Baobyte AML Suite
Book a demo

DNFBPs

The obligation is real. The software was never written for you.

Designated non-financial businesses and professions carry genuine anti-money-laundering duties, and almost every tool and guide available assumes a bank's compliance department. This page assumes the opposite: a professional firm or a dealership with no compliance software, a real obligation, and an examiner who will eventually ask for a client file.

  • SCUML-registered businesses
  • Law firms and accountants
  • Real estate and high-value dealers
  • Trust and company service providers

Scope

Who this covers, and what their file has to show

The designated categories are set by legislation and have been revised. If your activity resembles a row below, treat yourself as in scope until your own counsel tells you otherwise — that is the cheaper direction to be wrong in.

DNFBP categories, their dominant risk, and what the record must demonstrate
CategoryWhere the risk sitsWhat the file has to show
Legal practitionersClient money, company formation, property transactions and trust arrangementsWho the client is, who ultimately benefits, where the funds came from, and the basis on which the engagement was accepted
Accountants and auditorsCompany formation, acting as or arranging a nominee, managing client accountsEngagement-level risk assessment, client and beneficial-owner identity, and the reason a higher-risk engagement was accepted
Real estate agents and developersHigh-value purchases, corporate and offshore buyers, cash or part-cash considerationBoth sides of the transaction identified, the beneficial owner behind a corporate buyer, and a source-of-funds record
Dealers in precious metals and stonesCash sales, portable high value, cross-border movementCustomer identification at the point of sale, aggregation of linked sales, and a retrievable record of each transaction
Trust and company service providersNominee directors and shareholders, corporate structures that obscure ownershipThe natural person behind the structure, corroborated rather than accepted on assertion

Obligations

What a designated business actually owes

No section numbers and no deadlines on this page. The categories below are stable; the mechanics attached to them are the part your counsel should confirm for your category.

SCUMLRegistration as a designated business
Businesses and professions designated under Nigeria's anti-money-laundering legislation are required to register with the Special Control Unit against Money Laundering. Which activities fall inside the designation is set by law and has been revised, so the scope question belongs to your own counsel — but if you form companies, hold client money, transact property or deal in high-value goods, assume you are in scope until advised otherwise.
SCUML / NFIUA named reporting officer and a route for reports
A designated business is expected to identify a person responsible for compliance and reporting, and to have a working route for suspicious transaction reporting. Confirm the current channel and any periodic return cycle for your category before go-live; the mechanics differ by category and have changed over time.
AML legislationCustomer due diligence, including on one-off clients
Identify the customer and verify that identity; identify the beneficial owner behind a company or arrangement; understand the purpose of the relationship; and apply enhanced measures where risk is higher. Occasional and one-off customers are not exempt — an estate agency that only ever acts for a buyer once still has to know who the buyer is.
AML legislationRecord keeping that survives staff turnover
Customer records, identity evidence and transaction records have to be retained for a defined period and be retrievable on request. In practice the failure is almost never the retention period; it is that the record is in an ex-employee's folder and cannot be produced as a coherent file.
AML legislationA written policy, a risk assessment, and evidenced training
A proportionate programme still needs to be written down, approved by whoever runs the firm, and taught to the people who apply it — with a record that the teaching happened. For a small firm this is a short document, but its absence is the easiest finding an examiner can make.
SanctionsScreening applies to professional services too
Designated-party obligations are not limited to financial institutions. A firm acting for a designated person, or transferring property to one, is exposed regardless of sector, which makes screening at engagement acceptance and periodically thereafter a basic control rather than a bank practice.
NDPAClient identity data is personal data
Copies of identity documents, ownership declarations and source-of-funds evidence attract lawful-basis, retention and subject-rights obligations. For firms holding scanned identity documents in a shared drive, this is frequently the more immediate exposure of the two.

Operational reality

What this looks like in a firm that has never had a compliance system

  • There is no compliance software, because there was never a budget line for oneThe current system is a spreadsheet of clients, a folder of scanned identity documents named inconsistently, and a WhatsApp thread where someone once asked whether a client seemed odd. Each part is defensible on its own. Together they cannot show that a policy was applied, because nothing records that it was.
  • The obligation is real and the guidance was written for banksAlmost every AML resource a Nigerian professional firm can find assumes a transaction monitoring system, an alert queue and a compliance department. None of that maps to a five-partner practice, so the practical question — what does a defensible client file actually contain — goes unanswered.
  • The client is a company and nobody knows who is behind itA property purchase by a newly incorporated company with nominee shareholders is the archetypal case. Establishing the natural person who ultimately owns or controls it, recording how that was established, and recognising when the answer is implausible is the single hardest recurring task in this segment.
  • Nobody in the firm owns this, so everybody half-owns itWithout a named reporting officer and a defined acceptance step, client take-on happens partner by partner and the standard drifts. The result is a file that varies by whoever opened it, which is exactly the pattern an examination surfaces.
  • An examiner asks for a file from three years agoThe associate who opened it has left, the identity documents were emailed rather than filed, and the reason the engagement was accepted lives in nobody's memory. Retrievability — not sophistication — is what is being tested.
  • Registration has been sold to you as the whole obligationRegistering as a designated business is a starting condition, not the programme. Firms that were sold a registration and told they were compliant are the most exposed group in this segment, because they believe the work is finished.

