the same lawful-basis, retention and access obligations as data collected anywhere else — and are considerably more likely to end up in an unsecured drawer.

Operational reality

Why this is harder than it looks from a bank

  • The control point is a cashier with a queue behind themWhatever the policy says, the identification step happens at a counter, under time pressure, by someone whose primary job is the transaction. A control that adds two minutes will be worked around. A control that is a structured capture with the screening running while the details are typed will not.
  • Aggregation is the whole game, and identity is what makes it possibleFour transactions across three days and two branches only aggregate if all four are attached to the same customer record. Inconsistent name capture and no verified identifier means the aggregate never forms, and the structuring pattern the rule was written to catch never fires.
  • Cash carries no counterparty informationThere is no originating account, no payment message and no counterparty name to screen. The only information in the transaction is what the operator captured, which puts the entire weight of the control on capture quality at the counter.
  • Mixed currency turns into meaningless totalsA day's activity in three currencies aggregated at whatever rate a spreadsheet happened to hold produces a number that is wrong in an unpredictable direction — and thresholds are applied against exactly that number.
  • Small teams, high turnover, paper recordsTicket books, a register, and a folder of photocopies. Each is retrievable in principle and none of it is retrievable in the hour before an inspection, particularly for a branch whose staff have turned over twice since the period in question.
  • The person who captures cannot be the person who approvesSeparation of duties is not a large-institution luxury here; the teller who accepts an unusual transaction should not be the person who decides it was fine. In a small operator that means a named approver, configured as such, rather than an informal understanding.

Structure

The same control, at a counter instead of an account

Where a bureau de change's control differs structurally from a bank's
ControlIn a bankIn a bureau de change
Customer identificationAt account opening, once, with time to verifyAt the counter, in the transaction, often for someone with no ongoing relationship
Counterparty dataArrives in the payment message and can be screenedDoes not exist — only what the operator captured
AggregationNatural: activity attaches to an accountOnly works if identity capture is consistent enough to link the transactions
Timing of the controlMonitoring can run overnight against a persisting relationshipScreening has to run before cash changes hands with someone who may not return
Separation of dutiesDistinct departmentsA named approver outside the counter, because the operator has no departments
Evidence at inspectionRetrievable from core systemsFrequently a ticket book and a folder of photocopies unless the capture was structured

Platform

Which capabilities carry this segment

Customer and CDD

Structured customer capture with coded Nigerian addresses and identifiers, so the same walk-in customer resolves to the same record on their fourth visit.

Learn more

Screening and watchlists

Counter-side sanctions and PEP screening with retained source, version and match evidence behind every hit — including the cleared ones, which are the ones later questioned.

Learn more

Transaction monitoring

Aggregation of linked transactions across days, tellers and branches, with the rule and its version retained against every alert raised.

Learn more

Governed reporting

Threshold and suspicious transaction report content generated from governed mappings, with review, approval and filing evidence held against the exact payload.

Learn more

Investigation and casework

One case per subject rather than one note per ticket, so a pattern spread across branches is investigated once.

Learn more

Audit and privacy

Retention schedules for counter-collected identity documents, restricted access to sensitive fields, and an audit record of who looked at what.

Learn more

Inspection readiness

What you can produce for a date range, without the ticket books

  • Every counter transaction linked to a customer record, with the identity evidence captured at the time.
  • The aggregation view for any customer across a date range, showing how linked transactions were assessed.
  • Screening evidence with list source and version as at the moment of each check, cleared hits included.
  • The approval record for any transaction that required a second person, with the actor and timestamp.
  • Threshold and suspicious report content with its validation evidence and the filing acknowledgement state.
  • A retention schedule applied to identity documents collected at the counter, and the access record against them.

Proof

Bureau de change case study

Reserved for an operator that has approved publication.

Placeholder — no bureau de change engagement has been approved for publication. Replace with sourced, approved content before this page is made public.

Reserved for an operator that has approved publication

The write-up will cover what counter capture looked like before, how aggregation across branches changed what was detected, and what the next inspection asked for.

Challenge
How the counter captured customers, and what could not be aggregated.
Approach
What changed at the counter, and how staff were trained on it.
Result
Stated by the operator, against a defined baseline.

—

Linked transactions detected

Awaiting a baseline and a measurement window.

—

Counter capture time

Awaiting a measured figure, not an estimate.

—

Inspection outcome

Awaiting written permission to describe it.

Questions

What operators ask first

Our tellers are not compliance staff. Will they use this?
Only if the capture step is shorter than the workaround. The design target is a structured customer capture that runs screening while the details are being entered, rather than a separate compliance system a cashier has to remember to open. Where the counter genuinely cannot be changed, the fallback is same-day structured capture — worse, but honest about the trade.
How are the reporting thresholds configured?
As governed configuration, proposed and approved with an effective date and a retained prior version. That matters more here than elsewhere: when a reporting level changes, an operator needs to show which level was in force on a given date, and a console edit with no history cannot show it.
We operate in three currencies. How are totals handled?
Amount units are explicit and mixed-currency input is refused rather than silently aggregated — either the transaction is kept in its own currency with approved separate totals, or the conversion is an explicit, recorded step. A single blended number produced by an unrecorded rate is not something a threshold can defensibly be applied to.
Can several branches share one record of a customer?
Yes, and that is the point of the customer record existing at all. Branches can be scoped as org units so staff see their own activity, while aggregation and case correlation still operate across the whole operator.

Related reading

Start the conversation

Start at the counter

Show us the capture step as it happens today — the ticket, the identity document, the register — and we will show you what the same ninety seconds looks like when the record it produces can be aggregated, screened and retrieved.

Book a demoTalk to a compliance specialist