What we do not do

Your SCUML identifier is captured, not verified

Stated here rather than in a footnote, because this segment has been sold verification theatre before.

Where to start

The minimum defensible programme, in four steps

Not the mature programme. The version that means an examination finds a firm doing the basics properly rather than a firm with nothing to show.

  1. Register your clients properly

    One record per client with identity evidence attached, the beneficial owner recorded where the client is not a natural person, and the address coded rather than free text. This alone replaces the spreadsheet and the folder.

  2. Decide before you act

    A risk rating and an acceptance decision at engagement, recorded with the reason. The point is not the rating; it is that the decision exists, is dated and is attributable to a person.

  3. Screen, and keep the evidence

    Screen the client and its beneficial owners at acceptance and periodically. Retain the source, the version and the match evidence so a clearance can be defended rather than remembered.

  4. Be able to produce the file

    Everything above, retrievable for one named client in minutes, years later, by someone who was not there. That is the test an examination actually applies.

Platform

Which capabilities carry this segment

Note what is absent: high-volume transaction monitoring. Most DNFBPs do not have a transaction stream to monitor, and configuring one they do not need is how a proportionate programme becomes an abandoned one.

Customer and CDD

A structured client register with governed forms, identity evidence, ownership declarations and Nigerian addresses coded to state and local government area — the file an examiner asks for, held as a record rather than a folder.

Learn more

Screening and watchlists

Sanctions, PEP and adverse-media screening at engagement acceptance and on a schedule afterwards, with the match evidence and list version retained behind each decision.

Learn more

Investigation and casework

Somewhere to put a concern that is not yet a report: the question, what was checked, who was asked, and what was concluded — dated and attributable.

Learn more

Governed reporting

Report content generated from governed mappings with review and approval evidence, so the reporting officer is not drafting a narrative from memory into an unfamiliar form.

Learn more

Audit and privacy

Retention schedules, legal holds, and a record of who accessed a client's sensitive data — the part of the obligation professional firms most often overlook.

Learn more

Implementation

A go-live path sized for a firm with no project team, starting from the client register you already have rather than from a blank system.

Learn more

Examination readiness

What you can put in front of an examiner

  • A single client file per client: identity evidence, beneficial ownership, risk rating, acceptance decision and the person who made it.
  • Screening evidence with the list source and version as at the moment of each check, including the clearances.
  • The record of any concern raised, what was investigated, and the conclusion — including where the conclusion was that no report was warranted.
  • Your written policy and risk assessment as versioned artefacts with approval records, not as a document with an unknown last-edited date.
  • Training completion held against the same record as the operational evidence.
  • A retention schedule that is configured and enforced, and a legal hold that can stop deletion when a matter requires it.

Proof

DNFBP case study

Reserved for a firm that has approved publication.

Placeholder — no DNFBP engagement has been approved for publication. Replace with sourced, approved content before this page is made public.

Reserved for a firm that has approved publication

The write-up will cover what the firm's records looked like beforehand, what the first phase actually consisted of, how long it took people who had other jobs to do, and what happened at the next examination.

Challenge
How client records were held before, and what could not be produced.
Approach
Which phase came first, who in the firm owned it, and what it cost in hours.
Result
What the firm can now produce, stated by the firm.

—

Time to retrieve a client file

Awaiting a before-and-after the firm will stand behind.

—

Clients migrated

Awaiting an actual migration record.

—

Examination outcome

Awaiting written permission to describe it.

Questions

What professional firms ask

We are a five-person firm. Is this proportionate?
The obligations are proportionate to your size and risk; the requirement to be able to produce a coherent client file is not. The realistic comparison is not platform cost against zero, it is platform cost against the hours currently spent reconstructing files, plus the exposure of not being able to reconstruct one at all.
Does the platform verify our SCUML registration?
No, and it says so. A supplied registration identifier is captured exactly as given, encrypted, and held with a status meaning only that the applicant supplied it. There is no live registry adapter in this release, and the service deliberately fails closed if asked to verify rather than returning an unearned green tick. When a verification route exists, the status will change and the change will be visible in the record.
How does this interact with legal professional privilege?
That is a question for your own counsel, and deliberately not one this page answers. How the designated-business regime applies to legal practitioners in Nigeria has been the subject of litigation and of legislative change, and the interaction with privilege is precisely where a firm needs advice specific to its practice rather than a vendor's summary. What the platform provides is control over who can see what, so that whatever boundary your counsel sets can be enforced technically.
We already registered with SCUML. Are we not compliant?
Registration is a precondition. The programme is the customer due diligence, the records, the screening, the risk assessment, the training, the reporting officer and the ability to evidence all of it. Firms that were sold a registration and told the work was done are the ones most likely to be surprised by an examination.
Can we start with just the client register?
Yes, and for most firms in this segment that is the right first phase. The register plus identity evidence plus a recorded acceptance decision covers the majority of what an examination samples, and it is the foundation everything else attaches to.

Related reading

Start the conversation

Start with the client register, not with a programme

For most designated businesses the honest first phase is getting every client into one structured record with identity evidence and a recorded acceptance decision. That is a conversation about your existing spreadsheet, and it is where we would rather start than with a demonstration of features you do not need yet.

Book a demoTalk to a compliance specialist